Vehicle redundancy control method and device, electronic device and storage medium

Abstract

This application provides a vehicle redundancy control method, apparatus, electronic device, and storage medium. The method includes: monitoring the vehicle controller via message monitoring by each of a plurality of target controllers to obtain message monitoring information; identifying target message monitoring information indicating a failure of the vehicle controller from all the message monitoring information; determining a failure of the vehicle controller if the number of target message monitoring information is greater than or equal to a preset threshold, and generating a redundancy takeover command by a first controller among the plurality of target controllers; and sending the redundancy takeover command to each second controller among the plurality of target controllers (excluding the first controller itself), so that the first controller and each second controller perform redundant control of the vehicle according to the redundancy takeover command. This application solves the problem in related technologies where vehicle redundancy control schemes suffer from unnecessary redundant control intervention due to misjudgment.

Description

Technical Field

[0001] This application relates to the field of vehicle control technology, and in particular to a vehicle redundancy control method and apparatus, electronic equipment and storage medium. Background Technology

[0002] Current new energy vehicles typically adopt a centralized control architecture centered on the vehicle control unit (VCU). The VCU receives information such as accelerator pedal, brake pedal, gear position, vehicle speed, driving mode, available battery power, and motor status, and sends target torque or drive requests to the motor controller (MCU). At the same time, the VCU also participates in the high-voltage power-on and power-off process of the power battery, DC-DC output voltage or enable control, fault diagnosis, and vehicle operation mode management.

[0003] In this architecture, the Battery Management System (BMS) is responsible for managing battery pack voltage, current, temperature, insulation, high-voltage interlock, relay status, and charge / discharge capacity; the DC-DC controller is responsible for converting the high-voltage power of the battery into low-voltage bus power to ensure power supply to the low-voltage system; and the MCU (motor controller) is responsible for driving the motor torque output. These controllers typically communicate with the Vehicle Control Unit (VCU) via CAN, Ethernet, or other vehicle-mounted buses.

[0004] When the MCU, BMS, or DCDC fails to receive a valid VCU message within a preset time, the existing solution generally uses a single controller to independently determine the VCU communication timeout and enter a simple limp or shutdown mode. However, if the failure is determined by the MCU or any single controller based on the VCU message timeout, it is easy to make misjudgments due to poor local wiring harness contact, bus interference, or local communication abnormalities, resulting in unnecessary redundant control intervention.

[0005] Therefore, the vehicle redundancy control schemes in related technologies have the problem of frequent unnecessary redundancy control interventions due to misjudgment. Summary of the Invention

[0006] This application provides a vehicle redundancy control method and apparatus, electronic device and storage medium to at least solve the problem that vehicle redundancy control schemes in the related art frequently result in unnecessary redundancy control intervention due to misjudgment.

[0007] According to one aspect of the embodiments of this application, a vehicle redundancy control method is provided, comprising: The vehicle controller is monitored by each of the multiple target controllers in the vehicle to obtain message monitoring information. The multiple target controllers include the following controllers: battery management system, motor controller and DC-DC converter. Among all the message monitoring information, the target message monitoring information indicating the failure of the vehicle controller is identified; If the number of target message monitoring information is greater than or equal to a preset number threshold, the vehicle controller is determined to be faulty, and the first controller among the multiple target controllers generates a redundant takeover command. The first controller sends the redundancy takeover command to each of the plurality of target controllers other than the first controller, so that the first controller and each of the second controllers perform redundant control of the vehicle in accordance with the redundancy takeover command.

[0008] Optionally, as described in the aforementioned method, the message monitoring information includes: Information used to indicate whether the control message sent by the vehicle controller to each target controller has been received within a first preset time period, wherein the control message includes: MCU control instructions sent to the motor controller, BMS control instructions sent to the battery management system, and DCDC control instructions sent to the DC-DC converter; Information used to indicate whether the message number of the heartbeat message sent by the vehicle controller to each target controller has been updated within a second preset time period; Information used to indicate whether the number of consecutive target abnormalities in the messages sent by the vehicle controller to each target controller exceeds a preset threshold, wherein the target abnormalities include: CRC check abnormality and message length abnormality.

[0009] Optionally, as described above, the step of determining that the vehicle controller has failed when the number of target message monitoring information is greater than or equal to a preset threshold, and generating a redundancy takeover command by the first controller among the plurality of target controllers, includes: If the number of target message monitoring information is greater than or equal to a preset threshold, the vehicle controller is determined to be faulty. If it is determined that the current vehicle speed is greater than the vehicle speed threshold, the high voltage of the power battery is currently energized, the vehicle is in D or R gear and the low voltage bus voltage of the vehicle is higher than the nominal voltage of the battery, then the motor controller, battery management system and DC converter are all operating normally and normal information is obtained. Based on the vehicle controller failure and the normal information, the first controller among the plurality of target controllers generates a redundant takeover command.

[0010] Optionally, as described above, the first controller is a battery management system, and the first controller performs redundant control on the vehicle according to the redundancy takeover command, including: The battery management system performs at least one of the following operations to redundancy control of the vehicle in accordance with the redundancy takeover command and unless a condition prohibiting high-voltage holding is detected: Maintain the main positive relay and main negative relay of the power battery in the closed state; The system sends real-time battery information of the vehicle's power battery to the motor controller and the DC-DC converter, so that the motor controller limits the target torque based on the available discharge power in the received real-time battery information, and the DC-DC converter adjusts the operating state of the DC-DC converter based on the DC-DC control command in the received real-time battery information.

[0011] Optionally, as described above, the method further includes: When the battery management system detects a condition that prohibits high voltage holding or a fault in the battery management system during redundancy control of the vehicle, the battery management system sends a high voltage power-down command and a redundancy exit command. In response to the redundancy exit command, the motor controller reduces the target torque to zero torque according to a preset maximum safe descent slope. The DC-DC converter responds to the redundancy exit command by stopping the power supply to the low-voltage side. The battery management system controls the main positive relay and the main negative relay to disconnect according to a preset power-down procedure.

[0012] Optionally, as described above, when the second controller is the DC-DC converter, each of the second controllers performs redundant control of the vehicle according to the redundancy takeover command, including: The DC-DC converter blocks the output voltage adjustment request issued by the vehicle controller and outputs low-voltage bus voltage according to a preset target voltage or target voltage range, wherein the upper limit of the target voltage and the upper limit of the target voltage range are both lower than the preset voltage upper limit. The DC-DC converter prioritizes providing low-voltage power to the designated equipment. The DC-DC converter monitors its own operating status in real time to obtain DC-DC operating status information; When the DC-DC converter detects that the low-voltage bus voltage cannot be maintained above a preset safety threshold or that the DC-DC operating status information is abnormal, it sends a DC-DC maintenance failure message to the other target controllers among the plurality of target controllers, excluding the DC-DC converter, to indicate that redundant control of the vehicle should be terminated.

[0013] Optionally, as described above, when the second controller is the motor controller, each of the second controllers performs redundant control of the vehicle according to the redundancy takeover command, including: The motor controller stops using the target torque output by the vehicle controller as the only torque input, records the last effective torque before the vehicle controller fails, and uses the current actual output torque or the effective torque as the initial torque for redundant control of the vehicle. The motor controller reads the second hard-wired path signal of the accelerator pedal and determines the redundant target torque for redundant control of the vehicle based on the second hard-wired path signal. When the braking signal of the vehicle is valid, the redundant target torque is limited to 0 or rapidly reduced from the initial torque to 0 according to a preset braking priority strategy. The motor controller uses a slope limiting algorithm to smoothly transition the output torque from the initial torque to the redundant target torque. The motor controller performs a validity check on the hard-wired pedal signal. If it determines that the hard-wired pedal signal is unreliable or that the motor controller itself is faulty, it prohibits the increase of positive drive torque and sends a motor controller maintenance failure message to the other target controllers among the plurality of target controllers, except for the motor controller, to indicate the exit from redundant control of the vehicle. The hard-wired pedal signal includes: the second hard-wired path signal and the first hard-wired path signal used by the vehicle controller. The motor controller limits the vehicle's operating parameters and gradually reduces the positive drive torque when the vehicle's current speed is higher than the preset redundant speed limit, until the vehicle's speed drops below the preset redundant speed.

[0014] Optionally, as described in any of the preceding embodiments, the method further includes: If the real-time vehicle speed is lower than the preset speed threshold and no requested drive torque is received, or if the first controller receives DC-DC maintenance failure information, the first controller executes a power-down procedure, issues a high-voltage power-down command and a redundancy exit command, the motor controller executes torque zeroing, the DC-DC converter stops working, and the battery management system disconnects the main positive relay and the main negative relay. The DC-DC maintenance failure information is used to indicate that the low-voltage bus voltage cannot be maintained above the preset safety threshold or that the DC-DC converter is abnormal. When the vehicle controller returns to normal, if the latest message monitoring information of the vehicle controller remains normal for a preset period of time, and the target torque output by the vehicle controller and the redundant target torque currently output by the motor controller satisfy a preset relationship, the battery management system, the motor controller, and the DC-DC converter will stop redundant control of the vehicle, and the vehicle controller will control the vehicle.

[0015] According to another aspect of the embodiments of this application, a vehicle redundancy control device is also provided, comprising: The monitoring module is used to monitor the vehicle controller through each of the multiple target controllers of the vehicle to obtain message monitoring information. The multiple target controllers include the following controllers: battery management system, motor controller and DC-DC converter. The determination module is used to identify the target message monitoring information indicating the failure of the vehicle controller from all message monitoring information; A redundancy takeover instruction generation module is used to determine that the vehicle controller has failed when the number of target message monitoring information is greater than or equal to a preset number threshold, and the first controller among the plurality of target controllers generates a redundancy takeover instruction. A redundancy control module is used to control the first controller to send the redundancy takeover command to each of the plurality of target controllers other than the first controller, so that the first controller and each of the second controllers perform redundant control of the vehicle in accordance with the redundancy takeover command.

[0016] According to another aspect of the embodiments of this application, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; wherein the memory is used to store a computer program; and the processor is used to execute the method steps of any of the above embodiments by running the computer program stored in the memory.

[0017] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to execute the method steps of any of the above embodiments when running.

[0018] In this embodiment, message monitoring information is obtained by monitoring the vehicle controller through each of a plurality of target controllers. The plurality of target controllers include a battery management system, a motor controller, and a DC-DC converter. From all the message monitoring information, target message monitoring information indicating a failure of the vehicle controller is identified. If the number of target message monitoring information is greater than or equal to a preset threshold, the vehicle controller is determined to have failed, and a first controller among the plurality of target controllers generates a redundancy takeover command. The first controller then sends the redundancy takeover command to all target controllers except itself. Each second controller enables the first controller and each second controller to perform redundant control of the vehicle according to the redundancy takeover instruction. In this embodiment, the message detection information obtained by multiple target controllers is used to comprehensively determine whether the vehicle controller has failed. The vehicle controller is only confirmed to have failed when the number of target message monitoring information is greater than or equal to a preset threshold. This effectively avoids the purpose of a single controller taking over vehicle control from the vehicle controller due to misjudgment. This achieves the technical effect of greatly reducing the number and frequency of redundant control interventions, and solves the problem of frequent unnecessary redundant control interventions due to misjudgment in related vehicle redundancy control schemes. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an optional vehicle redundancy control method according to an embodiment of this application. Figure 2 This is a flowchart illustrating another optional vehicle redundancy control method according to an embodiment of this application; Figure 3 This is a flowchart illustrating another optional vehicle redundancy control method according to an embodiment of this application; Figure 4 This is a schematic diagram of an optional vehicle redundancy control system according to an embodiment of this application; Figure 5This is a structural block diagram of an optional vehicle redundancy control device according to an embodiment of this application; Figure 6 This is a structural block diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] The vehicle redundancy control method of this application embodiment can be executed by a server, a terminal, or both. Alternatively, the vehicle redundancy control method of this application embodiment can be executed by a client installed on the terminal.

[0025] Taking the vehicle redundancy control method in this embodiment being executed by the terminal (i.e., the vehicle) as an example, Figure 1 A vehicle redundancy control method provided in this application includes the following steps: Step S102: Message monitoring information is obtained by monitoring the vehicle controller through each of the multiple target controllers of the vehicle. The multiple target controllers include the following controllers: battery management system, motor controller and DC-DC converter.

[0026] The vehicle redundancy control method in this embodiment can be applied to scenarios where, when the vehicle controller fails, other controllers of the vehicle (e.g., battery management system BMS, motor controller MCU, DC-DC converter DCDC) perform redundant control of the vehicle.

[0027] Specifically, each of the multiple target controllers in the vehicle independently monitors the vehicle controller's messages to obtain message monitoring information reflecting the vehicle controller's communication status. Each target controller independently determines whether the vehicle controller is in normal operating condition based on the VCU messages it receives (i.e., messages from the vehicle controller), and uses the monitoring results for subsequent redundancy takeover or safety degradation decisions. In other words, each target controller (i.e., the Battery Management System (BMS), Motor Controller (MCU), and DC-DC Converter (DCDC) monitors the operating status of the vehicle controller's VCU in real time and generates its own message monitoring information.

[0028] As an optional embodiment, as described above, the message monitoring information includes: Message reception timeout information: This is information used to indicate whether the control messages (i.e., BMS control instructions, DCDC control instructions, MCU control instructions) sent by the vehicle controller to each target controller have been received within a first preset time period (T1, for example, 10ms, 20ms, etc.). The control messages include: MCU control instructions sent to the motor controller, BMS control instructions sent to the battery management system, and DCDC control instructions sent to the DC-DC converter. Heartbeat message status information: This is information used to indicate whether the message number (i.e., Rolling Counter) of the heartbeat message sent by the vehicle controller to each target controller is updated within a second preset duration (T2, e.g., 100ms, 200ms, etc.). Message integrity information: This is information used to indicate whether the number of consecutive target anomalies in the messages sent by the vehicle controller to each target controller exceeds a preset threshold. Target anomalies include: CRC check anomalies and message length anomalies.

[0029] In this embodiment, all message monitoring information used for judgment in the subsequent step S104 is the latest message monitoring information obtained by each target controller. Furthermore, each message monitoring information must also meet the requirement that the acquisition time interval is within a preset event interval so as to accurately reflect the effectiveness of the vehicle controller at a certain moment.

[0030] Step S104: Among all the message monitoring information, identify the target message monitoring information that indicates the failure of the vehicle controller.

[0031] Specifically, each target controller can send its judgment result regarding the failure of the vehicle controller to other target controllers in the form of a failure flag. In one implementation, the BMS generates and sends a failure flag F_BMS (i.e., used to characterize the target message monitoring information generated by the battery management system indicating a failure of the vehicle controller), the MCU generates and sends a failure flag F_MCU (i.e., used to characterize the target message monitoring information generated by the motor controller indicating a failure of the vehicle controller), and the DCDC generates and sends a failure flag F_DCDC (i.e., used to characterize the target message monitoring information generated by the DC-DC converter indicating a failure of the vehicle controller). Thus, based on whether each target controller generates and sends a failure flag, the target message monitoring information indicating a failure of the vehicle controller can be determined from all the message monitoring information.

[0032] Step S106: If the number of target message monitoring information is greater than or equal to a preset number threshold, the vehicle controller is determined to be faulty, and the first controller among multiple target controllers generates a redundant takeover command.

[0033] Specifically, after determining the target message monitoring information, the relationship between the number of target message monitoring messages indicating vehicle controller failure and a preset quantity threshold can be statistically analyzed. When the number of target message monitoring messages is greater than or equal to the preset quantity threshold, the vehicle controller is determined to have failed. In one implementation, the quantity threshold needs to be greater than half the number of all target controllers; for example, when there are three target controllers, the preset quantity threshold can be two, i.e., a "two out of three" strategy is adopted: any two controllers among the BMS, MCU, and DCDC determine that the VCU has failed, thus confirming the VCU failure. In one implementation, after the collaborative arbitration is successful, the first controller among the multiple target controllers (e.g., BMS) sends a redundancy takeover command to the remaining controllers, i.e., the BMS generates the redundancy takeover command, which may include, but is not limited to: redundancy takeover enable flag, maximum allowed drive power, maximum allowed vehicle speed, DCDC enable command, high voltage command (maintain high voltage or reduce high voltage), and redundancy exit command.

[0034] As an optional embodiment, the method described above can be implemented by the following steps to determine that the vehicle controller has failed when the number of target message monitoring information is greater than or equal to a preset threshold, and to generate a redundant takeover command by the first controller among multiple target controllers: If the number of target message monitoring information is greater than or equal to a preset threshold, the vehicle controller is determined to be faulty.

[0035] If it is determined that the vehicle's current speed is greater than the speed threshold, the high voltage of the power battery is currently energized, the vehicle is in D or R gear and the low voltage bus voltage of the vehicle is higher than the nominal voltage of the battery, then the motor controller, battery management system and DC-DC converter are all operating normally and normal information is obtained.

[0036] Based on the vehicle controller failure and normal information, the first controller among multiple target controllers generates a redundant takeover command.

[0037] In other words, when a vehicle controller failure is determined, it is necessary to further determine whether the current state of the vehicle meets the preset redundancy takeover entry conditions. In one implementation, the preset redundancy takeover entry conditions include: the current vehicle speed is greater than the vehicle speed threshold V_min (e.g., 10 km / h), the high voltage of the power battery is currently energized, the vehicle is in D or R gear, the vehicle's low-voltage bus voltage is higher than the battery's nominal voltage (i.e., the DC-DC converter is working), and the MCU, BMS, and DC-DC converter are not in a fault state that prohibits redundancy control. When all the above conditions are met, the first controller among multiple target controllers generates a redundancy takeover command, thereby putting the vehicle system into redundancy takeover mode.

[0038] In step S108, the first controller sends a redundancy takeover command to each of the multiple target controllers other than the first controller, so that the first controller and each of the second controllers can perform redundant control of the vehicle in accordance with the redundancy takeover command.

[0039] Specifically, the first controller (e.g., BMS) sends the generated redundancy takeover command to each of the multiple target controllers (i.e., MCU and DCDC) other than the first controller. Upon receiving the redundancy takeover command, the first controller and each of the second controllers perform redundant control on the vehicle according to the control parameters in the command. This includes limiting maximum drive power, limiting maximum vehicle speed, enabling the DCDC, maintaining high voltage power or performing high voltage reduction operations, and performing redundancy deactivation when necessary. In the event of VCU failure, the BMS, MCU, and DCDC work together to take over vehicle control, ensuring safe vehicle operation.

[0040] For example, when the vehicle is traveling at 80 km / h, the VCU experiences a software malfunction and resets, causing the RollingCounter message in the critical control message to fail to update for 2 consecutive seconds. The BMS, MCU, and DCDC detect the VCU failure and complete a coordinated arbitration. The BMS, after confirming there is no collision, no thermal runaway, no insulation fault, and that the high-voltage interlock is functioning correctly without prohibiting high-voltage holding, maintains the main positive and negative relays closed and sends available discharge power; the DCDC enters an independent low-voltage holding mode; the MCU reads the last effective torque and the hard-wired pedal signal, and outputs redundant torque after slope limiting, allowing the vehicle to maintain controllable deceleration without noticeable jerking.

[0041] The MCU briefly missed receiving VCU messages due to localized communication interference, but the BMS and DC-DC converter continued to receive valid VCU heartbeats. The system did not meet the "two out of three" collaborative arbitration condition, thus not triggering redundant takeover. Only the localized MCU communication anomaly was recorded to avoid accidental takeover.

[0042] In this embodiment, message monitoring information is obtained by monitoring the vehicle controller through each of the multiple target controllers of the vehicle. These multiple target controllers include the battery management system, motor controller, and DC-DC converter. From all the message monitoring information, target message monitoring information indicating a failure of the vehicle controller is identified. If the number of target message monitoring messages is greater than or equal to a preset threshold, a failure of the vehicle controller is determined, and a first controller among the multiple target controllers generates a redundancy takeover command. The first controller sends the redundancy takeover command to each second controller among the multiple target controllers (excluding the first controller itself), enabling the first controller and each second controller to perform redundant control of the vehicle according to the redundancy takeover command. Because this embodiment uses message detection information obtained from multiple target controllers to comprehensively determine whether the vehicle controller has failed, and only confirms a failure when the number of target message monitoring messages is greater than or equal to a preset threshold, it effectively avoids a single controller taking over vehicle control from the vehicle controller due to misjudgment. This achieves the technical effect of greatly reducing the number and frequency of redundant control interventions, thereby solving the problem in related technologies where vehicle redundancy control schemes frequently result in unnecessary redundant control interventions due to misjudgment.

[0043] As an optional embodiment, as described above, the first controller is a battery management system, and the first controller performs redundant control of the vehicle according to the redundancy takeover command, including the following steps: The battery management system performs at least one of the following operations to redundancy control the vehicle in accordance with the redundancy takeover command and unless a condition prohibiting high voltage holding is detected.

[0044] Specifically, after generating or receiving a redundancy takeover command, the Battery Management System (BMS) first checks whether a condition prohibiting high-voltage holding exists. This condition includes, but is not limited to, serious battery faults, insulation faults, high-voltage interlock circuit breaks, relay sticking, or relays failing to disconnect properly—all of which endanger high-voltage safety. If no such condition is detected, the BMS performs at least one of the following operations to provide redundancy control for the vehicle: Maintaining the main positive and main negative relays closed in the absence of a condition prohibiting high-voltage holding, ensuring the battery continuously supplies power to the vehicle's high-voltage system and guaranteeing reliable execution of redundancy control commands.

[0045] Maintain the main positive relay and main negative relay of the power battery in the closed state.

[0046] Specifically, after confirming that there are no conditions that prohibit high-voltage maintenance, the battery management system keeps the main positive relay and the main negative relay of the power battery in a closed state to ensure that the high-voltage circuit of the power battery remains conductive, thereby maintaining the continuity of high-voltage power supply to the vehicle and providing energy guarantee for the vehicle's continued operation in the event of a failure of the vehicle controller.

[0047] The system sends real-time battery information of the vehicle's power battery to the motor controller and DC-DC converter, so that the motor controller can limit the target torque based on the available discharge power in the received real-time battery information, and the DC-DC converter can adjust the operating state of the DC-DC converter based on the DC-DC control instructions in the received real-time battery information.

[0048] Specifically, during redundancy takeover, the battery management system continuously calculates and sends real-time battery information of the power battery to the motor controller (MCU) and DC-DC converter (DCDC). This real-time battery information includes, but is not limited to: the power battery's available discharge power, battery pack voltage, battery pack current, battery state of charge (SOC), battery temperature, insulation status, high-voltage interlock status, relay status, and fault level.

[0049] After receiving real-time battery information from the battery management system, the motor controller limits the target torque based on the available discharge power. That is, after the vehicle controller fails, the motor controller no longer relies on the torque command of the vehicle controller, but autonomously limits the motor output torque based on the available discharge power provided by the battery management system to avoid exceeding the battery capacity and causing over-discharge or damage to the power battery.

[0050] After receiving real-time battery information from the battery management system, the DC-DC converter adjusts its own operating state (such as enabling, voltage output regulation, etc.) according to the DC-DC control instructions contained therein, to ensure the normal operation of the vehicle's low-voltage power supply system and provide a stable low-voltage power supply for the vehicle's low-voltage electrical equipment (including instruments, lights, power steering, etc.).

[0051] In one implementation, after confirming that the instrument has entered the redundant control process, it also prompts the driver to go to a safe location for maintenance as soon as possible through the display interface of the human-machine interaction system, so as to remind the driver that the vehicle is in redundant control mode and needs to be stopped safely in time.

[0052] In this embodiment, the motor controller autonomously limits the target torque based on the available discharge power sent by the battery management system, preventing over-discharge or over-capacity operation of the battery due to unlimited torque requests after the vehicle controller fails, thus ensuring the safety of the power system. Furthermore, the DC-DC converter adjusts its operating state according to the control commands from the battery management system to ensure the normal operation of the low-voltage power supply system, providing a stable power supply for safety-related low-voltage loads such as instrument indicators, power steering, and brake assist. As an optional embodiment, as described above, the method further includes: When the battery management system detects a condition that prohibits high-voltage holding or a battery management system malfunction during vehicle redundancy control, the battery management system sends a high-voltage power-down command and a redundancy exit command.

[0053] Specifically, the Battery Management System (BMS) continuously monitors the system status during vehicle redundancy control. When any condition prohibiting high-voltage maintenance or a fault occurs in the BMS itself, the BMS determines that it can no longer safely maintain high-voltage power supply and immediately generates and sends a high-voltage power-down command and a redundancy exit command to other target controllers. Conditions prohibiting high-voltage maintenance include, but are not limited to: severe battery faults, insulation faults, high-voltage interlock circuit breaks, and main relay malfunctions (such as sticking or failure to disconnect properly), which endanger high-voltage safety. Battery management system faults include, but are not limited to: internal communication failures, sampling anomalies, and main control chip failures, which prevent the BMS from performing redundancy control functions normally.

[0054] In response to the redundancy exit command, the motor controller reduces the target torque to zero torque according to the preset maximum safe descent slope.

[0055] In other words, after receiving the redundancy exit command from the battery management system, the motor controller (MCU) immediately initiates the torque exit procedure in response. The MCU gradually reduces the current output torque at a safe rate, without causing vehicle vibration or loss of control, according to a preset maximum safe descent rate, until the torque value drops to zero, thereby safely terminating the motor's power output and avoiding the risk of vehicle impact or loss of control due to sudden torque cutoff. This maximum safe descent rate can be the upper limit of the torque change rate set by the MCU during the torque exit process to ensure vehicle driving safety. It represents the maximum allowable reduction in motor output torque per unit time, typically measured in Newton-meters per second (Nm / s) or Newton-meters per millisecond (Nm / ms).

[0056] This embodiment uses a motor controller to gradually reduce torque to zero according to the maximum safe descent slope, rather than immediately cutting off the torque. This effectively avoids vehicle shaking, jerking, or loss of control caused by sudden torque changes, and improves driving safety and ride comfort during the redundancy withdrawal process.

[0057] The DC-DC converter responds to the redundancy exit command by stopping the power supply to the low-voltage side.

[0058] In other words, after receiving the redundancy exit command from the battery management system, the DC-DC converter immediately stops the low-voltage side power output in response to the command. At this time, the DC-DC converter no longer converts the high-voltage electricity from the power battery into low-voltage electricity to supply the vehicle's low-voltage electrical equipment (including instruments, lights, power steering, brake assist, etc.), preparing for the subsequent high-voltage power-off.

[0059] This embodiment uses a motor controller to gradually reduce torque to zero according to the maximum safe descent slope, rather than immediately cutting off the torque. This effectively avoids vehicle shaking, jerking, or loss of control caused by sudden torque changes, and improves driving safety and ride comfort during the redundancy withdrawal process.

[0060] The battery management system controls the main positive relay and the main negative relay to disconnect according to the preset power-down procedure.

[0061] In other words, after the DC-DC converter stops supplying power to the low-voltage side and the motor controller torque drops to zero, the battery management system controls the main positive relay and the main negative relay to disconnect in an orderly manner according to the preset high-voltage power-down procedure, completely cutting off the high-voltage output circuit of the power battery and completing the safe high-voltage power-down. In one embodiment, the preset power-down procedure disconnects the main positive relay first, and then the main negative relay, to reduce the risk of arcing when the relays disconnect, ensuring the safety and reliability of the power-down process. At this point, the vehicle completes the entire exit process from the redundant control mode to the safe power-down state.

[0062] In this embodiment, when a condition prohibiting high voltage holding or a battery management system malfunction is detected, a graded and orderly exit process is executed in sequence, which involves reducing the torque of the motor, stopping the DC-DC converter from supplying power, and disconnecting the relay. This avoids vehicle loss of control or high voltage safety accidents caused by the simultaneous interruption of multiple functions, and ensures a smooth and safe exit process.

[0063] like Figure 2 As shown, as an optional embodiment, with the method described above, when the second controller is a DC-DC converter, redundant control of the vehicle by each second controller according to the redundancy takeover command can be achieved through the following steps: In step S202, the DC-DC converter blocks the output voltage adjustment request issued by the vehicle controller and outputs low-voltage bus voltage according to the preset target voltage or target voltage range. The upper limit of the target voltage and the target voltage range is lower than the preset voltage upper limit.

[0064] Specifically, after receiving a redundancy takeover command, the DC-DC converter enters a low-voltage sustaining mode. In this mode, the DC-DC converter disables output voltage regulation requests from the vehicle control unit (VCU) and no longer responds to VCU's output voltage regulation commands. Instead, it outputs low-voltage bus voltage according to a preset target voltage or target voltage range. The preset target voltage or target voltage range is calibrated based on the low-voltage battery type, ambient temperature, DC-DC converter temperature, current limits, and critical low-voltage load requirements. Furthermore, the upper limit of both the target voltage and the target voltage range is lower than the preset voltage upper limit, thus ensuring normal power supply to low-voltage loads while preventing damage to low-voltage equipment from excessively high output voltage.

[0065] Step S204: The DC converter prioritizes low-voltage power supply to the designated equipment.

[0066] Specifically, in redundant control mode, the DC-DC converter prioritizes power supply to designated critical low-voltage load devices (i.e., designated devices). These designated devices include, but are not limited to, the power steering controller, brake controller, instrument cluster, hazard warning lights, gateway, battery management system (BMS), motor controller (MCU), and necessary sensors. This priority power supply strategy ensures that, even in the event of a vehicle controller failure, critical devices directly related to safe vehicle operation always receive a stable low-voltage power supply in redundant control mode.

[0067] Step S206: The DC-DC converter monitors its own operating status in real time to obtain DC-DC operating status information.

[0068] Specifically, the DC-DC converter continuously monitors its own operating status in real time during low-voltage sustaining mode. The DC-DC operating status information includes: over-temperature status, over-current status, input undervoltage status, output overvoltage status, output undervoltage status, and short-circuit protection status. Through real-time monitoring, the DC-DC converter can promptly detect its own operational anomalies, providing a basis for subsequent fault diagnosis and redundancy termination decisions.

[0069] In step S208, when the DC converter detects that the low-voltage bus voltage cannot be maintained above the preset safety threshold or that there is an abnormality in the DC-DC operating status information, it sends a DC-DC maintenance failure message to the other target controllers besides the DC converter among multiple target controllers to indicate the exit from redundant control of the vehicle.

[0070] Specifically, when the DC-DC converter detects that the low-voltage bus voltage cannot be maintained above the preset safety threshold, or when there is an abnormality in the DCDC operating status information (such as serious internal faults such as over-temperature, over-current, input undervoltage, output overvoltage, output undervoltage, or short-circuit protection), the DC-DC converter generates a DCDC maintenance failure flag (i.e., DCDC maintenance failure information) and sends this DCDC maintenance failure information to other target controllers besides the DC-DC converter (at least including the battery management system BMS and the motor controller MCU) to indicate that the current DC-DC converter can no longer maintain low-voltage power supply and needs to exit the redundant control of the vehicle. After receiving this information, the other target controllers perform the corresponding redundancy exit operation.

[0071] The method in this embodiment shields the vehicle controller's output voltage adjustment requests via a DC-DC converter, providing low-voltage output according to a preset target voltage or target voltage range. This avoids abnormal fluctuations in the low-voltage bus voltage caused by erroneous voltage adjustment commands that might be issued after a vehicle controller failure, ensuring the stability of the low-voltage power supply. Furthermore, by prioritizing the power supply to critical low-voltage loads such as the power steering controller, brake controller, instrument cluster, hazard warning lights, and gateway, it ensures that critical equipment directly related to vehicle safety can continue to operate normally in emergency situations where the vehicle controller fails, thus guaranteeing driving safety. Moreover, the preset target voltage or target voltage range is calibrated based on the low-voltage battery type, ambient temperature, DC-DC converter temperature, current limits, and critical low-voltage load requirements, enabling the low-voltage output to adapt to different vehicle configurations and actual operating conditions, improving the flexibility and adaptability of the solution. Finally, by promptly sending DC-DC maintenance failure information to the battery management system and motor controller when the DC-DC converter detects that the low-voltage bus voltage cannot be maintained above the preset safety threshold or a serious internal fault occurs, the existing redundancy exit process is triggered, thus avoiding the safety risks that may be caused by continuing to maintain redundant control when the low-voltage power supply capacity is insufficient, and improving the overall vehicle functional safety level.

[0072] like Figure 3 As shown, as an optional embodiment, with the method described above, when the second controller is a motor controller, redundant control of the vehicle by each second controller according to the redundancy takeover command can be achieved through the following steps: In step S302, the motor controller stops using the target torque output by the vehicle controller as the only torque input, records the last effective torque before the vehicle controller fails, and uses the current actual output torque or effective torque as the initial torque for redundant control of the vehicle.

[0073] Specifically, after receiving the redundancy takeover command, the motor controller (MCU) no longer relies on the target torque output by the vehicle controller (VCU) as the sole torque input. Instead, it first records the last valid torque frame T_last received before the vehicle controller failed, and uses either the current actual output torque or T_last as the initial torque for redundancy takeover. This avoids the motor controller losing its torque command source due to vehicle controller failure. By using either the last valid torque frame before vehicle controller failure or the current actual output torque as the initial torque for redundancy takeover, the motor controller avoids torque command interruption caused by sudden vehicle controller failure, ensuring control continuity.

[0074] In step S304, the motor controller reads the second hard-wired path signal of the accelerator pedal and determines the redundant target torque for redundant control of the vehicle based on the second hard-wired path signal. When the vehicle's braking signal is valid, the redundant target torque is limited to 0 or rapidly reduced from the initial torque to 0 according to the preset braking priority strategy.

[0075] Specifically, the motor controller reads the second hard-wired path signal from the accelerator pedal (i.e., a spare hard-wired signal independent of the first hard-wired path signal used by the vehicle controller), and can combine it with the braking signal, gear signal, vehicle speed, motor speed, motor controller's own fault status, and the available discharge power limit of the battery management system (BMS) to jointly calculate the redundant target torque. In one embodiment, the redundant target torque T_red is calculated as follows: T_red = min{ T_pedal, T_bms_limit, T_limp_limit, T_speed_limit}; Among them, T_pedal is the driver's required torque calculated based on the hard-wired pedal opening, vehicle speed, and gear position; T_bms_limit is the battery power limit torque calculated based on the available discharge power of the battery management system; T_limp_limit is the preset maximum torque limit in redundant takeover mode; and T_speed_limit is the torque limit under maximum vehicle speed or vehicle stability constraints. When the vehicle's braking signal is valid, the redundant target torque is limited to 0 or rapidly reduced from the initial torque to 0 according to the preset braking priority strategy, i.e., the motor controller is prohibited from outputting positive drive torque under braking conditions.

[0076] By calculating the redundant target torque using the method described in this embodiment, it can be ensured that the torque output is always within the safety boundary, avoiding exceeding the system's capacity. Furthermore, when the braking signal is valid, the redundant target torque is limited to 0 or rapidly decreases to 0, ensuring that the motor does not output positive drive torque under braking conditions, realizing the safety logic of braking priority, and avoiding conflict between braking and drive.

[0077] In step S306, the motor controller uses a slope limiting algorithm to smoothly transition the output torque from the initial torque to the redundant target torque.

[0078] Specifically, to avoid a sudden torque jump during take-off, the motor controller employs a slope limiting algorithm to smoothly transition the output torque from the initial take-off torque to the redundant target torque. Optionally, the torque T_out(k) output by the motor controller is controlled according to the following formula: T_out(k) = T_out(k-1) + sat[ T_red(k) - T_out(k-1), -R_down·Δt, R_up·Δt ]; Where T_out(k) is the output torque of the current control cycle, T_out(k-1) is the output torque of the previous control cycle, R_up is the torque rise slope, R_down is the torque fall slope, Δt is the control cycle, and sat[] is the limiting function used to ensure that the torque output is within the set rise and fall gradient range. Furthermore, R_up is less than the torque rise slope in normal mode (i.e., the whole vehicle is controlled by VCU), and R_down is greater than or equal to R_up, so as to prioritize the safety torque reduction requirement while ensuring the smoothness of torque transition.

[0079] This embodiment uses a slope limiting algorithm to smoothly transition the output torque from the initial torque to the redundant target torque, which not only ensures the smoothness of the torque transition (avoiding driving shock) but also prioritizes the safety torque reduction requirements, thereby improving the driving comfort and safety of the redundant control process.

[0080] In step S308, the motor controller performs a validity check on the hard-wired pedal signal. If it determines that the hard-wired pedal signal is unreliable or that the motor controller itself has malfunctioned, it prohibits the increase of positive drive torque and sends a motor controller maintenance failure message to the other target controllers besides the motor controller among the multiple target controllers to indicate the exit from redundant control of the vehicle. The hard-wired pedal signal includes a second hard-wired path signal and a first hard-wired path signal used by the vehicle controller.

[0081] Specifically, during redundant takeover, the motor controller performs a rationality check on the hard-wired pedal signal. This may include, but is not limited to, signal range verification, dual-channel ratio verification, rate of change verification, short-circuit / open-circuit detection, and verification against braking signals and vehicle speed change trends. Furthermore, the hard-wired pedal signal includes the second hard-wired path signal read by the motor controller itself and the first hard-wired path signal used by the vehicle controller. When the hard-wired pedal signal is determined to be unreliable (e.g., exceeding a reasonable range, abnormal dual-channel ratio, abnormal rate of change, short circuit / open circuit, or contradictory to braking signals and vehicle speed change trends) or when the motor controller itself experiences a serious malfunction, the motor controller prohibits the increase of positive drive torque and sends a motor controller maintenance failure flag (i.e., motor controller maintenance failure information) to other target controllers besides the motor controller (at least including the battery management system BMS and DC-DC converter DCDC) to indicate that the current motor controller can no longer maintain redundant control and must exit redundant control of the vehicle. This effectively prevents unintended acceleration caused by abnormal pedal signals. Furthermore, when the hard-wired pedal signal is unreliable or the motor controller itself experiences a serious malfunction, it proactively sends a maintenance failure flag to the battery management system and DC-DC converter, triggering the collaborative redundancy exit process. This avoids the safety risks that may arise from continuing to maintain redundant control under a single controller failure state.

[0082] In step S310, the motor controller limits the vehicle's operating parameters and gradually reduces the positive drive torque when the vehicle's current speed is higher than the preset redundant speed limit, until the vehicle speed is reduced to below the preset redundant speed.

[0083] Specifically, during redundant takeover, the motor controller limits vehicle operating parameters, including but not limited to the following: maximum vehicle speed, maximum drive power, maximum acceleration, and maximum torque change rate. When the vehicle's current speed exceeds the preset redundant speed limit, the motor controller gradually reduces the positive drive torque, causing the vehicle speed to gradually decrease to a safe speed range, i.e., until the speed drops below the preset redundant speed. This ensures that the vehicle always operates within a safe speed range in the redundant control mode after the vehicle controller fails, thus avoiding the risk of speeding.

[0084] As an optional embodiment, the method of any of the preceding embodiments further includes: If the vehicle's real-time speed is lower than the preset speed threshold and no requested drive torque is received, or if the first controller receives a DC-DC maintenance failure message, the first controller executes a power-down procedure, issues a high-voltage power-down command and a redundancy exit command, the motor controller executes torque zeroing, the DC-DC converter stops working, and the battery management system disconnects the main positive relay and the main negative relay. The DC-DC maintenance failure message is used to indicate that the low-voltage bus voltage cannot be maintained above the preset safety threshold or that there is an abnormality in the DC-DC converter.

[0085] Specifically, in the safe parking exit scenario, when the vehicle's real-time speed is lower than the preset speed threshold V_stop (e.g., 3 km / h) for a preset time (e.g., 2 seconds), and the driver does not request drive torque via the accelerator pedal, the first controller (i.e., the battery management system, BMS) determines that the vehicle is essentially at a stop and has no power demand, and executes the power-off procedure. In the fault exit scenario, when the battery management system receives a DC-DC converter failure message from the DC-DC converter, indicating that the DC-DC converter is unable to maintain the low-voltage bus above the preset safety threshold or that the DC-DC converter itself is malfunctioning, the battery management system also executes the power-off procedure without waiting for the vehicle to come to a complete stop.

[0086] When the battery management system executes the power-down procedure, it sends a high-voltage power-down command and a redundancy deactivation command to the motor controller and the DC-DC converter. Upon receiving the redundancy deactivation command, the motor controller performs torque zeroing, and upon receiving the redundancy deactivation command, the DC-DC converter stops working. Subsequently, the battery management system disconnects the main positive relay and the main negative relay according to the preset power-down procedure, completing the safe high-voltage power-down.

[0087] Furthermore, if the vehicle experiences a high-level fault such as a collision, thermal runaway, severe insulation failure, high-voltage interlock HVIL disconnection, or motor controller maintenance failure, the system will not wait for the vehicle to come to a complete stop and will immediately perform rapid torque reduction and emergency power-off operations to ensure the safety of the vehicle and its occupants.

[0088] When the vehicle controller returns to normal, if the latest message monitoring information of the vehicle controller remains normal for a preset period of time, and the target torque output by the vehicle controller and the redundant target torque currently output by the motor controller meet a preset relationship, the battery management system, motor controller and DC-DC converter will stop redundant control of the vehicle, and the vehicle controller will control the vehicle.

[0089] Specifically, this step involves exiting redundant control due to the recovery of the vehicle controller. Optionally, when the vehicle controller (VCU) comes back online, the battery management system, motor controller, and DC-DC converter do not immediately exit redundant takeover, but instead enter a recovery handshake state to ensure that the VCU has fully recovered and its output signals are reliable.

[0090] During the handshake recovery process, the vehicle controller must meet the following conditions: continuously maintain the output of a valid heartbeat signal, a valid rolling counter, and a valid CRC check value for a preset duration T_rec, to prove that the VCU communication link and signal integrity have been restored to normal, that is, the latest message monitoring information remains normal for a preset duration. Simultaneously, the vehicle controller reads or receives current redundancy status information, which may include, but is not limited to: current output torque, vehicle speed, gear position, available power of the battery management system, relay status, DC-DC converter output voltage, and fault codes, to obtain the current actual operating status of the vehicle.

[0091] Regarding torque switching conditions, the preset relationship can include: the difference between the target torque output by the vehicle controller and the redundant target torque currently output by the motor controller is less than a preset threshold, or the target torque of the vehicle controller needs to follow the current output torque of the motor controller at a preset slope. Here, "following at a preset slope" means that when the target torque output by the VCU is inconsistent with the redundant target torque of the MCU, the VCU gradually adjusts the target torque to match the current output torque of the MCU at a set rate of change, rather than abruptly changing it, thus creating conditions for a smooth switching later.

[0092] Once the aforementioned consistency, torque difference, and safety conditions are met, the battery management system sends a command to exit redundant takeover. Upon receiving the command, the motor controller smoothly switches from the redundant torque source back to the vehicle controller torque source; the DC-DC converter, upon receiving the command, switches from low-voltage sustaining mode back to normal target voltage control, resuming its response to vehicle controller output voltage adjustment requests. If the vehicle controller signal is lost or malfunctions again during the recovery process, the system maintains the redundant takeover state or re-enters the collaborative arbitration state to ensure that vehicle control is not returned to the incompletely recovered VCU.

[0093] For example, after the VCU is abnormally reset and then re-connected, the BMS, MCU, and DCDC enter a recovery handshake state. The VCU continuously outputs valid heartbeats and reads the current redundancy status. The VCU target torque follows the MCU's current output torque at a preset slope. After the torque difference is less than a threshold and the DCDC target voltage switching condition is met, the system exits redundancy takeover and resumes normal vehicle control.

[0094] like Figure 4 As shown, the methods of any of the above embodiments are applied to Figure 4 The diagram illustrates a redundant control system for high-voltage, low-voltage, and drive coordination in a new energy vehicle. The system includes: a vehicle control unit (VCU), a battery management system (BMS), a motor control unit (MCU), a DC-DC converter (DCDC), a main positive relay and a main negative relay for the power battery, an accelerator pedal, and communication between the various controllers.

[0095] The vehicle accelerator pedal includes two output hardwires: the first output hardwire (used to output the first hardwire path signal) is connected to the VCU, and under normal circumstances, this path receives the driver's torque request; the second redundant hardwire (used to output the second hardwire path signal) connects the accelerator pedal directly to the MCU, and if the VCU fails, the MCU can calculate the target torque through the redundant accelerator pedal signal.

[0096] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0097] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM (Read-Only Memory) / RAM (Random Access Memory), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0098] According to another aspect of the embodiments of this application, a vehicle redundancy control device for implementing the above-described vehicle redundancy control method is also provided. Figure 5 This is a structural block diagram of an optional vehicle redundancy control device according to an embodiment of this application, such as... Figure 5 As shown, the device may include: The monitoring module 51 is used to monitor the vehicle controller through each of the multiple target controllers of the vehicle to obtain message monitoring information. The multiple target controllers include the following controllers: battery management system, motor controller and DC-DC converter. The determination module 52 is used to determine the target message monitoring information indicating the failure of the vehicle controller from all message monitoring information; The redundant takeover instruction generation module 53 is used to determine that the vehicle controller has failed when the number of target message monitoring information is greater than or equal to a preset number threshold, and the first controller among multiple target controllers generates a redundant takeover instruction. The redundancy control module 54 is used to control the first controller to send a redundancy takeover command to each of the multiple target controllers other than the first controller, so that the first controller and each of the second controllers can perform redundant control of the vehicle in accordance with the redundancy takeover command.

[0099] It should be noted that the monitoring module 51 in this embodiment can be used to perform the above step S102, the determination module 52 in this embodiment can be used to perform the above step S104, the redundancy takeover instruction generation module 53 in this embodiment can be used to perform the above step S106, and the redundancy control module 54 in this embodiment can be used to perform the above step S108.

[0100] In addition to the modules described above, the apparatus in this embodiment may also include modules that execute any method in any of the aforementioned vehicle redundancy control methods.

[0101] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of the device, can run in the hardware environment implementing the vehicle redundancy control method described in any of the foregoing embodiments. They can be implemented in software or hardware, wherein the hardware environment includes a network environment.

[0102] According to another aspect of the embodiments of this application, an electronic device for implementing the above-described vehicle redundancy control method is also provided. The electronic device may be a server, a terminal, or a combination thereof.

[0103] According to another embodiment of this application, an electronic device is also provided, comprising: Figure 6 As shown, the electronic device may include: a processor 1501, a communication interface 1502, a memory 1503, and a communication bus 1504, wherein the processor 1501, the communication interface 1502, and the memory 1503 communicate with each other through the communication bus 1504.

[0104] Memory 1503 is used to store computer programs; When processor 1501 executes the program stored in memory 1503, it performs the following steps: Step S102: Message monitoring information is obtained by monitoring the vehicle controller through each of the multiple target controllers of the vehicle. The multiple target controllers include the following controllers: battery management system, motor controller and DC-DC converter.

[0105] Step S104: Among all the message monitoring information, identify the target message monitoring information that indicates the failure of the vehicle controller.

[0106] Step S106: If the number of target message monitoring information is greater than or equal to a preset number threshold, the vehicle controller is determined to be faulty, and the first controller among multiple target controllers generates a redundant takeover command.

[0107] In step S108, the first controller sends a redundancy takeover command to each of the multiple target controllers other than the first controller, so that the first controller and each of the second controllers can perform redundant control of the vehicle in accordance with the redundancy takeover command.

[0108] Optionally, in this embodiment, the communication bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used to represent it in the figure, but this does not mean that there is only one bus or one type of bus. The communication interface is used for communication between the aforementioned electronic device and other devices.

[0109] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0110] As an example, the memory 1503 described above may include, but is not limited to, the monitoring module 51, the determination module 52, the redundancy takeover command generation module 53, and the redundancy control module 54 of the vehicle redundancy control device described above. Furthermore, it may include, but is not limited to, other module units of the vehicle redundancy control device described above, which will not be elaborated upon in this example.

[0111] The processor mentioned above can be a general-purpose processor, including but not limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; it can also be DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0112] This application also provides a computer-readable storage medium, which includes a stored program, wherein the program executes the method steps of the above method embodiments when it runs.

[0113] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0114] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0115] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0116] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0117] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0118] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the solution provided in this embodiment, depending on actual needs.

[0119] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0120] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A vehicle redundancy control method, characterized in that, include: The vehicle controller is monitored by each of the multiple target controllers in the vehicle to obtain message monitoring information. The multiple target controllers include the following controllers: battery management system, motor controller and DC-DC converter. Among all the message monitoring information, the target message monitoring information indicating the failure of the vehicle controller is identified; If the number of target message monitoring information is greater than or equal to a preset number threshold, the vehicle controller is determined to be faulty, and the first controller among the multiple target controllers generates a redundant takeover command. The first controller sends the redundancy takeover command to each of the plurality of target controllers other than the first controller, so that the first controller and each of the second controllers perform redundant control of the vehicle in accordance with the redundancy takeover command.

2. The method according to claim 1, characterized in that, The message monitoring information includes: Information used to indicate whether the control message sent by the vehicle controller to each target controller has been received within a first preset time period, wherein the control message includes: MCU control instructions sent to the motor controller, BMS control instructions sent to the battery management system, and DCDC control instructions sent to the DC-DC converter; Information used to indicate whether the message number of the heartbeat message sent by the vehicle controller to each target controller has been updated within a second preset time period; Information used to indicate whether the number of consecutive target abnormalities in the messages sent by the vehicle controller to each target controller exceeds a preset threshold, wherein the target abnormalities include: CRC check abnormality and message length abnormality.

3. The method according to claim 1, characterized in that, When the number of target message monitoring information is greater than or equal to a preset threshold, the vehicle controller is determined to have failed, and the first controller among the plurality of target controllers generates a redundancy takeover command, including: If the number of target message monitoring information is greater than or equal to a preset threshold, the vehicle controller is determined to be faulty. If it is determined that the current vehicle speed is greater than the vehicle speed threshold, the high voltage of the power battery is currently energized, the vehicle is in D or R gear and the low voltage bus voltage of the vehicle is higher than the nominal voltage of the battery, then the motor controller, battery management system and DC converter are all operating normally and normal information is obtained. Based on the vehicle controller failure and the normal information, the first controller among the plurality of target controllers generates a redundant takeover command.

4. The method according to claim 1, characterized in that, The first controller is a battery management system. The first controller performs redundant control on the vehicle according to the redundancy takeover command, including: The battery management system performs at least one of the following operations to redundancy control of the vehicle in accordance with the redundancy takeover command and unless a condition prohibiting high-voltage holding is detected: Maintain the main positive relay and main negative relay of the power battery in the closed state; The system sends real-time battery information of the vehicle's power battery to the motor controller and the DC-DC converter, so that the motor controller limits the target torque based on the available discharge power in the received real-time battery information, and the DC-DC converter adjusts the operating state of the DC-DC converter based on the DC-DC control command in the received real-time battery information.

5. The method according to claim 4, characterized in that, The method further includes: When the battery management system detects a condition that prohibits high voltage holding or a fault in the battery management system during redundancy control of the vehicle, the battery management system sends a high voltage power-down command and a redundancy exit command. In response to the redundancy exit command, the motor controller reduces the target torque to zero torque according to a preset maximum safe descent slope. The DC-DC converter responds to the redundancy exit command by stopping the power supply to the low-voltage side. The battery management system controls the main positive relay and the main negative relay to disconnect according to a preset power-down procedure.

6. The method according to claim 1, characterized in that, When the second controller is the DC-DC converter, each of the second controllers performs redundant control of the vehicle according to the redundancy takeover command, including: The DC-DC converter blocks the output voltage adjustment request issued by the vehicle controller and outputs low-voltage bus voltage according to a preset target voltage or target voltage range, wherein the upper limit of the target voltage and the upper limit of the target voltage range are both lower than the preset voltage upper limit. The DC-DC converter prioritizes providing low-voltage power to the designated equipment. The DC-DC converter monitors its own operating status in real time to obtain DC-DC operating status information; When the DC-DC converter detects that the low-voltage bus voltage cannot be maintained above a preset safety threshold or that the DC-DC operating status information is abnormal, it sends a DC-DC maintenance failure message to the other target controllers among the plurality of target controllers, excluding the DC-DC converter, to indicate that redundant control of the vehicle should be terminated.

7. The method according to claim 1, characterized in that, When the second controller is the motor controller, each of the second controllers performs redundant control of the vehicle according to the redundancy takeover command, including: The motor controller stops using the target torque output by the vehicle controller as the only torque input, records the last effective torque before the vehicle controller fails, and uses the current actual output torque or the effective torque as the initial torque for redundant control of the vehicle. The motor controller reads the second hard-wired path signal of the accelerator pedal and determines the redundant target torque for redundant control of the vehicle based on the second hard-wired path signal. When the braking signal of the vehicle is valid, the redundant target torque is limited to 0 or rapidly reduced from the initial torque to 0 according to a preset braking priority strategy. The motor controller uses a slope limiting algorithm to smoothly transition the output torque from the initial torque to the redundant target torque. The motor controller performs a validity check on the hard-wired pedal signal. If it determines that the hard-wired pedal signal is unreliable or that the motor controller itself is faulty, it prohibits the increase of positive drive torque and sends a motor controller maintenance failure message to the other target controllers among the plurality of target controllers, except for the motor controller, to indicate the exit from redundant control of the vehicle. The hard-wired pedal signal includes: the second hard-wired path signal and the first hard-wired path signal used by the vehicle controller. The motor controller limits the vehicle's operating parameters and gradually reduces the positive drive torque when the vehicle's current speed is higher than the preset redundant speed limit, until the vehicle's speed drops below the preset redundant speed.

8. The method according to any one of claims 1 to 7, characterized in that, The method further includes: If the real-time vehicle speed is lower than the preset speed threshold and no requested drive torque is received, or if the first controller receives DC-DC maintenance failure information, the first controller executes a power-down procedure, issues a high-voltage power-down command and a redundancy exit command, the motor controller executes torque zeroing, the DC-DC converter stops working, and the battery management system disconnects the main positive relay and the main negative relay. The DC-DC maintenance failure information is used to indicate that the low-voltage bus voltage cannot be maintained above the preset safety threshold or that the DC-DC converter is abnormal. When the vehicle controller returns to normal, if the latest message monitoring information of the vehicle controller remains normal for a preset period of time, and the target torque output by the vehicle controller and the redundant target torque currently output by the motor controller satisfy a preset relationship, the battery management system, the motor controller, and the DC-DC converter will stop redundant control of the vehicle, and the vehicle controller will control the vehicle.

9. A vehicle redundancy control device, characterized in that, include: The monitoring module is used to monitor the vehicle controller through each of the multiple target controllers of the vehicle to obtain message monitoring information. The multiple target controllers include the following controllers: battery management system, motor controller and DC-DC converter. The determination module is used to identify the target message monitoring information indicating the failure of the vehicle controller from all message monitoring information; A redundancy takeover instruction generation module is used to determine that the vehicle controller has failed when the number of target message monitoring information is greater than or equal to a preset number threshold, and the first controller among the plurality of target controllers generates a redundancy takeover instruction. A redundancy control module is used to control the first controller to send the redundancy takeover command to each of the plurality of target controllers other than the first controller, so that the first controller and each of the second controllers perform redundant control of the vehicle in accordance with the redundancy takeover command.

10. An electronic device comprising a processor, a communication interface, a memory, and a communication bus, wherein, The processor, the communication interface, and the memory communicate with each other via the communication bus, characterized in that... The memory is used to store computer programs; The processor is configured to perform the method of any one of claims 1 to 8 by running the computer program stored in the memory.

11. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 8 when run on a processor.

Images