Control unit communication redundancy method and apparatus

Abstract

This invention relates to the field of vehicle technology and discloses a method and apparatus for communication redundancy of control units. The method includes: after all control units are powered on, authenticating the control units to determine a first control unit and a second control unit; setting the second control unit to read-only receive mode; continuously monitoring and acquiring externally published messages on the data bus using the second control unit; updating the data status of the second control unit based on the externally published messages; if the first control unit malfunctions when it receives a transmission command for an internally transmitted message, then the control unit corresponding to the second control unit is designated as the first control unit; and the newly determined first control unit publishes externally transmitted messages based on the internally transmitted messages and the transmission command. This invention can solve the problem of user vehicle safety caused by a single point of failure in the electronic control unit during operation, thus helping to ensure user vehicle safety.

Description

Technical Field

[0001] This invention relates to the field of vehicle technology, and in particular to a method and apparatus for communication redundancy in a control unit. Background Technology

[0002] In a vehicle's powertrain system, the Engine Management System (EMS) is the core Electronic Control Unit (ECU), responsible for critical control functions such as fuel injection, ignition timing, and torque coordination. In traditional vehicle electrical and electronic architectures, a single EMS controller is typically configured on the Controller Area Network (CAN) bus. This controller periodically sends messages containing engine operating status (such as multi-frame messages carrying parameters like torque, speed, and temperature) to the powertrain CAN bus based on a predefined and negotiated CAN communication matrix. These messages are then received and accessed in real-time by other controllers, including the Automatic Transmission Controller (AT), Gateway Controller, and Airbag Controller.

[0003] However, this single EMS controller architecture has a significant single point of failure risk. Once the EMS controller experiences hardware failure (such as MCU damage or power module failure), software anomaly (such as program crash or watchdog reset), or communication interface failure, the engine will not be able to work properly. This could result in a minor power outage and triggering of the limp-home mode, or even a serious driving safety accident.

[0004] To address the aforementioned single point of failure issue, various redundancy control schemes have been proposed in the industry, but each scheme has its shortcomings to varying degrees. This article, based on publicly available patent literature, analyzes the existing technologies one by one as follows: Existing technical solution 1: Patent CN107143429B, "A Redundant System and Design Method for Electronically Controlled Unit Pump Diesel Engine ECU", discloses a redundancy architecture of main and backup ECUs. This solution uses an independent safety programmable logic controller (PLC) as the arbitration master station to collect the heartbeat signals and diagnostic messages of the two ECUs in real time. When a fault is detected in the main ECU, a switching command is issued, and the drive module of the faulty ECU is cut off through a relay. This solution has three main defects: (1) It requires additional dedicated safety PLC hardware as an arbitration module, which increases the system material cost and occupies more hardware layout space; (2) The safety PLC itself forms a new single point of failure. Once the PLC fails, the entire redundant system will completely fail; (3) The main and backup ECUs complete data synchronization through an independent redundant communication bus, which requires the addition of a dedicated physical communication channel, increasing the cost and layout complexity of the vehicle wiring harness.

[0005] Existing technical solution 2: Patent CN112821994B, "A UDS Response Arbitration System and Method for Dual Redundant ECUs", discloses a diagnostic response coordination scheme under a dual-ECU redundant architecture. In the scheme, the two CPUs (CPU1 and CPU2) complete data interaction through independent UART communication links. CPU1 summarizes the diagnostic response information of the two CPUs and outputs it to the outside in a unified manner, realizing the communication transparency of the redundant system to the diagnostic tools. This scheme has obvious limitations: (1) The dual CPUs need to rely on an additional UART private communication link to complete data coordination, which increases the hardware interface configuration requirements and software algorithm complexity; (2) This scheme is only designed for the coordination problem at the diagnostic response level and does not cover the real-time CAN communication redundancy mechanism during engine operation; (3) Both CPUs have the ability to send CAN messages, which can easily cause the bus load to increase and cannot solve the problem of the redundancy architecture perceived by other controllers in the vehicle.

[0006] Existing technical solution three: Patent CN108549358A "A Redundant Controller Diagnostic System and Method Based on CAN Bus" discloses a primary and backup controller differentiation scheme. By assigning differentiated CAN transmit IDs and receive IDs to the two controllers, the identities of the primary and backup controllers are distinguished. The diagnostic tool completes communication interaction with the corresponding controller through different CAN IDs. The defects of this scheme are as follows: (1) The dual controllers use independent CAN ID communication, which requires other controllers in the vehicle and diagnostic tools to adapt to two sets of communication IDs in advance, which greatly increases the design complexity of the vehicle communication matrix and the adaptation workload of each controller; (2) It does not achieve unified CAN ID for external messages, and cannot complete the seamless switching of the primary and backup controllers without changing the external communication identifier.

[0007] Existing technical solution four: Patent CN103634150B, "A Redundant High-Security CAN Bus Communication Method", discloses a CAN communication redundancy scheme with a "two-by-two" architecture. Each main and backup module has two built-in synchronous computing CPUs and relies on a dual-redundant CAN bus to realize data communication. This scheme has obvious application drawbacks: (1) The system architecture is extremely complex, and each module needs to be configured with dual CPUs to complete synchronous computing and data comparison, which greatly doubles the hardware cost; (2) Two independent CAN physical buses need to be deployed, which increases the weight of the vehicle wiring harness and manufacturing cost; (3) This scheme is suitable for ultra-high security level scenarios such as railway signals, but it has problems of redundancy architecture and excessive cost for the redundancy requirements of vehicle engine management system, and its adaptability is poor. Summary of the Invention

[0008] The purpose of this invention is to provide a method and apparatus for communication redundancy in a control unit, so as to at least solve the problem of user vehicle safety caused by a single point of failure in the electronic control unit during the operation of the vehicle, thereby helping to ensure user vehicle safety. To address the aforementioned technical problems, in a first aspect, the present invention provides a control unit communication redundancy method, comprising at least: S1, Predefined internal and external message transmission and publication messages of the control unit; S2. After all the control units are powered on, the control units are authenticated to identify the first control unit and the second control unit among the control units; S3. Set the second control unit to read-only receiving mode; S4. In the read-only receiving mode, the second control unit continuously listens for and acquires the outgoing messages on the data bus; S5. Update the data status of the second control unit based on the externally released message; S6. When the first control unit receives the sending instruction of the internal sending message, if the first control unit malfunctions, the control unit corresponding to the second control unit is determined as the first control unit, and the newly determined first control unit publishes the external release message based on the internal sending message and the sending instruction.

[0009] Optionally, after step S5, the method further includes: S71. In response to the first control unit receiving the sending instruction of the internal sending message, obtain the message identifier of the internal sending message corresponding to the sending instruction; S72. Send the corresponding external release message to the data bus based on the message identifier.

[0010] Optionally, step S2 includes: S21. After all the control units are powered on, read the identity pin level status of each control unit. S22. The control unit with the first identity pin level state is determined as the first control unit, and the control unit with the second identity pin level state is determined as the second control unit.

[0011] Optionally, step S2 further includes: S23. After all the control units are powered on, read the identity parameter calibration value of each control unit; S24. Based on the identity parameter calibration value, determine the first control unit and the second control unit in the control unit.

[0012] Optionally, after step S2, the method further includes: S81. In response to the first control unit receiving a diagnostic command, modify the identity parameter calibration values ​​of the first control unit and the second control unit; S82. The first control unit and the second control unit are redefined based on the identity parameter calibration value.

[0013] Optionally, after step S2, the method further includes: When the second control unit detects a communication abnormality in the first control unit, it sets the second control unit to operating mode and simultaneously records the fault code of the first control unit.

[0014] Optionally, step S6 includes: S61. When the first control unit receives the sending instruction of the internal transmission message, if the first control unit malfunctions, the control unit corresponding to the second control unit is identified as the first control unit. S62. Use the newly determined first control unit to read the message identifier of the internal transmission message; S63. Determine and publish the externally published message based on the message identifier.

[0015] Optionally, after step S2, the method further includes: S91. When the second control unit receives the externally published message, it records the reception period of each externally published message; S92. If the receiving period is greater than the preset period, it is determined that there is an anomaly in the data link corresponding to the externally published message.

[0016] Optionally, after step S2, the method further includes: S101. When the first control unit publishes the external publication message, record the external publication message published at the time of publication and the external publication message already published in the data bus; S102. Start the counter and compare the message data of the published message with the previously published message frame by frame. S103. When the message data is inconsistent, the counter is incremented, and when the counter value is greater than a preset value, a data release failure is triggered.

[0017] Secondly, the present invention also provides a communication redundancy device for a control unit, comprising at least: The message definition module is used to predefine the internal messages sent by the control unit and the messages published externally; The unit determination module is used to authenticate the control units after all the control units are powered on, so as to determine the first control unit and the second control unit among the control units; The transmit prohibition module is used to set the second control unit to read-only receive mode; The message monitoring module is used to continuously monitor and acquire the outgoing messages on the data bus using the second control unit in the read-only receiving mode. The data update module is used to update the data status of the second control unit based on the externally published message; The message publishing module is used to, when the first control unit receives the sending instruction of the internally sent message and the first control unit fails, determine the control unit corresponding to the second control unit as the first control unit, and use the newly determined first control unit to publish the externally published message based on the internally sent message and the sending instruction.

[0018] The technical solution provided by this invention firstly predefines internal transmission messages and external publication messages for the control unit; further, after all control units are powered on, the control units are authenticated to determine the first control unit and the second control unit; further, the second control unit is set to read-only receiving mode; further, the second control unit continuously monitors and acquires external publication messages on the data bus; further, the data status of the second control unit is updated based on the external publication messages; further, when the first control unit receives the transmission command for the internal transmission message, if the first control unit malfunctions, the control unit corresponding to the second control unit is determined as the first control unit; finally, the newly determined first control unit publishes external publication messages based on the internal transmission messages and transmission commands.

[0019] Therefore, this invention, on the one hand, configures a first control unit and a second control unit. When the first control unit malfunctions, the second control unit can immediately take over external communication through identity switching, ensuring the continuous and reliable operation of the engine. On the other hand, this invention only allows the first control unit to send messages to the data bus at any given time; the second control unit operates in pure receive mode, only listening to messages on the bus and not actively sending messages. Therefore, the communication load of the data bus remains completely consistent with the traditional single-ECU solution, without increasing the communication burden of the data bus. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of a control unit communication redundancy method provided by the present invention; Figure 2 This is a schematic diagram of another control unit communication redundancy method provided by the present invention; Figure 3 This is a schematic diagram of a control unit communication redundancy device provided by the present invention; Figure 4This is a diagram of a dual-ECU system architecture provided by the present invention; Figure 5 This invention provides a flowchart for message sending and receiving; Figure 6 This is a flowchart of an identity switching process provided by the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0022] Figure 1 This is a schematic diagram of a control unit communication redundancy method provided by the present invention. The present invention is applicable to redundancy control scenarios for various types of vehicle controllers. This control unit communication redundancy method can be, but is not limited to, executed by the control unit communication redundancy device of the present invention as the execution subject, which can be implemented in software and / or hardware. For example... Figure 1 As shown, the communication redundancy method for the control unit includes at least the following steps: S1, predefined internal transmission messages and external publication messages of the control unit.

[0023] The control unit can be an electronic control unit (ECU). Figure 4 This invention provides a dual-ECU system architecture diagram, such as... Figure 4 As shown, internally transmitted messages and externally published messages can be two sets of Controller Area Network (CAN) messages defined in the ECU application layer software. These are internally transmitted messages and externally published messages, which are identical in signal content and layout, but differ in their CAN identifiers (CAN IDs). The CAN ID for internally transmitted messages is an identifier used internally by the ECU, while the CAN ID for externally published messages is an identifier negotiated and determined with other controllers. Before transmission, the ECU decides whether to dynamically map and replace the CAN ID based on its current identity.

[0024] Specifically, in the CAN communication protocol database (DBC file), the EMS controller predefines two sets of messages: ① Internal Transmitted Messages (denoted as EMSTx message group): These are transmitted messages used internally by the ECU, containing N frames (N is an integer greater than or equal to 1). Each frame is configured with a first CAN identifier (denoted as (text{ID_Tx}_i), (i=1,2,dots,N)). This type of message carries key engine operation signals, such as combustion torque, driver-demanded torque, engine speed, accelerator pedal position, and engine temperature.

[0025] ② Externally broadcast messages (denoted as EMS message group): These are messages sent to other controllers within the network. They also contain N frames, each configured with a second CAN identifier (denoted as (text{ID_Rx}_i), (i=1,2,dots,N)). The signal definition, bit layout, and transmission period of each message are completely consistent with the corresponding EMSTx message. The CANID used by the EMS message group is a standard message identifier negotiated and determined with other controllers during the vehicle development phase. The correspondence between the two message groups is as follows: (text{ID_Tx}_i) and (text{ID_Rx}_i) correspond one-to-one ((i=1,2,dots,N)), and (text{ID_Tx}_i) is consistent with (text{ID_Rx}_i).

[0026] S2. After all control units are powered on, the control units are authenticated to identify the first control unit and the second control unit.

[0027] The first control unit is the primary control unit, responsible for external communication. The second control unit is the backup control unit, responsible for hot standby monitoring. Both the primary and backup control units are two identical EMS control units connected to the data bus. Both ECUs can identify themselves using calibration parameters or hard-wired signals. Calibration parameters are configuration parameters stored in the ECU's non-volatile memory, which can be modified online via diagnostic services; hard-wired signals determine identity through the high and low levels of the ECU's digital input pins. Both ECUs possess complete EMS control logic, including signal acquisition, control calculations, actuator driving, and CAN communication functions. Authentication is used to specifically confirm which control unit is the primary control unit.

[0028] S3. Set the second control unit to read-only receiving mode.

[0029] The read-only receive mode allows the ECU to receive messages without sending them, thus preventing the ECU from sending all messages in the EMSTx message group. Specifically, this is achieved by setting the transmit attribute of the EMSTx message group's transmit PDU (Protocol Data Unit) to a disabled state, or by setting the corresponding transmit signal to an invalid state at the COM layer.

[0030] S4. In read-only receive mode, the second control unit continuously listens for and acquires outgoing messages on the data bus.

[0031] The data bus can be a vehicle communication bus such as CAN bus, CAN FD, FlexRay, or LIN. Taking CAN bus as an example, the CAN bus serves as the core communication backbone network of the vehicle's powertrain domain, carrying real-time data interaction between the EMS and other powertrain domain controllers. In receive-only mode, the second control unit continuously listens for and receives outgoing messages (EMS message group, CAN ID is ID_Rx_i) on the CAN bus. The received message data is parsed in real time and stored in the ECU's global variables or application-layer state data structure.

[0032] S5. Update the data status of the second control unit based on the externally released message.

[0033] The updated data status can be a real-time update of the engine operating status mirror inside this ECU, including but not limited to: engine speed, various torque values, throttle pedal opening, engine temperature, engine status words, etc., so that the internal status variables of the second control unit are synchronized with the first control unit, and are ready to seamlessly take over external communication when the identity is switched to the first control unit.

[0034] S6. When the first control unit receives the sending instruction for the internal sending message, if the first control unit malfunctions, the control unit corresponding to the second control unit is determined as the first control unit, and the newly determined first control unit is used to publish the external sending message based on the internal sending message and the sending instruction.

[0035] The technical solution provided by this invention firstly predefines the internal transmission messages and external publication messages of the control unit; further, after all control units are powered on, the control units are authenticated to determine the first control unit and the second control unit; further, the second control unit is set to read-only receiving mode; further, in read-only receiving mode, the second control unit continuously listens for and acquires the external publication messages on the data bus; further, the data status of the second control unit is updated based on the external publication messages; finally, when the first control unit receives the transmission command of the internal transmission message, if the first control unit malfunctions, the control unit corresponding to the second control unit is determined as the first control unit, and the newly determined first control unit publishes the external publication message based on the internal transmission message and the transmission command.

[0036] Therefore, this invention, on the one hand, configures a first control unit and a second control unit. When the first control unit malfunctions, the second control unit can immediately take over external communication through identity switching, ensuring the continuous and reliable operation of the engine. On the other hand, this invention only allows the first control unit to send messages to the data bus at any given time; the second control unit operates in pure receive mode, only listening to messages on the bus and not actively sending messages. Therefore, the communication load of the data bus remains completely consistent with the traditional single-ECU solution, without increasing the communication burden of the data bus.

[0037] Based on the above embodiments or implementation methods Figure 2 This is a schematic diagram of another control unit communication redundancy method provided by the present invention, which is based on the above embodiments and includes additions and refinements. For example... Figure 2 As shown, the communication redundancy method for the control unit includes at least the following steps: S1, predefined internal transmission messages and external publication messages of the control unit.

[0038] S2. After all control units are powered on, the control units are authenticated to identify the first control unit and the second control unit.

[0039] In another specific implementation, step S2 includes: S21. After all control units are powered on, read the identity pin level status of each control unit.

[0040] S22. The control unit with the first identity pin level state is determined as the first control unit, and the control unit with the second identity pin level state is determined as the second control unit.

[0041] The first identity pin can be at a high level, while the second identity pin can be at a low level.

[0042] In yet another specific implementation, step S2 further includes: S23. After all control units are powered on, read the identity parameter calibration value of each control unit.

[0043] S24. Determine the first control unit and the second control unit in the control unit based on the identity parameter calibration value.

[0044] The identity parameter calibration value can be dynamically modified online through the diagnostic service. During ECU power-on initialization, the value of the identity calibration parameter is read from the non-volatile memory, and the identity of the first control unit and the second control unit is determined according to the first preset value or the second preset value of the parameter, respectively.

[0045] It is understandable that the identity parameter calibration value and the identity pin level status can be read simultaneously. When the two are consistent, the value is taken; when the two are inconsistent, the identity pin level status takes priority, and a diagnostic fault code is recorded to indicate the inconsistency.

[0046] S3. Set the second control unit to read-only receiving mode.

[0047] S4. In read-only receive mode, the second control unit continuously listens for and acquires outgoing messages on the data bus.

[0048] S5. Update the data status of the second control unit based on the externally released message.

[0049] It is understood that, in one specific implementation, after step S5, the following steps are also included: S71. In response to the first control unit receiving a transmission command for an internal transmission message, obtain the message identifier of the internal transmission message corresponding to the transmission command.

[0050] S72. Send the corresponding external release message to the data bus based on the message identifier.

[0051] Specifically, step S72 can be as follows: In the CAN transmission underlying driver or COM (communication management) layer, dynamically modify the CAN ID (ID_Tx_i, i.e., message identifier) ​​of the internally defined transmission message (EMSTx message group) to the CAN ID (ID_Rx_i, i.e., message identifier) ​​of the corresponding externally published message (EMS message group). That is, for i=1 to N, ID_Tx_i is replaced with ID_Rx_i. The dynamic replacement of the CAN ID can be achieved in the AUTOSAR architecture by configuring the routing table of the PDU Router (PduR), or by passing the replaced CAN ID when calling the CAN driver's transmission interface at the COM layer. Further, according to the message cycles defined in DBC, the messages with the replaced CAN IDs are periodically sent to the power CAN bus. It should be noted that at this time, the CAN ID of the message sent to the CAN bus is the ID (ID_Rx_i) of the externally published message. Other controllers receive these messages normally and are completely unaware of the difference in the identity of the sending ECU.

[0052] S61. When the first control unit receives the instruction to send an internal message, if the first control unit malfunctions, the control unit corresponding to the second control unit will be identified as the first control unit.

[0053] S62. Use the newly determined first control unit to read the message identifier of the internally transmitted message.

[0054] S63. Determine and publish externally released messages based on message identifiers.

[0055] in, Figure 5 This invention provides a message sending and receiving flowchart, such as... Figure 5 As shown, step S63 can specifically be to dynamically modify the CAN ID (i.e., message identifier) ​​of the internally defined internally sent message to the CAN ID (i.e., message identifier) ​​of the corresponding externally published message, thereby determining the externally published message and completing the publication.

[0056] In yet another specific implementation, it also includes: S81. In response to the first control unit receiving a diagnostic command, modify the identity parameter calibration values ​​of the first control unit and the second control unit.

[0057] The diagnostic command indicates that the entire vehicle needs ECU maintenance or testing. Repair personnel can send a diagnostic command to the current primary control unit using a diagnostic tool, modifying the identity calibration parameter values ​​from the preset values ​​of the corresponding ECUA to the preset values ​​of the corresponding ECUB, and simultaneously modifying the identity calibration parameters of the current ECUB from the preset values ​​of the corresponding ECUB to the preset values ​​of the corresponding ECUA.

[0058] S82. The first control unit and the second control unit are redefined based on the identity parameter calibration values.

[0059] Figure 6 This invention provides a flowchart of an identity switching process, such as... Figure 6 As shown, after the modification, the original ECUB immediately takes over external communication as ECUA, and the original ECUA switches to ECUB and enters hot standby monitoring mode. It is understandable that during the control unit identity switching process, the ECU internally performs the following operations: Update Identification Variable: Modify the value of the global identification variable inside this ECU and simultaneously update the identification calibration parameters stored in the non-volatile memory.

[0060] Switch CAN message transmission behavior: If the new identity is ECUA, enable the transmission of EMSTx message groups and enable CANID mapping function; if the new identity is ECUB, disable the transmission of EMSTx message groups and disable CAN ID mapping function.

[0061] Maintain CAN message reception behavior: Regardless of the identity switch, the ECU always continuously receives outgoing messages (EMS message group) to ensure the continuity of status data.

[0062] Reporting switching events: Notify other relevant systems in the vehicle (such as gateways, instrument clusters, etc.) of the identity switching event via CAN messages or diagnostic services.

[0063] In yet another specific implementation, it also includes: When the second control unit detects a communication abnormality in the first control unit, it sets the second control unit to operating mode and simultaneously records the fault code of the first control unit.

[0064] In yet another specific implementation, it also includes: S91. When the second control unit receives externally published messages, it records the reception cycle of each externally published message.

[0065] S92. If the receiving period is greater than the preset period, it is determined that there is an anomaly in the data link corresponding to the externally published message.

[0066] Specifically, steps S91 and S92 can be as follows: When the second control unit receives an outgoing message, it independently maintains a timeout counter for each message frame. If a message frame is not received within M consecutive transmission cycles (i.e., a preset cycle), it is determined that the communication link corresponding to the message frame is abnormal, triggering a timeout alarm or triggering an identity switch.

[0067] In yet another specific implementation, it also includes: S101. When the first control unit publishes an external publication message, record the external publication messages published at the time of publication and those already published in the data bus.

[0068] S102. Start the counter and compare the message data of the published messages with those of the previously published messages frame by frame. S103. When the message data is inconsistent, increment the counter, and trigger a data release failure when the counter value is greater than the preset value.

[0069] Specifically, steps S101-S103 can be as follows: When the first control unit sends a message, it simultaneously listens to its own messages on the CAN bus and compares the data actually sent to the bus with the data in the internal transmission buffer frame by frame. If a data inconsistency is found, the error counter is incremented, and when it exceeds the threshold, fault handling is triggered.

[0070] In other scenarios, this invention also provides a LiveCounter verification method, which uses a predefined loop counter signal in the message to verify the continuity of the LiveCounter during reception. If a discontinuity is detected, it is determined to be a frame loss event. The Checksum verification method uses a predefined checksum signal in the message to perform integrity verification on the received message data. If the verification fails, it is marked as a data integrity error.

[0071] Furthermore, this invention uses the AUTOSAR (AUTomotive Open System AR Architecture) standard software architecture as an example to illustrate the implementation of this invention.

[0072] (1) ECU hardware platform: Two ECUs with the same MCU model are configured. Each ECU is equipped with a CAN controller and a CAN transceiver, and is connected to the power CAN network through a standard CAN bus interface. The identity selection pin is connected to the power supply voltage via an external pull-up resistor; when the external switch is closed and grounded, the pin is at a low level, corresponding to one identity; when the switch is open, the pin is at a high level, corresponding to the other identity.

[0073] (2) AUTOSAR communication stack configuration: CAN Driver Layer (CAN): Completes the configuration of the CAN controller hardware object. Configures a CAN transmit hardware object for each frame in the internal transmit message group (EMSTx), and configures a CAN receive hardware object for each frame in the external publish message group (EMS).

[0074] CAN Interface Layer (CanIf): Implements the mapping relationship between CAN identifiers and PDU identifiers. Configure two sets of mapping entries: one set corresponds to the raw CAN identifier of the internal transmission message group EMSx, and the other set corresponds to the standard CAN identifier of the externally published message group EMS.

[0075] PDU Routing Layer (PduR): Configures the routing table to implement PDU routing selection. In this invention, the PduR module dynamically switches the routing path based on the current identity of the ECU: if the ECU identity is ECUAA, the PDU to be transmitted from the COM layer is routed to the CanIf layer, where the CanIf layer completes the CAN identifier mapping replacement; if the ECU identity is ECUB (second control unit), the PDU transmission route is set to an empty route, retaining only the receiving path.

[0076] COM Layer: Defines the mapping relationship between signals and PDUs. When the ECU is in the identity of ECUA (First Control Unit), the COM layer normally fills in the signal values ​​of the internal transmission messages (obtaining data from the application layer RTE interface) and sends the PDU to the PduR layer; when the ECU is in the identity of ECUB, the COM layer sets the transmit prohibition attribute of the transmission port to be enabled, and only receives the signals of the externally published messages and uploads them to the application layer.

[0077] (3) Application layer identity management module: An identity management module is added to the application layer software components. This module implements the following functions: during the power-on initialization phase, it reads the calibration value and / or hard wire signal to determine the initial identity of the ECU; during operation, it periodically detects the change in hard wire signal level and the update of calibration value; when the identity switching conditions are met, it calls the PduR module configuration interface to update the routing table; and it maintains the ECU identity state machine and records the switching log.

[0078] (4) Testing and Verification: A simulation platform was built based on the CANoe test environment. The platform includes two ECUs and simulation nodes for simulating other controllers. The verification results show that when the ECUA is working normally, other controller nodes only receive externally published messages, and the message signal content is completely consistent with the messages sent internally by the ECUA. After modifying the identity calibration parameters through the calibration tool, the ECU can complete the identity switch in a very short time (about one communication cycle), and communication is seamlessly restored. During the entire switching process, the CAN bus load rate remains constant, and there is no message loss or CAN identifier conflict.

[0079] Therefore, compared with the prior art, the present invention has at least the following beneficial effects: (1) Achieve ECU hardware redundancy, eliminate single points of failure, and improve system reliability. Two EMS control units (first control unit and second control unit) are mounted on the same power CAN bus to form a redundant architecture; when one of the ECUs fails, the other ECU can immediately take over external communication through identity switching to ensure the continuous and reliable operation of the engine.

[0080] (2) No increase in CAN bus communication load. At any given time, only one ECU with the identity of the first control unit is allowed to send messages to the CAN bus. The other ECU with the identity of the second control unit works in pure receive mode, only listening to bus messages and not actively sending messages. Therefore, the CAN bus communication load is completely consistent with the traditional single ECU solution.

[0081] (3) External controllers are unaware of each other, reducing system coupling and adaptation costs. Based on the message ID dynamic mapping mechanism proposed in this invention, when the first control unit sends a message, it dynamically converts the CAN identifier corresponding to the internal message into the CAN identifier of the externally published message determined by the whole vehicle before sending it. For other controllers in the network, they only need to receive and parse the pre-agreed external messages. The protocol interface does not need to be modified, and there is no need to identify which physical ECU sent the message.

[0082] (4) The second control unit is hot-standby and monitors in real time, supporting rapid and seamless takeover. During operation, the ECU with the identity of the second control unit continuously monitors and receives external messages sent by the first control unit, and synchronizes all engine operating status information in real time, including engine speed, torque, accelerator pedal position, engine temperature, etc. When the identity switch is triggered, the internal state of the second control unit is completely synchronized with the first control unit, and it can immediately switch to the identity of the first control unit and take over external communication.

[0083] (5) Flexible and controllable identity switching mechanism. The determination and switching of ECU identity can be achieved through calibrated parameters (configuration parameters stored in non-volatile memory) or hard-wired signals (level status of ECU external hardware pins). The calibrated parameter scheme supports online dynamic modification via diagnostic services without hardware modifications; the hard-wired scheme is simple to implement and highly reliable. The two methods can be used independently or mutually verified.

[0084] Figure 3 This is a schematic diagram of a control unit communication redundancy device provided by the present invention. The present invention is applicable to redundancy control scenarios for at least various types of vehicle controllers. This control unit communication redundancy device can be implemented in software and / or hardware. Figure 3 As shown, the communication redundancy device of the control unit includes at least: The message definition module 110 is used to predefine the internal transmission messages and external publication messages of the control unit.

[0085] The unit determination module 120 is used to authenticate the control units after all control units are powered on, so as to determine the first control unit and the second control unit among the control units.

[0086] The transmit prohibition module 130 is used to set the second control unit to read-only receive mode.

[0087] The message monitoring module 140 is used to continuously monitor and acquire outgoing messages on the data bus using the second control unit in read-only receive mode.

[0088] The data update module 150 is used to update the data status of the second control unit based on the externally published message.

[0089] The message publishing module 160 is used to receive the internal message sending instruction from the first control unit. When the first control unit fails, it determines the control unit corresponding to the second control unit as the first control unit and uses the newly determined first control unit to publish external messages based on the internal message sending instruction.

[0090] Optionally, the message publishing module 160 is also used for: In response to the first control unit receiving a transmission command for an internal transmission message, the control unit obtains the message identifier of the internal transmission message corresponding to the transmission command; and sends the corresponding external transmission message to the data bus based on the message identifier.

[0091] Optionally, the cell determination module 120 is used for: After all control units are powered on, the identity pin level state of each control unit is read; and the control unit with the first identity pin level state is identified as the first control unit, and the control unit with the second identity pin level state is identified as the second control unit.

[0092] Optionally, the cell determination module 120 is used for: After all control units are powered on, the identity parameter calibration value of each control unit is read; and, based on the identity parameter calibration value, the first control unit and the second control unit are determined in the control units.

[0093] Optionally, it also includes: The identity switching module 170 is used to respond to the first control unit receiving a diagnostic command, modify the identity parameter calibration values ​​of the first control unit and the second control unit, and redetermine the first control unit and the second control unit based on the identity parameter calibration values.

[0094] Optionally, it also includes: The malfunction module 180 is used to set the second control unit to working mode and simultaneously record the fault code of the first control unit when the second control unit detects a communication malfunction in the first control unit.

[0095] Optionally, the identity swapping module 170 is also used for: When the first control unit receives the instruction to send an internal message and the first control unit malfunctions, the control unit corresponding to the second control unit is identified as the first control unit; and the message identifier of the internal message is read using the newly identified first control unit; and the message is identified and published based on the message identifier.

[0096] Optionally, the malfunction module 180 is also used for: When the second control unit receives outgoing messages, it records the reception period of each outgoing message; and if the reception period is greater than a preset period, it determines that there is an anomaly in the data link corresponding to the outgoing message.

[0097] Optionally, the malfunction module 180 is also used for: When the first control unit publishes an external publication message, it records the external publication messages published at the time of publication and those already published on the data bus; it also starts a counter and compares the message data of the external publication messages published at the time of publication with those already published frame by frame; and when the message data is inconsistent, it increments the counter and triggers a data publication fault when the counter value is greater than a preset value.

[0098] The technical solution provided by this invention firstly predefines the internal transmission messages and external publication messages of the control unit through a message definition module; further, after all control units are powered on, the control unit is authenticated through a unit determination module to identify the first control unit and the second control unit; further, the second control unit is set to read-only reception mode through a transmission prohibition module; further, in read-only reception mode, the second control unit is continuously monitored and acquired by a message monitoring module using the second control unit; further, the data status of the second control unit is updated based on the external publication messages through a data update module; finally, when the first control unit receives the transmission instruction for the internal transmission message through a message publication module, and the first control unit malfunctions, the control unit corresponding to the second control unit is identified as the first control unit, and the newly identified first control unit is used to publish the external publication message based on the internal transmission message and the transmission instruction.

[0099] Therefore, this invention, on the one hand, configures a first control unit and a second control unit. When the first control unit malfunctions, the second control unit can immediately take over external communication through identity switching, ensuring the continuous and reliable operation of the engine. On the other hand, this invention only allows the first control unit to send messages to the data bus at any given time; the second control unit operates in pure receive mode, only listening to messages on the bus and not actively sending messages. Therefore, the communication load of the data bus remains completely consistent with the traditional single-ECU solution, without increasing the communication burden of the data bus.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A control unit communication redundancy method, characterized by, At least including: S1, Predefined internal and external message transmission and publication messages of the control unit; S2. After all the control units are powered on, the control units are authenticated to identify the first control unit and the second control unit among the control units; S3. Set the second control unit to read-only receiving mode; S4. In the read-only receiving mode, the second control unit continuously listens for and acquires the outgoing messages on the data bus; S5. Update the data status of the second control unit based on the externally released message; S6. When the first control unit receives the sending instruction of the internal sending message, if the first control unit malfunctions, the control unit corresponding to the second control unit is determined as the first control unit, and the newly determined first control unit publishes the external release message based on the internal sending message and the sending instruction.

2. The control unit communication redundancy method according to claim 1, characterized in that, Following step S5, the following is also included: S71. In response to the first control unit receiving the sending instruction of the internal sending message, obtain the message identifier of the internal sending message corresponding to the sending instruction; S72. Send the corresponding external release message to the data bus based on the message identifier.

3. The control unit communication redundancy method of claim 1, wherein, Step S2 includes: S21. After all the control units are powered on, read the identity pin level status of each control unit. S22. The control unit with the first identity pin level state is determined as the first control unit, and the control unit with the second identity pin level state is determined as the second control unit.

4. The control unit communication redundancy method of claim 1, wherein, Step S2 also includes: S23. After all the control units are powered on, read the identity parameter calibration value of each control unit; S24. Based on the identity parameter calibration value, determine the first control unit and the second control unit in the control unit.

5. The control unit communication redundancy method of claim 1, wherein, Following step S2, the following is also included: S81. In response to the first control unit receiving a diagnostic command, modify the identity parameter calibration values ​​of the first control unit and the second control unit; S82. The first control unit and the second control unit are redefined based on the identity parameter calibration value.

6. The control unit communication redundancy method of claim 1, wherein, Following step S2, the following is also included: When the second control unit detects a communication abnormality in the first control unit, it sets the second control unit to operating mode and simultaneously records the fault code of the first control unit.

7. The control unit communication redundancy method of claim 1, wherein, Step S6 includes: S61. When the first control unit receives the sending instruction of the internal transmission message, if the first control unit malfunctions, the control unit corresponding to the second control unit is determined as the first control unit. S62. Use the newly determined first control unit to read the message identifier of the internal transmission message; S63. Determine and publish the externally published message based on the message identifier.

8. The control unit communication redundancy method of claim 1, wherein, Following step S2, the following is also included: S91. When the second control unit receives the externally published message, it records the reception period of each externally published message; S92. If the receiving period is greater than the preset period, it is determined that there is an anomaly in the data link corresponding to the externally published message.

9. The control unit communication redundancy method of claim 1, wherein, Following step S2, the following is also included: S101. When the first control unit publishes the external publication message, record the external publication message published at the time of publication and the external publication message already published in the data bus; S102. Start the counter and compare the message data of the published message with the previously published message frame by frame. S103. When the message data is inconsistent, the counter is incremented, and when the counter value is greater than a preset value, a data release failure is triggered.

10. A control unit communication redundancy apparatus, characterized by, The apparatus is used to perform the control unit communication redundancy method as described in any one of claims 1-9; The device includes at least: The message definition module is used to predefine the internal messages sent by the control unit and the messages published externally; The unit determination module is used to authenticate the control units after all the control units are powered on, so as to determine the first control unit and the second control unit among the control units; The transmit prohibition module is used to set the second control unit to read-only receive mode; The message monitoring module is used to continuously monitor and acquire the outgoing messages on the data bus using the second control unit in the read-only receiving mode. The data update module is used to update the data status of the second control unit based on the externally published message; The message publishing module is used to, when the first control unit receives the sending instruction of the internal sending message and the first control unit fails, determine the control unit corresponding to the second control unit as the first control unit, and use the newly determined first control unit to publish the external publishing message based on the internal sending message and the sending instruction.

Images