Safety strategy determining method and apparatus, vehicle, and storage medium

Abstract

A safety strategy determining method, applied to a hybrid transmission control unit (HTCU), and comprising: monitoring an environment signal in a hybrid transmission; when an error occurs to the environment signal, determining an abnormal event corresponding to the environment signal; analyzing the abnormal event, and determining a safety state corresponding to the abnormal event; on the basis of the safety state and the current gear of a vehicle, determining a safety strategy corresponding to the abnormal event, wherein the current gear comprises one gear in different driving modes, and the safety strategy comprises at least one of the following: maintaining the current gear, reverting the gear in the hybrid transmission to the current gear, and switching from the current gear to a corresponding downshifted gear; sending a gear switching request carrying the safety strategy to a vehicle electronic control unit (VECU), wherein the gear switching request is used for requesting the VECU to switch to a target gear on the basis of the safety strategy; and switching the gear in the hybrid transmission to the target gear. The problem of over-protection or under-protection in the hybrid transmission is avoided, and therefore the driving safety is improved. Also provided is a security strategy determining apparatus.

Description

Security strategy determination method, device, vehicle and storage medium CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] The embodiments of this application are based on and claim the priority of Chinese patent application with application number 202410029867.3 and application date January 8, 2024. The entire contents of the Chinese patent application are hereby introduced into the embodiments of this application as a reference. Technical Field

[0002] The present invention relates to the field of automobile control, and in particular to a method, device, vehicle and storage medium for determining a safety strategy. Background Art

[0003] If a shift failure occurs during the vehicle's power-on or power-off self-learning process, or while driving, without real-time monitoring, the inability to enter safety mode after a shift failure can damage the transmission and even cause unexpected vehicle deceleration, leading to a safety accident. Furthermore, existing safety modes often maintain the current gear or prohibit shifting, which can lead to over- or under-protection issues for complex hybrid transmissions. Summary of the Invention

[0004] In view of this, the present invention provides a method, device, vehicle and storage medium for determining a security policy.

[0005] The technical solution of the present invention is achieved as follows:

[0006] In a first aspect, the present invention provides a method for determining a safety strategy, which is applied to a hybrid transmission control unit HTCU, the method comprising: monitoring environmental signals in the hybrid transmission; the environmental signals comprising at least one of the following: a voltage signal, a current signal, a temperature signal, a sensor signal, and a position signal; in the event that an error occurs in the environmental signal, determining an abnormal event corresponding to the environmental signal; analyzing the abnormal event to determine a safety state corresponding to the abnormal event; determining a safety strategy corresponding to the abnormal event based on the safety state and a current gear position of the vehicle; the current gear position comprising a gear position under different driving modes; wherein the safety strategy comprises at least one of the following: maintaining the current gear position, returning the gear position in the hybrid transmission to the current gear position, and switching the current gear position to a corresponding downgraded gear position; sending a gear switching request carrying the safety strategy to a vehicle electronic control unit VECU; the gear switching request is used to request the VECU to switch a target gear position based on the safety strategy; and switching the gear position in the hybrid transmission to the target gear position.

[0007] In a second aspect, the present invention provides a method for determining a safety strategy, which is applied to a vehicle electronic control unit (VECU), the method comprising: receiving a gear switching request carrying a safety strategy sent by a hybrid transmission control unit (HTCU); the safety strategy is determined by the safety state corresponding to an abnormal event and the current gear of the vehicle; the abnormal event corresponds to an error in an environmental signal in the hybrid transmission; the current gear includes a gear under different driving modes; when the safety strategy is to maintain the current gear, the target gear is maintained unchanged; when the safety strategy is to return the gear in the hybrid transmission to the current gear, the target gear is switched to the current gear; when the safety strategy is to switch the current gear to a corresponding downgraded gear, the target gear is switched to the downgraded gear.

[0008] In a third aspect, the present invention provides a device for determining a safety strategy, the device comprising: a monitoring module for monitoring environmental signals in a hybrid transmission; the environmental signals comprising at least one of the following: a voltage signal, a current signal, a temperature signal, a sensor signal, and a position signal; a first determination module for determining an abnormal event corresponding to the environmental signal when an error occurs in the environmental signal; a second determination module for analyzing the abnormal event and determining a safety state corresponding to the abnormal event; a third determination module for determining a safety strategy corresponding to the abnormal event based on the safety state and a current gear position of a vehicle; the current gear position comprising a gear position under different driving modes; wherein the safety strategy comprises at least one of the following: maintaining the current gear position, returning the gear position in the hybrid transmission to the current gear position, and switching the current gear position to a corresponding downgraded gear position; a first sending module for sending a gear switching request carrying the safety strategy to a vehicle electronic control unit (VECU); the gear switching request is used to request the VECU to switch a target gear position based on the safety strategy; and a first switching module for switching the gear position in the hybrid transmission to the target gear position.

[0009] In a fourth aspect, the present invention provides a device for determining a safety strategy, the device comprising: a first receiving module for receiving a gear switching request carrying a safety strategy sent by a hybrid transmission control unit HTCU; the safety strategy is determined by the safety state corresponding to an abnormal event and the current gear of the vehicle; the abnormal event corresponds to an error in the environmental signal in the hybrid transmission; the current gear includes a gear under different driving modes; a second switching module for maintaining the target gear unchanged when the safety strategy is to maintain the current gear; a third switching module for switching the target gear to the current gear when the safety strategy is to return the gear in the hybrid transmission to the current gear; and a fourth switching module for switching the target gear to the downgraded gear when the safety strategy is to switch the current gear to the corresponding downgraded gear.

[0010] In a fifth aspect, the present invention provides a vehicle comprising a memory and a controller, wherein the memory stores a computer program that can be run on the controller, and the controller implements the steps in the above method when executing the program.

[0011] In a sixth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the above method when executed by a processor.

[0012] In this invention, when the hybrid transmission control unit (HTCU) detects an error in an environmental signal, it determines a corresponding abnormal event based on the environmental signal; analyzes the abnormal event to determine the corresponding safety state; determines a corresponding safety strategy based on the safety state and the current gear position; and sends a gear shift request containing the safety strategy to the vehicle electronic control unit (VECU). The VECU then switches the target gear position based on the safety strategy. The HTCU then switches the hybrid transmission gear to the target gear position. This system, by monitoring the environmental signal, promptly detects shift failures and specifically determines safety strategies based on the abnormal event corresponding to the environmental signal. This system is suitable for complex hybrid transmissions, meeting shift failure detection and safety strategies for different drive modes, avoiding over- or under-protection issues, and thus improving driving safety.

[0013] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and do not limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In the accompanying drawings (which are not necessarily drawn to scale), like reference numerals may describe similar components in different views. Like reference numerals with different letter suffixes may represent different instances of similar components. The accompanying drawings generally illustrate various embodiments discussed herein by way of example and not limitation.

[0015] FIG1 is a schematic diagram of a vehicle shifting structure provided by an embodiment of the present application;

[0016] FIG2 is a flowchart of a method for determining a security policy according to an embodiment of the present application;

[0017] FIG3 is a second flow chart of a method for determining a security policy provided in an embodiment of the present application;

[0018] FIG4 is a flowchart of a method for determining a security policy according to an embodiment of the present application;

[0019] FIG5 is a schematic diagram of a shift failure FTA structure provided by an embodiment of the present application;

[0020] FIG6 is a schematic diagram of a first structure of a device for determining a security policy according to an embodiment of the present application;

[0021] FIG7 is a second schematic diagram of the structure of a device for determining a security policy according to an embodiment of the present application;

[0022] FIG8 is a schematic diagram of a hardware entity of a vehicle provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The exemplary embodiments disclosed herein will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the specific embodiments described herein. Rather, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0024] In the following description, numerous specific details are provided to provide a more thorough understanding of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced without one or more of these details. In other instances, certain technical features known in the art are not described to avoid confusion with the present application; that is, all features of actual embodiments are not described herein, nor are well-known functions and structures described in detail.

[0025] It should be understood that although the terms first, second, third, etc. can be used to describe various elements, components, areas, layers and / or parts, these elements, components, areas, layers and / or parts should not be limited by these terms. These terms are only used to distinguish one element, component, area, layer or part from another element, component, area, layer or part. Therefore, without departing from the teachings of this application, the first element, component, area, layer or part discussed below can be expressed as a second element, component, area, layer or part. When the second element, component, area, layer or part is discussed, it does not mean that the first element, component, area, layer or part necessarily exists in this application.

[0026] The purpose of the terms used herein is only to describe specific embodiments and is not intended to limit the present application. When used herein, the singular forms "a", "an", and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "comprising" and / or "including", when used in this specification, determine the presence of the features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or groups. When used herein, the term "and / or" includes any and all combinations of the relevant listed items.

[0027] The present invention provides a vehicle shift mechanism 100. As shown in FIG1 , the vehicle shift mechanism 100 includes a vehicle electronic control unit (VECU) 110 for transmitting a target gear position; an engine 120 for providing power to the vehicle; wheels 130 for driving the vehicle; and a hybrid multi-speed transmission 140 for shifting vehicle gears. The hybrid multi-speed transmission 140 includes a hybrid transmission control unit (HTCU) 141 for controlling gear shifting; a drive motor 142 for driving the vehicle; a generator 143 for providing power; a gear transmission mechanism 144 (including a planetary carrier, fixed axis gears, ring gear, differential assembly, sun gear, and bearings) for transmitting motion and power; a shift actuator 145 (including a shift motor, shift hub, shift fork, and synchronizer) for implementing gear shifting; and synchronizers 146 (S1L, S1R, S1L, and S2R) for shortening shift times.

[0028] The power transmission routes include series mode: synchronizer S2L is engaged; parallel (direct drive) mode: a total of four gears, ① direct drive mode first gear: synchronizer S1R and S2L are engaged; ② direct drive 2nd gear: synchronizer S1R and S2R are engaged; ③ direct drive 3rd gear: synchronizer S1L and S2L are engaged; ④ direct drive 4th gear: synchronizer S1L and S2R are engaged; Electronic Continuously Variable Transmission (ECVT) mode: a total of four gears, ECVT1-1st gear or ECVT1-2nd gear: synchronizer S1R is engaged; ECVT2-2nd gear or ECVT2-1st gear: synchronizer S1L is engaged; pure electric vehicle (EV) mode, among which ECVT mode includes EV operating conditions. EV mode does not output power through the synchronizer and does not require gear disengagement judgment.

[0029] At present, most of the safety modes in related technologies are to protect the current gear or prohibit gear shifting. For the above-mentioned complex hybrid multi-speed transmission, the corresponding safety mode cannot be determined specifically, and problems of over-protection or under-protection may occur; moreover, the existing safety mode does not distinguish between the two situations of in-gear and out-of-gear, or the judgment of in-gear and out-of-gear is judged only by the gear shift status signal, resulting in untimely or inaccurate judgment of gear shift failure, which leads to problems such as failure to determine the safety strategy in time or inaccurate safety strategy, further causing damage to the gearbox or triggering a safety accident.

[0030] Based on the above-mentioned related issues, an embodiment of the present application provides a method for determining a safety strategy. The HTCU monitors environmental signals to identify corresponding abnormal events; analyzes the abnormal events to determine the corresponding safety state; and then determines the corresponding safety strategy based on the safety state and the current gear position. A gear shift request carrying the safety strategy is sent to the vehicle electronic control unit (VECU). The VECU switches the target gear position according to the safety strategy; and the HTCU switches the gear position in the hybrid transmission to the target gear position. In this way, by monitoring environmental signals, shift failures can be detected in a timely manner, and a safety strategy can be determined specifically based on the abnormal events corresponding to the environmental signals. This method is suitable for complex hybrid transmissions, meets the requirements of shift failure monitoring and safety strategies for different drive modes, avoids over-protection or under-protection issues, and thus improves driving safety.

[0031] An embodiment of the present application provides a method for determining a safety strategy, as shown in FIG2 , which is applied to a hybrid transmission control unit HTCU. The method includes the following steps S210 to S260:

[0032] Step S210: monitoring environmental signals in the hybrid transmission; the environmental signals include at least one of the following: a voltage signal, a current signal, a temperature signal, a sensor signal, and a position signal.

[0033] Here, environmental signals represent signals such as temperature, voltage, current, and position in the hybrid transmission. Voltage signals may include at least one of the following: a phase midpoint voltage signal, a shift motor bus voltage signal, a Metal-Oxide-Semiconductor Field-Effect Transistor (MOS) voltage signal, and a power supply voltage signal; current signals may include shift motor current signals; temperature signals may include MOS transistor temperature signals; sensor signals may include Hall effect sensors and pulse width modulation (PWM) signals; and position signals may include shift motor position signals and shift hub position difference signals.

[0034] Step S220: When an error occurs in the environmental signal, determine an abnormal event corresponding to the environmental signal.

[0035] It's understandable that abnormal events are the result of environmental signal monitoring, with each environmental signal corresponding to an abnormal event. For example, if the HTCU detects an abnormal phase midpoint voltage, it indicates a short or open circuit in the shift motor phase; if the HTCU detects an excessively high shift motor current, it indicates an overcurrent in the shift hub motor hardware or software.

[0036] It should be noted that the HTCU can monitor multiple environmental signals simultaneously and identify multiple abnormal events.

[0037] In this embodiment of the present application, abnormal events can be derived through fault tree analysis (FTA). Fault tree analysis (FAT) is used to analyze undesirable conditions in a system, such as abnormal events. After deriving abnormal events using FTA, a corresponding environmental signal is assigned to each abnormal event. When an error in the environmental signal is detected, the corresponding abnormal event is activated.

[0038] By using the fault tree analysis method in advance to derive abnormal events of shift failure, corresponding measures can be taken to improve the reliability and stability of the system.

[0039] Step S230: Analyze the abnormal event and determine the safety status corresponding to the abnormal event.

[0040] Here, we can analyze and classify the impact of abnormal events on gear shifting to determine the safety state corresponding to the abnormal events. It should be noted that multiple abnormal events can correspond to the same safety state.

[0041] Step S240: Determine a safety strategy corresponding to the abnormal event based on the safety state and the current gear of the vehicle; the current gear includes a gear under different driving modes; wherein the safety strategy includes at least one of the following: maintaining the current gear, returning the gear in the hybrid transmission to the current gear, and switching the current gear to a corresponding downgraded gear.

[0042] In the embodiment of the present application, the safety strategy refers to the safety measures implemented after the vehicle fails to shift into gear. Different driving modes include: series mode, direct drive mode, ECVT mode and EV mode.

[0043] It should be noted that a downgraded gear refers to a gear that is lower in rank than the current gear and adjacent to the current gear. It should be understood that when downgrading a gear, you must first downgrade to the closest gear, then to the next closest gear. You cannot downshift across gears (for example, directly shifting from 3rd gear to 1st gear).

[0044] Step S250: sending a gear switching request carrying the safety policy to the vehicle electronic control unit VECU; the gear switching request is used to request the VECU to switch the target gear based on the safety policy.

[0045] Here, the target gear position refers to the switching gear position sent by the VECU to the HTCU.

[0046] Step S260: Switching the gear in the hybrid transmission to the target gear.

[0047] In the embodiment of the present application, after the VECU switches the target gear, it sends the target gear to the HTCU, and the HTCU switches the current gear in the hybrid transmission direction to the target gear.

[0048] In this embodiment of the present application, the HTCU monitors environmental signals to identify corresponding abnormal events; analyzes these abnormal events to determine the corresponding safety state; and then, based on the safety state and the current gear position, determines the corresponding safety policy. A gear shift request containing the safety policy is sent to the vehicle electronic control unit (VECU). The VECU then switches the target gear position based on the safety policy. The HTCU then switches the hybrid transmission gear to the target gear position. This system, by monitoring environmental signals, promptly detects shift failures and specifically determines safety policies based on the abnormal events corresponding to these environmental signals. This system is suitable for complex hybrid transmissions, meeting shift failure detection and safety policy requirements for different drive modes, avoiding over- or under-protection issues and improving driving safety.

[0049] In some embodiments, the implementation of step S240 may include the following steps S241 to S243:

[0050] Step S241: when the safety state is that the shift motor is off, determining to maintain the current gear position;

[0051] It should be understood that when the shift motor is off, shifting cannot be performed and the HTCU needs to maintain the current gear.

[0052] Step S242: When the safety state is that the shift motor is not shut down and the shift is stuck, determining to return the gear position in the hybrid transmission to the current gear position;

[0053] Here, shifting sticking occurs in both disengaging and engaging gears. Disengaging gears generally does not cause sticking if the synchronizer residual torque is minimal. Engaging gear sticking typically occurs when shifting from series mode to first gear in direct drive mode, from ECVT mode to direct drive mode, from EV mode to ECVT mode, and from EV mode to fourth gear in direct drive mode.

[0054] Step S243: When the safety state is that the shift motor is not shut down and shifting is possible, determine to switch the current gear to a corresponding downgraded gear.

[0055] In the embodiment of the present application, when the shift motor is not shut down and shifting is possible, the HTCU needs to enter a safe gear that does not affect driving in advance, so the current gear needs to be downgraded.

[0056] In an embodiment of the present application, the safety strategy corresponding to the abnormal event is determined in a targeted manner according to different safety states and gear positions under multiple driving modes, and the degradation processing is optimized. In this way, in the event of a gear shift failure, the safety strategy can be accurately determined to avoid over-protection or under-protection problems, thereby further improving driving safety.

[0057] In some embodiments, the implementation of step S241 may include steps S2411 to S2412:

[0058] Step S2411: When the vehicle completes the gear shift, maintaining the current gear position;

[0059] Here, the vehicle completing the gear shift means that the vehicle is in gear.

[0060] Step S2412: When the vehicle has not completed the gear shift, request to cut off the power and maintain the current gear.

[0061] Here, the vehicle not completing the gear shift means that the vehicle is not in gear.

[0062] It should be understood that if the HTCU has not completed the shift after the shift motor is turned off, the vehicle is in neutral, which can pose a safety risk. Therefore, it is necessary to determine whether the vehicle is in gear. If the vehicle is not in gear, the HTCU requests power cut, and the VECU maintains the target gear and limits output torque to 0.

[0063] In addition, after the shift motor is turned off, when driving in direct drive mode, if the engine speed is low and the vehicle stalls or the driver actively stops the vehicle, the drive motor (such as the P3 motor) is allowed to directly drive the vehicle to a safe point.

[0064] In an embodiment of the present application, after determining the safety strategy, it is determined whether the vehicle has completed the gear shift. If the vehicle has not completed the gear shift (is not in gear), further safety measures are taken in a timely manner to avoid driving safety problems caused by the vehicle being out of gear when executing the safety strategy.

[0065] In some embodiments, the implementation of step S241 further includes steps S310 to S330:

[0066] Step S310: determining the degree of completion of the shift hub angle during the shifting process;

[0067] Here, the completion degree of the shift hub angle refers to the progress of the shift hub angle to the target shift hub angle, and the completion degree can be represented by the shift process signal HTCU_GearProgress.

[0068] Step S320: determining that the vehicle has completed the gear shift if the completion degree meets a preset threshold;

[0069] Step S330: When the degree of completion does not meet the preset threshold, determining that the vehicle has not completed the gear shift.

[0070] Here, the preset threshold may be set during the hardware design phase, and the preset threshold may be less than or equal to the first threshold or greater than or equal to the second threshold. Generally, the first threshold is k%, and the second threshold is (100-k)%.

[0071] The k value can be defined based on the allowable shift hub angle deviation range required by the design. For example, if the shift hub angle is required to change by A degrees and the allowable angle error is B degrees, then k is 100 multiplied by B divided by A. Here, k is designed to be 5.

[0072] In an embodiment of the present application, whether the vehicle has completed the gear shift is determined based on the degree of completion of the shift hub angle. This improves the accuracy of judging whether the vehicle is in gear or not, improves the safety of executing the safety strategy, and further improves driving safety.

[0073] In some embodiments, the implementation of step S310 may include steps S311 to S315:

[0074] Step S311: determining a first difference between the real-time target shift hub angle and the real-time actual shift hub angle;

[0075] Here, real-time refers to a case where the sampling frequency is very low, typically 5 milliseconds (ms). The first difference value may be an average value of the difference between the target and actual shift hub angles in a preset time period.

[0076] It should be understood that, under normal circumstances, when the vehicle maintains the current gear, there will be a certain error between the target shift hub position and the actual shift hub position.

[0077] Step S312: determining a second difference between the target shift hub angle at the time when the target gear position changes and the actual shift hub angle at the time when the target gear position changes;

[0078] Here, the target shift occurrence time refers to the time when the vehicle shifts gears.

[0079] Step S313: Compare the first difference with the second difference to obtain a first ratio;

[0080] Step S314: Calculate the difference between 1 and the first ratio to obtain a third difference;

[0081] Step S315: convert the third difference into a percentage to obtain the degree of completion.

[0082] It should be noted that completion is generally expressed as a percentage. Here, you need to convert the completion into a percentage.

[0083] In the embodiment of the present application, by optimizing the calculation method of the completion of the shift hub angle, the accuracy of judging whether the gear is in gear or not is improved, and over-protection or under-protection is effectively avoided.

[0084] In some embodiments, the implementation of step S241 further includes step S410:

[0085] Step S410: if the shift hub angle fed back by the vehicle during the self-learning process cannot represent the actual position of the shift hub, determining that the vehicle has not completed the shift; or

[0086] When the abnormal event is that the position of the shift hub cannot be determined, it is determined that the vehicle has not completed the shift.

[0087] It should be understood that if the shift hub position cannot be determined, the shift hub angle completion cannot be calculated. Generally, the default completion is 50%, which means the vehicle is not in gear.

[0088] Among them, situations where the shift hub position cannot be determined include: shift failure during the vehicle's power-on or power-off self-learning process, PWM signal failure, and shift hub position error.

[0089] In the embodiment of the present application, considering that the completion of the shift hub angle cannot be calculated due to the inability to determine the shift hub position, it is assumed that the vehicle has not completed the shift. In this way, by optimizing the judgment strategy of in-gear and out-of-gear, over-protection or under-protection is effectively avoided.

[0090] The present application provides a method for determining a security policy, as shown in FIG3 , which is applied to a vehicle electronic control unit (VECU). The method includes steps S510 to S540:

[0091] Step S510: receiving a gear shift request carrying a safety policy sent by a hybrid transmission control unit HTCU; the safety policy is determined by a safety state corresponding to an abnormal event and a current gear position of the vehicle; the abnormal event corresponds to an error in an environmental signal in the hybrid transmission; and the current gear position includes a gear position under different driving modes.

[0092] In the embodiment of the present application, the VECU receives a gear switching request from the HTCU and switches the target gear according to the gear switching request.

[0093] Step S520: When the safety strategy is to maintain the current gear, the target gear is maintained unchanged.

[0094] In the embodiment of the present application, the HTCU requests to maintain the current gear position, and the VECU needs to keep the target gear position unchanged.

[0095] Step S530: When the safety strategy is to return the gear in the hybrid transmission to the current gear, the target gear is switched to the current gear.

[0096] In the embodiment of the present application, the HTCU requests to return the gear in the hybrid transmission to the current gear, and the VECU switches the target gear to the current gear.

[0097] Step S540: When the safety strategy is to switch the current gear to a corresponding downgraded gear, the target gear is switched to the downgraded gear.

[0098] In the embodiment of the present application, the HTCU requests to switch the current gear of the hybrid transmission to the corresponding downgraded gear, and the VECU switches the target gear to the downgraded gear.

[0099] In the application embodiment, the HTCU specifically determines a safety strategy for abnormal events and carries the safety strategy in the gear shift request to enable the VECU to accurately switch the target gear, effectively avoiding over-protection and under-protection problems, improving driving safety and protecting the shift mechanism.

[0100] In some embodiments, the implementation of step S530 includes steps S531 to S538:

[0101] Step S531: If the series mode gear fails to be switched to the first gear of the direct drive mode, switching the target gear to the series mode gear; the target gear is the first gear of the direct drive mode;

[0102] Here, according to the hybrid multi-speed transmission structure, it can be seen that the first gear of the series mode and the direct drive mode are both combined with the synchronizer S2L. Therefore, the series mode gear is a gear similar to the first gear of the direct drive mode.

[0103] Step S532: If the first gear of the electronic continuously variable transmission (ECVT) mode fails to be switched to the first gear or the second gear of the direct drive mode, switching the target gear to the first gear of the ECVT mode; the target gear is the first gear or the second gear of the direct drive mode;

[0104] Here, the first gear of the ECVT mode and the first gear or the second gear of the direct drive mode are both combined with the synchronizer S1R. Therefore, the first gear of the ECVT mode is a gear close to the first gear or the second gear of the direct drive mode.

[0105] Step S533: If the second gear in the ECVT mode fails to be engaged with the first gear or the second gear in the direct drive mode, switching the target gear to the second gear in the ECVT mode; the target gear is the first gear or the second gear in the direct drive mode;

[0106] Here, the second gear in the ECVT mode and the first gear or the second gear in the direct drive mode are both combined with the synchronizer S1R. Therefore, the second gear in the ECVT mode is a gear close to the first gear or the second gear in the direct drive mode.

[0107] Step S534: If the third gear in the ECVT mode fails to be switched to the third gear or the fourth gear in the direct drive mode, switching the target gear to the third gear in the ECVT mode; the target gear is the third gear or the fourth gear in the direct drive mode;

[0108] Here, the third gear in the ECVT mode and the third gear or fourth gear in the direct drive mode are both combined with the synchronizer S1L. Therefore, the third gear in the ECVT mode is a gear similar to the third gear or fourth gear in the direct drive mode.

[0109] Step S535: If the fourth gear in the ECVT mode fails to be engaged with the third gear or the fourth gear in the direct drive mode, switching the target gear to the fourth gear in the ECVT mode; the target gear is the third gear or the fourth gear in the direct drive mode;

[0110] Here, the fourth gear in the ECVT mode and the third gear or fourth gear in the direct drive mode are both combined with the synchronizer S1L. Therefore, the fourth gear in the ECVT mode is a gear close to the third gear or fourth gear in the direct drive mode.

[0111] Step S536: If the first gear in the pure electric vehicle EV mode fails to be switched to the second gear in the ECVT mode, the target gear is switched to the third gear in the ECVT mode; the target gear is the third gear in the ECVT mode; if the HTCU fails to switch the gear to the third gear in the ECVT mode, the third gear in the ECVT mode is switched to the first gear in the EV mode;

[0112] Here, the EV mode is not combined with the synchronizer. If the first gear in EV mode fails to shift to the second gear in ECVT mode, it is necessary to first switch the target gear to the first closest gear (third gear in ECVT mode). If the switch fails, then switch the target gear to the second closest gear (first gear in EV mode).

[0113] Step S537: If the first gear in the EV mode fails to be switched to the third gear in the ECVT mode, the target gear is switched to the second gear in the ECVT mode; if the HTCU fails to switch the gear to the second gear in the ECVT mode, the second gear in the ECVT mode is switched to the first gear in the EV mode;

[0114] Here, the second gear in ECVT mode is a gear similar to the third gear in ECVT mode; the first gear in EV mode is a gear similar to the second gear in ECVT mode.

[0115] Step S538: When the second gear in the EV mode fails to be switched to the fourth gear in the direct drive mode, the target gear is switched to the second gear in the EV mode; the target gear is the fourth gear in the direct drive mode.

[0116] Here, the second gear in EV mode is a gear similar to the fourth gear in direct drive mode.

[0117] In the embodiment of the present application, based on the gear shift sticking in different driving modes, the adjacent gear corresponding to the target gear (i.e., the current gear) is determined, and the target gear is returned to the current gear. This effectively improves the problem of over-protection or under-protection.

[0118] In some embodiments, the implementation of step S540 may include steps S541 to S545:

[0119] Step S541: when the current gear is in ECVT mode or series mode, keeping the target gear unchanged;

[0120] Here, the ECVT mode and the series mode are safe gears, so the target gear can remain unchanged.

[0121] Step S542: When the current gear is the first gear of the direct drive mode, the target gear is switched to the first gear of the ECVT mode; the downgraded gear is the first gear of the ECVT mode;

[0122] Here, the ECVT mode first gear is a downshift gear adjacent to the direct drive mode first gear.

[0123] Step S543: When the current gear is the second gear of the direct drive mode or the first gear of the EV mode, the target gear is switched to the second gear of the ECVT mode; the downgraded gear is the second gear of the ECVT mode;

[0124] Here, the ECVT mode second gear is a downshift gear adjacent to the direct drive mode second gear or the EV mode first gear.

[0125] Step S544: When the current gear is the third gear in the direct drive mode, the target gear is switched to the third gear in the ECVT mode; the downgraded gear is the third gear in the ECVT mode;

[0126] Here, the ECVT mode third gear is a downshift gear adjacent to the direct drive mode third gear.

[0127] Step S545: When the current gear is the fourth gear in the direct drive mode or the second gear in the EV mode, the target gear is switched to the fourth gear in the ECVT mode; the downgraded gear is the fourth gear in the ECVT mode.

[0128] Here, the ECVT mode fourth gear is a lower gear adjacent to the direct drive mode fourth gear or the EV mode second gear.

[0129] In an embodiment of the present application, according to the different driving modes of the current gear, the downgrade gear corresponding to the current gear is determined, and the target gear is switched to the downgrade gear, so that the vehicle enters a safe gear or a gear that does not affect driving in advance, avoiding overprotection or underprotection, thereby protecting the shifting mechanism and improving driving safety.

[0130] The following describes in detail the method for determining the security policy provided in the embodiment of the present application in conjunction with specific application scenarios.

[0131] This embodiment of the present application relates to another safety strategy determination method. Based on FTA-derived abnormal events, the method monitors the environmental signals of the shift motor to identify abnormal events and then determines a targeted safety strategy for these abnormal events. This method can monitor and protect against shift failures in various driving modes, maximizing protection for the shift mechanism, reducing maintenance costs, and improving driving safety.

[0132] Another method for determining a security policy will be described in detail below. As shown in FIG4 , the method includes steps S1 to S5:

[0133] S1: Use FTA to derive abnormal events and environmental signals.

[0134] It should be understood that the abnormal events in the embodiments of the present application may be underlying events in the application scenario.

[0135] An embodiment of the present application provides a shift failure FTA structure, as shown in Figure 5. The causes of the shift failure 50 analyzed by the FTA include but are not limited to a shift motor drive failure 51, a shift motor sensor signal error 52, a shift mechanism stuck 53, and an unreliable shift hub position 54.

[0136] As shown in Figure 5, a shift motor drive fault 51 corresponds to four abnormal events. Abnormal event 1 511 is a shift motor phase short circuit or open circuit, and the corresponding environmental signal is the phase midpoint voltage. Abnormal event 2 512 is a shift motor bus voltage that is too high / too low, and the corresponding environmental signal is the shift motor bus voltage. Abnormal event 3 513 is a shift hub motor hardware or software overcurrent, and the corresponding environmental signal is the shift motor current. Abnormal event 4 514 is a shift hub motor MOS transistor short circuit or overtemperature, and the corresponding environmental signal is the MOS transistor voltage / temperature signal. A shift motor sensor signal error corresponds to two abnormal events. Abnormal event 521 is an undefined or invalid Hall signal, and the corresponding environmental signal is the Hall signal. Abnormal event 6 522 is a Hall signal supply voltage that is too low, and the corresponding environmental signal is the supply voltage signal. Abnormal event 7 523 is a PWM duty cycle that is too high / too low / abnormal carrier frequency, and the corresponding environmental signals are the duty cycle and carrier frequency signals. A stuck shift mechanism corresponds to one abnormal event, where abnormal event eight (531) is an abnormal change in the shift motor speed or position, and the corresponding environmental signal is the motor speed or position signal. Unreliable shift hub position corresponds to one abnormal event, where abnormal event nine (541) is an incorrect shift hub position, and the corresponding environmental signal is the difference signal between the shift hub position calculated by PWM and the shift hub position calculated by Hall effect.

[0137] S2: Monitor environmental signals.

[0138] S3: Determine abnormal events based on erroneous environmental signals.

[0139] In the embodiment of the present application, monitoring different environmental signals represents different safety mechanisms (Safety Mechanisms, SM), as shown in Figure 5, the safety mechanism 5111 corresponding to abnormal event 1 511 monitors the phase midpoint voltage for each cycle, and the signal error enters the safe state when it exceeds a certain time; the safety mechanism 5121 corresponding to abnormal event 2 512 monitors the shift motor bus voltage for each cycle, and the signal error enters the safe state when it exceeds a certain time; the safety mechanism 5131 corresponding to abnormal event 3 513 monitors the shift motor current for each cycle, and the signal error enters the safe state when it exceeds a certain time; the safety mechanism 5141 corresponding to abnormal event 4 514 monitors the MOS tube voltage / temperature signal for each cycle, and the signal error enters the safe state when it exceeds a certain time; the safety mechanism 5211 corresponding to abnormal event 521 monitors the MOS tube voltage / temperature signal for each cycle, and the signal error enters the safe state when it exceeds a certain time; Monitor the Hall signal, and enter the safe state if the signal error exceeds a certain time; the safety mechanism 5221 corresponding to abnormal event six 522 monitors the power supply voltage signal for each cycle, and enters the safe state if the signal error exceeds a certain time; the safety mechanism 5231 corresponding to abnormal event seven 523 monitors the duty cycle & carrier frequency signal for each cycle, and enters the safe state if the signal error exceeds a certain time; the safety mechanism 5311 corresponding to abnormal event eight 531 monitors the motor speed / position signal for each cycle, and enters the safe state if the signal error exceeds a certain time; the safety mechanism 5411 corresponding to abnormal event nine 541 monitors the difference signal between the shift hub position calculated by PWM and the shift hub position calculated by HALL for each cycle, and enters the safe state if the signal error exceeds a certain time.

[0140] By monitoring various environmental signals, when an error occurs in an environmental signal, it indicates that an abnormal event corresponding to the environmental signal has occurred.

[0141] S4: Analyze the abnormal event and determine the safety status corresponding to the abnormal event.

[0142] In the embodiment of the present application, the impact of abnormal events is analyzed and classified, and safety status is formulated for different categories. Here, in the case of multiple abnormal events, the abnormal events can be classified first to reduce the system processing burden.

[0143] It should be understood that the overtemperature in abnormal event 4 can be divided into warning event 4 (1), i.e., the shift motor drive overtemperature warning; and serious event 4 (2), i.e., the shift motor drive overtemperature shutdown:

[0144] For example, through analysis, abnormal events 1, 2, 3 and 4 (2) can be classified into the first category. The safety state corresponding to the first category is that the driver chip is protected and needs to be shut down, so that gear shifting cannot be performed; abnormal event 4 (1) can be classified into the second category. The safety state corresponding to the second category is that the driver chip is protected and an over-temperature warning is issued, so that gear shifting can be performed; abnormal events 5, 6 and 7 can be classified into the third category. The safety state corresponding to the third category is that the gear shift motor cannot work or works incorrectly due to signal error, so it needs to be shut down, so that gear shifting cannot be performed; abnormal event 8 can be classified into the fourth category. The safety state corresponding to the fourth category is that the gear shift hub cannot move normally or the motor cannot work normally due to mechanical jamming, so gear shifting is restricted; abnormal event 9 can be classified into the fifth category. The safety state corresponding to the fifth category is that the gear shift motor works incorrectly due to unreliable signal, so that the position of the gear shift hub is unknown and needs to be shut down, so that gear shifting cannot be performed.

[0145] S5: Develop security policies for different security states.

[0146] According to the S4 analysis, the first, third, and fifth categories all need to be shut down, and gear shifting cannot be performed. Therefore, the safe state is: the gear shift motor is shut down, and the gear shift motor stops working. Among them, after the gear shift motor is shut down, the safety strategy is determined as follows: (1) If the gear shift is completed and the current gear is in series mode or ECVT mode, the HTCU requests to maintain the current gear, the VECU maintains the target gear at the current gear, and the HTCU does not shift gears; (2) If the gear shift is completed and the current gear is in direct drive / EV mode, the HTCU requests to maintain the current gear, the VECU maintains the target gear at the current gear, and the HTCU does not shift gears; in direct drive mode, if the engine stalls due to low speed or the driver actively stops during driving, the drive motor is allowed to directly drive the vehicle to a safe point; (3) If during the gear shift process, the HTCU requests to cut off the power, the VECU target gear remains at the current gear, and the VECU limits the output shaft torque to 0.

[0147] Among them, the implementation of judging whether the vehicle has completed the gear shift can refer to the above steps S310 to S330 and steps 311 to S315, which will not be repeated here.

[0148] According to the S4 analysis and summary, the fourth category does not need to be shut down, and it is impossible to shift gears or it is impossible to shift gears in a certain direction. Among them, the safety strategies refined according to different gears are as follows: (1) If the series gear shift fails to shift to the first gear of the direct drive mode, the HTCU requests to return to the nearest series gear, the VECU target gear is switched to the series gear, the HTCU switches to the series gear and remains in the current series gear; (2) If the first gear of the ECVT mode fails to shift to the first gear or the second gear of the direct drive mode, the HTCU requests to return to the nearest ECVT mode gear, the VECU switches the target gear to the first gear of the ECVT mode, the HTCU switches to the first gear of the ECVT mode and remains in the current ECVT1-1 gear; (3) If the second gear of the ECVT mode fails to shift to the first gear or the second gear of the direct drive mode, the HTCU requests to return to the nearest ECVT mode gear. VT mode gear, VECU switches the target gear to ECVT mode second gear, HTCU switches to ECVT mode second gear, and maintains in the current ECVT mode second gear; (4) ECVT mode third gear fails to shift to direct drive mode third gear or fourth gear, HTCU requests to return to the nearest ECVT mode gear, VECU switches the target gear to ECVT mode third gear, HTCU switches to ECVT mode third gear, and maintains in the current ECVT mode third gear; (5) ECVT mode fourth gear fails to shift to direct drive mode third gear or fourth gear, HTCU requests to return to the nearest ECV mode T gear, VECU switches the target gear to ECVT mode third gear, HTCU switches to ECVT mode third gear, and maintains in the current ECVT mode third gear; VT mode fourth gear, HTCU switches to ECVT mode fourth gear, and maintains in the current ECVT mode fourth gear; (6) EV mode first gear fails to be switched to ECVT mode second gear, HTCU requests to return to the nearest ECVT mode gear, VECU switches the target gear to ECVT mode third gear, HTCU switches to ECVT mode third gear, and maintains in the current ECVT mode third gear. If returning to ECVT mode third gear fails, VECU switches the target gear to EV mode first gear, HTCU switches to EV mode first gear, and maintains in the current EV mode first gear; (7) EV mode first gear is switched to ECVT mode third gear If the shift fails, the HTCU requests to return to the similar ECVT mode, the VECU switches the target gear to the second gear of ECVT mode, the HTCU switches to the second gear of ECVT mode, and maintains the second gear of the current ECVT mode. If the shift fails to return to the second gear of ECVT mode, the VECU switches the target gear to the first gear of EV mode, the HTCU switches to the first gear of EV mode, and maintains the first gear of the current EV mode. (8) If the shift fails to shift from the second gear of EV mode to the fourth gear of direct drive mode, the HTCU requests to return to EV mode, the VECU switches the target gear to the second gear of EV mode, the HTCU switches to the second gear of EV mode, and maintains the second gear of the current EV mode.

[0149] According to the S4 analysis and summary, the second category does not need to be shut down, and gear shifting can be performed, entering a safe gear that does not affect driving in advance. Among them, the safety strategy after refinement according to different current gears is: (1) When the current gear is ECVT / series mode, HTCU requests to maintain the current gear, VECU keeps the target gear at the current gear, and HTCU does not shift gears; (2) When the current gear is the first gear of direct drive mode, HTCU requests to switch to the adjacent ECVT mode, VECU target gear switches to the first gear of ECVT mode, HTCU switches to the first gear of ECVT mode, and maintains the current first gear of ECVT mode; (3) When the current gear is the second gear of direct drive mode or the first gear of EV mode, HTCU requests to switch to the adjacent ECVT mode, VECU switches the target gear to the second gear of ECVT mode (4) If the current gear is the third gear in direct drive mode, the HTCU requests to switch to the adjacent ECVT mode, the VECU switches the target gear to the third gear in ECVT mode, the HTCU switches to the third gear in ECVT mode, and maintains the current third gear in ECVT mode; (5) If the current gear is the fourth gear in direct drive mode or the second gear in EV mode, the HTCU requests to switch to the adjacent ECVT mode gear, the VECU switches the target gear to the fourth gear in ECVT mode, the HTCU switches to the fourth gear in ECVT mode, and maintains the current fourth gear in ECVT mode.

[0150] The advantages of the method for determining the safety strategy provided in the embodiment of the present application include: from the perspective of hardware protection and functional safety, it provides a shift failure monitoring and degradation processing that meets different drive modes such as direct drive / parallel, ECVT / EV, and series drive; uses a functional safety fault tree analysis method to derive monitoring underlying events and their safety mechanisms, classifies the derived events and SM, and thus refines the corresponding safety mechanisms, which can effectively avoid over-protection or under-protection; and optimizes the judgment strategy of being in gear and not in gear, which can effectively avoid over-protection or under-protection.

[0151] The embodiment of the present application provides a device for determining a security policy. As shown in FIG6 , the device 600 for determining a security policy includes:

[0152] A monitoring module 601 is configured to monitor environmental signals in the hybrid transmission; the environmental signals include at least one of the following: a voltage signal, a current signal, a temperature signal, a sensor signal, and a position signal;

[0153] A first determining module 602 is configured to determine an abnormal event corresponding to the environmental signal when an error occurs in the environmental signal;

[0154] A second determining module 603 is configured to analyze the abnormal event and determine a safety status corresponding to the abnormal event;

[0155] a third determining module 604 configured to determine a safety strategy corresponding to the abnormal event based on the safety state and a current gear position of the vehicle; the current gear position comprising a gear position under different driving modes; wherein the safety strategy comprises at least one of the following: maintaining the current gear position, returning the gear position in the hybrid transmission to the current gear position, and switching the current gear position to a corresponding downgraded gear position;

[0156] The first sending module 605 is used to send a gear switching request carrying the safety policy to the vehicle electronic control unit VECU; the gear switching request is used to request the VECU to switch the target gear based on the safety policy;

[0157] The first switching module 606 is configured to switch the gear in the hybrid transmission to the target gear.

[0158] In some embodiments, the third determination module 604 includes a first determination submodule, used to determine whether to maintain the current gear position when the safety state is that the shift motor is turned off; a second determination submodule, used to determine whether to return the gear position in the hybrid transmission to the current gear position when the safety state is that the shift motor is not turned off and the gear shift is stuck; and a third determination submodule, used to determine whether to switch the current gear position to a corresponding downgraded gear position when the safety state is that the shift motor is not turned off and gear shifting is possible.

[0159] In some embodiments, the first determination submodule includes a first holding unit for holding the current gear position when the vehicle completes the gear shift; and a second holding unit for requesting to cut off power and hold the current gear position when the vehicle does not complete the gear shift.

[0160] In some embodiments, the first determination submodule also includes a first determination unit for determining the completion degree of the shift hub angle during the gear shifting process; a second determination unit for determining that the vehicle has completed the gear shifting if the completion degree meets a preset threshold; and a third determination unit for determining that the vehicle has not completed the gear shifting if the completion degree does not meet the preset threshold.

[0161] In some embodiments, the first determination unit also includes a first determination subunit, which is used to determine the first difference between the real-time target shift hub angle and the real-time actual shift hub angle; a second determination subunit, which is used to determine the second difference between the target shift hub angle at the moment when the target gear changes and the actual shift hub angle at the moment when the target gear changes; a first calculation subunit, which is used to compare the first difference with the second difference to obtain a first ratio; a second calculation subunit, which is used to calculate the difference between 1 and the first ratio to obtain a third difference; and a third calculation subunit, which is used to convert the third difference into a percentage to obtain the degree of completion.

[0162] In some embodiments, the third determination unit also includes a third determination sub-unit, which is used to determine that the vehicle has not completed the shift when the shift hub angle fed back by the vehicle during the self-learning process cannot represent the actual position of the shift hub; or, when the abnormal event is that the shift hub position cannot be determined, determine that the vehicle has not completed the shift.

[0163] In some embodiments, the first determination module 602 also includes an export module for exporting the abnormal event based on the fault tree analysis FTA; a fourth determination submodule for determining the abnormal event corresponding to the environmental signal based on a mapping relationship; the mapping relationship is used to characterize the correspondence between the abnormal event and the environmental signal.

[0164] The embodiment of the present application provides a device for determining a security policy. As shown in FIG7 , the device 700 for determining a security policy includes:

[0165] A first receiving module 701 is configured to receive a gear shift request carrying a safety policy sent by a hybrid transmission control unit (HTCU); the safety policy is determined by a safety state corresponding to an abnormal event and a current gear position of the vehicle; the abnormal event corresponds to an error in an environmental signal in the hybrid transmission; and the current gear position includes a gear position under different driving modes.

[0166] A second switching module 702 is configured to maintain the target gear position unchanged when the safety policy is to maintain the current gear position;

[0167] The third switching module 703 is further configured to switch the target gear to the current gear when the safety strategy is to return the gear in the hybrid transmission to the current gear;

[0168] The fourth switching module 704 is further configured to switch the target gear to the downgraded gear when the safety policy is to switch the current gear to the corresponding downgraded gear.

[0169] In some embodiments, the third switching module 703 includes a first switching submodule for switching the target gear to the series mode gear when the series mode gear fails to be switched to the first gear of the direct drive mode; the target gear is the first gear of the direct drive mode; when the first gear of the electronic continuously variable transmission ECVT mode fails to be switched to the first gear or the second gear of the direct drive mode, switching the target gear to the first gear of the ECVT mode; the target gear is the first gear or the second gear of the direct drive mode; when the second gear of the ECVT mode fails to be switched to the first gear or the second gear of the direct drive mode, switching the target gear to the second gear of the ECVT mode; the target gear is the first gear or the second gear of the direct drive mode; when the third gear of the ECVT mode fails to be switched to the third gear or the fourth gear of the direct drive mode, switching the target gear to the third gear of the ECVT mode; the target gear is the third gear or the fourth gear of the direct drive mode; when the fourth gear of the ECVT mode fails to be switched to the third gear or the fourth gear of the direct drive mode If the HTCU fails to switch the gear to the third gear of the ECVT mode, the target gear is the third gear or the fourth gear of the direct drive mode. If the HTCU fails to switch the gear to the third gear of the ECVT mode, the target gear is the third gear of the ECVT mode. If the HTCU fails to switch the gear to the second gear of the ECVT mode, the target gear is the first gear of the ECVT mode. If the HTCU fails to switch the gear to the second gear of the ECVT mode, the target gear is the first gear of the EV mode. If the HTCU fails to switch the gear to the second gear of the ECVT mode, the target gear is the first gear of the EV mode. If the HTCU fails to switch the gear to the second gear of the ECVT mode, the target gear is the first gear of the EV mode.

[0170] In some embodiments, the fourth switching module 704 includes a second switching sub-module, which is used to keep the target gear unchanged when the current gear is ECVT mode or series mode; switch the target gear to the first gear of ECVT mode when the current gear is the first gear of direct drive mode; the downgraded gear is the first gear of ECVT mode; when the current gear is the second gear of direct drive mode or the first gear of EV mode, switch the target gear to the second gear of ECVT mode; the downgraded gear is the second gear of ECVT mode; when the current gear is the third gear of direct drive mode, switch the target gear to the third gear of ECVT mode; the downgraded gear is the third gear of ECVT mode; when the current gear is the fourth gear of direct drive mode or the second gear of EV mode, switch the target gear to the fourth gear of ECVT mode; the downgraded gear is the fourth gear of ECVT mode.

[0171] The description of the above embodiment of the device for determining a security policy is similar to the description of the above embodiment of the method for determining a security policy, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the device for determining a security policy provided in the embodiments of the present application can be used to execute the method described in the above embodiment of the method for determining a security policy. For technical details not disclosed in the embodiments of the device of the present application, please refer to the description of the embodiment of the method for determining a security policy of the present application for understanding.

[0172] It should be noted that in the embodiments of the present application, if the aforementioned security policy determination method is implemented in the form of a software functional module and sold or used as a standalone product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of the present application, or the portion that contributes to the relevant technology, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions for causing a vehicle to execute all or part of the security policy determination method described in each embodiment of the present application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a magnetic disk, or an optical disk. Thus, the embodiments of the present application are not limited to any specific hardware, software, or firmware, or any combination of hardware, software, or firmware.

[0173] An embodiment of the present application provides a security policy determination device, including a memory and a controller, wherein the memory stores a computer program that can be run on the controller, and when the controller executes the program, it implements some or all of the steps in the above-mentioned security policy determination method.

[0174] The present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a controller, implements some or all of the steps in the above-mentioned method for determining a security policy. The computer-readable storage medium may be transient or non-transient.

[0175] An embodiment of the present application provides a computer program including a computer-readable code. When the computer-readable code runs in a vehicle, a controller in the vehicle executes some or all of the steps in the determination method for implementing the above-mentioned security policy.

[0176] An embodiment of the present application provides a computer program product comprising a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, the computer program implements some or all of the steps in the security policy determination method described above. The computer program product can be implemented in hardware, software, or a combination thereof. In some embodiments, the computer program product is embodied as a computer storage medium. In other embodiments, the computer program product is embodied as a software product, such as a software development kit (SDK).

[0177] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between the embodiments, and their similarities or similarities can be referenced. The descriptions of the above device, storage medium, computer program, and computer program product embodiments are similar to the descriptions of the above security policy determination method embodiments, and have similar beneficial effects as the method embodiments. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of this application, please refer to the description of the security policy determination method embodiment of this application for understanding.

[0178] It should be noted that an embodiment of the present application provides a vehicle, as shown in FIG8 . The hardware entities of vehicle 800 include: a controller 801, a communication interface 802, and a memory 803. The controller 801 generally controls the overall operation of vehicle 800. The communication interface 802 enables the vehicle, which determines the security policy, to communicate with other terminals or servers via a network. The memory 803 is configured to store instructions and applications executable by the controller 801 and can also cache data to be processed or processed by the controller 801 and various modules in the vehicle 800 (e.g., image data, audio data, voice communication data, and video communication data). This can be implemented using flash memory (FLASH) or random access memory (RAM). Data can be transmitted between the controller 801, communication interface 802, and memory 803 via a bus 804.

[0179] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned steps / processes does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0180] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0181] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0182] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed across multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0183] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0184] Those skilled in the art will understand that all or part of the steps of the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, and other media that can store program codes.

[0185] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a vehicle to execute all or part of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0186] The above is only an implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. A method for determining a safety strategy, which is applied to a hybrid transmission control unit (HTCU). The method includes: Monitoring environmental signals in the hybrid transmission; the environmental signals include at least one of the following: voltage signal, current signal, temperature signal, sensor signal, and position signal; When an error occurs in the environmental signals, determining an abnormal event corresponding to the environmental signals; Analyzing the abnormal event to determine a safety state corresponding to the abnormal event; Based on the safety state and the current gear of the vehicle, determining a safety strategy corresponding to the abnormal event; the current gear includes a gear in different driving modes; wherein, the safety strategy includes at least one of the following: maintaining the current gear, returning the gear in the hybrid transmission to the current gear, and switching the current gear to a corresponding degraded gear; Sending a gear shift request carrying the safety strategy to a vehicle electronic control unit (VECU); the gear shift request is used to request the VECU to switch the target gear based on the safety strategy; Switching the gear in the hybrid transmission to the target gear.

2. The method according to claim 1, wherein The determining, based on the safety state and the current gear of the vehicle, a safety strategy corresponding to the abnormal event includes: When the safety state is that the shift motor is turned off, determining to maintain the current gear; When the safety state is that the shift motor is not turned off and there is a shift jam, determining to return the gear in the hybrid transmission to the current gear; When the safety state is that the shift motor is not turned off and shifting is possible, determining to switch the current gear to a corresponding degraded gear; Wherein, the determining to maintain the current gear includes: When the vehicle has completed a gear shift, maintaining the current gear; When the vehicle has not completed a gear shift, requesting to cut off power and maintaining the current gear.

3. The method according to claim 2, wherein The method further includes: Determining the completion degree of the shift hub angle during a gear shift; When the completion degree meets a preset threshold, determining that the vehicle has completed a gear shift; When the completion degree does not meet the preset threshold, determining that the vehicle has not completed a gear shift.

4. The method according to claim 3, wherein, The determining the completion degree of the shift hub angle during a gear shift includes: Determining a first difference between a real-time target shift hub angle and a real-time actual shift hub angle; Determining a second difference between the target shift hub angle at the moment when the target gear changes and the actual shift hub angle at the moment when the target gear changes; Comparing the first difference with the second difference to obtain a first ratio; Calculating a difference between 1 and the first ratio to obtain a third difference; Converting the third difference into a percentage to obtain the completion degree.

5. The method according to claim 3, wherein The method further includes: When the shift hub angle fed back by the vehicle during a self-learning process cannot represent the actual position of the shift hub, determining that the vehicle has not completed a gear shift; or, When the abnormal event is that the position of the shift hub cannot be determined, determining that the vehicle has not completed a gear shift.

6. A method for determining a safety strategy, which is applied to a vehicle electronic control unit (VECU). The method includes: Receive a gear shift request carrying a safety policy sent by the hybrid transmission control unit HTCU; The safety policy is determined by the safety state corresponding to an abnormal event and the current gear of the vehicle; the abnormal event corresponds to an error in the environmental signal in the hybrid transmission; the current gear includes a gear in different driving modes; When the safety policy is to maintain the current gear, keep the target gear unchanged; When the safety policy is to shift the gear in the hybrid transmission back to the current gear, switch the target gear to the current gear; When the safety policy is to switch the current gear to the corresponding degraded gear, switch the target gear to the degraded gear.

7. The method according to claim 6, wherein, The switching of the target gear to the current gear includes: When the direct drive mode first gear cannot be engaged from the series mode gear, switch the target gear to the series mode gear; the target gear is the direct drive mode first gear; When the direct drive mode first or second gear cannot be engaged from the first gear of the electronic continuously variable transmission (ECVT) mode, switch the target gear to the first gear of the ECVT mode; the target gear is the direct drive mode first or second gear; When the direct drive mode first or second gear cannot be engaged from the second gear of the ECVT mode, switch the target gear to the second gear of the ECVT mode; the target gear is the direct drive mode first or second gear; When the direct drive mode third or fourth gear cannot be engaged from the third gear of the ECVT mode, switch the target gear to the third gear of the ECVT mode; the target gear is the direct drive mode third or fourth gear; When the direct drive mode third or fourth gear cannot be engaged from the fourth gear of the ECVT mode, switch the target gear to the fourth gear of the ECVT mode; the target gear is the direct drive mode third or fourth gear; When the second gear of the electronic continuously variable transmission (ECVT) mode cannot be engaged from the first gear of the pure electric vehicle (EV) mode, switch the target gear to the third gear of the ECVT mode; the target gear is the third gear of the ECVT mode; when the HTCU fails to switch the gear to the third gear of the ECVT mode, switch the third gear of the ECVT mode to the first gear of the EV mode; When the third gear of the ECVT mode cannot be engaged from the first gear of the EV mode, switch the target gear to the second gear of the ECVT mode; when the HTCU fails to switch the gear to the second gear of the ECVT mode, switch the second gear of the ECVT mode to the first gear of the EV mode; When the direct drive mode fourth gear cannot be engaged from the second gear of the EV mode, switch the target gear to the second gear of the EV mode; the target gear is the direct drive mode fourth gear.

8. The method according to claim 6 or 7, wherein The switching of the target gear to the degraded gear includes: When the current gear is in the ECVT mode or the series mode, keep the target gear unchanged; When the current gear is the first gear of the direct drive mode, switch the target gear to the first gear of the ECVT mode; the degraded gear is the first gear of the ECVT mode; When the current gear is the second gear of the direct drive mode or the first gear of the EV mode, switch the target gear to the second gear of the ECVT mode; the degraded gear is the second gear of the ECVT mode; When the current gear is the third gear of the direct drive mode, switch the target gear to the third gear of the ECVT mode; the degraded gear is the third gear of the ECVT mode; When the current gear is the fourth gear of the direct drive mode or the second gear of the EV mode, switch the target gear to the fourth gear of the ECVT mode; the degraded gear is the fourth gear of the ECVT mode.

9. A device for determining a safety strategy, the device comprising: A monitoring module for monitoring environmental signals in the hybrid transmission; the environmental signals include at least one of the following: voltage signal, current signal, temperature signal, sensor signal, and position signal; A first determination module for determining an abnormal event corresponding to the environmental signal when the environmental signal is in error; A second determination module for analyzing the abnormal event to determine a safety state corresponding to the abnormal event; A third determination module for determining a safety strategy corresponding to the abnormal event based on the safety state and the current gear of the vehicle; the current gear includes a gear in different driving modes; wherein, the safety strategy includes at least one of the following: keeping the current gear, returning the gear in the hybrid transmission to the current gear, and switching the current gear to a corresponding degraded gear; A first sending module for sending a gear shifting request carrying the safety strategy to the vehicle electronic control unit VECU; the gear shifting request is used to request the VECU to switch the target gear based on the safety strategy; A first switching module for switching the gear in the hybrid transmission to the target gear.

10. A device for determining a safety strategy, the device comprising: A first receiving module for receiving a gear shifting request carrying a safety strategy sent by the hybrid transmission control unit HTCU; The safety strategy is determined by the safety state corresponding to the abnormal event and the current gear of the vehicle; the abnormal event corresponds to an error in the environmental signal in the hybrid transmission; the current gear includes a gear in different driving modes; A second switching module for keeping the target gear unchanged when the safety strategy is to keep the current gear; A third switching module is further configured to switch the target gear to the current gear when the safety strategy is to return the gear in the hybrid transmission to the current gear; The fourth switching module is further configured to switch the target gear to the downgraded gear when the security policy is to switch the current gear to the corresponding downgraded gear.

Images