Redundant control system, method, device, storage medium, and vehicle

Abstract

A redundant control system, a method, a device, a storage medium, and a vehicle. The redundant control system (100) comprises: a first main controller (101), a first backup controller (102), and a second backup controller (103), wherein the first main controller (101) is used for controlling a first functional component (104) and a second functional component (105); the first functional component (104) comprises one of a torque component, a braking component, a power supply component and a sensing component, and the second functional component (105) comprises one of a torque component, a braking component, a power supply component and a sensing component; the first backup controller (102) is connected to the first functional component (104); the second backup controller (103) is connected to the second functional component (105); when the first main controller (101) loses the control capability over the first functional component (104), the first backup controller (102) controls the first functional component (104); and when the first main controller (101) loses the control capability over the second functional component (105), the second backup controller (103) controls the second functional component (105).

Description

Redundancy control system, method, device, storage medium and vehicle TECHNICAL FIELD

[0001] The present application relates to the field of vehicle control, and in particular to a redundancy control system, method, device, storage medium and vehicle. BACKGROUND

[0002] With the development of vehicle control technology, the control of automobile electronic / electricity architecture is increasingly regionally centralized, for example, the SOA (Service-Oriented Architecture) of "central computing unit and regional access" is used to realize domain control of the vehicle. In the scene of L3 high-order automatic driving, it is particularly important to realize redundancy backup and timely switching of the key functions of the central computing unit to ensure that the vehicle can safely stop by the roadside or drive to a repair site after a certain distance when a fault occurs.

[0003] SUMMARY

[0004] Therefore, the present application provides a redundancy control system, method, device, storage medium and vehicle.

[0005] In a first aspect, an embodiment of the present application provides a redundancy control system, comprising: a first main controller, a first backup controller and a second backup controller. The first main controller is configured to control a first functional component and a second functional component; the first functional component comprises one of a torque component, a brake component, a power component and a perception component; the second functional component comprises one of a torque component, a brake component, a power component and a perception component; the first backup controller is connected to the first functional component; the second backup controller is connected to the second functional component; when the first main controller loses the control ability of the first functional component, the first backup controller controls the first functional component; when the first main controller loses the control ability of the second functional component, the second backup controller controls the second functional component.

[0006] In a possible implementation manner of the first aspect, the first main controller controls the first functional component through a first link, and the first link comprises the first backup controller; and / or the first main controller controls the second functional component through a second link, and the second link comprises the second backup controller.

[0007] In a possible implementation manner of the first aspect, the redundancy control system further comprises a third backup controller, and the third backup controller is connected to the first functional component.

[0008] In a possible implementation manner of the first aspect, the first functional component includes a first sub-functional component and a second sub-functional component; the first backup controller is connected with the first sub-functional component; and the third backup controller is connected with the second sub-functional component.

[0009] In a possible implementation manner of the first aspect, when the first main controller loses the control ability over the first functional component, the control over the first functional component by the first backup controller includes: when the first main controller loses the control ability over the first functional component, the first backup controller controls the first sub-functional component, and the third backup controller controls the second sub-functional component.

[0010] In a possible implementation manner of the first aspect, the first controller is the first backup controller in a first time period, and the second controller is the first backup controller in a second time period.

[0011] In a possible implementation manner of the first aspect, the first main controller is further configured to control a third functional component, the third functional component including one of a torque component, a brake component, a power supply component and a perception component; the first backup controller is further connected with the third functional component, and when the first main controller loses the control over the third functional component, the first backup controller controls the third functional component; or the second backup controller is further connected with the third functional component, and when the first main controller loses the control over the third functional component, the second backup controller controls the third functional component.

[0012] In a possible implementation manner of the first aspect, when the first main controller loses the control ability over the first functional component, the control over the first functional component by the first backup controller includes: the first backup controller monitors the control ability of the first main controller over the first functional component, and when the first backup controller monitors that the first main controller loses the control ability over the first functional component, the first backup controller controls the first functional component.

[0013] In a possible implementation manner of the first aspect, the monitoring, by the first backup controller, of the control capability of the first master controller over the first functional component includes: monitoring, by the first backup controller, a first target message output by the first master controller, the first target message being used to represent the control capability of the first master controller over the first functional component; and if a monitoring result of the first backup controller on the first target message meets the first preset condition, the first master controller loses the control capability over the first functional component.

[0014] In a possible implementation manner of the first aspect, the first preset condition includes: the first target message is not detected within a preset time length.

[0015] In a possible implementation manner of the first aspect, the redundant control system further includes: when the first master controller restores the control capability over the first functional component, controlling, by the first master controller, the first functional component; and when the first master controller restores the control capability over the second functional component, controlling, by the first master controller, the second functional component.

[0016] In a possible implementation manner of the first aspect, when the first master controller restores the control capability over the first functional component and the first master controller restores the control capability over the second functional component, controlling, by the first master controller, the first functional component and controlling, by the first master controller, the second functional component.

[0017] In a possible implementation manner of the first aspect, the controlling, by the first master controller, of the first functional component includes: detecting, by the first master controller, whether the first master controller sends a second target message, the second target message being used to represent the control capability of the first master controller over the first functional component; when a detection result of the first master controller on the second target message meets a second preset condition, the first master controller restores the control capability over the first functional component; and when the first master controller restores the control capability over the first functional component, the first backup controller gives up the control capability over the first functional component, and the first master controller controls the first functional component.

[0018] In a possible implementation manner of the first aspect, when the first main controller restores the control capability of the first functional component, the first backup controller gives up the control capability of the first functional component, and the control of the first functional component by the first main controller comprises: when the main controller restores the control capability of the first functional component, the first main controller detects whether there is a third target message output by the first backup controller, the third target message being used to represent that the first backup controller is in a control state for the first functional component; when the first main controller does not detect the third target message, the first main controller controls the first functional component.

[0019] In a second aspect, an embodiment of the present application provides a redundancy control method, which is suitable for a redundancy control system, the redundancy control system comprising: a first main controller and a plurality of controllers; the plurality of controllers comprising a first backup controller and a second backup controller; the first main controller being configured to control a first functional component and a second functional component; the first functional component comprising one of a torque component, a brake component, a power component and a perception component, and the second functional component comprising one of the torque component, the brake component, the power component and the perception component; the first backup controller being connected with the first functional component; the second backup controller being connected with the second functional component;

[0020] The redundancy control method comprises:

[0021] determining the first backup controller in the plurality of controllers, the first backup controller being configured to control the first functional component when the first main controller loses the control capability of the first functional component;

[0022] determining the second backup controller in the plurality of controllers, the second backup controller being configured to control the second functional component when the first main controller loses the control capability of the second functional component.

[0023] In a possible implementation manner of the second aspect, the determining the first backup controller in the plurality of controllers comprises: determining the first backup controller in the plurality of controllers based on a matching degree of the controller and the first functional component; and the matching degree of the controller and the first functional component is related to at least one of a resource matching degree of the controller and the first functional component, a security level matching degree of the controller and the first functional component, a communication interface of the controller, and a communication link association degree of the controller and the first functional component.

[0024] In a possible implementation manner of the second aspect, the matching degree of the same controller and the first functional component is variable.

[0025] In a possible implementation of the second aspect, the configuration data table is generated based on the functional attribute of the functional component and the attribute of the controller, and the configuration data table is used to represent deployment information of the backup controller for controlling the functional component.

[0026] In a possible implementation of the second aspect, the redundancy control method further includes: including a first controller in the plurality of controllers, and updating the first controller as the current first backup controller when the matching degree between the first controller and the first functional component is greater than the matching degree between the current first backup controller and the first functional component.

[0027] In a third aspect, an embodiment of the present application provides a device, including a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to execute the method provided in the second aspect.

[0028] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, including a stored program, wherein when the program is running, the device where the computer readable storage medium is located is controlled to execute the method provided in the second aspect.

[0029] In a fifth aspect, an embodiment of the present application provides a vehicle, which is configured with the redundancy control system provided in the first aspect.

[0030] The redundancy control method provided in the embodiments of the present application can distribute the control function of the first functional component and the control function of the second functional component of the first main controller to the first backup controller and the second backup controller, thereby reducing the resource requirement of the redundancy backup for each backup controller, and facilitating the reduction of the cost of the vehicle control system. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0032] FIG. 1 is a schematic diagram of a redundancy control system provided in an embodiment of the present application;

[0033] FIG. 2 is a schematic diagram of a vehicle electronic appliance;

[0034] FIG. 3 is a schematic diagram of a redundancy control system provided in an embodiment of the present application;

[0035] Fig. 4 is a schematic diagram of a redundancy control system according to an embodiment of the present application;

[0036] Fig. 5 is a schematic diagram of a redundancy control system according to an embodiment of the present application;

[0037] Fig. 6 is a schematic diagram of a redundancy control system according to an embodiment of the present application;

[0038] Fig. 7 is a schematic diagram of a redundancy control system according to an embodiment of the present application;

[0039] Fig. 8 is a schematic diagram of a redundancy control system according to an embodiment of the present application;

[0040] Fig. 9 is a schematic diagram of a redundancy control system according to an embodiment of the present application;

[0041] Fig. 10a is a schematic diagram of a vehicle electronic device;

[0042] Fig. 10b is a schematic diagram of a redundancy backup of Fig. 10a according to an embodiment of the present application;

[0043] Fig. 11 is a schematic diagram of a redundancy control system according to an embodiment of the present application;

[0044] Fig. 12 is a schematic diagram of an interaction between a first master controller and a first backup controller according to an embodiment of the present application;

[0045] Fig. 13 is a schematic diagram of an interaction between a first master controller and a first backup controller according to an embodiment of the present application;

[0046] Fig. 14 is a schematic diagram of an interaction between a first master controller and a first backup controller according to an embodiment of the present application;

[0047] Fig. 15 is a schematic diagram of an interaction between a first master controller and a first backup controller according to an embodiment of the present application;

[0048] Fig. 16 is a flowchart of a redundancy control method according to an embodiment of the present application.

[0049] Fig. 17 is a schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to better understand the technical solutions of the present application, the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0051] It should be clear that the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0052] The terminology used in the embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the description of the embodiments of the present application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0053] It should be understood that the term "and / or" used herein is merely an association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects.

[0054] Before the embodiments of the present application are specifically introduced, the terms applied or possibly applied to the embodiments of the present application are first explained.

[0055] In order to ensure the driving safety of the vehicle, it is necessary to redundantly back up the master control system of the vehicle, so as to ensure that the redundant backup system can take over the control of the vehicle by the master control system when the master control system fails, thereby ensuring the driving safety of the vehicle.

[0056] In order to realize the redundant backup of the master control system of the vehicle, the technical personnel and researchers have made a lot of efforts. For example, by adding the same domain controller on the electronic and electrical architecture for redundant backup, or relying on the existing vehicle electronic and electrical architecture, directly using the first regional controller to backup the second regional controller. However, no matter which way, the implementation of the redundant backup has disadvantages: among them, the first way has the problem of high cost of adding backup controller, but it is difficult to avoid common cause failure; the redundant backup in the second way has high requirements for the calculation and storage resources of the backup controller in the implementation process, which also increases the cost of the second regional controller. In addition, the technical personnel and researchers consider that the master controller meets certain failure conditions, for example, communication loss, and the redundant backup system takes over, but they do not consider the case where the master controller recovers during the takeover process of the redundant backup system, thereby causing bus conflict and other risks during the process of the master control system recovering the takeover function.

[0057] In summary, the redundant backup of the existing vehicle master control system is actually a backup of the domain controller, which is a whole backup of the entire master control system, and the backup granularity is the system. This results in that the resources occupied by the backup are relatively concentrated, and the storage requirement of the redundant backup is high.

[0058] Therefore, the present application provides a redundant control system, method, device, storage medium and vehicle to improve the problem that the resources occupied by the backup are relatively concentrated and the backup cost is high in the redundant control process.

[0059] As shown in FIG. 1, the application provides a redundancy control system 100, comprising a first main controller 101, a first backup controller 102 and a second backup controller 103. The first main controller 101 is configured to control a first functional component 104 and a second functional component 105. The first functional component 104 comprises one of a torque component, a brake component, a power component and a sensing component, and the second functional component 105 comprises one of a torque component, a brake component, a power component and a sensing component. The first functional component 104 is different from the second functional component 105.

[0060] In a possible implementation, the torque component comprises all components on a torque chain, such as a working machine, a transmission shaft, a differential and a wheel, etc. The working machine refers to a device for providing driving power for a vehicle, such as an engine for a fuel vehicle, an electric machine for a new energy electric vehicle, and an engine and an electric machine for a hybrid vehicle.

[0061] In a possible implementation, the brake component comprises a brake pedal and a brake.

[0062] In a possible implementation, the power component comprises a power source and a power-on / off management component. In a new energy electric vehicle or a hybrid vehicle, the power source comprises a power source and an auxiliary power source. The power source provides power for the working machine, and the auxiliary power source provides power for the vehicle management system. For example, the power source is a high-voltage power source, and the auxiliary power source is a 12V power source.

[0063] In a possible implementation, the sensing component comprises a camera and / or a radar.

[0064] It should be noted that the above functional components are only exemplary, and the functional components can also be other functional components. For example, the first functional component comprises one of a gear management component, a vehicle mode management component, a steering component, an information processing component and a communication component. The second functional component comprises one of a gear management component, a vehicle mode management component, a steering component, an information processing component and a communication component.

[0065] In a possible implementation, the first main controller 101 has a first control function and a second control function. The first control function refers to the control function of the first functional component 104, and the second control function refers to the control function of the second functional component 105. The first control function and the second control function are different functions. For example, the first main controller can be a domain controller, or the first main controller can be a central computing unit.

[0066] The first backup controller 102 is connected with the first functional component 104. The second backup controller 103 is connected with the second functional component 105.

[0067] In a possible implementation, the first backup controller 102 is communicatively connected with the first functional component 104, for example, a wired communication connection, such as communication connection through at least one of a CAN bus and an Ethernet cable. The second backup controller 103 is communicatively connected with the second functional component 105, for example, a wired communication connection, such as communication connection through at least one of a CAN bus and an Ethernet cable.

[0068] In a possible implementation, the first backup controller 102 and the second backup controller 103 are different controllers. The first backup controller 102 and the second backup controller 103 can be based on an existing electronic and electrical architecture of a vehicle. As shown in FIG. 2, the electronic and electrical architecture of the vehicle includes a central computing unit, a plurality of regional gateways, and a plurality of controllers. The first main controller 101 can be the central computing unit, and the first backup controller 102 and the second backup controller 103 can be the regional gateways or the controllers under the regional gateways.

[0069] In a possible implementation, the first backup controller is configured to store a redundant backup of a first control function, and the second backup controller is configured to store a redundant backup of a second control function. The first backup controller can actively perform the redundant backup of the first control function and store the redundant backup in the first backup controller, that is, the first backup controller acquires the first control function from the first main controller or the upper machine, and copies and stores the first control function in the first backup controller. Alternatively, the upper machine or the first main controller can copy the first control function and then store the redundant backup of the first control function in the first backup controller. The second backup controller can actively perform the redundant backup of the second control function and store the redundant backup in the second backup controller, that is, the second backup controller acquires the second control function from the first main controller or the upper machine, and copies and stores the second control function in the second backup controller. Alternatively, the upper machine or the first main controller can copy the second control function and then store the redundant backup of the second control function in the second backup controller. Therefore, the embodiment of the application performs the backup in the granularity of the function for the redundant backup of the vehicle control system, rather than performing the redundant backup in the granularity of the controller for the first main controller.

[0070] When the first main controller loses the control capability of the first functional component, the first backup controller controls the first functional component. When the first main controller loses the control capability of the second functional component, the second backup controller controls the second functional component.

[0071] In a possible implementation, the first master controller can lose the control ability over the first functional component due to a failure. The first master controller can actively lose the control ability over the first functional component, for example, when the first master controller monitors that the current condition is insufficient to support it to complete the first control function, for example, the first master controller determines whether the first master controller can achieve the first control function by monitoring the message or state value generated by itself for representing the control state of the first functional component.

[0072] In the embodiment of the present application, the function-based redundant backup is implemented, and the redundant backup of a single function can be implemented by a backup controller, and the backup controller can be a regional gateway or a controller in the existing electronic and electrical architecture of the vehicle. Therefore, the redundant control system provided in the embodiment of the present application can utilize the idle resources of multiple vehicle-mounted controllers to cooperatively redundantly backup the driving function of the master controller, thereby effectively improving the utilization rate of the regional gateway or the controller in the electronic and electrical architecture of the vehicle and saving the cost of function redundant backup.

[0073] In an embodiment of the present application, the first master controller controls the first functional component through a first link, and the first link includes the first backup controller.

[0074] The first link can be a communication link between the first master controller and the first functional component. The first link includes the first backup controller, that is, the first backup controller is located on the first link. The first backup controller is located on the first link, and the first backup controller can control the first functional component through the first link, thereby reducing the implementation difficulty of the first backup controller when taking over the control right of the first functional component and saving the cost.

[0075] In an embodiment of the present application, the first master controller controls the second functional component through a second link, and the second link includes the second backup controller.

[0076] The second link can be a communication link between the first master controller and the second functional component. The second link includes the second backup controller, that is, the second backup controller is located on the first link. The second backup controller is located on the second link, and the second backup controller can control the second functional component through the second link, thereby reducing the implementation difficulty of the second backup controller when taking over the control right of the second functional component and saving the cost.

[0077] As shown in FIG. 3 or FIG. 4, in an embodiment of the present application, the redundant backup system further includes a third backup controller 106, and the third backup controller 106 is connected with the first functional component 104.

[0078] In a possible implementation of the embodiment, the third backup controller 106 is configured to store the backup of the control function of the first controller, that is, the control function of the first functional component 104 is at least doubly redundantly backed up.

[0079] In the implementation, when the first main controller 101 loses the control ability over the first functional component 104, the first backup controller 102 is preferentially selected to control the first functional component 104, and when the first backup controller 102 also loses the control ability over the first functional component 104 (at this time, the first main controller also loses the control ability over the first functional component 104), the third backup controller 106 controls the first functional component 104.

[0080] It should be noted that the two backup controllers can be determined based on the matching degree with the first functional component 104 in the plurality of controllers, and the first backup controller 102 and the third backup controller 106 can be randomly determined or determined based on the matching degree with the first functional component 104 in the two backup controllers. For example, the random determination means that, in the two backup controllers, any one is the first backup controller 102, and the other is the third backup controller 106. The determination based on the matching degree with the first functional component 104 means that, in the two backup controllers, the one with the higher matching degree with the first functional component 104 is the first backup controller 102, and the one with the lower matching degree with the first functional component 104 is the third backup controller 106.

[0081] In the implementation, the control of the first functional component 104 is at least doubly redundantly backed up, which can increase the driving safety factor.

[0082] In a possible implementation of the embodiment, the first functional component 104 includes a first sub-functional component 1041 and a second sub-functional component 1042. The first backup controller 102 is connected with the first sub-functional component 1041. The third backup controller 106 is connected with the second sub-functional component 1042.

[0083] The first main controller 101 controls the first functional component 104, including that the first main controller 101 controls the first sub-functional component 1041 and the first main controller 101 controls the second sub-functional component 1042. The first backup controller 102 is connected with the first functional component 104, including that the first backup controller 102 is electrically connected with the first sub-functional component 1041. The first control function includes a first sub-control function and a second sub-control function, wherein the first sub-control function refers to the control function of the first main controller 101 to the first sub-functional component 1041, and the second sub-control function refers to the control function of the first main controller 101 to the second sub-functional component 1042. The first backup controller 102 is configured to store a redundant backup of the first sub-control function, and the second backup controller 103 is configured to store a redundant backup of the second sub-control function. Therefore, in the redundant control system provided in the implementation mode, the redundant backup is realized in the granularity of the sub-control function, so as to further reduce the hardware resource requirement of the backup controller in the redundant backup process and further reduce the cost.

[0084] In an implementation mode of the embodiment, when the first main controller 101 loses the control ability to the first functional component 104, the first backup controller 102 controls the first functional component 104, including that:

[0085] When the first main controller 101 loses the control ability to the first functional component 104, the first backup controller 102 controls the first sub-functional component 1041, and the third backup controller 106 controls the second sub-functional component 1042.

[0086] In the implementation mode, the first main controller 101 loses the control ability to at least one of the first sub-functional component 1041 and the second sub-functional component 1042, which means that the first main controller 101 loses the control ability to the first functional component 104.

[0087] For example, when the first main controller 101 loses the control ability to the first functional component 104, the first backup controller 102 controls the first sub-functional component 1041, and the third backup controller 106 controls the second sub-functional component 1042, including that:

[0088] When the first main controller 101 loses the control ability to the first sub-functional component 1041 or loses the control ability to the second sub-functional component 1042, the first backup controller 102 controls the first sub-functional component 1041, and the third backup controller 106 controls the second sub-functional component 1042.

[0089] In the present implementation, when the first main controller 101 loses the control ability over either of the first sub-function component 1041 and the second sub-function component 1042, the first backup controller 102 controls the first sub-function component 1041 and the third backup controller 106 controls the second sub-function component 1042. This design can effectively avoid the ping-pong effect caused by the first main controller 101 losing the control ability over the first sub-function component 1041 and the unstable control ability over the second sub-function component 1042.

[0090] In one implementation of the present embodiment, when the first main controller 101 loses the control ability over the first function component 104, the first backup controller 102 controls the first function component 104, which includes:

[0091] When the first main controller 101 loses the control ability over the first sub-function component 1041, the first backup controller 102 controls the first sub-function component 1041; when the first main controller 101 loses the control ability over the second sub-function component 1042, the third backup controller 106 controls the second sub-function component 1042.

[0092] In the present implementation, the redundancy backup is implemented in the granularity of sub-control function. When the first main controller 101 loses the control ability over the sub-function component, the corresponding backup controller controls the sub-function component, which can further reduce the hardware requirements of the controller required for the redundancy backup and further save the cost.

[0093] As shown in FIG. 5 or FIG. 6, in one embodiment of the present application, the redundancy backup system further includes a fourth backup controller 107, and the fourth backup controller 107 is connected with the second function component 105.

[0094] In one possible implementation of the present embodiment, the fourth backup controller 107 is configured to store the backup of the second control function, that is, the control function of the second function component 105 is at least doubly redundantly backed up in the present embodiment.

[0095] In the present implementation, when the first main controller 101 loses the control ability over the second function component 105, the second backup controller 103 is preferentially selected to control the second function component 105, and when the second backup controller 103 also loses the control ability over the second function component 105 (at this time, the first main controller also loses the control ability over the first function component 104), the fourth backup controller 107 controls the second function component 105.

[0096] It should be noted that two backup controllers can be confirmed based on the matching degree with the second functional component 105 in the plurality of controllers, and the confirmation of the second backup controller 103 and the fourth backup controller 107 in the two backup controllers can be random or based on the matching degree with the second functional component 105. For example, the random confirmation means that, in the two backup controllers, any one is the second backup controller 103 and the other is the fourth backup controller 107. The matching degree based on the second functional component 105 means that, in the two backup controllers, the one with a high matching degree with the second functional component 105 is the second backup controller 103, and the one with a low matching degree with the second functional component 105 is the fourth backup controller 107.

[0097] In the present implementation, at least dual redundant backup of the control of the second functional component 105 can increase the driving safety factor.

[0098] In a possible implementation of the present embodiment, the second functional component 105 includes a third sub-functional component 1051 and a fourth sub-functional component 1052. The second backup controller 103 is connected with the third sub-functional component 1051. The fourth backup controller 107 is connected with the fourth sub-functional component 1052.

[0099] The control of the second functional component 105 by the first main controller 101 includes the control of the third sub-functional component 1051 by the first main controller 101 and the control of the fourth sub-functional component 1052 by the first main controller 101. The connection of the second backup controller 103 with the second functional component 105 includes the electrical connection of the second backup controller 103 with the third sub-functional component 1051.

[0100] In a possible implementation of the present embodiment, the second functional component 105 includes a third sub-functional component 1051 and a fourth sub-functional component 1052, and the second control function includes a third sub-control function and a fourth sub-control function, wherein the third sub-control function refers to the control function of the first main controller 101 on the third sub-functional component 1051, and the fourth sub-control function refers to the control function of the first main controller 101 on the fourth sub-functional component 1052.

[0101] In an implementation of the present embodiment, when the first main controller 101 loses the control ability of the second functional component 105, the control of the second functional component 105 by the second backup controller 103 includes:

[0102] When the first main controller 101 loses the control ability of the third sub-function component 1051, the second backup controller 103 controls the third sub-function component 1051; when the first main controller 101 loses the control ability of the fourth sub-function component 1052, the fourth backup controller 107 controls the fourth sub-function component 1052.

[0103] In an implementation manner of the embodiment of the application, when the first main controller 101 loses the control ability of the second function component 105, the second backup controller 103 controls the second function component 105, including:

[0104] When the first main controller 101 loses the control ability of the third sub-function component 1051 or the fourth sub-function component 1052, the second backup controller 103 controls the third sub-function component 1051, and the fourth backup controller 107 controls the fourth sub-function component 1052.

[0105] In the implementation manner, when the first main controller 101 loses the control ability of any one of the first sub-function component 1041 and the second sub-function component 1042, the first backup controller 102 controls the first sub-function component 1041, and the third backup controller 106 controls the second sub-function component 1042. This design can effectively avoid the ping-pong effect caused by the instability of the control ability of the first main controller 101 to the second sub-function component 1042.

[0106] In the embodiment of the application, as shown in FIG. 3 or FIG. 4, the redundant control system includes the third backup controller 106, as shown in FIG. 5 or FIG. 6, the redundant control system includes the fourth backup controller 107, and as shown in FIG. 7, the redundant control system 100 includes both the third backup controller 106 and the fourth backup controller 107.

[0107] In an embodiment of the application, the redundant control system includes a first controller and a second controller. In a first time period, the first controller is a first backup controller. In a second time period, the second controller is the first backup controller.

[0108] In an embodiment of the application, in a first time period, the first controller is a first backup controller. In a second time period, the second controller is the first backup controller. That is, the first backup controller can be changed in different time periods. This mechanism that the first backup controller can be changed can increase the flexibility of the redundant backup, thereby achieving better adaptation of the controller and the redundant backup.

[0109] As shown in FIG. 8, in an embodiment of the present application, the first main controller 101 is further configured to control a third functional component 108. The third functional component 108 comprises one of a torque component, a brake component, a power component, and a sensing component. The first backup controller 102 is further connected to the third functional component 108, and when the first main controller 101 loses control of the third functional component 108, the first backup controller 102 controls the third functional component 108.

[0110] In the embodiment, the first main controller 101 has a third control function, and the first control function refers to the control function of the first main controller 101 on the third functional component 108. The first backup controller 102 is further configured to store a redundant backup of the third control function. Therefore, based on the hardware conditions (e.g., free resources, security level, etc.) of the regional gateway and the controllers connected thereto, the redundant backup of multiple control functions can be stored in the same regional gateway or controller, i.e., the redundant backup of multiple functions can be stored in the same controller.

[0111] In an embodiment of the present application, the second backup controller is further connected to the third functional component, and when the first main controller loses control of the third functional component, the second backup controller controls the third functional component.

[0112] In the embodiment, the first main controller has a third control function, and the first control function refers to the control function of the first main controller on the third functional component. The second backup controller is further configured to store a redundant backup of the third control function. Therefore, based on the hardware conditions (e.g., free resources, security level, etc.) of the regional gateway and the controllers connected thereto, the redundant backup of multiple control functions can be stored in the same regional gateway or controller, i.e., the redundant backup of multiple functions can be stored in the same controller.

[0113] As shown in FIG. 9, in an embodiment of the present application, the redundant control system 100 further comprises a second main controller 109, a fifth backup controller 110, and a sixth backup controller 111. The second main controller 109 is configured to control a fourth functional component 112 and a fifth functional component 113. The fifth backup controller 110 is connected to the fourth functional component 112, and the sixth backup controller 111 is connected to the fifth functional component 113. When the second main controller 109 loses control of the fourth functional component 112, the fifth backup controller 110 controls the fourth functional component 112. When the second main controller 109 loses control of the fifth functional component 113, the sixth backup controller 111 controls the fifth functional component 113.

[0114] In the embodiment, the first master controller 101 and the second master controller 109 control the functional components in different zones or domains, and the redundant backup of the control function corresponding to each functional component is located in the corresponding controller.

[0115] For example, as shown in FIG. 10a, the electronic and electrical architecture of the vehicle includes a first central computing unit, a second central computing unit, a first regional gateway, a second regional gateway, a third regional gateway, a fourth regional gateway, a first controller, a second controller, a third controller, and a fourth controller. The first central computing unit has a first control function, a second control function, a third control function, and a fourth control function, and the second central computing unit has a fifth control function and a sixth control function. The first control function is the control function of the first central computing unit on the first functional component, the second control function is the control function of the first central computing unit on the second functional component, the third control function is the control function of the first central computing unit on the third functional component, the fourth control function is the control function of the first central computing unit on the fourth functional component, the fifth control function is the control function of the second central computing unit on the fifth functional component, and the sixth control function is the control function of the second central computing unit on the sixth functional component. One of the first central computing unit and the second central computing unit is a first master controller, and the other is a second master controller. The first backup controller can be one of the first regional gateway, the second regional gateway, the third regional gateway, the fourth regional gateway, the first controller, the second controller, the third controller, and the fourth controller, and the second backup controller can be one of the first regional gateway, the second regional gateway, the third regional gateway, the fourth regional gateway, the first controller, the second controller, the third controller, and the fourth controller. As shown in FIG. 10b, the redundant backup of the first control function and the second control function is deployed in the second regional gateway, the redundant backup of the third control function is deployed in the first regional gateway, and the redundant backup of the fourth control function is deployed in the third regional gateway.

[0116] As shown in FIG. 11, the first master controller is a vehicle domain controller. The vehicle domain controller has a torque control function, a hibernation wake-up function, a high-voltage power-on and power-off function, a vehicle mode control function, and a gear control function, etc. The torque control function is used to control the torque components in the torque chain, the high-voltage power-on and power-off function is used to control the power-on and power-off of the power battery, and the gear control function is used to control the gear. The vehicle domain controller VDC is in the same network segment as the first regional gateway, the battery controller BMS, the motor controller MCU, and the direct-current transformer DCDC.

[0117] Taking the torque chain function as an example, the first regional gateway, the battery controller BMS, and the motor controller MCU all meet the basic conditions, wherein the motor controller MCU is an actuator of torque control and belongs to the downstream of the torque chain function, and the function deployment matching coefficient is higher. If the torque chain function is deployed in the MCU, the torque control delay can be reduced to a certain extent, and therefore the torque chain function is inclined to be deployed in the MCU, and the first regional gateway is the second.

[0118] For the hibernation wake-up function, since the first regional gateway originally bears part of the hibernation wake-up function, the hibernation wake-up function is preferentially deployed in the first regional gateway.

[0119] The backup of the functions such as power-on and power-off and vehicle mode is deployed in the first regional gateway, and the backup of the gear control function is deployed in the second regional gateway.

[0120] As shown in FIG. 12, in an embodiment of the present application, when the first main controller loses the control ability of the first functional component, the first backup controller controls the first functional component, including:

[0121] The first backup controller monitors the control ability of the first main controller to the first functional component, and when the first backup controller monitors that the first main controller loses the control ability of the first functional component, the first backup controller controls the first functional component.

[0122] The first main controller will periodically output information representing the control state of the functional component (the first functional component or the second functional component) to the outside, and the state information can be sent to the corresponding backup controller. Alternatively, the state information can be sent to the CAN bus, and then the corresponding backup controller obtains the state information from the CAN bus.

[0123] For example, the first main controller in the embodiment periodically outputs first information representing the control state of the first main controller to the first functional component to the outside, for the first backup controller to obtain. The first backup controller determines whether the first main controller loses the control ability of the first functional component based on the received first information, and when the first main controller loses the control of the first functional component, the first backup controller controls the first functional component.

[0124] In a possible implementation manner of the embodiment, the first information is valid representation information, and the valid representation information indicates that the control ability of the first main controller to the first functional component is valid. At this time, if the first backup controller does not obtain the first information, it indicates that the first main controller loses the control ability of the first functional component.

[0125] In a possible implementation of the embodiment, the first information includes valid representation information and invalid representation information. The invalid representation information indicates that the first master controller has no control capability over the first functional component, i.e., loses the control capability over the first functional component. When the first backup controller obtains the valid representation information, it indicates that the first master controller has the control capability over the first functional component, and when the first backup controller obtains the invalid representation information, it indicates that the first master controller has no control capability over the first functional component, i.e., the first master controller loses the control capability over the first functional component.

[0126] In a possible implementation of the embodiment, the first information includes a first target message. The first backup controller monitoring the control capability of the first master controller over the first functional component includes: the first backup controller monitoring the first target message output by the first master controller, the first target message being used to represent the control capability of the first master controller over the first functional component. If the monitoring result of the first backup controller on the first target message meets a first preset condition, the first master controller loses the control capability over the first functional component.

[0127] Taking the first target message as the valid representation information, the first preset condition includes: no first target message is detected within a preset time length.

[0128] As shown in FIG. 13, in an embodiment of the present application, when the first master controller loses the control capability over the first functional component, the control of the first functional component by the first backup controller includes:

[0129] The first master controller confirms its control capability over the first functional component through self-monitoring. That is, the first master controller monitors the control capability of the first master controller over the first functional component, for example, through a flag bit or through monitoring the execution result fed back by the first functional component. When the first master controller monitors that the first master controller loses the control capability over the first functional component, the first master controller sends first takeover information to the first backup controller, and the first backup controller takes over the control of the first functional component after receiving the first takeover information. The first takeover information is used to instruct the first backup controller to start exercising the control right over the first functional component, or the first takeover information is used to represent that the first master controller loses the control capability over the first functional component.

[0130] In an embodiment of the present application, when the first master controller loses the control capability over the first sub-functional component or loses the control capability over the second sub-functional component, the control of the first sub-functional component by the first backup controller and the control of the second sub-functional component by the third backup controller include:

[0131] The first backup controller monitors whether the first master controller loses control ability over the first sub-function component, and the third backup controller monitors whether the first master controller loses control ability over the second sub-function component. When the first backup controller monitors that the first master controller loses control ability over the first sub-function component or the third backup controller monitors that the first master controller loses control ability over the second sub-function component, the first backup controller controls the first sub-function component, and the third backup controller controls the second sub-function component.

[0132] The first backup controller monitors whether the first master controller loses control ability over the first sub-function component, and the third backup controller monitors whether the first master controller loses control ability over the second sub-function component. When the first backup controller monitors that the first master controller loses control ability over the first sub-function component or the third backup controller monitors that the first master controller loses control ability over the second sub-function component, the first backup controller controls the first sub-function component, and the third backup controller controls the second sub-function component.

[0133] In a possible implementation, the first sub-information is valid representation information, that is, the first sub-information indicates that the first master controller has control ability over the first sub-function component. For example, the first sub-information is a first sub-target message. When the first sub-information meets a first sub-preset condition, the first master controller loses control over the first sub-function component. The first sub-preset condition is that the first sub-information is not received within a preset time length.

[0134] In a possible implementation, the first sub-information is valid representation information or invalid representation information. When the first sub-information is valid representation information, it indicates that the first master controller has control ability over the first sub-function component. When the first sub-information is invalid representation information, it indicates that the first master controller loses control ability over the first sub-function component.

[0135] The implementation process of the third backup controller monitoring whether the first master controller loses control ability over the second sub-function component can refer to the implementation process of the first backup controller monitoring whether the first master controller loses control ability over the first sub-function component in the foregoing embodiments, which is not described herein.

[0136] In an embodiment of the present application, when the first master controller loses control ability over the first sub-function component or loses control ability over the second sub-function component, the first backup controller controls the first sub-function component, and the third backup controller controls the second sub-function component, including:

[0137] The first main controller monitors the control ability of the first main controller to the first sub-function component and to the second sub-function component. When the first main controller monitors that the first main controller loses the control ability to the first sub-function component or monitors that the first main controller loses the control ability to the second sub-function component, the first main controller sends takeover information to the first backup controller and the second backup controller respectively, the first backup controller receives the takeover information and takes over the control of the first sub-function component, and the third backup controller receives the takeover information and takes over the control of the second sub-function component.

[0138] In an embodiment of the present application, when the first main controller loses the control ability to the second function component, the implementation process of the second backup controller to control the second function component can refer to the implementation process of the first backup controller to control the first function component when the first main controller loses the control ability to the first function component in the foregoing embodiment, which is not described herein.

[0139] In an embodiment of the present application, when the first main controller controls the first function component, the control state of the first backup controller to the first function component is in a silent state, and when the first backup controller is in the silent state, the first backup controller runs the redundant backup of the first control function but does not output the result externally.

[0140] When the first main controller controls the second function component, the control state of the second backup controller to the second function component is in a silent state, and when the second backup controller is in the silent state, the second backup controller runs the redundant backup of the second control function but does not output the result externally.

[0141] In the embodiment, when the control ability of the first main controller to the function component is valid, the backup controller is in a silent state, and the backup controller in the silent state keeps the running and calculation synchronized with the first main controller but does not output the result externally, so that the backup controller can timely, accurately and effectively exercise the control right to the function component when the backup controller takes over the function component.

[0142] In an embodiment of the present application, the redundant control system comprises a third backup controller and / or a fourth backup controller. The third backup controller can be the third backup controller in the previous embodiment or a controller that backs up other control functions (i.e., a controller that has control functions for other functional components, and when the first main controller loses control capability for the functional components, the third backup controller controls the functional components). The fourth controller can be the fourth backup controller in the previous embodiment or a controller that backs up other control functions (i.e., a controller that has control functions for other functional components, and when the first main controller loses control capability for the functional components, the fourth backup controller controls the functional components). When the first main controller controls the functional components corresponding to the third backup controller, the third backup controller runs the corresponding redundant backup but does not output externally. When the first main controller controls the functional components corresponding to the fourth backup controller, the fourth backup controller runs the corresponding redundant backup but does not output externally.

[0143] As shown in FIG. 10b, the first central computing unit has multiple key driving functions: a first control function, a second control function, a third control function, and a fourth control function. According to the functional safety level of the controller, the free resources, and other indicators, the key driving functions of the first central computing unit (i.e., the main controller) are dispersed and deployed to other controllers (backup controllers) according to a predetermined matching rule. When the first central computing unit is in a normal state, the backup controllers will calculate at the same time as the central computing unit, i.e., in a hot standby mode, but the calculation results of the backup controllers are not output externally. When the central computing unit fails completely, it will take over all key driving functions and output the corresponding calculation results to the communication bus. For example, in FIG. 10b, the redundant backup of the first control function and the second control function is deployed in the second regional gateway, the redundant backup of the third control function is deployed in the first regional gateway, and the redundant backup of the fourth control function is deployed in the third regional gateway. The first control function and the second control function of the first central computing unit fail, and the third control function and the fourth control function are normal, so the redundant backup of the third control function in the first regional gateway is in a silent state, and the redundant backup of the fourth control function in the third regional gateway is in a silent state, and the second regional gateway takes over the first control function and the second control function. That is, when the first central computing unit partially fails, the backup controller only takes over the failed key driving function, and the non-failed function is still executed by the central computing unit.

[0144] In an embodiment of the present application, the redundant control system further comprises: when the first main controller recovers control capability for the first functional component, the first main controller controls the first functional component. When the first main controller recovers control capability for the second functional component, the first main controller controls the second functional component.

[0145] When the first main controller recovers the control ability of the first function component, the first backup controller gives up the control of the first function component, and the first main controller controls the first function component again. When the first main controller recovers the control ability of the second function component, the second backup controller gives up the control of the second function component, and the first main controller controls the second function component again.

[0146] In this embodiment, the first main controller controls the first function component or the second function component again when the first main controller partially recovers the function. This design can relieve the computing pressure of the first backup controller or the second backup controller in time, and improve the service life of the first backup controller and the second backup controller.

[0147] In one embodiment of the present application, when the first main controller recovers the control ability of the first function and the first main controller recovers the control ability of the second function component, the first main controller controls the first function component, and the first main controller controls the second function component.

[0148] In this embodiment, the first main controller controls the first function component or the second function component again when the first main controller completely recovers the function. This design can effectively avoid the ping-pong effect between the first main controller and the backup controller caused by the instability of the first main controller.

[0149] In one embodiment of the present application, when the first main controller recovers the control ability of the first function component, the first main controller controls the first function component. Or when the first main controller recovers the control ability of the first function and the first main controller recovers the control ability of the second function component, the first main controller controls the first function component, and the first main controller controls the second function component.

[0150] As shown in FIG. 14, the first main controller controls the first function component includes that the first main controller confirms whether the first main controller recovers the control ability of the first function component through self-detection. When the first main controller recovers the control ability of the first function component, the first main controller controls the first function component.

[0151] After confirming that the first master controller restores the control ability over the first function component, the controlling the first function component by the first master controller comprises the step of: firstly confirming whether the first backup controller controls the first function component. If the first backup controller controls the first function component, the first master controller will firstly make the first backup controller give up the control ability over the first function component, i.e. the first backup controller does not control the first function component. After confirming that the first backup controller gives up the control ability over the first function component, the first master controller controls the first function component.

[0152] In the step of confirming whether the first master controller restores the control ability over the first function component by self-detecting, the first master controller confirms whether the first master controller restores the control ability over the first function component by detecting whether the first master controller sends a second target message, wherein the second target message is used to represent that the first master controller has the control ability over the first function component, and the first master controller restores the control ability over the first function component when the detection result of the first master controller on the second target message meets a second preset condition.

[0153] The first master controller detects whether the first master controller sends a second target message, wherein the second target message is used to represent that the first master controller has the control ability over the first function component, and the first master controller restores the control ability over the first function component when the detection result of the first master controller on the second target message meets a second preset condition.

[0154] In the step of confirming whether the first backup controller controls the first function component, the first master controller confirms whether the first backup controller controls the first function component by detecting whether the first backup controller sends a second information, wherein the second information is used to represent whether the first backup controller has the control ability over the first function component.

[0155] The first backup controller periodically sends a second information to the outside when the first master controller loses the control ability over the first function component, wherein the second information is used to represent whether the first backup controller has the control ability over the first function component.

[0156] The first master controller acquires the second information and confirms whether the first backup controller controls the first function component based on the second information. The specific implementation process of the step can be:

[0157] The first backup controller sends the second information to the CAN bus, and the first master controller acquires the second information from the CAN bus. Alternatively, in another possible implementation manner, the first master controller receives the second information sent by the first backup controller.

[0158] The first master controller confirms whether the first backup controller controls the first function component based on the second information, wherein the second information is valid representation information or invalid representation information, the first backup controller controls the first function component when the second information is the valid representation information, and the first backup controller does not control the first function component when the second information is the invalid representation information.

[0159] As shown in FIG. 14, in an implementation manner of the embodiment, the first master controller causing the first backup controller to give up the control capability of the first function component includes:

[0160] When the first master controller restores the control capability of the first function component, the first master controller periodically outputs recovery information to the outside;

[0161] After the first backup controller obtains the recovery information, the first backup controller gives up the control of the first function component, and the first backup controller outputs second information to the outside. At this time, the second information is invalid representation information.

[0162] In an implementation manner of the embodiment, the second information is valid representation information, for example, the second information is a third target message. When the first master controller restores the control capability of the first function component, the first backup controller gives up the control capability of the first function component, and the first master controller controls the first function component, including:

[0163] When the first master controller restores the control capability of the first function component, the first master controller detects whether there is a third target message output by the first backup controller, and the third target message is used to represent that the first backup controller is in a control state of the first function component.

[0164] When the first master controller does not detect the third target message, the first master controller controls the first function component.

[0165] As shown in FIG. 15, in an implementation manner of the embodiment, the first master controller causing the first backup controller to give up the control capability of the first function component includes:

[0166] When the first master controller restores the control capability of the first function component, the first master controller sends recovery information to the first backup controller. After the first backup controller receives the recovery information, the first backup controller actively gives up the control of the first function component, feeds back an execution result to the first master controller, and after the first master controller receives the feedback execution result, the first master controller controls the first function component.

[0167] When the first master controller restores the control capability of the first function component, the first backup controller gives up the control capability of the first function component, and the first master controller controls the first function component.

[0168] In an embodiment of the present application, the redundant control system further includes: the first master controller generates a configuration data table based on the function attribute of the function component and the attribute of the controller, the configuration data table is used to represent the deployment information of the backup controller controlling the function component, and the configuration data table is stored in the first master controller.

[0169] In the embodiment, the configuration data table can provide a reference basis for subsequent maintenance.

[0170] The implementation process of the second functional component controlled by the first master controller can refer to the implementation process of the first functional component controlled by the first master controller in the foregoing embodiments, which will not be described herein.

[0171] For example, the specific working process of the redundant backup system shown in FIG. 11 can be as follows:

[0172] When the vehicle domain controller works normally, the gear function module of the second regional gateway, the torque chain of the MCU, and the sleep wake-up and power-on / off management function module of the first regional gateway perform calculation at the same time, but the calculation results are not output externally, that is, the corresponding communication messages are not sent to the bus. When the vehicle domain controller completely fails, the controllers deployed by the redundant backup of each control function take over the control function, and the corresponding calculation results are output to the bus.

[0173] When the vehicle domain controller has partial function failure, such as gear failure, while the torque chain, power-on / off management function and the like are still normal, the second regional gateway will take over the gear function, while the torque chain, power-on / off management function and the like are still implemented by the vehicle domain controller.

[0174] After the first and second regional gateways and the MCU take over the vehicle controller function, if the function of the vehicle domain controller recovers to normal, it is necessary to identify whether the bus state is in the takeover state first. If it has been taken over, the vehicle domain controller does not send the related control message directly to avoid bus conflict and controller ping-pong effect caused by direct recovery of message sending. For example, a state identification signal is added between the vehicle domain controller and the corresponding regional gateway or MCU. When the regional gateway is in the function takeover state, a state signal of the currently taken over function is sent to the vehicle domain controller; when the function of the vehicle domain controller recovers to normal, a state signal of the function recovery of the vehicle domain controller is sent to the regional gateway. When the regional gateway or MCU receives the state signal of the function recovery of the vehicle domain controller, the takeover state is abandoned and the normal state is restored. When the vehicle domain controller and the regional gateway deploying the backup function are both in the normal state, the control system switches to the vehicle domain controller to enable the non-critical driving function of the vehicle and improve the driving comfort.

[0175] Therefore, by using the redundant control system provided in the embodiments of the present application, the key functions to be backed up can be dispersedly deployed on different components, so as to reduce the requirements for storage and calculation resources and the like of a single component. The specific deployment scheme is designed according to a preset rule, such as matching the functional safety level and resource requirement, and meets the minimization of new bus message transmission.

[0176] The embodiment of the present application further provides a redundancy control method, which is suitable for a redundancy control system including a first main controller and a plurality of controllers. The plurality of controllers include a first backup controller and a second backup controller. The first main controller is configured to control a first functional component and a second functional component. The first functional component includes one of a torque component, a brake component, a power component and a sensing component, and the second functional component includes one of the torque component, the brake component, the power component and the sensing component. The first backup controller is connected with the first functional component. The second backup controller is connected with the second functional component. The redundancy control method is suitable for redundancy backup of an upper computer to the redundancy control system. The redundancy control method includes the following steps:

[0177] In S100, the upper computer determines the first backup controller from the plurality of controllers.

[0178] The first backup controller is configured to control the first functional component when the first main controller loses the control ability over the first functional component.

[0179] In S200, the upper computer determines the second backup controller from the plurality of controllers.

[0180] The second backup controller is configured to control the second functional component when the first main controller loses the control ability over the second functional component.

[0181] It should be noted that the execution sequence of S100 and S200 has no priority, and the execution sequence can be S100→S200 as shown in FIG. 16, or S200→S100.

[0182] In a possible implementation, the first main controller has a first control function and a second control function. The first control function refers to the control function of the first main controller over the first functional component, and the second control function refers to the control function of the first main controller over the second functional component. The upper computer selects one controller from the plurality of controllers as the first backup controller, and the first backup controller is configured to store the redundancy backup of the first control function. The upper computer selects one controller from the plurality of controllers as the second backup controller, and the second backup controller is configured to store the redundancy backup of the second control function.

[0183] In a possible implementation, the determination of the first backup controller from the plurality of controllers includes the following steps:

[0184] The first backup controller is determined from the plurality of controllers based on a matching degree of the controller and the first functional component. The matching degree of the controller and the first functional component is associated with at least one of a resource matching degree of the controller and the first functional component, a security level matching degree of the controller and the first functional component, a communication interface of the controller, and a communication link association degree of the controller and the first functional component. The resource matching degree of the controller and the first functional component refers to a matching degree of an idle resource of the controller and a resource occupied by the control function of the first functional component.

[0185] In a possible implementation, determining the second backup controller from the plurality of controllers comprises:

[0186] The second backup controller is determined from the plurality of controllers based on a matching degree of the controller and the second functional component. The matching degree of the controller and the second functional component is associated with at least one of a resource matching degree of the controller and the second functional component, a security level matching degree of the controller and the second functional component, a communication interface of the controller, and a communication link association degree of the controller and the second functional component. The resource matching degree of the controller and the second functional component refers to a matching degree of an idle resource of the controller and a resource occupied by the control function of the second functional component.

[0187] In a possible implementation, the matching degree of the same controller and the same functional component is variable. For example, the matching degree of the same controller and the first functional component is variable. Alternatively, the matching degree of the same controller and the second functional component is variable.

[0188] In an embodiment of the present application, the redundancy control method further comprises: S300, the host computer generates a configuration data table based on the functional attribute of the functional component and the attribute of the controller, and the configuration data table is used to represent deployment information of the backup controller for controlling the functional component.

[0189] In this embodiment, when performing later maintenance or updating, the corresponding relationship between the functional component and the backup controller can be obtained based on the configuration data table, so that it is known that the redundancy backup of the control function of the functional component A is located in which controller.

[0190] In a possible implementation, the redundancy control method further comprises: S400, after the host computer generates the configuration data table, the host computer stores the configuration data table in the first master controller.

[0191] In order to improve the adaptability, the vehicle control system needs to be updated. When the vehicle control system is updated, the current first backup controller is not necessarily the most matched one with the first functional component. Therefore, the redundancy control method can further comprise:

[0192] When the matching degree of the target function component in the plurality of controllers is greater than the backup controller currently corresponding to the target function, the controller with the greatest matching degree of the target function component in the plurality of controllers is updated to the backup controller currently corresponding to the target function. The target function component can be any one of the first function component, the second function component, the third function component, the first sub-function component, the second sub-function component, the third sub-function component, and the fourth sub-function component.

[0193] For example, the plurality of controllers include the first controller, and when the matching degree of the first controller and the first function component is greater than the matching degree of the current first backup controller and the first function component, the host computer updates the first controller to the current first backup controller.

[0194] In this embodiment, for example, when the host computer updates the vehicle control system, the first backup controller is determined again in the plurality of controllers, and when the matching degree of the first function component in the plurality of controllers is greater than the matching degree of the current first backup controller and the first function component, the controller is updated to the current first backup controller.

[0195] For example, the plurality of controllers include the third controller, and when the matching degree of the third controller and the second function component is greater than the matching degree of the current second backup controller and the second function component, the host computer updates the second controller to the current second backup controller.

[0196] The redundancy control method provided in the embodiments of the present application can flexibly backup the redundancy of the control function to a suitable controller. Thus, on the one hand, the resource utilization rate of the regional gateway and the controller can be effectively increased, and on the other hand, the hardware cost of the redundancy backup can be saved.

[0197] As shown in FIG. 17, the embodiments of the present application further provide a device, which includes a processor 201, a memory 202, and a communication unit 203. These components communicate through one or more buses. Those skilled in the art can understand that the structure of the server shown in the figure does not constitute a limitation on the embodiments of the present application. It can be a bus structure or a star structure, and can include more or fewer components than shown in the figure, or combine some components or different components.

[0198] The communication unit 203 is configured to establish a communication channel, so that the storage device can communicate with other devices. The communication unit 203 receives user data sent by other devices or sends user data to other devices.

[0199] The processor 201, as the control center of the storage device, connects various parts of the entire electronic device by using various interfaces and lines, executes various functions of the electronic device and / or processes data by running or executing software programs and / or modules stored in the memory 202 and calling data stored in the memory. The processor can be composed of an integrated circuit (IC), for example, can be composed of a single packaged IC, or can be composed of multiple packaged ICs connected together. For example, the processor 201 can only include a central processing unit (CPU). In the embodiments of the present application, the CPU can be a single operation core or can include multiple operation cores.

[0200] The memory 202 is used to store the execution instructions of the processor 201. The memory 202 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0201] When the execution instructions in the memory 202 are executed by the processor 201, the embedded device 200 is enabled to execute part or all of the steps of the redundancy control method provided by the foregoing embodiments.

[0202] The embodiments of the present application provide a computer readable storage medium, which includes a stored program. When the program is running, the computer readable storage medium controls the device where the computer readable storage medium is located to execute part or all of the steps of the redundancy control method provided by any of the foregoing embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0203] Those skilled in the art can clearly understand that the redundancy control method in the embodiments of the present application can be realized by means of software and necessary general hardware platforms. Based on such understanding, the redundancy control method provided by the embodiments of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the method described in the various embodiments or some parts of the embodiments of the present application.

[0204] The application also provides a vehicle, which is configured with the redundancy control system provided by any one of the foregoing embodiments.

[0205] Based on the vehicle provided by the redundancy control system provided by the embodiments of the application, the redundancy backup of the driving function can be distributed in the regional gateway or the controller, thereby reducing the hardware cost of the redundancy backup and improving the resource utilization of the regional gateway or the controller.

[0206] The same or similar parts among the various embodiments in the specification can be referred to each other. Especially, for the device embodiments and the terminal embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the related parts can be referred to the description in the method embodiments.

Claims

1. A redundant control system, characterized by, Comprising: a first main controller for controlling a first functional component and a second functional component; the first functional component comprising one of a torque component, a brake component, a power component and a sensing component, the second functional component comprising one of a torque component, a brake component, a power component and a sensing component; a first backup controller connected to the first functional component; a second backup controller connected to the second functional component; when the first main controller loses the control ability of the first functional component, the first backup controller controls the first functional component; when the first main controller loses the control ability of the second functional component, the second backup controller controls the second functional component.

2. The redundant control system of claim 1, wherein, The first main controller controls the first functional component through a first link, the first link comprising the first backup controller; and / or The first main controller controls the second functional component through a second link, the second link comprising the second backup controller.

3. The redundant control system of claim 1, wherein, Further comprising a third backup controller, the third backup controller connected to the first functional component.

4. The redundant control system of claim 3, wherein, The first functional component comprises a first sub-functional component and a second sub-functional component; the first backup controller connected to the first sub-functional component; the third backup controller connected to the second sub-functional component.

5. The redundant control system of claim 4, wherein, The when the first main controller loses the control ability of the first functional component, the first backup controller controls the first functional component comprises: when the first main controller loses the control ability of the first functional component, the first backup controller controls the first sub-functional component, and the third backup controller controls the second sub-functional component.

6. The redundant control system of claim 1, wherein, Comprising: a first controller and a second controller, in a first time period, the first controller is the first backup controller; in a second time period, the second controller is the first backup controller.

7. The redundant control system of claim 1, wherein, The first main controller is further configured to control a third functional component, the third functional component comprising one of a torque component, a brake component, a power component and a sensing component; the first backup controller is further connected to the third functional component, when the first main controller loses the control of the third functional component, the first backup controller controls the third functional component; or the second backup controller is further connected to the third functional component, when the first main controller loses the control of the third functional component, the second backup controller controls the third functional component.

8. The redundant control system of claim 1, wherein, The when the first main controller loses the control ability of the first functional component, the first backup controller controls the first functional component comprises: The first backup controller monitors the control ability of the first main controller to the first functional component, when the first backup controller monitors that the first main controller loses the control ability of the first functional component, the first backup controller controls the first functional component.

9. The redundant control system of claim 8, wherein, The first backup controller monitoring the control ability of the first main controller to the first functional component comprises: the first backup controller monitoring a first target message output by the first main controller, the first target message being used to represent the control ability of the first main controller to the first functional component; if the monitoring result of the first backup controller to the first target message meets a first preset condition, the first main controller loses the control ability to the first functional component.

10. The redundant control system of claim 9, wherein, The first preset condition comprises: no first target message is detected within a preset time length.

11. The redundant control system of claim 1, wherein, Further comprising: When the first main controller restores the control ability to the first functional component, the first main controller controls the first functional component; When the first main controller restores the control ability to the second functional component, the first main controller controls the second functional component. When the first main controller restores the control ability to the first functional component and the first main controller restores the control ability to the second functional component, the first main controller controls the first functional component and the first main controller controls the second functional component.

12. The redundant control system of claim 1, wherein, The control of the first main controller to the first functional component comprises:

13. The redundant control system of claim 11 or 12, wherein, The first main controller detects whether the first main controller sends a second target message, the second target message being used to represent the control ability of the first main controller to the first functional component, when the detection result of the first main controller to the second target message meets a second preset condition, the first main controller restores the control ability to the first functional component; When the first main controller restores the control ability to the first functional component, the first backup controller gives up the control ability to the first functional component, and the first main controller controls the first functional component. When the first main controller restores the control ability to the first functional component, the first backup controller gives up the control ability to the first functional component, and the first main controller controls the first functional component comprises:

14. The redundant control system of claim 13, wherein, When the first main controller restores the control ability to the first functional component, the first main controller detects whether there is a third target message output by the first backup controller, the third target message being used to represent that the first backup controller is in the control state to the first functional component; When the first main controller does not detect the third target message, the first main controller controls the first functional component. The redundancy control method is suitable for a redundancy control system, 15. A redundancy control method characterized by, The redundancy control system comprises: a first main controller and a plurality of controllers; the plurality of controllers comprise a first backup controller and a second backup controller; The first main controller is used to control a first functional component and a second functional component; the first functional component comprises one of a torque component, a brake component, a power component and a sensing component, and the second functional component comprises one of a torque component, a brake component, a power component and a sensing component; ​ a first backup controller connected with the first functional component; a second backup controller connected with the second functional component; the redundancy control method comprises: determining the first backup controller from the plurality of controllers, the first backup controller being configured to control the first functional component when the first master controller loses the control ability over the first functional component; determining the second backup controller from the plurality of controllers, the second backup controller being configured to control the second functional component when the first master controller loses the control ability over the second functional component.

16. The redundancy control method according to claim 15, wherein the determining the first backup controller from the plurality of controllers comprises: determining the first backup controller from the plurality of controllers based on the matching degree of the controller with the first functional component, the matching degree of the controller with the first functional component being associated with at least one of the following: the matching degree of the controller with the resource of the first functional component, the matching degree of the controller with the security level of the first functional component, the communication interface of the controller, and the association degree of the communication link between the controller and the first functional component.

17. The redundancy control method of claim 15, wherein, the matching degree of the same controller with the first functional component is variable.

18. The redundancy control method of claim 15, wherein, generating a configuration data table based on the functional attribute of the functional component and the attribute of the controller, the configuration data table being configured to represent the deployment information of the backup controller for controlling the functional component.

19. The redundancy control method of claim 15, wherein, comprises: including the first controller in the plurality of controllers, and updating the first controller as the current first backup controller when the matching degree of the first controller with the first functional component is greater than the matching degree of the current first backup controller with the first functional component.

20. An apparatus, comprising: the device comprises a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to execute the method of any one of claims 15-19.

21. A computer-readable storage medium, characterized in that, the computer readable storage medium comprises a stored program, wherein when the program is running, the device where the computer readable storage medium is located is controlled to execute the method of any one of claims 15-19.

22. A vehicle characterized by the vehicle is configured with the redundancy control system of any one of claims 1-14.

Images