Summary of the invention
For the problem that the fault reaction time of correlation technique middle controller is long, not yet propose effective solution at present, for this reason, fundamental purpose of the present invention is to provide a kind of electric machine controller for vehicle and vehicle, to solve the problem.
To achieve these goals, according to an aspect of the present invention, provide a kind of electric machine controller for vehicle, this electric machine controller comprises: first processor, comprises the first sub-processor, the second sub-processor, comparer and power control unit; First CAN transceiver, is connected with the first sub-processor, and the first sub-processor sends the first request signal by the first CAN transceiver; Second CAN transceiver, is connected with the second sub-processor, and the second sub-processor sends the second request signal by the second CAN transceiver; First sub-processor is connected with the second CAN transceiver, for the first feedback signal of first signal that read back by the second CAN transceiver; Second sub-processor is connected with the first CAN transceiver, for the second feedback signal of secondary signal of being read back by the first CAN transceiver; Comparer is connected with the first sub-processor and the second sub-processor, for comparing the first feedback signal and the second feedback signal, obtains comparative result; Power control unit, is connected with comparer, and for the malfunction of the CAN according to comparative result determination electric machine controller, wherein, the first request signal is identical with the second request signal.
Further, power control unit comprises according to the malfunction of comparative result determination electric machine controller: when comparative result indicates the first feedback signal consistent with the second feedback signal, determine that the CAN of electric machine controller is normal; When comparative result indicates the first feedback signal and the second feedback signal is inconsistent, determine the CAN fault of electric machine controller, generate the detection signal detecting the first CAN transceiver and the first CAN transceiver whether fault successively.
Whether further, electric machine controller also comprises: SBC chip, and SBC chip is connected with first processor, for carrying out continual question and answer process to first processor, lost efficacy with the duty detecting first processor.
Further, electric machine controller also comprises: the second processor, is connected with first processor, for generating emergency treatment signal when first processor loses efficacy, load drive unit; Emergency treatment unit, is connected with the second processor by load drive unit, for carrying out emergency treatment to vehicle under the control of emergency treatment signal.
Further, electric machine controller also comprises: power array; First switch, is connected with the second processor, sensor group and power array respectively, under the control of the second processor, the output of power array is supplied to sensor group; Second processor is connected with sensor group, for the signal that receiving sensor group collects; First processor is connected with sensor group, for the signal that receiving sensor group collects.
Further, power array is also connected with the first CAN transceiver and the second CAN transceiver respectively, for powering for the first CAN transceiver and the second CAN transceiver.
Further, electric machine controller also comprises: perform feedback unit, be connected between motor load and the second processor, for the executing state of motor load is fed back to the second processor.
Further, electric machine controller also comprises: the second switch, be connected with first processor, the second processor, external control switch and SBC chip respectively, work is started under controlling in the enabling signal of external control switch, and the work of control SBC chip under the control of first processor and the second processor.
Further, electric machine controller also comprises: drive and position feedback unit, be connected between first processor and motor load, for the control signal drive motor load by passing through first processor, and the position of motor load is fed back to first processor, wherein, motor load is the load that safety is relevant.
To achieve these goals, according to a further aspect in the invention, provide a kind of vehicle, this vehicle comprises: for the electric machine controller of vehicle.
Pass through the above embodiment of the present invention, article two, CAN fault is monitored mutually, particularly, the data that MCU passage 1 sends are monitored by MCU passage 2 through outside line, the data that MCU passage 2 sends are monitored by MCU passage 1 through outside line, when transient fault occurs the inner arbitrary processor core of MCU1 (i.e. first processor) (i.e. the first sub-processor and the second sub-processor), because comparer double-core execution result compares, relatively itself is by hardware implementing (using comparer in the above-described embodiments), fault can be found very soon, improve fault reaction speed, controller system possesses the less fault tolerance time.By the above embodiment of the present invention, solve the problem of the fault reaction time length of prior art middle controller, achieve the effect of real time reaction controller failure.
Embodiment
It should be noted that, when not conflicting, the embodiment in the application and the feature in embodiment can combine mutually.Below with reference to the accompanying drawings and describe the present invention in detail in conjunction with the embodiments.
According to embodiments providing a kind of electric machine controller for vehicle, as shown in Figure 1, this electric machine controller can comprise: first processor 30, comprises the first sub-processor 301, second sub-processor 302, comparer 303 and power control unit 304; First CAN transceiver, is connected with the first sub-processor, and the first sub-processor sends the first request signal by the first CAN transceiver 40; Second CAN transceiver, is connected with the second sub-processor, and the second sub-processor sends the second request signal by the second CAN transceiver; First sub-processor is connected with the second CAN transceiver 41, for the first feedback signal of first signal that read back by the second CAN transceiver; Second sub-processor is connected with the first CAN transceiver, for the second feedback signal of secondary signal of being read back by the first CAN transceiver; Comparer is connected with the first sub-processor and the second sub-processor, for comparing the first feedback signal and the second feedback signal, obtains comparative result; Power control unit, is connected with comparer, and for the malfunction of the CAN according to comparative result determination electric machine controller, wherein, the first request signal is identical with the second request signal.
Wherein, CAN is controller local area network.
First processor in the above embodiment of the present invention can adopt double-core lock-step MCU (i.e. microprocessor) processor chips, first processor in above-described embodiment can comprise the first sub-processor and the second sub-processor, and two sub-processors outwards send data (or request) respectively by MCU passage 1 and MCU passage 2.Particularly, first processor is LOCKSTEP (double-core is asynchronous) processor.
Pass through the above embodiment of the present invention, article two, CAN fault is monitored mutually, particularly, the data that MCU passage 1 sends are monitored by MCU passage 2 through outside line, the data that MCU passage 2 sends are monitored by MCU passage 1 through outside line, when transient fault occurs the inner arbitrary processor core of MCU1 (i.e. first processor) (i.e. the first sub-processor and the second sub-processor), because comparer double-core execution result compares, relatively itself is by hardware implementing (using comparer in the above-described embodiments), fault can be found very soon, improve fault reaction speed, controller system possesses the less fault tolerance time.By the above embodiment of the present invention, solve the problem of the fault reaction time length of prior art middle controller, achieve the effect of real time reaction controller failure.
In the above embodiment of the present invention, because MCU1 (i.e. first processor) inside have employed dual processors back-up processing, simultaneously, CAN system also backups each other, when arbitrary place transient fault occurs, equal energy Timeliness coverage and process, therefore, the transient fault of the present invention program to CAN communication and MCU is insensitive.
Further, although the first processor of above-described embodiment have employed dual core processor chip, but the program run due to each core is identical, therefore traditional dual chip scheme is compared, the present invention realizes only needing familiar a processor, and software does not need to consider (hardware self can compare result) the transient fault of processor internal hardware, reduces software development difficulty.
Particularly, power control unit can comprise according to the malfunction of comparative result determination electric machine controller: when comparative result indicates the first feedback signal consistent with the second feedback signal, determine that the CAN of electric machine controller is normal; When comparative result indicates the first feedback signal and the second feedback signal is inconsistent, determine the CAN fault of electric machine controller, generate the detection signal detecting the first CAN transceiver and the first CAN transceiver whether fault successively.
Whether in the above embodiment of the present invention, electric machine controller can also comprise: SBC chip, and SBC chip is connected with first processor, for carrying out continual question and answer process to first processor, lost efficacy with the duty detecting first processor.
Wherein, SBC is system base chip.
Pass through above-described embodiment, the installation site of first processor is isomery, eliminate double-core to greatest extent with the common cause failure be integrated on a DIE (i.e. integrated circuit), simultaneously, because SBC chip carries out continuous question and answer process to MCU chip, reduce further the common cause failure of MCU clock and power supply, improve system reliability.
Particularly, electric machine controller can also comprise: the second processor, is connected with first processor, for generating emergency treatment signal when first processor loses efficacy; Load drive unit; Emergency treatment unit, is connected with the second processor by load drive unit, for carrying out emergency treatment to vehicle under the control of emergency treatment signal.
In above-mentioned implementing, because emergency treatment has been carried out in the inefficacy of the second processor MCU 2 couples of first processor MCU1, further increase controller secure and robustness, be applicable to security fields application.
According to the abovementioned embodiments of the present invention, electric machine controller can also comprise: power array; First switch, is connected with the second processor, sensor group and power array respectively, under the control of the second processor, the output of power array is supplied to sensor group; Second processor is connected with sensor group, for the signal that receiving sensor group collects; First processor is connected with sensor group, for the signal that receiving sensor group collects.
Particularly, power array is also connected with the first CAN transceiver and the second CAN transceiver respectively, for powering for the first CAN transceiver and the second CAN transceiver.
In the above embodiment of the present invention, electric machine controller also comprises: perform feedback unit, be connected between motor load and the second processor, for the executing state of motor load is fed back to the second processor.
Further, electric machine controller can also comprise: the second switch, be connected with first processor, the second processor, external control switch and SBC chip respectively, work is started under controlling in the enabling signal of external control switch, and the work of control SBC chip under the control of first processor and the second processor.
Further, electric machine controller can also comprise: drive and position feedback unit, be connected between first processor and motor load, for the control signal drive motor load by passing through first processor, and the position of motor load is fed back to first processor, wherein, motor load is the load that safety is relevant.
Owing to all having carried out fault diagnosis and feedback of status to performance element and load unit, to the monitoring degree that load faulty has had, carry out specific aim process accordingly, effectively reduce thrashing risk.
By the above embodiment of the present invention, shorten the fault tolerance time; Reduce because performance element feeds back the common cause failure directly feeding back to primary processor and bring, improve system reliability; Double protection is carried out to safe dependent failure, guarantees security of system; 24V and 12V system compatible designs; And reduce systemic software development difficulty.
Fig. 2 is a kind of optional structural representation for the electric machine controller of vehicle according to the embodiment of the present invention.As shown in Figure 2, this controller can comprise: power supply and protected location 10, sensor group 11, first CAN network 12, second CAN network 13, the motor load 14 that safety is relevant, the emergency treatment unit 15 that electric machine controller is real-time, power array 20, first switch SW1, second switch SW2, first processor 30, first sub-processor 301, second sub-processor 302, comparer 303, power control unit 304, second processor 31, first CAN transceiver 40, second CAN transceiver 41, CAN monitoring circuit 42, drive and position feedback unit 50, perform feedback unit 51, load drive unit 52.
Particularly, the technical scheme of the present invention of above-described embodiment is as shown in Fig. 2 dotted line frame, it is the base application environment of technical solution of the present invention beyond dotted line frame, wherein: Unit 14 are the motor load that safety is relevant, first switch SW1 receives the second processor 31 i.e. control of MCU2, and the output from power array 20 is supplied to sensor group 11; Power array 20 is the power supply of powering to CAN transceiver and sensor group; Second switch SW2 receives the input from power supply and protected location 10, and receives enabling signal, the first processor MCU130 of external control switch KEY, the control of the second processor 31.
Particularly, SBC chip 21 provides power supply and intelligent WDT for the second processor 31, and WD1 provides WDT for the second processor 31, and accept the second processor 31 play dog signal.
Wherein, the basic circuit that the first processor 30 in above-described embodiment forms for LOCKSTEP microprocessor chip, for realizing the control of safe related load motor, the second processor is the basic circuit of microprocessor chip composition; CAN monitoring circuit 42 is for realizing the monitoring to the second CAN transceiver.
In above-described embodiment, although there are two CAN network, CAN network can adopt same agreement, and the system of reducing realizes difficulty.
Particularly, the first above-mentioned switch SW1 can realize for adopting triode or the combination of field effect transistor basic circuit; Second switch SW2 can be field effect transistor or analog switch basic circuit; Power array 20 can realize for adopting LDO chip or SMPS Switching Power Supply; SBC chip 21 can be MC33907/8, TPS65381 chip application basic circuit; First processor 30 can adopt SPC5643L, TMS570 chip etc.; First CAN transceiver 40 and the second CAN transceiver 41 can be TJA1043 basic circuit; Driving and position feedback unit 50 can be the basic circuit of BTS6163D; Performing feedback unit 51 can be resistance capacitance combinational circuit (dividing potential drop and filtering).
The control principle of the embodiment of the present invention is introduced in detail below in conjunction with accompanying drawing 3 and accompanying drawing 4.
As shown in Figure 3, working-flow can realize as follows:
Step S301: judge that whether IGN signal is effective.
Wherein, in the effective situation of IGN signal, perform step S302: when IGN invalidating signal, terminate.Wherein, the IGN signal in above-described embodiment is the enabling signal of external control switch.
Step S302: under the first switch exports effective situation, controls power array and SBC chip powers on.
Step S303: detect SBC chip whether non-fault.
Wherein, when SBC failure of chip, perform step S312.In the trouble-free situation of SBC chip, perform step S304.
Step S304: control first processor, the first CAN transceiver, CAN monitoring circuit power on.
Step S305: detect first processor whether non-fault.
Wherein, when first processor fault, perform step S312.In the trouble-free situation of first processor, perform step S306.
Step S306: first processor work, export holding signal to the first switch that powers on, systems stay is powered.
Step S307: control system normally works.
Step S308: detect SBC chip whether non-fault.
Wherein, when SBC failure of chip, perform step S312.In the trouble-free situation of SBC chip, perform step S309.
Step S309: detect first processor whether non-fault.
Wherein, when first processor fault, perform step S312.In the trouble-free situation of first processor, perform step S310.
Step S310: whether effectively detect IGN signal.
Wherein, in the effective situation of IGN signal, perform step S312.When IGN invalidating signal, perform step S311.
Step S311: lower electric treatment, first processor forbids the holding signal that powers on.
Step S312: start the 3rd switch work.
Step S313: harm reduces, elimination, enters safe condition.
As shown in Figure 4, CAN transmission workflow can realize as follows:
Step S401: detect the first CAN transceiver and whether the second CAN transceiver has fault.
Wherein, under the first CAN transceiver and the trouble-free situation of the second CAN transceiver, perform step S402.In the first CAN transceiver and the second CAN transceiver in out of order situation, perform step S408.
Step S402: first processor sends signal by the first CAN transceiver.
Wherein, this signal is the first request signal in above-described embodiment.
Step S403: first processor to be read back the first feedback signal by the second CAN transceiver.
Step S404: first processor sends identical signal by the second CAN transceiver.
Wherein, this signal is the second request signal in above-described embodiment.
Step S405: first processor to be read back the second feedback signal by the first CAN transceiver.
Step S406: judge that whether the first feedback signal is equal with the second feedback signal.
Wherein, when equal, perform step S407; In unequal situation, perform step S408.
Step S407: prepare next time to send data.
Step S408: detect the first CAN transceiver whether fault.
Wherein, when the first CAN transceiver fault, perform step S409; When the first CAN transceiver not fault, perform step S411.
Step S409: forbid the first CAN transceiver.
Step S410: system enters only to be had the second CAN transceiver effective model and report the first CAN transceiver fault.
Step S411: detect the second CAN transceiver whether fault.
Wherein, when the second CAN transceiver fault, perform step S412; When the second CAN transceiver not fault, perform step S414.
Step S412: forbid the second CAN transceiver.
Step S413: system enters only to be had the first CAN transceiver effective model and report the second CAN transceiver fault.
Step S414: first processor resets.
According to the above embodiment of the present invention, additionally provide a kind of vehicle, this vehicle to comprise in above-described embodiment any one for the electric machine controller of vehicle.
First processor in the above embodiment of the present invention can adopt double-core lock-step MCU processor chips, first processor in above-described embodiment can comprise the first sub-processor and the second sub-processor, and two sub-processors outwards send data (or request) respectively by MCU passage 1 and MCU passage 2.Particularly, first processor is LOCKSTEP (double-core is asynchronous) processor.
Pass through the above embodiment of the present invention, article two, CAN fault is monitored mutually, particularly, the data that MCU passage 1 sends are monitored by MCU passage 2 through outside line, the data that MCU passage 2 sends are monitored by MCU passage 1 through outside line, when transient fault occurs the inner arbitrary processor core of MCU1 (i.e. first processor) (i.e. the first sub-processor and the second sub-processor), because comparer double-core execution result compares, relatively itself is by hardware implementing (using comparer in the above-described embodiments), fault can be found very soon, improve fault reaction speed, controller system possesses the less fault tolerance time.By the above embodiment of the present invention, solve the problem of the fault reaction time length of prior art middle controller, achieve the effect of real time reaction controller failure.
In the above embodiment of the present invention, because MCU1 (i.e. first processor) inside have employed dual processors back-up processing, simultaneously, CAN system also backups each other, when arbitrary place transient fault occurs, equal energy Timeliness coverage and process, therefore, the transient fault of the present invention program to CAN communication and MCU is insensitive.
Further, although the first processor of above-described embodiment have employed dual core processor chip, but the program run due to each core is identical, therefore traditional dual chip scheme is compared, the present invention realizes only needing familiar a processor, and software does not need to consider (hardware self can compare result) the transient fault of processor internal hardware, reduces software development difficulty.
From above description, can find out, present invention achieves following technique effect: pass through the above embodiment of the present invention, article two, CAN fault is monitored mutually, particularly, the data that MCU passage 1 sends are monitored by MCU passage 2 through outside line, the data that MCU passage 2 sends are monitored by MCU passage 1 through outside line, when transient fault occurs the inner arbitrary processor core of MCU1 (i.e. first processor) (i.e. the first sub-processor and the second sub-processor), because comparer double-core execution result compares, relatively itself is by hardware implementing (using comparer in the above-described embodiments), fault can be found very soon, improve fault reaction speed, controller system possesses the less fault tolerance time.By the above embodiment of the present invention, solve the problem of the fault reaction time length of prior art middle controller, achieve the effect of real time reaction controller failure.
The claimed counter of the application, processor and form this computing machine, each assembly of processor be all a kind of have determine shape, structure and occupy the entity products of certain space.Such as, microprocessor, image processor, sub-processor etc. are all can independent operating, the computer equipment with particular hardware structure, terminal or server.
The foregoing is only the preferred embodiments of the present invention, be not limited to the present invention, for a person skilled in the art, the present invention can have various modifications and variations.Within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.