CN111965968A

CN111965968A - Switching control method, system and device

Info

Publication number: CN111965968A
Application number: CN201910418250.XA
Authority: CN
Inventors: 刘祖齐; 张明明; 耿东玉
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2019-05-20
Filing date: 2019-05-20
Publication date: 2020-11-20

Abstract

A switching control method, a system and a device can be applied to the fields of automatic driving, auxiliary driving and vehicles. The method comprises the following steps: the second control device can judge whether the first control device is abnormal or not according to the own handshake check result and the handshake check result of the first control device, and when the first control device is abnormal, the second control device is switched to the main control state and sends switching indication information to the first control device. By adopting the method, the abnormal condition of the first control equipment can be found in time, and the hot backup switching control is carried out under the condition that the normal display or function of the central control equipment is influenced due to the abnormal condition of the first control equipment, so that a driver, an assistant driving user or an automatic driving user of the vehicle cannot sense the switching of the control function of the central control console, the driving comfort is effectively improved, and the user experience is improved.

Description

Switching control method, system and device

Technical Field

The present application relates to the field of communications technologies, and in particular, to a method, a system, and an apparatus for handover control.

Background

At present, for non-safety related equipment in a vehicle, such as a central console, when abnormal downtime occurs, a cold backup processing method is generally adopted. Namely, when the abnormality occurs, the system is powered off and then powered on manually by a user, so that the whole system is reactivated and returns to normal. For example, in a manual driving or driving assistance scene, the center console displays a navigation result, but when an abnormality occurs, the navigation is always stopped in a certain state, and a cold backup processing method is adopted, so that a user needs to power off and restart the system, and the system can be recovered to be normal.

Therefore, the cold backup processing mode needs manual power-off of the system, and business interruption exists in the middle of the system, so that driving comfort is affected, and user experience is poor.

Disclosure of Invention

The embodiment of the application provides a switching control method, a system and a device, which are used for realizing switching control of hot backup for central control equipment in a vehicle so as to improve driving comfort and improve user experience.

In a first aspect, an embodiment of the present application provides a switching control method, which is applicable to a vehicle control system that includes a central control device, a first control device, and a second control device; the method comprises the following steps: the method comprises the following steps that a first control device and a second control device carry out handshake check, the first control device is in a main control state, the second control device is in a standby control state, the main control state indicates that the control device in the main control state is used for controlling a central control device, the standby control state indicates that the control device in the standby control state is used for keeping communication with the central control device but not controlling the central control device, and the handshake check comprises one or more of frame loss detection, checksum (checksum) verification, heartbeat detection, static detection and dynamic detection; the first control equipment sends a handshake check result of the first control equipment to the second control equipment; the second control equipment receives the handshake checking result of the first control equipment, and judges whether the first control equipment is abnormal or not according to the handshake checking result of the first control equipment and the handshake checking result of the second control equipment; and under the condition that the first control equipment is judged to be abnormal, the second control equipment is switched to the main control state, and switching indication information is sent to the first control equipment.

By adopting the technical scheme provided by the embodiment of the application, through the handshake check between the first control equipment and the second control equipment, the abnormal condition of the first control equipment can be found in time, and under the condition that the normal display or function of the central control equipment is influenced due to the abnormal condition of the first control equipment, the first control equipment and the second control equipment can carry out hot backup switching control, so that a driver and a user assisting driving or automatic driving of a vehicle cannot sense the switching of the control function of the central control station, the driving comfort is effectively improved, and the user experience is improved. In addition, the vehicle-mounted station control system provided by the embodiment of the application has better robustness, and the safety of the vehicle-mounted station can be improved.

In one possible design, in the case where it is determined that the first control device is abnormal, the first control device may further receive switching indication information, and switch to the standby control state according to the switching indication information. In the embodiment of the present application, because the reasons of the abnormality occurring in the first control device may be various, the transceiving function and the control state switching function of the first control device may be affected or may not be affected, therefore, under the condition that the second control device determines that the first control device is abnormal, the first control device may receive the switching indication information in time and switch the control state, or may not receive the switching indication information in time, for example, the first control device may be out of order. In this way, the first control device can receive the switching indication information when the communication with the first control device is recovered, and switch the control state according to the switching indication information.

By adopting the technical scheme provided by the embodiment of the application, under the condition that the first control device is judged to be abnormal, the second control device can take over the control function of the central control device in time, and the first control device is instructed to be switched to the standby control state by sending the switching indication information to the first control device. In this way, the functions of the central control device can be kept normal, and the control right of the central control device is ensured to be unique, namely, only one control device can control the central control device at the same time.

In one possible design, the first control device and the second control device may perform periodic handshake checks at a certain time interval, and the handshake period (i.e., the time interval) may be set by those skilled in the art according to actual needs. For example, the handshake period may be related to the number or frequency of times of abnormality of the first control device or the second control device in a past period, where the abnormality of the control device is frequent, the handshake period may be set to be smaller, and where the abnormality of the control device is sparse, the handshake period may be set to be larger.

In one possible design, a first control state identifier is set in the first control device, and when the first control device is in the active control state, the first control state identifier is set to a first set value, and when the first control device is in the standby control state, the first control state identifier is set to a second set value; the second control device is provided with a second control state identifier, the second control state identifier is set to be a first set value when the second control device is in the active control state, and the second control state identifier is set to be a second set value when the second control device is in the standby control state. Thus, the set first control state identifier can reflect the control state of the first control device, such as whether the first control device is in the active control state or the standby control state; the set second control state identifier can reflect the control state of the second control device, for example, whether the second control device is in the active control state or the standby control state, so that the control states of the first control device and the second control device can be accurately inquired in time.

In addition, when the first control device switches the control state, the value of the first control state identifier may also be changed correspondingly, for example, the first control device switches from the active control state to the standby control state, and the first control device may modify the first control state identifier from a first set value to a second set value; similarly, when the second control device switches the control state, the value of the second control state identifier may also be changed correspondingly, for example, the second control device switches from the standby control state to the active control state, and the second control device may modify the second control state identifier from the second set value to the first set value.

In this embodiment, the control state of the first control device is different from the control state of the second control device, and the first control device and the second control device are active and standby, that is, when the first control device is in the active control state, the second control device should be in the standby control state, and when the first control device is in the standby control state, the second control device should be in the active control state. In this way, the first control state flag should be set to the first setting value or the second setting value according to the control state of the first control device, for example, the first setting value may also be 1, and the second setting value may be 0; similarly, the second control state flag should be set to the first setting value or the second setting value according to the control state of the second control device.

In a possible design, for example, before the first control device is in the active control state and the second control device is in the standby control state, or during the initialization process of the first control device and the second control device, the first control device may query the first control state identifier and send the queried first control state identifier to the second control device, and accordingly, the second control device may query the second control state identifier and send the queried second control state identifier to the first control device. Therefore, in the initialization process, namely the first control device enters the active control state, before the second control device enters the standby control state, the first control device can inquire the first control state identifier to confirm the initial control state of the first control device, the second control device can inquire the second control state identifier to confirm the initial control state of the second control device, further, the first control device and the second control device can interact the first control state identifier and the second control state identifier, so that the initial control state of the opposite side is confirmed, the control right of the central control device is ensured to be unique, the central control device can normally work after being started, and the situation of control confusion can not occur.

In one possible design, before the first control device is in the active control state and the second control device is in the standby control state, the method further includes: the first control equipment sends a first connection signal to the central control equipment, receives a first confirmation signal sent by the central control equipment, and enters a main control state according to the first confirmation signal; and the second control equipment sends a second connection signal to the central control equipment, receives a second confirmation signal sent by the central control equipment, and enters a standby control state according to the second confirmation signal. The first connection signal and the second connection signal can also be used for waking up the central control equipment.

By adopting the technical scheme provided by the embodiment of the application, the first control device and the second control device can both send connection signals to the central control device, so that the first control device and the second control device are both in communication connection with the central control device and correspondingly enter the active control state or the standby control state. Therefore, when the first control device is judged to be abnormal, the second control device can be switched to in time, switching delay possibly caused by the fact that the second control device is required to be switched to the main control state to establish communication connection with the central control device is avoided, and user experience is effectively improved.

In a possible design, when the first control device is in the active control state, the first control device may receive a request action instruction sent by the central control device, and send a request parameter corresponding to the request action instruction to the central control device; when the second control device is in the standby control state, the second control device may receive the request action command sent by the central control device, but does not respond to the request action command. The request action instructions sent by the central control device to the first control device and the second control device may be the same.

By adopting the technical scheme provided by the embodiment of the application, both the first control device and the second control device can receive the action request instruction from the central control device, but only the control device in the active control state can send the request parameter corresponding to the action request instruction to the central control device, and the control device in the standby control state does not respond to the action request instruction, i.e. does not send the request parameter corresponding to the action request instruction, so that the active control function of the active control device and the standby control function of the standby control device are realized, and the control confusion possibly caused by the response of the first control device and the second control device to the action request instruction is avoided.

In a second aspect, an embodiment of the present application provides another switching control method, which is applicable to a vehicle control system including: the system comprises a central control device, a first control device and a second control device; the method comprises the following steps: the method comprises the following steps that a first control device carries out self-checking, the first control device is in a main control state, the main control state indicates that the control device in the main control state is used for controlling a central control device, and the self-checking comprises one or more of power supply detection, storage device read-write detection, hardware watchdog detection, software watchdog detection, communication overtime frame loss detection, application layer logic detection and main control chip logic detection; the first control equipment sends the self-checking result of the first control equipment to second control equipment, the second control equipment is in a standby control state, and the standby control state indicates that the control equipment in the standby control state is used for keeping communication with the central control equipment but not controlling the central control equipment; the second control equipment receives the self-checking result of the first control equipment and judges whether the first control equipment is abnormal or not according to the self-checking result of the first control equipment; and under the condition that the first control equipment is judged to be abnormal, the second control equipment is switched to the main control state, and switching indication information is sent to the first control equipment.

By adopting the technical scheme provided by the embodiment of the application, self-checking is carried out through the first control equipment, the self-checking result is sent to the second control equipment, the abnormal condition of the first control equipment can be found in time, under the condition that the normal display or function of the central control equipment is influenced due to the abnormal condition of the first control equipment, the first control equipment and the second control equipment can carry out hot backup switching control, and therefore a driver and a user assisting driving or automatic driving of a vehicle cannot sense the switching of the control function of the central control station, the driving comfort is effectively improved, and the user experience is improved. In addition, the vehicle-mounted station control system provided by the embodiment of the application has better robustness, and the safety of the vehicle-mounted station can be improved.

In a possible design, the second control device may also perform self-checking, where the self-checking may include one or more of power supply detection, storage device read-write detection, hardware watchdog detection, software watchdog detection, communication timeout frame loss detection, application layer logic detection, and main control chip logic detection, and the self-checking performed by the second control device may be the same as or different from the detection items of the self-checking performed by the first control device, and is not limited; further, when it is determined that the first control device is abnormal and the second control device is normal, the second control device may switch to the active control state and send switching indication information to the first control device. Therefore, the second control device can take over the control function of the central control device only under the condition that the second control device is normal, so that the central control device can work normally after the second control device is switched to the main control state.

In a possible design, the first control device may perform periodic self-checking according to a certain time interval, and similarly, the second control device may also perform periodic self-checking according to a certain time interval, and the self-checking periods of the first control device and the second control device may be the same or different, and are not limited herein, but may be set by those skilled in the art as required. For example, the self-checking period may be related to the number of times or frequency of the abnormality of the first control device or the second control device in a past period of time, the self-checking period may be set to be smaller in a case where the abnormality of the control device occurs more frequently, and the self-checking period may be set to be larger in a case where the abnormality of the control device occurs more sparsely.

In a third aspect, embodiments of the present application provide yet another switching control method that is applicable to a vehicle control system including a center control apparatus, a first control apparatus, and a second control apparatus; the method comprises the following steps: the first control equipment and the second control equipment carry out handshake check, and the first control equipment carries out self-check, wherein the first control equipment is in a main control state which indicates that the control equipment in the main control state is used for controlling the central control equipment, and the second control equipment is in a standby control state which indicates that the control equipment in the standby control state is used for keeping communication with the central control equipment but not controlling the central control equipment; the first control equipment sends a handshake checking result and a self-checking result of the first control equipment to the second control equipment, and the second control equipment judges whether the second control equipment is abnormal or not according to the handshake checking result of the first control equipment, the self-checking result of the first control equipment and the handshake checking result of the second control equipment; and when judging that the second control equipment is abnormal, the second control equipment is switched to the main control state and sends switching indication information to the first control equipment.

By adopting the technical scheme provided by the embodiment of the application, the handshake check between the first control equipment and the second control equipment can be combined with the self-checking of the first control equipment to judge whether the first control equipment is abnormal or not, so that the abnormal condition of the first control equipment can be timely found, the switching control of hot backup is carried out under the condition that the normal display or function of the central control equipment is influenced due to the abnormal condition of the first control equipment, and thus, a driver of a vehicle, a user assisting driving or automatic driving cannot sense the switching of the control function of the central control station, the driving comfort is effectively improved, and the user experience is improved. In addition, the vehicle-mounted station control system provided by the embodiment of the application has better robustness, and the safety of the vehicle-mounted station can be improved.

In one possible design, the handshake check may include one or more of frame loss detection, checksum (checksum) verification, heartbeat detection, static detection, and dynamic detection, and the self-detection may include one or more of power supply detection, storage device read-write detection, hardware watchdog detection, software watchdog detection, communication timeout frame loss detection, application layer logic detection, and main control chip logic detection.

In a possible design, the second control device may also perform self-checking, and the self-checking performed by the second control device may be the same as or different from the detection items performed by the first control device, and is not limited herein. Further, when it is determined that the first control device is abnormal and the second control device is normal, the second control device may switch to the active control state and send switching indication information to the first control device. Therefore, the second control device can take over the control function of the central control device only under the condition that the second control device is normal, so that the central control device can work normally after the second control device is switched to the main control state.

In a fourth aspect, an embodiment of the present application provides a handover control system, where the system includes: the system comprises a central control device, a first control device and a second control device. The first control device has two possible control states, namely an active control state and a standby control state, the second control device also has two possible control states, namely an active control state and a standby control state, and the control state of the first control device is different from the control state of the second control device. The active control state means that the control device in the active control state can directly control the central control device, and the standby control state means that the control device in the standby control state maintains communication with the central control device but does not control the central control device. That is, in principle, when the first control device is in the active control state, the second control device should be in the standby control state, and when the first control device is in the standby control state, the second control device should be in the active control state. In the embodiment of the present application, a first control device and a second control device are described in the case that the first control device is in an active control state and the second control device is in a standby control state. It should be understood that, in the case where the first control device is in the standby control state while the second control device is in the active control state, the functions of the first control device and the second control device are also similar, and reference may be made to the above case.

The first control equipment is used for performing handshake verification with the second control equipment and sending a handshake verification result of the first control equipment to the second control equipment; the second control equipment is used for performing handshake check with the first control equipment, receiving a handshake check result of the first control equipment, and judging whether the first control equipment is abnormal or not according to the handshake check result of the first control equipment and the handshake check result of the second control equipment; the second control device is further configured to switch to the active control state and send switching indication information to the first control device when it is determined that the first control device is abnormal. The handshake check includes one or more of frame loss detection, checksum (checksum) verification, heartbeat detection, static detection, and dynamic detection.

In one possible embodiment, the first control device may perform a periodic handshake check with the second control device.

In one possible design, in the case where it is determined that there is an abnormality in the first control apparatus, the first control apparatus is further configured to: and receiving switching indication information, and switching to a standby control state according to the switching indication information.

In one possible design, a first control state identifier is set in the first control device, the first control state identifier is set to a first set value when the first control device is in the active control state, and the first control state identifier is set to a second set value when the first control device is in the standby control state; the second control equipment is provided with a second control state identifier, when the second control equipment is in the active control state, the second control state identifier is set to be a first set value, and when the second control equipment is in the standby control state, the second control state identifier is set to be a second set value. Correspondingly, when the first control device needs to perform state switching, the first control device can be used for resetting the value of the first control state identifier, and when the second control device needs to perform state switching, the second control device can be used for resetting the value of the second control state identifier.

In one possible design, the first control device is further configured to query the first control state identifier, and send the queried first control state identifier to the second control device; the second control device is further configured to query the second control state identifier, and send the queried second control state identifier to the first control device.

In a possible design, the first control device is further configured to send a first connection signal to the central control device, receive a first acknowledgement signal sent by the central control device, and enter the active control state according to the first acknowledgement signal; the entering of the first control device into the active control state may include: the first control equipment sets the first control state identifier as a first set value; the second control equipment is also used for sending a second connection signal to the central control equipment, receiving a second confirmation signal sent by the central control equipment, and entering a standby control state according to the second confirmation signal; wherein the second control device entering the standby control state may include: the second control equipment sets the second control state identifier as a second set value; the central control equipment is used for receiving a first connection signal sent by the first control equipment and sending a first confirmation signal to the first control equipment according to the first connection signal; and receiving a second connection signal sent by the second control equipment, and sending a second confirmation signal to the second control equipment according to the second connection signal. The first connection signal and the second connection signal may also be used to wake up the central control device.

In a possible design, when the first control device is in the active control state, the first control device is further configured to receive a request action instruction sent by the central control device, and send a request parameter corresponding to the request action instruction to the central control device; when the second control equipment is in a standby control state, the second control equipment is also used for receiving a request action instruction sent by the central control equipment, but does not respond to the request action instruction; the central control device is further configured to send a request action instruction to the first control device and the second control device, and receive a request parameter corresponding to the request action instruction sent by the first control device or the second control device. The action request instruction sent by the central control device to the first control device and the action request instruction sent by the second control device can be the same.

In a fifth aspect, an embodiment of the present application provides another handover control system, where the handover control system includes: the system comprises a central control device, a first control device and a second control device. The first control device has two possible control states, namely an active control state and a standby control state, the second control device also has two possible control states, namely an active control state and a standby control state, and the control state of the first control device is different from the control state of the second control device. The active control state means that the control device in the active control state can directly control the central control device, and the standby control state means that the control device in the standby control state maintains communication with the central control device but does not control the central control device. That is, in principle, when the first control device is in the active control state, the second control device should be in the standby control state, and when the first control device is in the standby control state, the second control device should be in the active control state. In the embodiment of the present application, a first control device and a second control device are described in the case that the first control device is in an active control state and the second control device is in a standby control state. It should be understood that, in the case where the first control device is in the standby control state while the second control device is in the active control state, the functions of the first control device and the second control device are also similar, and reference may be made to the above case.

The first control equipment is used for self-checking and sending a self-checking result of the first control equipment to the second control equipment; the second control equipment is used for receiving the self-checking result of the first control equipment and judging whether the first control equipment is abnormal or not according to the self-checking result of the first control equipment. The second control device is further configured to switch to the active control state and send switching indication information to the first control device when it is determined that the first control device is abnormal. The self-detection comprises one or more of power supply detection, storage device read-write detection, hardware watchdog detection, software watchdog detection, communication overtime frame loss detection, application layer logic detection and main control chip logic detection.

In one possible design, the second control device may be specifically configured to: and carrying out self-checking, switching to the main control state when the obtained self-checking result shows that the second control equipment is normal, and sending switching indication information to the first control equipment.

In one possible embodiment, the first control device can be used for periodic self-testing, and the second control device can also be used for periodic self-testing. Optionally, the self-test period of the first control device may be the same as the self-test period of the second control device; optionally, the self-checking items of the first control device may be the same as the self-checking items of the second control device.

In a sixth aspect, an embodiment of the present application provides another handover control system, including: the system comprises a central control device, a first control device and a second control device. The first control device has two possible control states, namely an active control state and a standby control state, the second control device also has two possible control states, namely an active control state and a standby control state, and the control state of the first control device is different from the control state of the second control device. The active control state means that the control device in the active control state can directly control the central control device, and the standby control state means that the control device in the standby control state maintains communication with the central control device but does not control the central control device. That is, in principle, when the first control device is in the active control state, the second control device should be in the standby control state, and when the first control device is in the standby control state, the second control device should be in the active control state. In the embodiment of the present application, a first control device and a second control device are described in the case that the first control device is in an active control state and the second control device is in a standby control state. It should be understood that, in the case where the first control device is in the standby control state while the second control device is in the active control state, the functions of the first control device and the second control device are also similar, and reference may be made to the above case.

The first control equipment is used for performing handshake verification with the second control equipment and sending a handshake verification result of the first control equipment to the second control equipment; the first control equipment is also used for carrying out self-checking and sending the obtained self-checking result to the second control equipment; the second control equipment is used for performing handshake check with the first control equipment, receiving a handshake check result of the first control equipment, receiving a self-check result of the first control equipment, and judging whether the first control equipment is abnormal or not according to the handshake check result of the first control equipment, the handshake check result of the second control equipment and the self-check result of the first control equipment; the second control device is further configured to switch to the active control state and send switching indication information to the first control device when it is determined that the first control device is abnormal. The handshake check includes one or more of frame loss detection, checksum (checksum) verification, heartbeat detection, static detection, and dynamic detection. The self-detection comprises one or more of power supply detection, storage device read-write detection, hardware watchdog detection, software watchdog detection, communication overtime frame loss detection, application layer logic detection and main control chip logic detection.

In a seventh aspect, an embodiment of the present application provides a switching control apparatus, where the apparatus may have a function of implementing the first control device in any one of the possible designs of the first aspect or the first aspect, or a function of implementing the first control device in any one of the possible designs of the second aspect or the second aspect, or a function of implementing the first control device in any one of the possible designs of the third aspect or the third aspect.

The apparatus may also have the functionality of the second control device in any of the possible designs of the first aspect or the first aspect described above, or the functionality of the second control device in any of the possible designs of the second aspect or the second aspect described above, or the functionality of the second control device in any of the possible designs of the third aspect or the third aspect described above.

The functions can be realized by hardware, and corresponding software can be executed by hardware, and the hardware or the software comprises one or more modules corresponding to the functions.

In one possible design, the apparatus includes a processing module and a transceiver module in a structure, where the processing module is configured to support the apparatus to perform a corresponding function in any one of the designs of the first aspect or the first aspect, or perform a corresponding function in any one of the designs of the second aspect or the second aspect. The transceiver module is configured to support communication between the apparatus and other communication devices, for example, when the apparatus is a first control device, the transceiver module may communicate with a second control device, send a handshake check result or a self-check result to the second control device, and also communicate with a central control device, and receive a request action instruction for operating the central control device. The apparatus may also include a memory module, coupled to the processing module, that stores program instructions and data necessary for the apparatus. As an example, the processing module may be a processor, the communication module may be a transceiver, the storage module may be a memory, and the memory may be integrated with the processor or disposed separately from the processor, which is not limited in this application.

In another possible design, the apparatus is configured to include a processor and a memory, the processor being coupled to the memory and operable to execute computer program instructions stored in the memory to cause the apparatus to perform the method of the first aspect or any of the possible designs of the first aspect, or to cause the apparatus to perform the method of the second aspect or any of the possible designs of the second aspect, or to cause the apparatus to perform the method of the third aspect or any of the possible designs of the third aspect. Optionally, the communication device further comprises a communication interface, the processor being coupled to the communication interface. The communication interface may be a transceiver or an input/output interface, and may also be an input/output interface of the chip.

In an eighth aspect, an embodiment of the present application further provides a chip system, including: a processor coupled to a memory for storing a program or instructions which, when executed by the processor, causes the system-on-chip to implement the method in any of the possible designs of the first aspect described above, or to perform the method in any of the possible designs of the second aspect described above, or to cause an apparatus to perform the method in any of the possible designs of the third aspect described above.

Optionally, the system on a chip may have one or more processors. The processor may be implemented by hardware or by software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, or the like. When implemented in software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

Optionally, the memory in the system-on-chip may also be one or more. The memory may be integrated with the processor or may be separate from the processor, which is not limited in this application. For example, the memory may be a non-transitory processor, such as a read only memory ROM, which may be integrated with the processor on the same chip or separately disposed on different chips, and the type of the memory and the arrangement of the memory and the processor are not particularly limited in this application.

The system-on-chip may be, for example, a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), a system on chip (SoC), a Central Processing Unit (CPU), a Network Processor (NP), a digital signal processing circuit (DSP), a Microcontroller (MCU), a Programmable Logic Device (PLD), or other integrated chips.

In a ninth aspect, embodiments of the present application provide a computer-readable storage medium, which stores computer-readable instructions, and when the computer-readable instructions are read and executed by a computer, the computer is enabled to execute the method in any one of the possible designs of the first aspect, or the method in any one of the possible designs of the second aspect, or the method in any one of the possible designs of the third aspect.

In a tenth aspect, embodiments of the present application provide a computer program product, which, when read and executed by a computer, causes the computer to perform the method in any one of the possible designs of the first aspect, or the method in any one of the possible designs of the second aspect, or the method in any one of the possible designs of the third aspect.

Drawings

Fig. 1 is a schematic structural diagram of a handover control system according to an embodiment of the present disclosure;

fig. 2 is a schematic flowchart of a handover control method according to an embodiment of the present application;

fig. 3 is a schematic diagram of an initialization process of a first control device and a second control device according to an embodiment of the present application;

fig. 4 is a schematic diagram of a first control device and a second control device provided in the embodiment of the present application to wake up a central control device;

fig. 5 is an interaction schematic diagram of a first control device and a second control device provided by an embodiment of the present application and a central control device;

fig. 6 is a schematic diagram illustrating a principle of frame loss detection according to an embodiment of the present application;

FIG. 7 is a schematic diagram of a checksum verification provided in an embodiment of the present application;

fig. 8 is a schematic flowchart of another handover control method according to an embodiment of the present application;

fig. 9 is a schematic diagram of a self-test program started by the first control device and the second control device according to an embodiment of the present application;

fig. 10 is a schematic diagram of a self-checking process of a control device according to an embodiment of the present application;

fig. 11 is a schematic flowchart of another handover control method according to an embodiment of the present application;

fig. 12 is a schematic diagram of a handshake checking procedure and a self-checking procedure initiated by a first control device and a second control device according to an embodiment of the present application;

fig. 13 is a schematic structural diagram of a switching control device according to an embodiment of the present application;

fig. 14 is another schematic structural diagram of a switching control device according to an embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in further detail with reference to the accompanying drawings.

It should be understood that, unless stated to the contrary, the ordinal numbers such as "first", "second", etc., used in the embodiments of the present application are used to distinguish a plurality of objects, but do not limit the sequence, timing, priority, or importance of the plurality of objects. "and/or" is used to describe the association relationship between the associated objects, and means that there may be three relationships, for example, a and/or B, and three cases, that is, a exists alone, a and B exist simultaneously, and B exists alone, may be represented. In addition, the character "/" generally indicates that the preceding and following related objects are in an "or" relationship, unless otherwise specified. The "plurality" means two or more, and the "plurality" may be understood as "at least two" in the embodiments of the present application. "at least one" is to be understood as meaning one or more, for example one, two or more.

Referring to fig. 1, a schematic structural diagram of a switching control system according to an embodiment of the present disclosure is shown, where the switching control system includes a central control device 110, a first control device 120, and a second control device 130. Further, the switching control system may further include a Body Control Module (BCM), which is not shown in fig. 1.

The central control device 110 is a device in the vehicle that is not related to safety, and is used to implement functions related to safety, such as navigation, sound, and positioning. For example, the central control device may be an in-vehicle entertainment system, a streaming media playing system, an in-vehicle navigation system, a radio, and the like, provided in the vehicle. Optionally, the central control device may be composed of a display screen, a power supply, a display driver, and other subsystems or modules. The center control device may also be referred to as a center console or a vehicle-mounted station, or may have other names, which is not limited herein. Accordingly, the first control device may also be referred to as a first console control device, a first console control system, a first vehicle stage control device, a first vehicle stage control system, or may also have other names; the second control device may also be referred to as a second center console control device, a second center console control system, a second stage control device, a second stage control system, or may have other names.

The first control device 120 and the second control device 130 are devices or systems for controlling the center control device 110. The structure of the implementation of both may be the same. Taking the first control apparatus as an example, the first control apparatus may include a control section and a power supply section. In one example, the control portion may include a physical processor, such as a Central Processing Unit (CPU), and optionally, the control portion may further include a memory, an input/output (i/o) and other peripherals coupled with the processor; in another example, the control portion may also be a logic unit having a control function, such as a Field Programmable Gate Array (FPGA).

The first control apparatus 120 and the second control apparatus 130 may implement the same control function of the vehicle-mounted stage, but in different control states. The first control device has two control states, an active control state and a standby control state, and the second control device may also have two control states, an active control state and a standby control state. The first control device and the second control device are in different control states, that is, at the same time, only one control device is in the active control state, the other control device is in the standby control state, and when the switching control system includes more control devices, the other control devices are in the standby control state. The control state may also be understood as a master/slave control state. In this embodiment, a control device in the active control state may be referred to as an "active control device", and a control device in the standby control state may be referred to as a "standby control device".

The main control equipment is used for actually controlling the central control equipment, and the standby control equipment is used for maintaining communication with the central control equipment but not actually controlling the central control equipment. Specifically, the active control device may be configured to be responsible for controlling the start and the reset of the central control device, receiving an operation request from a user to the central control device, and controlling the central control device to perform various operations requested by the user. When the main control device is abnormal, the main control device can also negotiate with the standby control device to perform control switching of hot backup. The standby control equipment is used for receiving the operation request of the user to the central control equipment but not responding to the operation request of the user, namely, normal communication with the central control equipment is maintained, but specific operation of the central control equipment requested by the user is not executed. The standby control equipment can also perform hot backup control switching after negotiation with the main control equipment, and switch to the main control state, thereby taking over the control function of the central control equipment.

And the body control unit BCM is used for awakening the first control equipment and the second control equipment and triggering the initialization process of the first control equipment and the second control equipment. Generally, the vehicle body control unit may wake up the first control device and the second control device after the vehicle is powered on, and trigger the first control device and the second control device to initialize. The body control unit BCM may also have other functions, which are not specifically limited herein.

It should be noted that, in the handover control system provided in the embodiment of the present application, functions and functions of each component in the handover control process may be implemented by referring to method flows in the following embodiments one to three, and for brevity, they are not described one by one here.

Example one

Please refer to fig. 2, which is a flowchart illustrating a handover control method according to an embodiment of the present disclosure. The method comprises the following steps S201 to S204:

step S201, the first control device and the second control device perform handshake check. The first control device is in an active control state, and the second control device is in a standby control state.

Before step S201 is executed, the first control device may enter the active control state, and the second control device may enter the standby control state. In a possible implementation manner, the first control device enters the active control state, and the second control device enters the standby control state, where the first control device directly enters the active control state after initialization, and the second control device directly enters the standby control state after initialization. In another possible implementation manner, the first control device enters the active control state, and the second control device enters the standby control state, where the first control device is switched from the original standby control state to the active control state, and the second control device is switched from the original active control state to the standby control state.

The initialization process of the first control device and the second control device will be described below by taking as an example that the first control device directly enters the active control state after initialization and the second control device directly enters the standby control state after initialization.

First, the body control unit BCM wakes up the first control device and the second control device, respectively. As shown in fig. 3, the body control unit BCM may transmit a wake-up control signal to the first control device and the second control device. It should be understood that the body control unit BCM may send the wake-up control signals of the first control device and the second control device at the same time, or may send the wake-up control signal of the first control device first and then send the wake-up control signal of the second control device, or vice versa, without limitation.

It should be noted that the body control unit BCM may have a plurality of possible implementations for waking up the first control device and the second control device. In one possible implementation, the BCM may directly power the first control device and the second control device through the physical hardwired controller. For example, after a driver unlocks a vehicle door through an intelligent key and enters a vehicle, the vehicle key or a one-key starting button is manually triggered, after the one-key starting module and the BCM pass authentication, a corresponding pin of the BCM outputs a signal to control the relays of the power supplies of the first control device and the second control device to be closed, wherein the signal output by the BCM can be a pulse signal or a step signal. Thus, the first control device and the second control device are powered on and started.

In another possible implementation manner, the BCM may wake up the first control device and the second control device through a bus message. The bus message may be a specific wake-up message or any message. For example, after a driver unlocks a vehicle door through a smart key and enters a vehicle, the vehicle start key or a one-key start button is manually triggered, after the one-key start module and the BCM pass authentication, the BCM may send a wake-up message to a Controller Area Network (CAN) bus, and when transceivers of the first control device and the second control device are woken up by the wake-up message, power management modules of the first control device and the second control device are woken up, the power management modules may power on main control chips of the first control device and the second control device, and the first control device and the second control device start to operate.

Subsequently, the first control device and the second control device respectively perform initialization, and confirm the respective initial control states and the initial control state of the other party. The initialization of the control device may include detecting whether each register in the control device is normal, where different types of registers or registers from different manufacturers and/or Original Equipment Manufacturers (OEMs) may be detected in different manners, and the detection manner is not limited herein.

In the embodiment of the application, a first control state identifier is arranged in the first control device, and a second control state identifier is arranged in the second control device. When the first control device is in the active control state, the first control state identifier is set to a first set value, and when the first control device is in the standby control state, the first control state identifier is set to a second set value. When the second control device is in the active control state, the second control state identifier is set to a first set value, and when the second control device is in the standby control state, the second control state identifier is set to a second set value. For example, the first set value may be 1, and the second set value may be 0. And confirming the control states of the first control equipment and the second control equipment through the set first control state identifier and the second control state identifier.

In practical application, the control state identifier may be a control state identifier bit set in a memory of the control device, where the memory may be an electrically erasable programmable read-write memory (EEPROM), and the control state identifier bit may also be referred to as a control state flag bit, a main/standby control identifier bit, a main/standby control flag bit, a main/standby identifier bit, a main/standby flag bit, or may have other names, which is not limited herein.

The first control state identifier and the second control state identifier may both have a default value, i.e. an initial value. This is to be understood as meaning that the first control device and the second control device have a default control state. For example, the first control device may be a default active control device, the second control device may be a default standby control state, which means that the first control device may directly enter the active control state after initialization, and the second control device may directly enter the standby control state after initialization. Accordingly, the initial value of the first control state flag is a first set value, and the initial value of the second control state flag is a second set value.

In view of this, the first control device may determine its initial control state by querying an initial value of the first control state identifier, and determining the initial control state of the first control device according to the initial value of the first control state identifier. For example, when the initial value of the first control state identifier is the first set value, the first control device may determine that its initial control state is the active control state. The second control device may determine its initial control state, where the second control device queries an initial value of the second control state identifier, and determines the initial control state of the second control device according to the initial value of the first control state identifier. For example, when the initial value of the second control state flag is the second set value, the second control apparatus may confirm that its initial control state flag is the standby control state.

In addition, the first control device can also send the inquired first control state identifier to the second control device, so that the second control device can know the initial control state of the first control device. The second control device may also send the queried second control state identifier to the first control device, so that the first control device can know the initial control state of the second control device. It should be understood that the first control state identifier and the second control state identifier may be sent at the same time or at different times, and the present application is not limited thereto. The purpose of the first control device and the second control device mutually confirming the initial control state of the other side is to confirm that the primary-standby relationship between the first control device and the second control device is normal, that is, the control states of the first control device and the second control device should not conflict under normal conditions, only one control device is in the primary control state at the same time, and the two control devices are not allowed to be in the primary control state or in the standby control state at the same time. If the initial control states of the first control device and the second control device conflict or overlap in the process, the two control devices can confirm the new non-conflicting initial control states in a negotiation manner.

Further, in order to enable the central control device to work normally, the first control device and the second control device can also wake up the central control device. The wake-up procedure can be as shown in fig. 4: the first control equipment sends a first connection signal to the central control equipment, the central control equipment sends a first confirmation signal to the first control equipment, and the first control equipment receives the first confirmation signal sent by the central control equipment and enters an active control state according to the first confirmation signal. And the second control equipment sends a second connection signal to the central control equipment, the central control equipment sends a second confirmation signal to the second control equipment, and the second control equipment receives the second confirmation signal sent by the second control equipment and enters a standby control state according to the second confirmation signal.

The control device may establish a communication connection with the central control device by sending a connection signal to the central control device and receiving a corresponding acknowledgement signal sent by the central control device. Therefore, the first control device and the second control device are in communication connection with the central control device, so that when the control states of the first control device and the second control device need to be switched, the switching delay is effectively reduced, and the user experience is improved. If only the first control device establishes communication connection with the central control device at the beginning stage, and the second control device does not send a connection signal to the central control device, the connection signal is sent again when the control state needs to be switched when the first control device is judged to be abnormal, and the communication connection with the central control device is established, so that switching delay exists. And the display screen of the central control device has no parameter display in the switching process of the control state, which is equivalent to a black screen, and the user experience is influenced.

The first control device enters the active control state, and the second control device enters the standby control state, which means that the central control device can send a request action instruction to the first control device and the second control device before switching the states next time, as shown in fig. 5; the first control device receives the request action instruction, and responds to the request action instruction, for example, sends a request parameter corresponding to the request action instruction to the central control device, so as to control the central control device to execute a certain operation; the second control device receives the request action instruction, but does not respond to the request action instruction, that is, does not send the request parameter corresponding to the request action instruction to the central control device, and does not control the central control device to execute the operation. After the first control device and the second control device switch the control states, as shown in fig. 5, the first control device may be in a standby control state, and the second control device may be in an active control state, at this time, the second control device may respond to the request action instruction sent by the central control device, and the first control device does not respond to the request action instruction sent by the central control device. As can be seen, both the first control device and the second control device can receive the request action instruction from the central control device, but only the control device in the active control state will send the request parameter corresponding to the request action instruction to the central control device, and the control device in the standby control state does not respond to the request action instruction, that is, does not send the request parameter corresponding to the request action instruction, thereby implementing the active control function of the active control device and the standby control function of the standby control device, and avoiding control confusion that may be caused by both the first control device and the second control device responding to the request action instruction.

In order to ensure the robustness of the system, the control state is unique, and after the first control device establishes a communication connection with the central control device, when the first control device enters the active control state, the first control device may further set the first control state identifier again. That is, even if the first control device and the second control device have confirmed the primary-standby relationship between them before, at this time, when the first control device enters the primary control state, the first control state identifier may be set to the first setting value again. Similarly, after the second control device establishes communication connection with the central control device, when the second control device enters the standby control state, the second control device may further set the second control state identifier again, and set the second control state identifier as the second set value.

It should be noted that, in the embodiment of the present application, the first connection signal may also be referred to as a first wake-up signal, and the second connection signal may also be referred to as a second wake-up signal. The first connection signal and the second connection signal both have the function of waking up the central control device, and the central control device can wake up after receiving the first connection signal or the second connection signal and then send confirmation signals to the first control device and the second control device to establish communication connection. In practical applications, the first control device may send the first connection signal and the second control device may send the second connection signal simultaneously or non-simultaneously, so that the central control device may be awakened under the trigger of the earlier received connection signal, and may be the first connection signal or the second connection signal, which is not limited specifically.

Further, as shown in fig. 4, after the first control device enters the active control state and the second control device enters the standby control state, the first control device and the second control device may start a periodic handshake check procedure. The handshake check is used for detecting whether the functions of the two control devices are normal, whether the communication is normal, whether the contents of the receiving and sending instructions are normal, and the like. The handshake period may generally be several instruction periods (ms level), that is, the first control device and the second control device interact with each other once handshake check result every several instruction periods. The handshake period may also be set by a person skilled in the art, or may also be dynamically adjusted according to the number of times or frequency of occurrence of an abnormality in the operation process of the first control device and the second control device, where the handshake period is reduced when the abnormality frequency is higher, and the handshake period is increased when the abnormality frequency is lower, and is not limited specifically.

The handshake check may include one or more of frame loss detection, checksum (checksum) verification, heartbeat detection, static detection, and dynamic detection. The frame loss detection, the checksum verification and the heartbeat detection are used for detecting whether communication between the first control device and the second control device is normal or not, and can be realized by sending a message to a receiving node through a sending node. Here, the transmitting node refers to the first control apparatus or the second control apparatus. When the sending node is the first control device, the receiving node is the second control device; and when the transmitting node is the second control device, the receiving node is the first control device. In the embodiment of the application, a frame of message for detection may be predefined, and a sending period of the message may be set, for example, the message may be sent once every 10ms, and a certain check sum storage space and a certain space of a cycle rolling counter are reserved in the message data, for example, the check sum storage space and the space of the cycle rolling counter may be respectively defined as 8 bits and 4 bits.

And the frame loss detection is used for detecting whether a frame loss fault occurs between the sending node and the receiving node. The principle of frame loss detection can be shown in fig. 6, and the logic of the sending node and the receiving node for judging whether the frame loss fault occurs is the same or similar, so that the "node" is used to refer to the sending node or the receiving node in fig. 5. After communication is established, the counter in the message data is added by 1 and is added to 15 every time the sending node sends a message, and then the communication is restarted; the receiving node will add 1 to the detection counter or change from 15 to 1 to start counting again every time it receives a frame of message. If the difference value between the current value of the counter and the last value of the counter is 1, 2 or-15 or 0 for one time, the result is normal, and if the difference value is not 1, 2 or-15 or 0 for two consecutive times, the result is an error. And if one error occurs, the suspected frame loss fault can be considered, counting the number of the faults occurring in the counter, and when the number of the continuous faults is greater than a set boundary threshold value N, the true frame loss fault can be considered. If no frame loss error occurs in the continuous M times of messages, the frame loss fault is repaired, and the corresponding zone bit is cleared. N, M are positive integers and can be determined according to different node requirements.

And the checksum verification is used for detecting whether the contents transmitted and received by the receiving node and the transmitting node are consistent or not and whether the transmitted and received contents are tampered or not. The checksum herein is not a Cyclic Redundancy Check (CRC) check of the data link layer, but refers to a checksum (checksum) stored in a space of 8 bits reserved in the message data of the application layer. The principle of Checksum verification may be as shown in fig. 7, after communication is established, a node may determine whether a Checksum in a received message is equal to a Checksum calculated by the node itself, if a calculated value of the Checksum (Checksum) is not equal to a received value, a Checksum error is determined, if checksums in consecutive X-times messages are all erroneous, a CRC failure is determined, if no error occurs in consecutive Y-times messages, the CRC failure is repaired, and a value of X, Y is determined according to requirements of different nodes.

The heartbeat detection is also called as timeout detection and is used for detecting whether the node of the opposite side is on line or whether a Controller Area Network (CAN) transceiver of the node of the opposite side is in a working state. The detection mode can use the principle of a rolling counter, and if the messages from the opposite node are not received continuously for a certain period, the opposite node can be considered to be not on line or the opposite node is overtime. In the embodiment of the application, the period of each node can be determined according to actual conditions, the principle is that the product of the period length and the times is smaller than the actual application requirement, and the detection time threshold of the important node can be set to be shorter appropriately.

In one possible design, the result of the heartbeat detection may include heartbeat counter information, which is the number of periodic handshakes between the sending node and the receiving node. The sending node and the receiving node can negotiate in advance to determine the period of periodic handshake, the sending node and the receiving node respectively count the heartbeat counter information, and the heartbeat counter is increased by 1 every time of handshake. If there is no periodic handshake within the negotiated period range, for example, there may be no heartbeat signal of the sending node, and at this time, the receiving node may determine that the sending node is faulty.

Static detection means that the first control device and the second control device store the same static check data and check result in a fixed memory address, such as an EEPROM or a Flash memory, in advance, and can store multiple copies in different address intervals to prevent a single place from failing. The two control devices perform calculations based on the same logic processing algorithm and compare the results. The first control device may compare the calculation result of the second control device, the static check data read from its own memory, and the current calculation result of the first control device itself. Taking static detection data stored in a memory (such as EEPROM) as a criterion for judgment, and if the received calculation result of the second control equipment is inconsistent with the static detection data in the memory, considering that the second control equipment is abnormal; if the current calculation result of the first control device is inconsistent with the static check data in the memory, the first control device is considered to be abnormal. Conversely, the second control device can likewise authenticate the first control device.

The dynamic detection means that the first control device and the second control device receive the information based on the current real-time parameters, such as the operation input instruction of a driver or automatic driving, or the running state parameters of the whole vehicle, such as a gear, a vehicle speed, a rotating speed, a temperature and the like, and adopt the same processing algorithm to calculate based on the same frame message (ensuring data synchronism). When the calculation results of the first control equipment and the second control equipment are consistent, the first control equipment and the second control equipment pass dynamic checking; if not, at least one of the first control apparatus and the second control apparatus is considered to be abnormal.

Step S202, the first control device sends the handshake check result of the first control device to the second control device.

By performing handshake check, the first control device and the second control device can both obtain their handshake check results, and thus the first control device can send their handshake check results to the second control device, so that the second control device can determine whether the first control device is normal. It should be understood that, according to the difference of the check mode/check item of the handshake check, the handshake check result will also be different, and the application is not limited.

Step S203, the second control device receives the handshake check result of the first control device, and determines whether the first control device is abnormal according to the handshake check result of the first control device and the handshake check result of the second control device.

And step S204, under the condition that the first control equipment is judged to be abnormal, the second control equipment is switched to the main control state, and switching indication information is sent to the first control equipment.

If one or more detection results in the handshake check result of the first control device and the handshake check result of the second control device indicate that the first control device is abnormal, the second control device may switch to the active control state, and set the second control state identifier to a first set value.

The reason for the abnormality of the first control device may be various, and the transceiving function and the control state switching function of the first control device may or may not be affected. Therefore, in the case where the second control apparatus determines that the first control apparatus is abnormal, the first control apparatus may receive the switching instruction information in time, switch to the standby control state, and set the first control state flag to the second setting value. The second control device may not be able to receive the switching indication information in time, for example, the first control device may be abnormally down. In this case, the first control device may receive the switching instruction information again when communication with the first control device is resumed, and switch to the standby control state based on the switching instruction information, setting the first control state flag to the second setting value.

In the embodiment of the present application, the switching indication information may also be a switching indication signal, for example, a pulse signal, a step signal, or the like, and is not limited specifically.

Therefore, the abnormal condition of the first control equipment can be found in time through the handshake check between the first control equipment and the second control equipment, and the first control equipment and the second control equipment can carry out hot backup switching control under the condition that the normal display or function of the central control equipment is influenced due to the abnormal condition of the first control equipment, so that a driver, an auxiliary driving or an automatic driving user of a vehicle cannot sense the switching of the control function of the central control station, the driving comfort is effectively improved, and the user experience is improved. In addition, the vehicle-mounted station control system provided by the embodiment of the application has better robustness, and the safety of the vehicle-mounted station can be improved.

Example two

Please refer to fig. 8, which is a flowchart illustrating another handover control method according to an embodiment of the present application. The method includes steps S801 to S804 as follows:

step S801, the first control device performs self-test, and the first control device is in the active control state.

Step S802, the first control device sends the self-checking result to the second control device, and the second control device is in a standby control state.

And step S803, the second control device receives the self-checking result of the first control device, and judges whether the first control device is abnormal or not according to the self-checking result of the first control device.

Step S804, when it is determined that the first control device is abnormal, the second control device switches to the active control state, and sends switching instruction information to the first control device.

It should be noted that the difference between the second embodiment and the first embodiment is that the first control device sends its self-test result to the second control device, and the second control device determines whether the first control device is abnormal or not according to the self-test result of the first control device. If one or more detection results in the self-detection results of the first control device show that the first control device is abnormal, the second control device can judge that the first control device is abnormal. Other aspects of the second embodiment can refer to the specific implementation manner in the first embodiment, and are not described herein again.

In a possible implementation manner, the second control device may also perform self-checking, and the second control device may switch to the active control state and send switching indication information to the first control device when it is determined that the first control device is abnormal and the second control device is normal. Therefore, the second control device can take over the control function of the central control device only under the condition that the second control device is normal, so that the central control device can work normally after the second control device is switched to the main control state.

As shown in fig. 9, the first control device may start the periodic self-checking program after establishing connection with the central control device and entering the main control state, and the second control device may start the periodic self-checking program after establishing connection with the central control device and entering the standby control state. The handshake period may generally be several instruction periods (ms level), that is, every several instruction periods, the first control device performs a self-test once and interacts with the second control device once to obtain a self-test result, and the same applies to the second control device. The handshake period may also be set by a person skilled in the art, or may also be dynamically adjusted according to the number of times or frequency of occurrence of an abnormality in the operation process of the first control device and the second control device, the self-checking period is reduced when the abnormality frequency is higher, and the self-checking period is increased when the abnormality frequency is lower, which is not limited specifically. It should be understood that the self-test period of the first control device and the self-test period of the second control device may be the same or different, and are not limited herein.

In this embodiment of the application, the self-test performed by the first control device and the second control device may include one or more of power supply detection, storage device read-write detection, hardware watchdog detection, software watchdog detection, communication timeout frame loss detection, application layer logic detection, and main control chip logic detection, and the above various detection manners may be sequentially executed according to the sequence shown in fig. 10, may also be executed according to other sequences, or each detection item may also be executed independently from each other, which is not limited in this application. In addition, the self-test performed by the second control device may be the same as or different from the test items of the self-test performed by the first control device, and the present application is also not limited thereto.

Therefore, the first control equipment carries out self-checking and sends a self-checking result to the second control equipment, the abnormal condition of the first control equipment can be found in time, and under the condition that the normal display or function of the central control equipment is influenced due to the abnormal condition of the first control equipment, the first control equipment and the second control equipment can carry out hot backup switching control, so that a driver, an auxiliary driving or an automatic driving user of a vehicle cannot sense the switching of the control function of the central control station, the driving comfort is effectively improved, and the user experience is improved. In addition, the vehicle-mounted station control system provided by the embodiment of the application has better robustness, and the safety of the vehicle-mounted station can be improved.

EXAMPLE III

Please refer to fig. 11, which is a flowchart illustrating another handover control method according to an embodiment of the present application. The method includes steps S1101 to S1104 as follows:

step S1101, performing handshake verification between the first control device and the second control device, where the first control device is in the active control state, and the second control device is in the standby control state.

And step S1102, the first control equipment performs self-checking.

Step S1103, the first control device sends the handshake check result and the self-check result of the first control device to the second control device.

Step S1104, the second control device receives the handshake check result and the self-check result of the first control device, and determines whether the first control device is abnormal according to the handshake check result of the first control device, the self-check result of the first control device, and the handshake check result of the second control device.

Step S1105, when it is determined that the first control device is abnormal, the second control device switches to the active control state, and sends switching instruction information to the first control device.

It is to be noted that, in the third embodiment, whether the first control device is abnormal or not is determined by combining handshake check between the first control device and the second control device with self-test of the first control device. The first control equipment can send the self-handshake check result and the self-check result to the second control equipment, and the second control equipment judges whether the first control equipment is abnormal or not according to the handshake check result of the first control equipment, the self-check result of the first control equipment and the handshake check result of the second control equipment. If one or more detection results of the handshake check result of the first control device, the self-detection result of the first control device, and the handshake check result of the second control device indicate that the first control device is abnormal, the second control device may determine that the first control device is abnormal. In other aspects of this second embodiment, reference may be made to specific implementation manners in the first and second embodiments, for example, how the first control device and the second control device perform initialization, contents of handshake check, contents of self-check, and the like, which are not described herein again. The following description will mainly deal with differences between the third embodiment and the first and second embodiments.

In one possible implementation, the second control device can also perform a self-test. As shown in fig. 12, the first control device may start a periodic handshake check program and a self-check program after establishing connection with the central control device and entering the master control state, and the second control device may start a periodic handshake check program and a self-check program after establishing connection with the central control device and entering the standby control state. The handshake period and the self-checking period may be the same, so that the first control device may send the handshake checking result and the self-checking result to the second control device together. The handshake period and the self-test period may also be different, in which case, the first control device may send the handshake check result and the self-test result to the second control device, respectively.

The self-test period of the first control device may be the same as or different from the self-test period of the second control device. And the second control equipment switches to the main control state and sends switching indication information to the first control equipment when judging that the first control equipment is abnormal and the second control equipment is normal. Therefore, the second control device can take over the control function of the central control device only under the condition that the second control device is normal, so that the central control device can work normally after the second control device is switched to the main control state.

Therefore, through the handshake check between the first control equipment and the second control equipment and the self-checking of the first control equipment, whether the first control equipment is abnormal or not is judged, the abnormal condition of the first control equipment can be found in time, and under the condition that the normal display or the function of the central control equipment is influenced due to the abnormal condition of the first control equipment, the switching control of hot backup is carried out, so that a driver of a vehicle and a user assisting driving or automatic driving cannot sense the switching of the control function of the central control station, the driving comfort is effectively improved, and the user experience is improved. In addition, the vehicle-mounted station control system provided by the embodiment of the application has better robustness, and the safety of the vehicle-mounted station can be improved.

In the following, several examples of the handover control method provided in the embodiment of the present application in practical applications are given in combination with the first embodiment, the second embodiment and the third embodiment.

In one example, the handshake check may include drop frame detection, checksum verification, heartbeat verification. If any one or more of the frame loss detection result, the checksum verification result and the heartbeat verification result is abnormal, the current handshake verification of the first control device and the second control device is considered to be failed. For example, if the heartbeat counter information of the first control device is inconsistent with the heartbeat counter information of the second control device, the first control device may malfunction.

In another example, the self-test may include the power supply test, the memory device read-write test, the hardware watchdog test, the software watchdog test, the communication timeout frame loss test, the application layer logic test, and the main control chip logic test shown in fig. 10. If any one or more detection results in the detection results of the first control device are abnormal, the first control device can be considered to have a fault, and the first control device can send the self-detection result to the second control device to initiate control state switching. If the handshake check of the first control device and the second control device is not passed and the self-check of the first control device is abnormal, the first control device is also considered to be in fault.

In yet another example, the handshake check may include a static detection and a dynamic detection. And if the static detection result indicates that the first control equipment is normal and the second control equipment is abnormal, and the calculation results of the first control equipment and the second control equipment in the dynamic detection are inconsistent, the first control equipment is considered to be normal and the second control equipment is considered to be abnormal.

In yet another example, the handshake check includes checksum verification, heartbeat detection, static detection, and dynamic detection. And judging whether the current handshake check of the first control equipment and the second control equipment passes through the comprehensive checking and verifying result, the heartbeat detection result, the static detection result and the dynamic detection result. And if the check sum verification result and the heartbeat detection result of the first control device and the second control device are normal, and the static detection result and the dynamic detection result of the first control device for detecting the second control device are normal, the first control device can be considered to be normal. Conversely, the second control device can authenticate the first control device in the same manner. If the check sum verification result and the heartbeat detection result of the first control device and the second control device are normal, the static detection result of the first control device for detecting the second control system is normal, but the dynamic detection result is abnormal, the first control device can be considered to be normal, and the second control device is considered to be abnormal. Conversely, the second control device can authenticate the first control device in the same manner.

An embodiment of the present application further provides a switching control device, please refer to fig. 13, which is a schematic structural diagram of the switching control device provided in the embodiment of the present application, and the switching control device includes: a transceiver module 1310 and a processing module 1320. The apparatus may be used as a first control device for implementing the functions related to the first control device system in any of the above method embodiments, and may also be used as a second control device for implementing the functions related to the second control device in any of the above method embodiments.

When the switching control apparatus is used as a first control device to execute the method embodiment shown in fig. 2, the transceiver module 1310 is configured to perform handshake verification with a second control device, send a handshake verification result to the second control device, and receive switching indication information; the processing module 1320 is configured to perform an operation of bringing the first control device into the active control state and switching to the standby control state according to the received switching indication information.

When the handover control apparatus performs the method embodiment shown in fig. 8 as the first control device, the transceiver module 1310 is configured to perform operations of transmitting the self-test result to the second control device and receiving handover indication information; the processing module 1320 is configured to perform an operation of bringing the first control device into the active control state and switching to the standby control state according to the received switching indication information.

When the switching control apparatus is used as a first control device to execute the method embodiment shown in fig. 11, the transceiver module 1310 is configured to perform handshake verification with a second control device, send a handshake verification result and a self-checking result to the second control device, and receive switching indication information; the processing module 1320 is configured to perform operations of entering the first control device into the active control state, performing self-checking, and switching to the standby control state according to the received switching indication information.

When the switching control apparatus is used as a second control device to execute the method embodiment shown in fig. 2, the transceiver module 1310 is configured to perform operations of receiving a handshake check result sent by the first control device and sending switching indication information to the first control device; the processing module 1320 is configured to execute an operation of enabling the second control device to enter the standby control state, determining whether the first control device is abnormal according to the handshake check result of the first control device and the handshake check result of the second control device, and switching to the active control state when it is determined that the second control device is abnormal.

When the switching control apparatus is used as a second control device to execute the method embodiment shown in fig. 8, the transceiver module 1310 is configured to perform operations of receiving the self-test result sent by the first control device and sending the switching instruction information to the first control device; the processing module 1320 is configured to perform operations of enabling the second control device to enter the standby control state, determining whether the first control device is abnormal according to a self-checking result of the first control device, and switching to the active control state when it is determined that the second control device is abnormal.

When the switching control apparatus is used as a second control device to execute the method embodiment shown in fig. 11, the transceiving module 1310 is configured to perform operations of receiving a handshake check result and a self-test result sent by the first control device, and sending switching instruction information to the first control device; the processing module 1320 is configured to execute an operation of enabling the second control device to enter the standby control state, determining whether the first control device is abnormal according to the handshake check result of the first control device, the self-checking result of the first control device, and the handshake check result of the second control device, and switching to the active control state when it is determined that the second control device is abnormal.

It is to be understood that the processing module 1320 involved in the apparatus provided in the embodiments of the present application may be implemented by a processor or a processor-related circuit component, and the transceiver module 1310 may be implemented by a transceiver or a transceiver-related circuit component.

It should be noted that the handover control apparatus 1300 provided in the embodiment of the present application may correspond to the first control device or the second control device executing the handover control method provided in the embodiment of the present application, and operations and/or functions of each module in the apparatus are respectively for implementing corresponding flows of the methods shown in fig. 2 to fig. 12, and are not described herein again for brevity.

Please refer to fig. 14, which is a schematic structural diagram of a switching control apparatus provided in the embodiment of the present application. The apparatus 1400 includes a processor 1410, a memory 1420, and a communication interface 1430. Optionally, the apparatus 1400 further includes an input device 1440, an output device 1450, and a bus 1460. The processor 1410, the memory 1420, the communication interface 1430, and the input device 1440 and the output device 1450 are connected to each other via a bus 1460. The memory 1420 stores instructions or programs therein, and the processor 1410 is configured to execute the instructions or programs stored in the memory 1420. When the instructions or programs stored in the memory 1420 are executed, the processor 1410 is configured to perform the operations performed by the processing module 1320 in the above-described method embodiment, and the communication interface 1430 is configured to perform the operations performed by the transceiver module 1310 in the above-described embodiment.

It should be noted that the apparatus 1400 provided in the embodiment of the present application may correspond to the first control device or the second control device executing the handover control method provided in the embodiment of the present invention, and operations and/or functions of each module in the apparatus 1400 are not described herein again for brevity in order to implement the corresponding flow of the method shown in fig. 2, fig. 8, or fig. 11, respectively.

An embodiment of the present application further provides a chip system, including: a processor coupled to a memory for storing a program or instructions that, when executed by the processor, cause the system-on-chip to implement the method of any of the above method embodiments.

It will be appreciated that the steps of the above described method embodiments may be performed by integrated logic circuits of hardware in a processor or instructions in the form of software. The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

The embodiment of the present application further provides a computer-readable storage medium, where computer-readable instructions are stored in the computer-readable storage medium, and when the computer-readable instructions are read and executed by a computer, the computer is enabled to execute the method in any of the above method embodiments.

The embodiments of the present application provide a computer program product, which when read and executed by a computer, causes the computer to execute the method in any of the above method embodiments.

The embodiment of the present application provides a hot backup switching control system, where the communication system includes the first vehicle load station control system and the second vehicle load station control system described in the above method embodiments. Optionally, the system may further include a vehicle-mounted station.

It should be understood that the processor mentioned in the embodiments of the present application may be a Central Processing Unit (CPU), and may also be other general purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

It will also be appreciated that the memory referred to in the embodiments of the application may be either volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory. The non-volatile memory may be a read-only memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an electrically Erasable EPROM (EEPROM), or a flash memory. Volatile memory can be Random Access Memory (RAM), which acts as external cache memory. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), double data rate SDRAM, enhanced SDRAM, SLDRAM, Synchronous Link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

It should be noted that when the processor is a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, the memory (memory module) is integrated in the processor.

It should be noted that the memory described herein is intended to comprise, without being limited to, these and any other suitable types of memory.

It should be understood that, in the various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the execution sequence, and the execution sequence of the processes should be determined by their functions and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.

The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A switching control method applied to a vehicle control system including a center control apparatus, a first control apparatus, and a second control apparatus, the method comprising:

the first control device and the second control device perform handshake check, the first control device is in a main control state, the second control device is in a standby control state, the main control state indicates that the control device in the main control state is used for controlling the central control device, the standby control state indicates that the control device in the standby control state is used for maintaining communication with the central control device but not controlling the central control device, and the handshake check includes one or more of frame loss detection, checksum (checksum) verification, heartbeat detection, static detection and dynamic detection;

the first control equipment sends a handshake check result of the first control equipment to the second control equipment;

the second control equipment receives a handshake check result of the first control equipment, and judges whether the first control equipment is abnormal or not according to the handshake check result of the first control equipment and the handshake check result of the second control equipment;

and under the condition that the first control equipment is judged to be abnormal, the second control equipment is switched to the main control state and sends switching indication information to the first control equipment.

2. A switching control method applied to a vehicle control system including a center control apparatus, a first control apparatus, and a second control apparatus, the method comprising:

the first control equipment carries out self-check, the first control equipment is in a main control state, the main control state indicates that the control equipment in the main control state is used for controlling the central control equipment, and the self-check comprises one or more of power supply detection, storage equipment read-write detection, hardware watchdog detection, software watchdog detection, communication overtime frame loss detection, application layer logic detection and main control chip logic detection;

the first control device sends a self-checking result of the first control device to the second control device, the second control device is in a standby control state, and the standby control state indicates that the control device in the standby control state is used for keeping communication with the central control device but not controlling the central control device;

the second control equipment receives the self-checking result of the first control equipment, and judges whether the first control equipment is abnormal or not according to the self-checking result of the first control equipment;

3. The method according to claim 1 or 2, wherein in a case where it is determined that there is an abnormality in the first control apparatus, the method further comprises:

the first control equipment receives the switching indication information;

and the first control equipment is switched to the standby control state according to the switching indication information.

4. The method according to any one of claims 1 to 3, wherein a first control state identifier is set in the first control device, and when the first control device is in the active control state, the first control state identifier is set to a first setting value, and when the first control device is in the standby control state, the first control state identifier is set to a second setting value;

the second control device is provided with a second control state identifier, the second control state identifier is set to the first set value when the second control device is in the active control state, and the second control state identifier is set to the second set value when the second control device is in the standby control state.

5. The method of claim 4, further comprising:

the first control equipment inquires the first control state identifier and sends the inquired first control state identifier to the second control equipment;

and the second control equipment inquires the second control state identifier and sends the inquired second control state identifier to the first control equipment.

6. The method of any of claims 1 to 5, wherein before the first control device is in the active control state, the method further comprises:

the first control equipment sends a first connection signal to the central control equipment;

the first control equipment receives a first confirmation signal sent by the central control equipment and enters the active control state according to the first confirmation signal;

before the second control device is in the standby control state, the method further includes:

the second control equipment sends a second connection signal to the central control equipment;

and the second control equipment receives a second confirmation signal sent by the central control equipment and enters the standby control state according to the second confirmation signal.

7. The method according to any one of claims 1 to 6, wherein when the first control device is in the active control state, the method further comprises: the first control equipment receives a request action instruction sent by the central control equipment and sends a request parameter corresponding to the request action instruction to the central control equipment;

when the second control device is in the standby control state, the method further comprises: and the second control equipment receives the action request instruction sent by the central control equipment, but does not respond to the action request instruction.

8. A handover control system, the system comprising: the control system comprises a central control device, a first control device and a second control device, wherein the first control device is in an active control state, the second control device is in a standby control state, the active control state indicates that the control device in the active control state is used for controlling the central control device, and the standby control state indicates that the control device in the standby control state is used for maintaining communication with the central control device but not controlling the central control device;

the first control device is configured to perform handshake verification with the second control device, and send a handshake verification result of the first control device to the second control device, where the handshake verification includes one or more of frame loss detection, checksum (checksum) verification, heartbeat detection, static detection, and dynamic detection;

the second control device is configured to perform handshake verification with the first control device, receive a handshake verification result of the first control device, and determine whether the first control device is abnormal according to the handshake verification result of the first control device and the handshake verification result of the second control device;

the second control device is further configured to switch to the active control state and send switching indication information to the first control device when it is determined that the first control device is abnormal.

9. A handover control system, the system comprising: the control system comprises a central control device, a first control device and a second control device, wherein the first control device is in an active control state, the second control device is in a standby control state, the active control state indicates that the control device in the active control state is used for controlling the central control device, and the standby control state indicates that the control device in the standby control state is used for maintaining communication with the central control device but not controlling the central control device;

the first control equipment is used for self-checking and sending a self-checking result of the first control equipment to the second control equipment, wherein the self-checking comprises one or more of power supply detection, storage equipment read-write detection, hardware watchdog detection, software watchdog detection, communication overtime frame loss detection, application layer logic detection and main control chip logic detection;

the second control device is configured to receive a self-test result of the first control device, and determine whether the first control device is abnormal according to the self-test result of the first control device;

10. The system according to claim 8 or 9, wherein in the case where it is determined that there is an abnormality in the first control apparatus, the first control apparatus is further configured to:

receiving the switching indication information;

and switching to the standby control state according to the switching indication information.

11. The system according to any one of claims 8 to 10, wherein a first control state identifier is set in the first control device, and when the first control device is in the active control state, the first control state identifier is set to a first setting value, and when the first control device is in the standby control state, the first control state identifier is set to a second setting value;

12. The system according to claim 11, wherein the first control device is further configured to query the first control state identifier, and send the queried first control state identifier to the second control device;

the second control device is further configured to query the second control state identifier, and send the queried second control state identifier to the first control device.

13. The system according to any one of claims 8 to 12, wherein the first control device is further configured to send a first connection signal to the central control device, receive a first acknowledgement signal sent by the central control device, and enter the active control state according to the first acknowledgement signal;

the second control device is further configured to send a second connection signal to the central control device, receive a second acknowledgement signal sent by the central control device, and enter the standby control state according to the second acknowledgement signal;

the central control device is further configured to receive the first connection signal sent by the first control device, and send a first acknowledgement signal to the first control device according to the first connection signal; and receiving the second connection signal sent by the second control device, and sending a second confirmation signal to the second control device according to the second connection signal.

14. The system according to any one of claims 8 to 13, wherein when the first control device is in the active control state, the first control device is further configured to receive a request action instruction sent by the central control device, and send a request parameter corresponding to the request action instruction to the central control device;

when the second control device is in the standby control state, the second control device is further configured to receive the request action instruction sent by the central control device, but not respond to the request action instruction;

the central control device is further configured to send the request action instruction to the first control device and the second control device, and receive a request parameter corresponding to the request action instruction sent by the first control device or the second control device.

15. A switching control apparatus, the apparatus comprising at least one processor coupled with at least one memory:

the at least one processor configured to execute computer programs or instructions stored in the at least one memory to cause the apparatus to perform the method of any of claims 1-7.

16. A computer-readable storage medium, having stored thereon a computer program or instructions, which, when read and executed by a computer, cause the computer to perform the method of any one of claims 1 to 7.