CN114201332A - Redundancy control method, device, chip and storage medium - Google Patents
Redundancy control method, device, chip and storage medium Download PDFInfo
- Publication number
- CN114201332A CN114201332A CN202210156913.7A CN202210156913A CN114201332A CN 114201332 A CN114201332 A CN 114201332A CN 202210156913 A CN202210156913 A CN 202210156913A CN 114201332 A CN114201332 A CN 114201332A
- Authority
- CN
- China
- Prior art keywords
- chip
- redundant
- application message
- main chip
- main
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0736—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function
- G06F11/0739—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function in a data processing system embedded in automotive or aircraft systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0751—Error or fault detection not based on redundancy
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0793—Remedial or corrective actions
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Hardware Redundancy (AREA)
Abstract
The application provides a redundancy control method, a redundancy control device, a chip and a storage medium, wherein a main chip sends a first application message under the condition that the main chip has no fault, and the main chip inhibits a redundancy chip through a GPIO (general purpose input/output) interface; under the condition that the main chip has a fault, the main chip does not send the first application message any more, and the fault of the main chip cannot control GPIO, so that the suppression of the redundant chip is cancelled, the redundant chip can send the second application message, and the method realizes that only the main chip sends the message when the main chip has no fault, the main chip does not send the first application message when the main chip has a fault, only the redundant chip sends the second application message, namely only one of the main chip and the redundant chip can send the message to control the vehicle, an arbitration module is not required to be added for message arbitration, and the development cost is reduced.
Description
Technical Field
The present application relates to the field of automotive communications technologies, and in particular, to a redundancy control method, device, chip, and storage medium.
Background
The navigation-assisted driving is an L2 level automatic driving function of a deep fusion navigation system and a high-precision map. On most highway sections, such as expressways, urban elevated roads and the like in the coverage area of the high-precision map, automatic auxiliary driving from a point A to a point B can be realized according to a navigation route set by a user, and the driver is allowed to leave hands momentarily and is close to the level L3 for automatic driving. When a system of the automatic driving vehicle breaks down, the system enters a minimum risk strategy, firstly, a driver is prompted to take over the vehicle to enter a manual driving mode, and if the driver does not take over the vehicle after the prompt, the vehicle is decelerated and stopped actively. In order to implement a minimum risk strategy, redundant control is generally designed for some links of automatic driving, specifically including links of environment sensing, positioning, planning, control, execution, power supply, communication and the like. The redundancy control aims to actively switch to a redundancy control chip and enter a minimum risk strategy when a vehicle is subjected to navigation-assisted driving and if the main control chip fails and is restarted.
In the prior art, a redundant chip is added on the basis of a main chip to realize redundant control, generally, when the main chip works normally, the application message sending of the redundant chip is inhibited, and when the main chip fails, the application message sending inhibiting the redundant chip is rapidly cancelled, so that the application message sent by the redundant chip controls the navigation assistant driving of a vehicle. However, after the application message for suppressing the redundant chip is cancelled, the redundant chip sends the redundant application message, and the main chip also sends the application message which is a default value, so that in order to enable the redundant chip to control the navigation assistant driving of the vehicle, a message arbitration module is added to arbitrate the application message sent by the main chip and the application message sent by the redundant chip, and the application message of the redundant chip is forwarded to an actuator of the vehicle, so as to control the navigation assistant driving of the vehicle. In the prior art, the arbitration module is required to arbitrate the main chip application message and the redundant chip application message, so that the development cost is increased, and the control of the production cost of the whole vehicle is not facilitated.
Disclosure of Invention
The present application mainly aims to provide a redundancy control method, an apparatus, a main chip and a storage medium, and aims to solve the technical problem that when a main chip fails in the prior art, an application message is simultaneously sent by the redundant chip and the main chip, and an arbitration module needs to be used to arbitrate the application message of the redundant chip and the application message of the main chip.
In a first aspect, the present application provides a redundancy control method, comprising:
if the main chip has no fault, the main chip sends a first application message and inhibits a redundant chip so that the redundant chip does not send a second application message, wherein the main chip inhibits the redundant chip through a GPIO interface;
and if the main chip fails, the main chip does not send the first application message, and the suppression on the redundant chip is cancelled, so that the redundant chip sends the second application message.
In some embodiments, if the main chip fails, the main chip does not send the first application packet, and cancels suppression on the redundant chip, so that after the redundant chip sends the second application packet, the method further includes:
after the main chip is eliminated, the main chip monitors the redundant chip in real time and judges whether the redundant chip sends the second application message or not;
if the redundant chip has sent the second application message, the main chip inhibits itself from sending the first application message;
and if the redundant chip does not send the second application message, the main chip inhibits the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
In some embodiments, the method further comprises: when the main chip has no fault, the main chip monitors the redundant chip in real time before sending the first application message, and judges whether the redundant chip sends the second application message;
if the redundant chip has sent the second application message, the main chip inhibits itself from sending the first application message;
and if the redundant chip does not send the second application message, the main chip inhibits the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
In some embodiments, in the initialization stage of the main chip, the main chip only sends a main chip network management packet and does not send the first application packet, and the redundant chip only sends a redundant chip network management packet and does not send the second application packet.
In some embodiments, the main chip suppressing the redundant chip through a GPIO interface includes:
and the main chip controls the GPIO interface to inhibit a message register of the redundant chip so that the redundant chip does not send the second application message.
In some embodiments, if the main chip fails, the main chip does not send the first application packet, and cancels suppression on the redundant chip, so that after the redundant chip sends the second application packet, the method further includes:
and restarting the main chip, and determining that the main chip has a fault to be eliminated if the main chip is restarted successfully.
In some embodiments, if the main chip fails, the main chip does not send the first application packet, and cancels suppression on the redundant chip, so that after the redundant chip sends the second application packet, the method further includes:
sending a vehicle taking over reminder to the driver;
and if the driver does not take over the vehicle within the preset time, controlling the vehicle to decelerate so as to enable the vehicle to stop at the side.
In a second aspect, the present application further provides a redundancy control apparatus, which is used in a main chip, the apparatus including:
and the message control module is used for sending a first application message and inhibiting a redundant chip through a GPIO (general purpose input/output) interface if the main chip has no fault so as to ensure that the redundant chip does not send a second application message, and if the main chip has a fault, not sending the first application message and canceling the inhibition on the redundant chip so as to ensure that the redundant chip sends the second application message.
In some embodiments, the message control module is further configured to monitor the redundant chip in real time after the failure of the main chip is eliminated, and determine whether the redundant chip has sent the second application message;
if the redundant chip has sent the second application message, inhibiting the redundant chip from not sending the first application message;
and if the redundant chip does not send the second application message, inhibiting the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
In some embodiments, the message control module is further configured to, when the main chip has no fault and before the first application message is sent, monitor the redundant chip in real time, and determine whether the redundant chip has sent the second application message;
if the redundant chip has sent the second application message, inhibiting the redundant chip from not sending the first application message;
and if the redundant chip does not send the second application message, inhibiting the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
In some embodiments, the message control module is further configured to, in the initialization stage of the main chip, send only a main chip network management message and not send the first application message, and enable the redundant chip to send only a redundant chip network management message and not send the second application message.
In some embodiments, the message control module is further configured to control the GPIO interface to suppress a message register of the redundant chip, so that the redundant chip does not send the second application message.
In some embodiments, the redundancy control device is further configured to restart the master chip, and determine that the master chip has a failure removed if the master chip is successfully restarted.
In some embodiments, the redundant control device is further configured to issue a take over vehicle alert to the driver;
and if the driver does not take over the vehicle within the preset time, controlling the vehicle to decelerate so as to enable the vehicle to stop at the side.
The application provides a redundancy control method, a redundancy control device, a chip and a storage medium, wherein under the condition that a main chip has no fault, the main chip sends a first application message, and the main chip inhibits and inhibits a redundancy chip through a GPIO (general purpose input/output) interface; under the condition that the main chip has a fault, the main chip does not send the first application message any more, and the fault of the main chip cannot control GPIO, so that the suppression of the redundant chip is cancelled, the redundant chip can send the second application message, and the method realizes that only the main chip sends the message when the main chip has no fault, the main chip does not send the first application message when the main chip has a fault, only the redundant chip sends the second application message, namely only one of the main chip and the redundant chip can send the message to control the vehicle, an arbitration module is not required to be added for message arbitration, and the development cost is reduced.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a network topology diagram involved in a redundancy control method;
fig. 2 is a schematic flowchart of a redundancy control method according to an embodiment of the present application;
FIG. 3 is a timing diagram of a redundancy control method;
the implementation, functional features and advantages of the objectives of the present application will be further explained with reference to the accompanying drawings.
Detailed Description
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some, but not all, embodiments of the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
The flow diagrams depicted in the figures are merely illustrative and do not necessarily include all of the elements and operations/steps, nor do they necessarily have to be performed in the order depicted. For example, some operations/steps may be decomposed, combined or partially combined, so that the actual execution sequence may be changed according to the actual situation.
The embodiment of the application provides a redundancy control method, a redundancy control device, a chip and a storage medium. The redundant control device can be applied to a chip, and the chip can be arranged in an automatic driving controller ADCU.
Some embodiments of the present application will be described in detail below with reference to the accompanying drawings. The embodiments described below and the features of the embodiments can be combined with each other without conflict.
As shown in fig. 1, the MCU1 is a main chip, the MCU2 is a redundant chip, both the main chip and the redundant chip are disposed in the ADCU, and are used for controlling the vehicle during navigation-assisted driving of the vehicle, the main chip CAN send a first application message CAN1 capable of controlling the vehicle, the redundant chip CAN send a second application message CAN2 having the same function as the first application message, the second application message is a redundant message of the first application message, a gateway is disposed outside the ADCU, and the first application message and the second application message are both forwarded through the gateway after being sent. The gateway can forward the first application message to other control units such as the actuator unit and the like for realizing the control of the vehicle, or forward the second application message for realizing the redundant control of the vehicle. The following describes a specific method for sending the first application message by the main chip and the second application message by the redundant chip in the present invention.
Referring to fig. 2, fig. 2 is a schematic flowchart illustrating a redundancy control method according to an embodiment of the present application.
As shown in fig. 2, the method includes steps S1 through S2.
Step S1, if the main chip has no fault, the main chip sends a first application message and inhibits the redundant chip so that the redundant chip does not send a second application message, wherein the main chip inhibits the redundant chip through a GPIO interface;
step S2, if the main chip fails, the main chip does not send the first application packet, and cancels the suppression of the redundant chip, so that the redundant chip sends the second application packet.
Preferably, before the step S1 and the step S2, the method further includes determining that the master chip generates a fault, where the fault generated by the master chip in the present embodiment is mainly a failure fault.
It should be noted that the GPIO interface is an abbreviation of General-purpose input/output (General-purpose) interface. The main chip and the redundant chip are respectively provided with a GPIO interface, and the GPIO interface on the main chip is connected with the GPIO interface on the redundant chip through a lead. When the GPIO interface of the main chip is in a high level 1 state, the register of the redundant chip can be inhibited, and the redundant chip cannot send out a second application message after being inhibited. When the GPIO interface of the main chip is in a low level '0' or 'communication loss' state, the redundant chip is not inhibited, and the redundant chip can send out a second sending application message.
Specifically, when the main chip has no fault, the main chip can send a first application message outwards to realize control over the vehicle; meanwhile, the GPIO interface of the main chip is in a high-level 1 state, the redundant chip is restrained, the redundant chip cannot send a second application message, and only the first application message is sent out at the moment. When the main chip fails, the main chip does not send the first application message any more and cannot continue to control the vehicle; meanwhile, as the fault of the main chip can not control the GPIO interface of the main chip, the GPIO interface of the main chip can not inhibit the register of the redundant chip any more, and the redundant chip can not inhibit the register of the redundant chip any more, and then starts to send a second application message to take over control of the vehicle.
Further, after the main chip fails, the main chip attempts to eliminate the failure through self restarting, if the main chip is restarted successfully, the main chip failure is determined to be eliminated, and if the main chip is restarted unsuccessfully, the main chip failure is determined not to be eliminated. Because the control capability is lost after the main chip fails, and the redundant chip can send the second application message after not being inhibited by the GPIO of the main chip, after the main chip is restarted and successfully recovers to normal, the main chip can monitor the redundant chip in real time and judge whether the redundant chip sends the second application message. If the main chip monitors that the redundant chip sends the second application message after the fault is recovered, the main chip inhibits the main chip from sending the first application message, so that only the second application message is sent out to control the vehicle. And if the main chip detects that the redundant chip does not send the second application message after the fault is recovered, the main chip is controlled to be in a high level 1 state to inhibit the redundant chip, and the first application message is sent to control the vehicle.
As a preferred embodiment, after the vehicle initialization is finished, and in the case that the main chip has no fault, the main chip also monitors the redundant chip in real time before sending the first application message, and determines whether the redundant chip sends the second application message. If the main chip monitors that the redundant chip sends the second application message before sending the first application message, the main chip inhibits the main chip from not sending the first application message, and only the second application message is sent out to control the vehicle. And if the main chip detects that the redundant chip does not send the second application message before sending the first application message, the main chip sends the first application message to control the vehicle after the redundant chip cannot send the second application message by controlling the GPIO interface of the main chip to be in a high level 1 state to restrain the redundant chip.
From the above, it can be seen that only the first application message is sent when the main chip has no fault, only the second application message is sent when the main chip has a fault, and the main chip realizes that only the message of one chip is sent out when the main chip has a fault or does not have a fault by inhibiting the sending of the message of the redundant chip or inhibiting the sending of the message of the main chip.
As a preferred embodiment, while the redundant chip sends the second application message to control the vehicle, the controller also controls to send a vehicle taking-over reminder to the driver, and the controller exits the navigation assistance driving after the driver takes over the vehicle for manual driving. If the driver does not take over the vehicle after the vehicle taking over reminding is sent out for more than the preset time, the vehicle is controlled to actively decelerate until the vehicle is stopped by the safe side.
As shown in fig. 3, the entire control flow is explained in conjunction with the control timing. The IG represents an ignition state of the vehicle, and when the IG is in a non-ignition OFF state, both the main chip MCU1 and the redundant chip MCU2 are in an inoperative state. After the vehicle is ignited, the main chip and the redundant chip enter an initialization stage, message registers of the main chip and the redundant chip are driven and then are in a forbidden state, the main chip only sends a network management message of the main chip and does not send a first application message, the redundant chip only sends a network management message of the redundant chip and does not send a second application message so as to avoid control conflict of the main chip and the redundant chip on the vehicle, and the GPIO of the main chip is in a non-started state. After the initialization of the main chip and the redundant chip is completed, the main chip does not generate failure fault, the message register of the main chip is in an available Enable state, the GPIO interface of the main chip is in a high-level 1 state, the GPIO interface of the main chip CAN generate an inhibiting effect on the register of the redundant chip to Enable the register of the redundant chip to be in a Disable state, at the moment, the main chip CAN send a first application message CAN1, and the register of the redundant chip is inhibited from sending a second application message CAN 2. When the main chip fails, the main chip cannot control the GPIO interface, the GPIO interface of the main chip cannot inhibit the redundant chip when being in a low level 0 state, the register of the redundant chip is in an available Enable state after the register of the redundant chip is not inhibited any more, the redundant chip sends out a second application message, and meanwhile, the main chip can inhibit the main chip from not sending out the first application message. After the main chip generates a fault and the redundant chip takes over the vehicle to send out a second application message, the main chip starts to restart, namely reinitialize, the message register of the main chip is also redriven, if the fault of the main chip is not eliminated after restarting, the message register of the main chip is still in a Disable state after redriving, the main chip does not send out the first application message, and the redundant chip continues to send out the second application message until the vehicle is flameout. If the main chip is restarted successfully, the main chip monitors that the redundant chip sends the second application message, then the main chip inhibits the register of the main chip to enable the register of the main chip to be in a forbidden state, the first application message is not sent, and the redundant chip continues to send the second application message until the vehicle is flameout.
The embodiment of the application provides a redundancy control device, which is used in a main chip and comprises:
and the message control module is used for sending a first application message and inhibiting a redundant chip through a GPIO (general purpose input/output) interface if the main chip has no fault so as to ensure that the redundant chip does not send a second application message, and if the main chip has a fault, not sending the first application message and canceling the inhibition on the redundant chip so as to ensure that the redundant chip sends the second application message.
The message control module is further configured to: after the fault of the main chip is eliminated, monitoring the redundant chip in real time, and judging whether the redundant chip sends the second application message or not;
if the redundant chip has sent the second application message, inhibiting the redundant chip from not sending the first application message;
and if the redundant chip does not send the second application message, inhibiting the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
The message control module is further configured to: when the main chip has no fault and before the first application message is sent, monitoring the redundant chip in real time and judging whether the redundant chip sends the second application message or not;
if the redundant chip has sent the second application message, inhibiting the redundant chip from not sending the first application message;
and if the redundant chip does not send the second application message, inhibiting the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
The message control module is further configured to: and in the initialization stage of the main chip, only sending a network management message of the main chip and not sending the first application message, and enabling the redundant chip to only send a network management message of the redundant chip and not send the second application message.
The message control module is further configured to: and controlling the GPIO interface to inhibit a message register of the redundant chip so that the redundant chip does not send the second application message.
The redundancy control apparatus is further configured to: and restarting the main chip, and if the main chip is restarted successfully, determining that the main chip has a fault and is eliminated.
The redundancy control apparatus is further configured to: sending a vehicle taking over reminder to the driver;
and if the driver does not take over the vehicle within the preset time, controlling the vehicle to decelerate so as to enable the vehicle to stop at the side.
It should be noted that, as will be clear to those skilled in the art, for convenience and brevity of description, the specific working processes of the apparatus and the modules and units described above may refer to the corresponding processes in the foregoing embodiments, and are not described herein again.
The embodiment of the application provides a main chip, the main chip comprises a storage unit, a processing unit and a control program which is stored in the storage unit and can be executed by the processing unit, and the processing module is used for providing calculation and control capacity for the main chip and supporting the operation of the main chip. The control program in the storage medium of the storage unit provides an execution environment. The redundancy control apparatus provided in the above embodiment may be implemented in the form of a control program, where the control program may be run on the main chip, and the main chip may run the control program to implement the steps of the redundancy control method described above.
In one embodiment, the master chip is configured to implement the following steps:
if the main chip has no fault, the main chip sends a first application message and inhibits a redundant chip so that the redundant chip does not send a second application message, wherein the main chip inhibits the redundant chip through a GPIO interface;
and if the main chip fails, the main chip does not send the first application message, and the suppression on the redundant chip is cancelled, so that the redundant chip sends the second application message.
In one embodiment, the main chip does not send the first application packet if the main chip fails, and cancels suppression of the redundant chip, so that after the redundant chip sends the second application packet, the main chip is configured to:
after the fault of the main chip is eliminated, the main chip monitors the redundant chip in real time and judges whether the redundant chip sends the second application message or not;
if the redundant chip has sent the second application message, the main chip inhibits itself from sending the first application message;
and if the redundant chip does not send the second application message, the main chip inhibits the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
In one embodiment, the master chip is further configured to implement: when the main chip has no fault, the main chip monitors the redundant chip in real time before sending the first application message, and judges whether the redundant chip sends the second application message;
if the redundant chip has sent the second application message, the main chip inhibits itself from sending the first application message;
and if the redundant chip does not send the second application message, the main chip inhibits the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
In one embodiment, the master chip is further configured to implement: and in the initialization stage of the main chip, controlling the main chip to only send a main chip network management message and not to send the first application message, and enabling the redundant chip to only send a redundant chip network management message and not to send the second application message.
In one embodiment, when the main chip implements that the main chip suppresses the redundant chip through a GPIO interface, the main chip is configured to implement:
and controlling the GPIO interface to inhibit a message register of the redundant chip so that the redundant chip does not send the second application message.
In one embodiment, the main chip does not send the first application packet and cancels suppression of the redundant chip if the main chip fails, so that after the redundant chip sends the second application packet, the main chip is configured to: and restarting the main chip, and if the main chip is restarted successfully, determining that the main chip has a fault and is eliminated.
In one embodiment, if the main chip fails, the main chip does not send the first application packet, and cancels suppression of the redundant chip, so that after the redundant chip sends the second application packet, the main chip is further configured to:
sending a vehicle taking over reminder to the driver;
and if the driver does not take over the vehicle within the preset time, controlling the vehicle to decelerate so as to enable the vehicle to stop at the side.
The embodiment of the present application further provides a storage medium, where a control program is stored on the storage medium, where the control program includes control instructions, and when the control instructions are executed, the implementation method may refer to various embodiments of the present application.
In the description of the present invention, it should be noted that the terms "upper", "lower", and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings, which are only for convenience in describing the present invention and simplifying the description, but do not indicate or imply that the referred device or element must have a specific orientation, be constructed in a specific orientation, and operate, and thus, should not be construed as limiting the present invention. Unless expressly stated or limited otherwise, the terms "mounted," "connected," and "connected" are intended to be inclusive and mean, for example, that they may be fixedly connected, detachably connected, or integrally connected; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meanings of the above terms in the present invention can be understood by those of ordinary skill in the art according to specific situations.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or system. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or system that comprises the element.
The above-mentioned serial numbers of the embodiments of the present application are merely for description and do not represent the merits of the embodiments. While the invention has been described with reference to specific embodiments, the scope of the invention is not limited thereto, and those skilled in the art can easily conceive various equivalent modifications or substitutions within the technical scope of the invention. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (10)
1. A redundancy control method, comprising the steps of:
if the main chip has no fault, the main chip sends a first application message and inhibits a redundant chip so that the redundant chip does not send a second application message, wherein the main chip inhibits the redundant chip through a GPIO interface;
and if the main chip fails, the main chip does not send the first application message, and the suppression on the redundant chip is cancelled, so that the redundant chip sends the second application message.
2. The redundancy control method according to claim 1, wherein if the primary chip fails, the primary chip does not send the first application packet and cancels suppression of the redundant chip, so that after the redundant chip sends the second application packet, the method further comprises:
after the fault of the main chip is eliminated, the main chip monitors the redundant chip in real time and judges whether the redundant chip sends the second application message or not;
if the redundant chip has sent the second application message, the main chip inhibits itself from sending the first application message;
and if the redundant chip does not send the second application message, the main chip inhibits the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
3. The redundancy control method according to claim 1, further comprising:
when the main chip has no fault, the main chip monitors the redundant chip in real time before sending the first application message, and judges whether the redundant chip sends the second application message;
if the redundant chip has sent the second application message, the main chip inhibits itself from sending the first application message;
and if the redundant chip does not send the second application message, the main chip inhibits the redundant chip so that the redundant chip does not send the second application message and sends the first application message.
4. The redundancy control method according to claim 1, further comprising:
and in the initialization stage of the main chip, the main chip only sends a main chip network management message and does not send the first application message, and the redundant chip only sends a redundant chip network management message and does not send the second application message.
5. The redundancy control method of claim 1, wherein said master chip disabling said redundant chip through a GPIO interface, comprises:
and the main chip controls the GPIO interface to inhibit a message register of the redundant chip so that the redundant chip does not send the second application message.
6. The redundancy control method according to claim 1, wherein if the primary chip fails, the primary chip does not send the first application packet and cancels suppression of the redundant chip, so that after the redundant chip sends the second application packet, the method further comprises:
and restarting the main chip, and determining that the main chip has a fault to be eliminated if the main chip is restarted successfully.
7. The redundancy control method according to claim 1, wherein if the primary chip fails, the primary chip does not send the first application packet and cancels suppression of the redundant chip, so that after the redundant chip sends the second application packet, the method further comprises:
sending a vehicle taking over reminder to the driver;
and if the driver does not take over the vehicle within the preset time, controlling the vehicle to decelerate so as to enable the vehicle to stop at the side.
8. A redundant control apparatus for use in a primary chip, said apparatus comprising:
and the message control module is used for sending a first application message and inhibiting a redundant chip through a GPIO (general purpose input/output) interface if the main chip has no fault so as to ensure that the redundant chip does not send a second application message, and if the main chip has a fault, not sending the first application message and canceling the inhibition on the redundant chip so as to ensure that the redundant chip sends the second application message.
9. A master chip, characterized in that the master chip comprises a storage unit, a processing unit, and a control program stored in the storage unit and executable by the processing unit, wherein the control program, when executed by the processing unit, implements the steps of the redundancy control method according to any one of claims 1 to 7.
10. A storage medium having a control program stored thereon, wherein the control program when executed implements the steps of the redundancy control method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210156913.7A CN114201332A (en) | 2022-02-21 | 2022-02-21 | Redundancy control method, device, chip and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210156913.7A CN114201332A (en) | 2022-02-21 | 2022-02-21 | Redundancy control method, device, chip and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114201332A true CN114201332A (en) | 2022-03-18 |
Family
ID=80645745
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210156913.7A Pending CN114201332A (en) | 2022-02-21 | 2022-02-21 | Redundancy control method, device, chip and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114201332A (en) |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5957985A (en) * | 1996-12-16 | 1999-09-28 | Microsoft Corporation | Fault-resilient automobile control system |
| CN104553835A (en) * | 2013-10-24 | 2015-04-29 | 三星泰科威株式会社 | Method for controlling vehicle driving |
| CN108351815A (en) * | 2015-11-12 | 2018-07-31 | 西门子股份公司 | Method for running multi-core processor |
| CN109032021A (en) * | 2018-08-07 | 2018-12-18 | 中国航空工业集团公司雷华电子技术研究所 | A kind of application method of the double MCU warm back-up control systems of redundancy |
| CN109445975A (en) * | 2018-10-18 | 2019-03-08 | 新华三技术有限公司 | Abnormality eliminating method, logic device and member device |
| CN110737192A (en) * | 2019-11-20 | 2020-01-31 | 东风商用车有限公司 | Automobile driving redundancy control system and method thereof |
| CN111007713A (en) * | 2019-07-10 | 2020-04-14 | 沈阳中科一唯电子技术有限公司 | Heterogeneous redundant vehicle control unit conforming to functional safety |
| CN113050475A (en) * | 2021-02-24 | 2021-06-29 | 北京航空航天大学 | CAN and 1553b dual-redundancy architecture design method based on VPX |
| CN113848950A (en) * | 2021-10-21 | 2021-12-28 | 广州文远知行科技有限公司 | Controller control method and device, vehicle and storage medium |
| CN113895451A (en) * | 2021-10-27 | 2022-01-07 | 东风汽车集团股份有限公司 | Safety redundancy and fault diagnosis system and method based on automatic driving system |
-
2022
- 2022-02-21 CN CN202210156913.7A patent/CN114201332A/en active Pending
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5957985A (en) * | 1996-12-16 | 1999-09-28 | Microsoft Corporation | Fault-resilient automobile control system |
| CN104553835A (en) * | 2013-10-24 | 2015-04-29 | 三星泰科威株式会社 | Method for controlling vehicle driving |
| CN108351815A (en) * | 2015-11-12 | 2018-07-31 | 西门子股份公司 | Method for running multi-core processor |
| US20180322001A1 (en) * | 2015-11-12 | 2018-11-08 | Siemens Aktiengesellschaft | Methods for operating multicore processors |
| CN109032021A (en) * | 2018-08-07 | 2018-12-18 | 中国航空工业集团公司雷华电子技术研究所 | A kind of application method of the double MCU warm back-up control systems of redundancy |
| CN109445975A (en) * | 2018-10-18 | 2019-03-08 | 新华三技术有限公司 | Abnormality eliminating method, logic device and member device |
| CN111007713A (en) * | 2019-07-10 | 2020-04-14 | 沈阳中科一唯电子技术有限公司 | Heterogeneous redundant vehicle control unit conforming to functional safety |
| CN110737192A (en) * | 2019-11-20 | 2020-01-31 | 东风商用车有限公司 | Automobile driving redundancy control system and method thereof |
| CN113050475A (en) * | 2021-02-24 | 2021-06-29 | 北京航空航天大学 | CAN and 1553b dual-redundancy architecture design method based on VPX |
| CN113848950A (en) * | 2021-10-21 | 2021-12-28 | 广州文远知行科技有限公司 | Controller control method and device, vehicle and storage medium |
| CN113895451A (en) * | 2021-10-27 | 2022-01-07 | 东风汽车集团股份有限公司 | Safety redundancy and fault diagnosis system and method based on automatic driving system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9740178B2 (en) | Primary controller designation in fault tolerant systems | |
| US9952948B2 (en) | Fault-tolerance pattern and switching protocol for multiple hot and cold standby redundancies | |
| CN102658801B (en) | Controller area network (CAN) system network management method for new energy vehicle | |
| JP5240260B2 (en) | Electronic control device for vehicle | |
| US20060276947A1 (en) | Electronic control apparatus for vehicle | |
| JP2018177103A (en) | Automatic drive control system for vehicle | |
| US20100098095A1 (en) | Routing method in in-vehicle gateway device | |
| JP5607219B2 (en) | Automotive communication systems | |
| JP2010285001A (en) | Electronic control system and functional agency method | |
| JP2010172137A (en) | Charge controller of hybrid vehicle | |
| CN114201332A (en) | Redundancy control method, device, chip and storage medium | |
| JP2010023556A (en) | Electronic control device | |
| CN111791702B (en) | Method and device for processing instrument indicator lamp, vehicle and storage medium | |
| MX2007010679A (en) | Intelligent driver module for controlling operation of a fuel pump. | |
| CN109263574B (en) | Finished automobile power supply mode redundancy control system and method | |
| CN116494893A (en) | Vehicle control method and device based on functional safety mechanism and central computing architecture | |
| JP2010023727A (en) | Control system and control device | |
| JP6120171B2 (en) | Electronic control unit | |
| JP5407757B2 (en) | Electronic device, power management device, and control method | |
| JP7503013B2 (en) | Electronic control device and method for starting electronic control device | |
| JP3923274B2 (en) | Collision information storage device | |
| JP5764043B2 (en) | Vehicle control system | |
| CN115805964A (en) | Redundant control system and method for automatic driving vehicle and vehicle | |
| WO2024122023A1 (en) | Control system for vehicle | |
| CN112799370B (en) | Control device, and vehicle-mounted system software restoration method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20220318 |