CN115743154A

CN115743154A - Redundancy control method, device, equipment and system and automatic driving vehicle

Info

Publication number: CN115743154A
Application number: CN202211433335.3A
Authority: CN
Inventors: 李立豪
Original assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Current assignee: Beijing Baidu Netcom Science and Technology Co Ltd
Priority date: 2022-11-16
Filing date: 2022-11-16
Publication date: 2023-03-07

Abstract

The disclosure provides a redundancy control method, a redundancy control device, an electronic device, a medium, a redundancy control system and an automatic driving vehicle, and relates to the technical field of computers, in particular to the fields of automatic driving, vehicle-mounted systems and domain controllers. The implementation scheme is as follows: acquiring the current state of a first controller; in response to the current state being the first state: acquiring a state monitoring result of the second controller; determining a first target state of the first controller and switching states based on the state monitoring result; and in response to the current state being the second state, determining a second target state of the first controller and switching states based on the first event for the first controller.

Description

Redundancy control method, device, equipment and system and automatic driving vehicle

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to the field of autopilot, in-vehicle systems, and domain controllers, and in particular, to a redundancy control method, apparatus, electronic device, computer-readable storage medium, computer program product, and system.

Background

The redundancy system is a system formed by repeatedly configuring part of important components and connecting two sets of components which are the same and relatively independently configured in order to improve the safety and reliability of the system. When a component in the system fails, the redundantly configured component can take over the work of the failed component.

With the further increase of the safety requirements of automobiles, more and more Electronic components of automobiles start to adopt a redundant Control system including an Electronic Control Unit (ECU) to cope with the interference of severe environment and various factors to the Control system of the automobiles.

The approaches described in this section are not necessarily approaches that have been previously conceived or pursued. Unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section. Similarly, unless otherwise indicated, the problems mentioned in this section should not be considered as having been acknowledged in any prior art.

Disclosure of Invention

The disclosure provides a redundancy control method, a redundancy control apparatus, an electronic device, a computer-readable storage medium, a computer program product, and a system.

According to an aspect of the present disclosure, there is provided a redundancy control method applied to a first controller in a redundancy control system including the first controller and a second controller, the method including: acquiring the current state of the first controller; in response to the current state being a first state: obtaining a state monitoring result of the second controller, wherein the state monitoring result indicates whether the second controller enters the first state; determining a first target state of the first controller and switching states based on the state monitoring result, wherein the first target state is the same as the next state after the second controller enters the first state; and in response to the current state being a second state, determining a second target state of the first controller and performing state switching based on a first event for the first controller.

According to an aspect of the present disclosure, there is provided a redundant control apparatus applied to a first controller in a redundant control system including the first controller and a second controller, the apparatus including: an acquisition module configured to acquire a current state of the first controller; a first response module comprising: an obtaining unit configured to obtain a state monitoring result of the second controller in response to the current state being a first state, wherein the state monitoring result indicates whether the second controller enters the first state; a determining unit configured to determine a first target state of the first controller and perform state switching based on the state monitoring result, wherein the first target state is the same as a next state after the second controller enters the first state; and a second response module configured to determine a second target state of the first controller and perform state switching based on a first event for the first controller in response to the current state being a second state.

According to an aspect of the present disclosure, there is provided an electronic device including: at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the redundancy control method described above.

According to an aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the redundancy control method described above.

According to an aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein the computer program realizes the above redundancy control method when executed by a processor.

According to an aspect of the present disclosure, there is provided a redundancy control system including: a first controller; and a second controller communicatively connected to the first controller, wherein any one of the first controller and the second controller is configured to perform the above-described redundancy control method.

According to an aspect of the present disclosure, there is provided an autonomous vehicle including the above-described electronic apparatus.

According to one or more embodiments of the present disclosure, the reliability of a redundant control system can be improved.

It should be understood that the statements in this section do not necessarily identify key or critical features of the embodiments of the present disclosure, nor do they limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate exemplary embodiments of the embodiments and, together with the description, serve to explain the exemplary implementations of the embodiments. The illustrated embodiments are for purposes of example only and do not limit the scope of the claims. Throughout the drawings, identical reference numbers designate similar, but not necessarily identical, elements.

FIG. 1 illustrates a schematic diagram of an exemplary system in which various methods described herein may be implemented, according to an embodiment of the present disclosure;

FIG. 2 shows a flow diagram of a redundancy control method according to an embodiment of the present disclosure;

FIG. 3 illustrates a state switching diagram for a first controller, according to some embodiments of the present disclosure;

FIG. 4 shows a block diagram of a redundant control apparatus according to an embodiment of the present disclosure;

FIG. 5 shows a schematic block diagram of a redundant control system according to an embodiment of the present disclosure;

FIG. 6 illustrates a connection schematic of a first controller and a second controller, according to some embodiments of the present disclosure; and

FIG. 7 illustrates a block diagram of an exemplary electronic device that can be used to implement embodiments of the present disclosure.

Detailed Description

Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, in which various details of the embodiments of the disclosure are included to assist understanding, and which are to be considered as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope of the present disclosure. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

In the present disclosure, unless otherwise specified, the use of the terms "first", "second", and the like to describe various elements is not intended to limit the positional relationship, the temporal relationship, or the importance relationship of the elements, and such terms are used only to distinguish one element from another. In some examples, a first element and a second element may refer to the same instance of the element, and in some cases, based on the context, they may also refer to different instances.

The terminology used in the description of the various described examples in this disclosure is for the purpose of describing particular examples only and is not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the elements may be one or more. Furthermore, the term "and/or" as used in this disclosure is intended to encompass any and all possible combinations of the listed items.

The ECU, one of the core electronic components of modern automobiles, is called a "running computer". The ECU can monitor various states of the vehicle operation (such as parking, acceleration, etc.) and various data input (such as braking, gear shifting, etc.) at any time, process various information according to a pre-designed program, and transmit the processed parameters to relevant execution devices to execute various predetermined control functions.

In order to meet the safety requirement, redundant ECUs can be arranged on the vehicle, and a redundant control system comprising double ECUs is formed. One of the ECUs in the redundant control system may be a master ECU, the other ECU acting as a backup to the master ECU, i.e., a backup ECU. Compared with a control system only comprising a single ECU, the redundant control system can further guarantee the safety of the vehicle, but the complexity of the control system is increased. In this case, how to ensure the reliability of the redundant control system becomes an urgent problem to be solved.

In view of the above problems, the embodiments of the present disclosure provide a redundancy control method for a redundancy control system. The method can lead the main controller and the controller to carry out state synchronization in time and keep relatively independent running states, thereby improving the reliability and the safety of the whole system and ensuring the stable running of the system.

Embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

Fig. 1 illustrates a schematic diagram of an example system 100 in which various methods and apparatus described herein may be implemented in accordance with embodiments of the present disclosure. Referring to fig. 1, the system 100 includes a motor vehicle 110, a server 120, and one or more communication networks 130 coupling the motor vehicle 110 to the server 120.

In an embodiment of the present disclosure, motor vehicle 110 may include a redundant control system according to an embodiment of the present disclosure.

The server 120 may run one or more services or software applications. In some embodiments, the server 120 may also provide other services or software applications, which may include non-virtual environments and virtual environments. In the configuration shown in fig. 1, server 120 may include one or more components that implement the functions performed by server 120. These components may include software components, hardware components, or a combination thereof, which may be executed by one or more processors. A user of motor vehicle 110 may, in turn, utilize one or more client applications to interact with server 120 to take advantage of the services provided by these components. It should be understood that a variety of different system configurations are possible, which may differ from system 100. Accordingly, fig. 1 is one example of a system for implementing the various methods described herein, and is not intended to be limiting.

The server 120 may include one or more general purpose computers, special purpose server computers (e.g., PC (personal computer) servers, UNIX servers, mid-end servers), blade servers, mainframe computers, server clusters, or any other suitable arrangement and/or combination. The server 120 may include one or more virtual machines running a virtual operating system, or other computing architecture involving virtualization (e.g., one or more flexible pools of logical storage that may be virtualized to maintain virtual storage for the server). In various embodiments, the server 120 may run one or more services or software applications.

The computing units in server 120 may run one or more operating systems including any of the operating systems described above, as well as any commercially available server operating systems. The server 120 can also run any of a variety of additional server applications and/or mid-tier applications, including HTTP servers, FTP servers, CGI servers, JAVA servers, database servers, and the like.

In some embodiments, server 120 may include one or more applications to analyze and consolidate data feeds and/or event updates received from motor vehicle 110. Server 120 may also include one or more applications to display data feeds and/or real-time events via one or more display devices of motor vehicle 110.

Network 130 may be any type of network known to those skilled in the art that may support data communications using any of a variety of available protocols, including but not limited to TCP/IP, SNA, IPX, etc. By way of example only, the one or more networks 130 may be a satellite communication network, a Local Area Network (LAN), an ethernet-based network, a token ring, a Wide Area Network (WAN), the internet, a virtual network, a Virtual Private Network (VPN), an intranet, an extranet, a blockchain network, a Public Switched Telephone Network (PSTN), an infrared network, a wireless network (including, for example, bluetooth, wi-Fi), and/or any combination of these and other networks.

The system 100 may also include one or more databases 150. In some embodiments, these databases may be used to store data and other information. For example, one or more of the databases 150 may be used to store information such as audio files and video files. The data store 150 may be implemented in a variety of locations. For example, the data store used by the server 120 may be local to the server 120, or may be remote from the server 120 and may communicate with the server 120 via a network-based or dedicated connection. The data store 150 may be of different types. In certain embodiments, the data store used by the server 120 may be a database, such as a relational database. One or more of these databases may store, update, and retrieve data to and from the database in response to the command.

In some embodiments, one or more of the databases 150 may also be used by applications to store application data. The databases used by the application may be different types of databases, such as key-value stores, object stores, or regular stores supported by a file system.

Motor vehicle 110 may include sensors 111 for sensing the surrounding environment. The sensors 111 may include one or more of the following sensors: visual cameras, infrared cameras, ultrasonic sensors, millimeter wave radar, and laser radar (LiDAR). Different sensors may provide different detection accuracies and ranges. The camera may be mounted in front of, behind, or otherwise on the vehicle. The visual camera may capture conditions inside and outside the vehicle in real time and present to the driver and/or passengers. In addition, by analyzing the picture captured by the visual camera, information such as traffic light indication, intersection situation, other vehicle running state, and the like can be acquired. The infrared camera can capture objects under night vision conditions. The ultrasonic sensors can be arranged around the vehicle and used for measuring the distance between an object outside the vehicle and the vehicle by utilizing the characteristics of strong ultrasonic directionality and the like. The millimeter wave radar may be installed in front of, behind, or other positions of the vehicle for measuring the distance of an object outside the vehicle from the vehicle using the characteristics of electromagnetic waves. The lidar may be mounted in front of, behind, or otherwise of the vehicle for detecting object edges, shape information, and thus object identification and tracking. The radar apparatus can also measure the velocity change of the vehicle and the moving object due to the doppler effect.

Motor vehicle 110 may also include a communication device 112. The communication device 112 may include a satellite positioning module capable of receiving satellite positioning signals (e.g., beidou, GPS, GLONASS, and GALILEO) from the satellites 141 and generating coordinates based on these signals. The communication device 112 may also include modules to communicate with a mobile communication base station 142, and the mobile communication network may implement any suitable communication technology, such as current or evolving wireless communication technologies (e.g., 5G technologies) like GSM/GPRS, CDMA, LTE, etc. The communication device 112 may also have a Vehicle-to-Vehicle (V2X) networking or Vehicle-to-anything (V2X) module configured to enable, for example, vehicle-to-Vehicle (V2V) communication with other vehicles 143 and Vehicle-to-Infrastructure (V2I) communication with Infrastructure 144. Further, the communication device 112 may also have a module configured to communicate with a user terminal 145 (including but not limited to a smartphone, tablet, or wearable device such as a watch), for example, via wireless local area network using IEEE802.11 standards or bluetooth. Motor vehicle 110 may also access server 120 via network 130 using communication device 112.

Motor vehicle 110 may also include a control device 113. The control device 113 may include a processor, such as a Central Processing Unit (CPU) or a Graphics Processing Unit (GPU), or other special purpose processor, etc., in communication with various types of computer-readable storage devices or media. The control device 113 may include an autopilot system for automatically controlling various actuators in the vehicle. The autopilot system is configured to control a powertrain (not shown), a steering system, and a braking system, etc., of a motor vehicle 110 (not shown) via a plurality of actuators in response to inputs from a plurality of sensors 111 or other input devices to control acceleration, steering, and braking, respectively, without or with limited human intervention. Part of the processing functions of the control device 113 may be realized by cloud computing. For example, some processing may be performed using an onboard processor while other processing may be performed using the computing resources in the cloud. The control device 113 may be configured to perform various embodiments of a control method based on the present disclosure. Furthermore, the control apparatus 113 may be implemented as one example of a computing device on the motor vehicle side (client) according to the present disclosure.

The system 100 of fig. 1 may be configured and operated in various ways to enable application of the various methods and apparatus described in accordance with the present disclosure.

According to some embodiments, motor vehicle 110 may be divided into a plurality of control domains, such as a power domain, a chassis domain, a body domain, a cockpit domain, and an autopilot domain, which may be divided by function. Each control domain may include one or more control devices 113. According to some embodiments, the control devices 113 in each control domain may be implemented as a redundant control system including two or more controllers (e.g., ECUs). Any controller in the redundancy control system can execute the redundancy control method of the embodiment of the disclosure, so that the controller and another controller can perform state synchronization and can keep relatively independent operation, and the reliability of the whole system is improved.

FIG. 2 shows a flow diagram of a redundancy control method 200 according to an embodiment of the present disclosure. The execution subject of the steps of the method 200 may be the first controller. The first controller may be any controller in a redundant control system.

The redundant control system based on the embodiment of the present disclosure includes a first controller and a second controller, where the first controller and the second controller are mutually active and standby, that is, when the first controller is a main controller, the second controller is a slave controller, and vice versa. Thus, the execution subject (first controller) of the method 200 may be a master controller or a slave controller in a redundant control system.

As shown in FIG. 2, method 200 includes steps S210-S230.

In step S210, the current state of the first controller is acquired.

In response to the current state being the first state, steps S221 and S222 are performed.

In step S221, a state monitoring result of the second controller is acquired. The state monitoring result indicates whether the second controller enters the first state.

In step S222, based on the state monitoring result, the first target state of the first controller is determined and the state switching is performed. The first target state is the same as the next state after the second controller enters the first state.

In response to the current state being the second state, step S230 is performed.

In step S230, a second target state of the first controller is determined and state switching is performed based on the first event for the first controller.

According to the embodiment of the present disclosure, when the first controller is in the first state, the next operating state thereof is determined based on the state monitoring result of the second controller to synchronize the states of the first controller and the second controller; when the first controller is in the second state, the state switching is performed based on its own event, and the switching process is independent of the state switching process of the second controller. The redundancy control method ensures that the first controller and the second controller can timely carry out state synchronization and can also keep independent operation, thereby improving the reliability of the whole system and ensuring the stable operation of the system all the time.

The various steps of method 200 are described in detail below.

In step S210, the current state of the first controller is acquired.

According to some embodiments, the current state of the first controller may be the first state or the second state. The first state refers to a state that requires state synchronization with the second controller. The second state refers to a state in which the first controller can operate independently without state synchronization with the second controller.

When the first controller is in the first state, it is necessary to determine its next state (i.e., a first target state) according to the current state of the second controller, so that the first controller and the second controller achieve state synchronization in the first target state, that is, the first target state is the same as the next state after the second controller enters the first state.

Steps S221 and S222 are performed in response to the first controller being in the first state.

In step S221, a state monitoring result of the second controller is acquired. The state monitoring result indicates whether the second controller enters the first state. In step S222, based on the state monitoring result, the first target state of the first controller is determined and the state switching is performed. That is, the state of the first controller is switched from the first state to the first target state. The first target state is the same as the next state after the second controller enters the first state. Thereby, the first controller and the second controller may achieve state synchronization in the first target state.

According to some embodiments, the redundant control system is powered by a power supply system, and the first state may be entered in response to a second event for the power supply system. According to the embodiment, the first controller and the second controller in the redundant control system are powered by the same power supply system, so that the integration level of the system can be improved, and the system components can be maintained and replaced conveniently. The first controller and the second controller are subjected to state synchronization in a first state triggered by a second event aiming at the power supply system, so that the power conditions of the first controller and the second controller can be synchronized, the complexity of system control is reduced, and the stability of the system is improved.

According to some embodiments, the second event may include a power-up event and a power-down event.

According to some embodiments, in the case that the second event is a power-on event, the first state may be an initialization synchronization state entered after the initialization is successfully performed in response to the power-on event, that is, the first state is an initialization synchronization state. Accordingly, determining the first target state of the first controller and performing state switching based on the state monitoring result includes: and in response to the fact that the second controller enters the initialized synchronous state within the first time after the first controller enters the initialized synchronous state, determining that the first target state is the normal working state and switching the states, so that the first controller and the second controller synchronously enter the normal working state.

According to the above embodiments, the redundant control system is powered in response to a power-up event. The first controller enters an initialization state after being powered on to perform initialization (including operations of hardware self-test, software initialization and the like). The first controller enters an initialization synchronization state, i.e., a first state, after the initialization is successful. In the initialized synchronous state, the first controller determines the next state (i.e., the first target state) to which the first controller itself enters by monitoring the state of the second controller and the time at which the second controller enters the initialized synchronous state. The first time is calculated from the first controller entering the initialized synchronized state. If the second controller also enters the initialization synchronization state in the first time, the initialization synchronization is successful, and the first controller and the second controller simultaneously jump to the normal working state, so that a complete function is provided for the system. For example, the first time may be set to 30s. If the second controller also enters the initialized synchronous state within 30s after the first controller enters the initialized synchronous state, the initialized synchronous state is successful, and the first controller and the second controller synchronously enter the normal working state.

According to some embodiments, in the case that the second event is a power-on event, determining the first target state of the first controller and performing the state switching based on the state monitoring result may further include: and determining that the first target state is a degraded working state and switching the states in response to the fact that the second controller does not enter the initialized synchronous state within the first time after the first controller enters the initialized synchronous state. Namely, if the second controller does not enter the initialization synchronization state within the first time, the initialization synchronization of the first controller and the second controller fails, and the first controller is automatically switched to the degradation working state to provide the degradation function, so as to ensure that the system can safely operate. For example, the first time may be set to 30s. If the second controller does not enter the initialized synchronous state within 30s after the first controller enters the initialized synchronous state, the initialized synchronous state fails, and the first controller enters the degraded working state.

According to the above embodiment, the controller that first enters the initialized synchronous state monitors the state of the other controller in the state, and determines the state of the next jump according to the time when the other controller enters the initialized synchronous state, the setting is to prevent that the state jump cannot be realized due to a failure of any one of the two controllers, and the other controller waits too long in the initialized synchronous state to make the control system unable to provide the control function. By setting the maximum waiting time (namely the first time), in the case of failure of one controller, the other controller can enter a degraded working state to provide a degraded function for the system, thereby ensuring the safe operation of the system.

According to some embodiments, in the case where the second event is a power-down event, the first state is a power-down preamble state entered after the power-down preparation work is successfully completed in response to the power-down event, that is, the first state is a power-down preamble state. Accordingly, determining the first target state of the first controller and performing state switching based on the state monitoring result includes: and in response to the fact that the second controller enters the power-off pre-preamble state within the second time after the first controller enters the power-off pre-preamble state, determining that the first target state is the power-off state and switching the states, so that the first controller and the second controller synchronously enter the power-off state.

According to the above embodiments, the redundant control system is powered down in response to a power down event. The first controller enters a shutdown preparation state after being powered off so as to perform power-off preparation work (including operations such as memory writing and hardware shutdown). The first controller enters a power-off preamble state after power-off preparation work is successfully completed. In the power-off preamble state, the first controller determines a next state (i.e., a first target state) to which it enters by monitoring a state of the second controller and a time when the second controller enters the power-off preamble state. The second time is counted from when the first controller enters the power-off preamble state. If the second controller also enters the power-off preamble state in the second time, the power-off preamble is successful, and the first controller and the second controller are powered off simultaneously, so that the power consumption of the system is reduced. For example, the second time may be set to 30s. If the second controller enters the power-off preamble state within 30s after the first controller enters the power-off preamble state, the power-off preamble is successful, and the first controller and the second controller synchronously enter the power-off state.

According to some embodiments, in the case that the second event is a power-off event, determining the first target state of the first controller and performing the state switching based on the state monitoring result may further include: and in response to the second controller not being monitored to enter the pre-power-off preamble state within a second time after the first controller enters the pre-power-off preamble state, determining that the first target state is a sleep state and performing state switching. That is, if the second controller does not enter the power-off preamble state within the second time, the power-off preamble fails, and the first controller switches to the sleep (hibernate) state by itself, so as to reduce the system energy consumption. For example, the second time may be set to 30s. If the second controller does not enter the power-off preamble state within 30s after the first controller enters the power-off preamble state, the power-off preamble fails, and the first controller enters the sleep state by itself.

According to the embodiment, the controller which firstly enters the power-off preamble state monitors the state of the other controller in the state, and determines the state of the next jump according to the time for the other controller to enter the power-off preamble state. By setting the maximum waiting time (namely the second time), under the condition that one controller fails, the other controller can enter a dormant state to timely close corresponding systems and components, so that the energy consumption of the system is reduced.

It should be noted that the first time and the second time in the embodiment of the present disclosure may be set as needed, and the values of the first time and the second time are not limited in the present disclosure. The first time and the second time may be the same or different.

According to some embodiments, the second state is an independent operational state of the first controller. In the case where the first controller is in the second state, the first controller can operate independently, and the state switching is performed based on its own event (i.e., the first event) without being synchronized with the state of the second controller. That is, in the case where the first controller is in the second state, the switching process of the first controller is independent of the state switching process of the second controller. It can be understood that the second state is an independent working state of the first controller, and at this time, the two controllers are in relatively independent operating states, so that the flexibility of the system can be improved.

In response to the first controller being in the second state, step S230 is performed.

According to some embodiments, the second state may comprise at least one of: an initialization state, a normal operating state, a degraded operating state, a sleep state, a fault state, a development state, or a shutdown preparation state.

In the initialization state, the first controller performs initialization after startup.

Under normal operating conditions, the first controller is capable of providing full functionality.

In the degraded operating state, the functionality provided by the first controller is limited. The first controller provides less functionality and less complexity in the degraded operating state than in the normal operating state.

In the sleep state, only the storage device in the first controller is powered on, and other circuits are powered off, so that the power consumption can be reduced and the power can be saved.

In a fault condition, the first controller is unable to provide functionality.

In the development state, a developer or tester may configure hardware or software of the first controller.

In the shutdown preparation state, the first controller performs preparation work before shutdown.

According to some embodiments, the first event may be a system request sent based on management requirements, such as a sleep request, a wake-up request, a reset request, and a mode switch request (e.g., a switch between developer mode and user mode), among others. The first event may also be a system failure event of the first controller itself, such as a temporary failure due to electromagnetic interference or poor contact, or a failure due to hardware such as a self sensor. The first event may also be a current state of the second controller being monitored and switching of the state thereof being performed based on the monitored state. The first event and the corresponding switching condition may be set according to the requirement, and are not limited herein.

According to some embodiments, determining the second target state of the first controller and performing the state switching based on the first event for the first controller in case that the second state is the initialization state comprises: and acquiring the current working mode of the first controller, responding to the fact that the current working mode is a developer mode, determining that the second target state is a development state, and switching the states. According to this embodiment, a developer mode can be provided for the redundant control system. When in developer mode, the first controller enters a development state to support pre-delivery development and testing requirements of a product (e.g., motor vehicle 110 shown in FIG. 1). In a development state, a higher safety level can be opened according to requirements so as to facilitate the testing of some limit working conditions.

According to some embodiments, the redundant control system is configured as a domain controller system of the vehicle, thereby being capable of improving the reliability of the domain controller system and ensuring the safe operation of the vehicle.

According to some embodiments, either one of the first controller and the second controller is a master controller and the other controller is a slave controller in a redundant control system. That is, when the first controller is a master controller, the second controller is a slave controller, and vice versa. A redundant control system may include a plurality of primary controllers and corresponding secondary controllers, whereby the motor vehicle may be controlled to perform a variety of different functions.

Based on the redundancy control method 200, fig. 3 illustrates a state switching diagram of a first controller (the state switching diagram of a second controller is the same as the first controller) according to some embodiments of the present disclosure. The state-switching diagram shown in fig. 3 can be understood as a state machine for any controller in a redundant system.

As shown in FIG. 3, the states of the first controller include an initialization state (Init) 310, an initialization synchronization state (initSyn) 320, a Normal operating state (Normal) 330, a Sleep state (Sleep) 340, a power Off ready state (PreOff) 350, a power Off preamble state (OffSyn) 360, a power Off state (Off) 370, a fault state (Error) 380, a degraded operating state (Limit) 390, and a development state (Product) 311.

In response to the redundant control system powering up, the first controller enters an initialization state 310. In the initialization state 310, the first controller performs operations such as hardware initialization self-test and software initialization. If the initialization is successful, the initialization synchronization state 320 is entered, and if the initialization is failed, the state is switched to the failure state 380. If the current working mode of the system is detected to be the developer mode, the system is switched to the development state 311.

When the first controller is in the development state 311, a higher level of safety may be enabled according to test requirements to facilitate testing of some extreme conditions. In this state, if a shutdown request is received, a switch is made to the shutdown preparation state 350.

When the first controller is in the initialization synchronization state 320, the initialization synchronization of the master controller and the slave controller is performed, so as to achieve the purpose of simultaneously entering a normal working state to provide functions for the system. Starting from the first controller entering this state, if it is detected that the second controller also enters the initialization synchronization state 320 within a specified maximum waiting time (corresponding to the above first time), the controller jumps to the normal operation state 330 together with the second controller. If the second controller is not monitored to enter the initialized synchronous state 320 within the specified maximum waiting time, the controller automatically jumps to the degraded operating state 390.

When the first controller is in the normal operating state 330, the master and slave controllers are all in the full function mode. In this state, if the first controller detects that the related components such as its hardware or sensor have failed, it switches to the failure state 380. If a sleep request from the system is received, the system switches to the sleep state 340. If the second controller is monitored to be in the fault state 380, the system switches to the degraded operation state 390 by itself.

When the first controller is in the sleep state 340, only some necessary components (e.g., memory, hard disk, etc.) are operated, and power consumption under certain conditions is reduced. In this state, if a wake-up request of the system is received, the system jumps to the normal operating state 330. If a shutdown request from the system is received, the system jumps to a shutdown preparation state 350 to prepare for shutdown.

When the first controller is in the shutdown preparation state 350, the corresponding memory write operation and the hardware shutdown operation are executed, and in this state, if a reset request of the system is received, the software reset is executed, and the system jumps to the initialization state 310. If the reset request of the system is not received, after the memory write operation and the hardware shutdown operation are completed, the system jumps to a power-off pre-synchronization state 360 to prepare for shutdown.

When the first controller is in the power-off preamble state 360, the main controller and the sub controller are power-off preamble to achieve the purpose of power-off simultaneously. Starting from the first controller entering this state, if it is detected that the second controller also enters the power-off pre-preamble state 360 within a prescribed maximum waiting time (corresponding to the second time above), the second controller is switched to the power-off state 370 together with the first controller to complete power-off. If the second controller is not monitored to enter the power-off preamble state 360 within the specified maximum wait time, it will sleep itself. At this time, the second controller that is not dormant will also switch to the dormant state immediately because it cannot receive the communication information of the dormant first controller, so that the first controller and the second controller synchronously enter the shutdown state 370.

After the first controller enters the power-off state 370, it needs to wait for the next system power-on.

The first controller is in the failure state 380 indicating that it is unable to recover from the failure within the current duty cycle (one duty cycle from system power up to system shutdown). And if the first controller receives a shutdown request of the system in the state, jumping to a shutdown preparation state to prepare for shutdown.

The reason the first controller enters the degraded operational state 390 is that the second controller is in a fault state, a communication signal, or is itself capable of providing only degraded functionality due to hardware such as sensors. If the first controller enters the degraded operating state 390 due to a temporary fault, such as a self electromagnetic interference or a poor contact, the first controller can switch to the normal operating state 330 after the temporary fault is removed. If the first controller fails permanently in the degraded operating state 390 and cannot be recovered in the current operating cycle, the first controller switches to the failed state 380. If the first controller receives a sleep request of the system in this state, it switches to the sleep state 340.

It is to be understood that, for the convenience of understanding the redundancy control method according to the embodiments of the present disclosure, the operating states and the state switching conditions of the redundancy control system are only exemplary, and the specific state settings and switching conditions may be set and changed according to actual situations.

According to an embodiment of the present disclosure, a redundancy control apparatus is also provided. Fig. 4 shows a block diagram of a redundancy control apparatus 400 according to an embodiment of the present disclosure. As shown in fig. 4, the apparatus 400 includes an obtaining module 410, a first responding module 420 and a second responding module 430, wherein the first responding module 420 includes an obtaining unit 421 and a determining unit 422.

The acquisition module 410 is configured to acquire a current state of the first controller.

The first response module 420 includes: an obtaining unit 421 configured to obtain a state monitoring result of the second controller in response to the current state being the first state, wherein the state monitoring result indicates whether the second controller enters the first state; the determining unit 422 is configured to determine a first target state of the first controller and perform state switching based on the state monitoring result, where the first target state is the same as a next state after the second controller enters the first state.

The second response module 430 is configured to determine a second target state of the first controller and perform state switching based on the first event for the first controller in response to the current state being the second state.

According to some embodiments, the redundant control system is powered by a power system, and the first state is entered in response to a second event for the power system.

According to some embodiments, the second event comprises a power-on event, the first state comprises an initialization synchronization state entered in response to the power-on event being initialized successfully, and the determining unit 421 is further configured to: and in response to the fact that the second controller enters the initialized synchronous state within the first time after the first controller enters the initialized synchronous state, determining that the first target state is the normal working state and switching the states, so that the first controller and the second controller synchronously enter the normal working state.

According to some embodiments, the determining unit 421 is further configured to: in response to the fact that the second controller is not monitored to enter the initialized synchronous state within the first time after the first controller enters the initialized synchronous state, determining that the first target state is the degraded working state and switching the states

According to some embodiments, the second event comprises a power-down event, the first state comprises a power-down preamble state entered in response to the power-down event successfully completing the power-down preparation work, the determining unit 421 is further configured to: and in response to the fact that the second controller enters the power-off pre-preamble state within the second time after the first controller enters the power-off pre-preamble state, determining that the first target state is the power-off state and switching the states, so that the first controller and the second controller synchronously enter the power-off state.

According to some embodiments, the determining unit 421 is further configured to: in response to the second controller not entering the power-off preamble state within a second time after the first controller enters the power-off preamble state, determining that the first target state is the sleep state and performing the state switch.

It should be understood that the various modules or units of the apparatus 400 shown in fig. 4 may correspond to the various steps in the method 200 described in fig. 2. Thus, the operations, features and advantages described in the method 200 above are equally applicable to the apparatus 400 and the various modules and units included therein. Certain operations, features and advantages may not be described in detail herein for the sake of brevity.

Although specific functionality is discussed above with reference to particular modules, it should be noted that the functionality of the various modules discussed herein may be divided into multiple modules and/or at least some of the functionality of multiple modules may be combined into a single module.

It should also be understood that the various techniques described herein may be implemented in software, hardware, elements, or program modules. The various modules described above in fig. 4 may be implemented in hardware or in hardware in combination with software and/or firmware. For example, the modules may be implemented as computer program code/instructions configured to be executed in one or more processors and stored in a computer-readable storage medium. Alternatively, the modules may be implemented as hardware logic/circuitry. For example, in some embodiments, one or more of the modules 410-430 may be implemented together in a System on a Chip (SoC). The SoC may include an integrated circuit chip (which includes one or more components of a Processor (e.g., a Central Processing Unit (CPU), microcontroller, microprocessor, digital Signal Processor (DSP), etc.), memory, one or more communication interfaces, and/or other circuitry), and may optionally execute received program code and/or include embedded firmware to perform functions.

According to an embodiment of the present disclosure, there is also provided an electronic apparatus including: at least one processor; and a memory communicatively coupled to the at least one processor, the memory storing instructions executable by the at least one processor, the instructions being executable by the at least one processor to enable the at least one processor to perform the redundancy control method of the disclosed embodiments.

There is also provided, in accordance with an embodiment of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform a redundancy control method of an embodiment of the present disclosure.

There is also provided, in accordance with an embodiment of the present disclosure, a computer program product, including a computer program, which when executed by a processor, implements the redundancy control method of an embodiment of the present disclosure.

According to an embodiment of the present disclosure, a redundant control system is also provided. The redundant control system includes a first controller and a second controller communicatively coupled to the first controller. Wherein any one of the first controller and the second controller is configured to perform the redundancy control method of the embodiments of the present disclosure.

According to an embodiment of the present disclosure, there is also provided an autonomous vehicle including the above-described electronic device. It will be appreciated that the autonomous vehicle also includes the redundant control system described above.

FIG. 5 shows a schematic block diagram of a redundant control system according to an embodiment of the present disclosure. As shown in fig. 5, the redundancy control system 500 includes: a first controller 510; and a second controller 520 communicatively coupled to the first controller 510, wherein any one of the first controller 510 and the second controller 520 is configured to perform the redundancy control method 200 of the disclosed embodiment.

According to some embodiments of the present disclosure, the first controller 510 and the second controller 520 are a primary controller and a secondary controller, respectively, in the redundant control system 500, i.e., when the first controller 510 is the primary controller of the redundant control system, the second controller 520 is the secondary controller of the redundant control system, and vice versa. Redundant control systems provide functionality for a vehicle (e.g., motor vehicle 110 in fig. 1) most of the time by a primary controller, and when the primary controller fails, the corresponding functionality is provided by a secondary controller. The main controller and the sub-controller may be identical or similar in structure, but may differ in processing speed and capacity.

Fig. 6 illustrates a connection schematic of a first controller to a second controller, according to some embodiments of the present disclosure. As shown in fig. 6, the first controller 610 and the second controller 620 communicate with each other through an SPI (Serial Peripheral Interface) communication method. Based on the communication of the first controller 610 with the second controller 620, the first controller 610 or the second controller 620 may implement the redundancy control method 200 of the embodiments of the present disclosure. In the embodiment shown in FIG. 6, the first controller 610 is a primary controller and the second controller 620 is a secondary controller in the redundant control system 600.

The SPI interface is a full-duplex three-wire synchronous serial peripheral interface, and adopts a Master-Slave (Master-Slave) architecture. The data from the first controller 610 or the second controller 620 is synchronized on the rising or falling edge of the clock so that the data can be transferred between the two controllers at the same time. As shown in fig. 6, CS 611 and CS 621 are chip select signal pins, and can be fixed to low level, i.e., active low. SCLK 612 and SCLK622 are clock signal pins, and data or signals transmitted between the first controller 610 and the second controller 620 are synchronized with the clock signal generated by the first controller 610.

Data in the first controller 610 is transmitted to the second controller 620 through the MOSI 613 pin and the SDI 623 pin, for example, the first controller 610 may send its status monitoring result to the second controller 620 through the MOSI 613 pin, and the second controller 620 receives the status monitoring result sent by the first controller 610 through the SDI 623 pin. Meanwhile, the data in the second controller 620 is transmitted to the first controller 610 through the MISO 614 pin through the SDO 624 pin, for example, the second controller 620 may transmit its own status monitoring result to the first controller 610 through the SDO 624 pin, and the first controller 610 receives the status monitoring result transmitted from the second controller 620 through the MISO 614 pin. Based on the status monitoring result of the other, the first controller 610 and the second controller 620 may perform corresponding status synchronization or status switching operations to implement the redundancy control method 200 according to an embodiment of the present disclosure.

In SPI communication, the master and slave controllers may select a clock polarity and a clock phase. According to the selection of the clock polarity and the clock phase (the clock polarity may be 1 or 0, and the clock phase may be 1 or 0), there are four SPI modes in total. The data transmitted through the SPI is typically related data in the underlying hardware library, such as synchronization data, and the like, and can be further configured according to specific needs.

According to some embodiments of the present disclosure, the first Controller and the second Controller may communicate with each other through a CAN (Controller Area Network) communication manner. Based on the communication of the first controller 610 with the second controller 620, the first controller 610 or the second controller 620 may implement the redundancy control method 200 of the embodiments of the present disclosure. The communication mode via the CAN bus CAN be complementary to the SPI communication mode. The SPI communication mode is mainly used for bottom layer synchronization, and the CAN communication mode CAN be used for application layer synchronization. The CAN communication mode is a fixed period signal transmission mode, and the signal comprises a variable value signal related to the system state. For example, the controller can determine the working state of the main controller at the moment through the variable signal value sent by the main controller, and the information also serves as one of the determination conditions for the state switching of the controller, and vice versa. In this way, the main controller and the slave controller can acquire the state of the other side in real time, so that the state of the main controller and the slave controller can be maintained according to the actual situation.

It CAN be understood that the communication mode between the first controller and the second controller is not limited to the SPI communication mode and the CAN communication mode mentioned above, and details are not repeated here.

Referring to fig. 7, a block diagram of a structure of an electronic device 700, which may be a server or a client of the present disclosure, which is an example of a hardware device that may be applied to aspects of the present disclosure, will now be described. Electronic device is intended to represent various forms of digital electronic computer devices, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the disclosure described and/or claimed herein.

As shown in fig. 7, the electronic device 700 includes a computing unit 701, which may perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM) 702 or a computer program loaded from a storage unit 708 into a Random Access Memory (RAM) 703. In the RAM703, various programs and data necessary for the operation of the electronic device 700 can be stored. The computing unit 701, the ROM 702, and the RAM703 are connected to each other by a bus 704. An input/output (I/O) interface 705 is also connected to bus 704.

A number of components in the electronic device 700 are connected to the I/O interface 705, including: an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 may be any type of device capable of inputting information to the electronic device 700, and the input unit 706 may receive input numeric or character information and generate key signal inputs related to user settings and/or function controls of the electronic device, and may include, but is not limited to, a mouse, a keyboard, a touch screen, a track pad, a track ball, a joystick, a microphone, and/or a remote controller. The output unit 707 may be any type of device capable of presenting information, and may include, but is not limited to, a display,Speakers, video/audio output terminals, vibrators, and/or printers. Storage unit 708 may include, but is not limited to, magnetic or optical disks. The communication unit 709 allows the electronic device 700 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and/or a chipset, such as bluetooth ^TM Devices, 802.11 devices, wi-Fi devices, wiMAX devices, cellular communication devices, and/or the like.

Computing unit 701 may be a variety of general and/or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various dedicated Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, and so forth. The computing unit 701 performs the various methods and processes described above, such as the method 200. For example, in some embodiments, the method 200 may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 700 via the ROM 702 and/or the communication unit 709. When the computer program is loaded into RAM703 and executed by the computing unit 701, one or more steps of the method 200 described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the method 200 by any other suitable means (e.g., by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.

Program code for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program code, when executed by the processor or controller, causes the functions/acts specified in the flowchart and/or block diagram to be performed. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic, speech, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), the internet, and blockchain networks.

The computer system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server may be a cloud server, a server of a distributed system, or a server with a combined blockchain.

It should be understood that various forms of the flows shown above, reordering, adding or deleting steps, may be used. For example, the steps described in the present disclosure may be performed in parallel, sequentially or in different orders, and are not limited herein as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved.

Although embodiments or examples of the present disclosure have been described with reference to the accompanying drawings, it is to be understood that the methods, systems, and apparatus described above are merely exemplary embodiments or examples and that the scope of the present disclosure is not limited by these embodiments or examples, but only by the claims as issued and their equivalents. Various elements in the embodiments or examples may be omitted or may be replaced with equivalents thereof. Further, the steps may be performed in an order different from that described in the present disclosure. Further, the various elements in the embodiments or examples may be combined in various ways. It is important that as technology evolves, many of the elements described herein may be replaced with equivalent elements that appear after the present disclosure.

Claims

1. A redundant control method for use with a first controller in a redundant control system that includes the first controller and a second controller, the method comprising:

acquiring the current state of the first controller;

in response to the current state being a first state:

acquiring a state monitoring result of the second controller, wherein the state monitoring result indicates whether the second controller enters the first state; and

determining a first target state of the first controller and switching states based on the state monitoring result, wherein the first target state is the same as the next state after the second controller enters the first state;

and

and in response to the current state being a second state, determining a second target state of the first controller and performing state switching based on a first event for the first controller.

2. The method of claim 1, wherein the redundant control system is powered by a power system, the first state being entered in response to a second event for the power system.

3. The method of claim 2, wherein the second event comprises a power-up event, the first state comprises an initialization synchronization state entered in response to the power-up event being initialized successfully, and the determining a first target state of the first controller and performing state switching based on the state monitoring result comprises:

and in response to monitoring that the second controller enters the initialized synchronous state within the first time after the first controller enters the initialized synchronous state, determining that the first target state is a normal working state and switching the states, so that the first controller and the second controller synchronously enter the normal working state.

4. The method of claim 3, wherein the determining a first target state of the first controller and switching states based on the state monitoring result further comprises:

and in response to that the second controller is not monitored to enter the initialized synchronous state within the first time after the first controller enters the initialized synchronous state, determining that the first target state is a degraded working state and switching the states.

5. The method of any of claims 2-4, wherein the second event comprises a power-down event, the first state comprises a power-down preamble state entered in response to the power-down event successfully completing power-down preparation work, and the determining and state switching the first target state of the first controller based on the state monitoring result comprises:

and in response to monitoring that the second controller enters the power-off pre-preamble state within a second time after the first controller enters the power-off pre-preamble state, determining that the first target state is the power-off state and performing state switching, so that the first controller and the second controller synchronously enter the power-off state.

6. The method of claim 5, wherein the determining a first target state of the first controller and switching states based on the state monitoring result further comprises:

determining that the first target state is a sleep state and performing a state switch in response to the second controller not entering the power-down-preamble state within a second time after the first controller enters the power-down-preamble state.

7. The method of any of claims 1-6, wherein the second state is a stand-alone state of operation of the first controller.

8. The method of claim 7, wherein the second state comprises at least one of:

an initialization state, a normal operating state, a degraded operating state, a sleep state, a fault state, a development state, or a shutdown preparation state.

9. The method of claim 8, wherein the second state comprises the initialization state, and wherein determining a second target state for the first controller and switching states based on a first event for the first controller comprises:

acquiring a current working mode of the first controller; and

and determining the second target state as the development state and switching the states in response to the current working mode being a developer mode.

10. The method of any of claims 1-9, wherein the redundant control system is configured as a domain controller system of a vehicle.

11. A redundant control apparatus for use with a first controller in a redundant control system that includes the first controller and a second controller, the apparatus comprising:

an acquisition module configured to acquire a current state of the first controller;

a first response module comprising:

an obtaining unit configured to obtain a state monitoring result of the second controller in response to the current state being a first state, wherein the state monitoring result indicates whether the second controller enters the first state; and

a determining unit configured to determine a first target state of the first controller and perform state switching based on the state monitoring result, wherein the first target state is the same as a next state after the second controller enters the first state;

and

a second response module configured to determine a second target state of the first controller and perform state switching based on a first event for the first controller in response to the current state being a second state.

12. The apparatus of claim 11, wherein the redundant control system is powered by a power system, the first state being entered in response to a second event for the power system.

13. The apparatus of claim 12, wherein the second event comprises a power-up event, the first state comprises an initialization synchronization state entered in response to the power-up event being initialized successfully, the determination unit is further configured to:

and in response to the fact that the second controller is monitored to enter the initialized synchronous state within the first time after the first controller enters the initialized synchronous state, determining that the first target state is a normal working state and performing state switching so as to enable the first controller and the second controller to synchronously enter the normal working state.

14. The apparatus of claim 13, wherein the determining unit is further configured to:

15. The apparatus according to any of claims 12-14, wherein the second event comprises a power-down event, the first state comprises a power-down preamble state entered in response to the power-down event successfully completing power-down preparation work, the determining unit is further configured to:

and in response to monitoring that the second controller enters the power-off pre-synchronization state within a second time after the first controller enters the power-off pre-synchronization state, determining that the first target state is a power-off state and performing state switching so that the first controller and the second controller synchronously enter the power-off state.

16. The apparatus of claim 15, wherein the determining unit is further configured to:

determining that the first target state is a sleep state and performing a state switch in response to the second controller not entering the power down preamble state within a second time after the first controller enters the power down preamble state.

17. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-10.

18. A non-transitory computer readable storage medium having stored thereon computer instructions for causing a computer to perform the method of any one of claims 1-10.

19. A computer program product comprising a computer program, wherein the computer program realizes the method of any one of claims 1-10 when executed by a processor.

20. A redundant control system comprising:

a first controller; and

a second controller communicatively coupled to the first controller,

wherein any of the first controller and the second controller is configured to perform the method of any of claims 1-10.

21. An autonomous vehicle comprising the electronic device of claim 17.