CN117485353A

CN117485353A - Automobile electronic and electric architecture, control method and vehicle

Info

Publication number: CN117485353A
Application number: CN202311501321.5A
Authority: CN
Inventors: 韩三楚; 张鹏; 蒋峰; 黄杰
Original assignee: Chongqing Changan Automobile Co Ltd
Current assignee: Chongqing Changan Automobile Co Ltd
Priority date: 2023-11-10
Filing date: 2023-11-10
Publication date: 2024-02-02

Abstract

The invention provides an automobile electronic and electric architecture, a control method and a vehicle, comprising the following steps: the central computing unit, the main area controller, at least one redundant area controller, the sensing unit and the control unit; the main area controller and at least one redundant area controller are connected in a ring shape; the central computing unit comprises a main chip and a redundant chip; the main chip and the redundant chip are respectively and jointly connected with the sensing unit; the main chip is connected with the main area controller and is used for sending a control instruction to the main area controller based on the data of the sensing unit; the redundant chip is connected with the redundant area controller and is used for sending a control instruction to the redundant area controller based on the data of the sensing unit after the link where the main area controller is located fails; the control unit is respectively connected with the main area controller and the redundant area controller and is used for controlling the running state of the vehicle based on the control instruction. The two decision systems are operated respectively, so that the complexity of the architecture system is reduced, and meanwhile, the safety of advanced intelligent driving is improved.

Description

Automobile electronic and electric architecture, control method and vehicle

Technical Field

The invention relates to the technical field of automobiles, in particular to an automobile electronic and electric architecture, a control method and a vehicle.

Background

The electronic and electric architecture is the core of an electric automobile, and the level of the electronic and electric architecture of one automobile directly influences the response speed of each function of the whole automobile, the safety degree, the possibility of carrying functions, the cost of a controller and a wire harness and the like.

The traditional distributed domain architecture is designed completely depending on the safety level of a key execution system, and is only suitable for low-order automatic driving function requirements.

Under the high-order intelligent driving scene, unmanned scene needs to be considered, and the traditional electronic and electric architecture can not meet the driving safety.

Disclosure of Invention

In view of the foregoing, embodiments of the present invention are directed to providing an automotive electronic and electrical architecture, a control method, and a vehicle that overcome or at least partially solve the foregoing problems.

In order to achieve the above purpose, the technical scheme adopted by the invention is as follows:

in a first aspect, embodiments of the present application disclose an automotive electronics electrical architecture comprising:

the central computing unit, the main area controller, at least one redundant area controller, the sensing unit and the control unit;

the main area controller and the at least one redundant area controller are connected in an annular mode;

The computing unit comprises a main chip and a redundant chip; the main chip and the redundant chip are respectively and commonly connected with the sensing unit; the main chip is connected with the main area controller and is used for sending a control instruction to the main area controller based on the data of the sensing unit; the redundant chip is connected with the redundant area controller and is used for sending a control instruction to the redundant area controller based on the data of the sensing unit after the link where the main area controller is located fails; the control unit is respectively connected with the main area controller and the redundant area controller and is used for controlling the running state of the vehicle based on the control instruction.

Optionally, the sensing unit includes: a main sensing unit and a redundant sensing unit; the control unit includes: a main control unit and a redundant control unit;

the main chip is connected with the main sensing unit, and the main area controller is connected with the main control unit;

the redundant chip is connected with the redundant sensing unit, and the redundant area controller is connected with the redundant control unit.

Optionally, the at least one redundant area controller includes: a first redundant area controller and a second redundant area controller;

The first end of the central computing unit is connected with the first end of the main area controller, the second end of the main area controller is connected with the first end of the second redundant area controller, the second end of the second redundant area controller is connected with the first end of the first redundant area controller, and the second end of the first redundant area controller is connected with the second end of the central computing unit.

Optionally, the method further comprises:

a main power supply and a redundant power supply;

and a third end of the second redundant area controller is connected with the main power supply, and a fourth end of the second redundant area controller is connected with the redundant power supply.

Optionally, the main power supply is connected with the main area controller, the central computing unit, the main sensing unit and the main control unit;

the redundant power supply is connected with the redundant area controller, the central computing unit, the redundant sensing unit and the redundant control unit.

Optionally, the main area controller and the at least one redundant area controller are connected through a bus; the bus includes: a first bus and a second bus;

the main control unit is connected to the first bus, and the redundant control unit is connected to the second bus.

Optionally, when the main area controller and the central computing unit communicate through a main link, the central computing unit and the main area controller support the same network protocol;

when the main area controller and the central computing unit communicate through a redundant link, the central computing unit, the main area controller and at least one redundant area controller support the same network protocol.

Optionally, the main sensing unit includes: at least one of radar, map and camera;

the redundant sensing unit includes: at least one of a redundant radar and a redundant camera;

the main control unit includes: a brake controller, a steering controller and a power controller;

the redundancy control unit includes: redundant brake controller, redundant steering controller and redundant power controller.

Optionally, the method further comprises: a third redundant area controller;

the third redundant area controller, the main area controller, the second redundant area controller and the first redundant area controller are connected in an annular mode.

In a second aspect, embodiments of the present application disclose a control method, the method including:

receiving sensing data acquired by a sensing unit and generating a control instruction based on the sensing data;

Under the condition that the main area controller is normal, the control instruction is sent to the main area controller through the main chip, so that the main area controller controls the running state of the vehicle based on the control instruction and the control unit;

and when the main area controller fails, the control instruction is sent to the redundant area controller through the redundant chip, so that the redundant area controller controls the running state of the vehicle based on the control instruction and the control unit.

In a third aspect, embodiments of the present application disclose a vehicle comprising: the automotive electronics and electrical architecture of the first aspect.

In a fourth aspect, embodiments of the present application disclose a control device, the device comprising:

the receiving module is used for receiving the sensing data acquired by the sensing unit and generating a control instruction based on the sensing data;

the first control module is used for sending the control instruction to the main area controller through the main chip under the condition that the main area controller is normal, so that the main area controller controls the running state of the vehicle based on the control instruction and the control unit;

and the second control module is used for sending the control instruction to the redundant area controller through the redundant chip under the condition that the main area controller fails, so that the redundant area controller controls the running state of the vehicle based on the control instruction and the control unit.

In a fifth aspect, embodiments of the present application disclose an electronic device comprising a processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions implementing the steps of the method according to the second aspect when executed by the processor.

In a fifth aspect, embodiments of the present application disclose a readable storage medium having stored thereon a program or instructions which when executed by a processor implement the steps of the method according to the second aspect.

In this embodiment of the application, the automotive electronics electrical architecture includes: the central computing unit, the main area controller, at least one redundant area controller, the sensing unit and the control unit; the main area controller and at least one redundant area controller are connected in a ring shape; the central computing unit comprises a main chip and a redundant chip; the main chip and the redundant chip are respectively and jointly connected with the sensing unit; the main chip is connected with the main area controller and is used for sending a control instruction to the main area controller based on the data of the sensing unit; the redundant chip is connected with the redundant area controller and is used for sending a control instruction to the redundant area controller based on the data of the sensing unit after the link where the main area controller is located fails; the control unit is respectively connected with the main area controller and the redundant area controller and is used for controlling the running state of the vehicle based on the control instruction. The application designs two sets of redundant perception decision systems, perception fusion calculation is carried out on a central computing unit, the two sets of perception fusion systems are respectively realized based on a main chip and a redundant chip, the main chip and the redundant chip are independent, and mutual verification can be realized. The main area controller and the redundant area controller are respectively positioned in a set of perception decision system. The control strategy of the transverse and longitudinal movement of the vehicle can be realized through the main area controller. Likewise, the redundant area controller may also implement a control strategy for lateral and longitudinal movement of the vehicle. Through the architecture design of the intelligent driving system, two decision systems respectively operate, so that the complexity of the architecture system is reduced, and meanwhile, the safety of advanced intelligent driving is improved.

Drawings

FIG. 1 is an electrical architecture for an automotive electronics system according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a communication mode of an electronic and electric architecture of an automobile according to an embodiment of the present invention;

fig. 3 is a schematic diagram of a switch configuration according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a control method according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of another control method according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a redundant power supply provided by an embodiment of the present invention;

FIG. 7 is a block diagram of a control device according to an embodiment of the present invention;

FIG. 8 is a block diagram of an electronic device provided by an embodiment of the present application;

fig. 9 is a block diagram of yet another electronic device provided by an embodiment of the present application.

Detailed Description

Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

Referring to fig. 1, which shows an automotive electronics electrical architecture provided in an embodiment of the present application, includes: a central computing unit, a main area controller VIU1, at least one redundant area controller (VIU 2, VIU3, VIU 4), a sensing unit and a control unit; the main area controller and at least one redundant area controller are connected in a ring shape; the central computing unit comprises a main chip and a redundant chip; the main chip and the redundant chip are respectively and jointly connected with the sensing unit; the main chip is connected with the main area controller VIU1 and is used for sending a control instruction to the main area controller based on the data of the sensing unit; the redundant chip is connected with the redundant area controller VIU2 and is used for sending a control instruction to the redundant area controller based on the data of the sensing unit after the link where the main area controller is located fails; the control unit is respectively connected with the main area controller and the redundant area controller and is used for controlling the running state of the vehicle based on the control instruction.

Specifically, referring to fig. 1, fig. 1 shows an automotive electronic and electrical architecture diagram provided in an embodiment of the present application, where a central computing unit may include a main chip and a redundant chip, the main chip may provide services for a sensing decision system 1 in fig. 1, the redundant chip may provide services for a sensing decision system 2 in fig. 1, the sensing decision system 1 and the sensing decision system 2 may be two decision systems that operate separately, the sensing decision system 1 is used to implement control of a driving state through a main link, and the sensing decision system 2 is used to implement control of the driving state through a redundant link. The primary link may be a link between the primary zone controller VIU1 and the central computing unit and the redundant link may be a link between the redundant zone controller VIU2 and the central computing unit. Both links can implement control strategies for lateral and longitudinal movement of the vehicle.

Referring to fig. 1, in the present application, a main area controller and at least one redundant area controller are annularly connected, in fig. 1, a main area controller and three redundant area controllers are taken as an example, wherein a first end of a redundant area controller VIU4 is connected with one end of a main area controller VIU1, the other end of the main area controller VIU1 is connected with one end of a redundant area controller VIU3, the other end of the redundant area controller VIU3 is connected with one end of a redundant area controller VIU2, and the other end of the redundant area controller VIU2 is connected with the other end of the redundant area controller VIU 4. The two zone controllers may be connected by way of an ethernet connection. The looped network architecture can fully play the advantages of the communication speed of the gigabit Ethernet and convert the advantages of redundant communication speed into the advantages of the reliability and the safety of the functions. In addition, the number of the redundant area controllers may be set according to the actual situation, and if the number of the redundant area controllers may be 1, 2 or more, the embodiment of the present application is not limited herein. If a redundant area controller VIU2 is taken as an example, two ends of the main area controller VIU1 may be respectively connected to two ends of the redundant area controller VIU2 to form a ring network architecture. Taking two redundant area controllers as an example, a ring network architecture can be formed by connecting the main area controller VIU1, the redundant area controller VIU2 and the redundant area controller VIU3 end to end. And so on, the ring network architecture between the redundant area controllers and the main area controller can be realized.

If the ethernet connection between the main area controller VIU1 and the redundant area controller VIU3 fails, so that the communication between the main area controller VIU1 and the redundant area controller VIU3 is abnormal, data transmission can be performed through the paths of the main area controller VIU1, the redundant area controller VIU4, the redundant area controller VIU2 and the redundant area controller VIU 3. The electronic and electric architecture with communication redundancy is provided by the annular structure of the gigabit Ethernet, so that high safety and high real-time performance of communication are ensured.

Further, the main chip and the redundant chip are respectively and commonly connected with the sensing unit, that is, as shown in fig. 1, the automatic driving sensing unit and the automatic driving redundant sensing unit are commonly formed into the sensing unit in the application, the automatic driving sensing unit can provide sensing data for the sensing decision system 1 of the main chip, the automatic driving redundant sensing unit can provide sensing data for the sensing decision system 2 of the redundant chip, and the main chip or the redundant chip can calculate the received sensing data to generate a control instruction. In addition, the automatic driving sensing unit and the automatic driving redundant sensing unit can communicate with the main chip and the redundant chip, so that the main chip or the redundant chip can monitor the working state of the sensing unit to avoid latent failure.

A human driving intelligent driving control strategy is deployed in the main area controller VIU1, a human driving intelligent driving redundant control strategy is deployed in the redundant area controller VIU2, and under the condition that the main link is normal, the main chip can send a control instruction to the main area controller VIU1 based on the data of the sensing unit; the main area controller VIU1 converts the control command into specific information such as steering, braking, etc., and releases the information to the actuator, which is a mechanism that performs operations such as braking, steering, etc. Under the condition that the main link fails, the redundant chip can send a control instruction to the redundant area controller VIU2 based on the data of the sensing unit; the redundant area controller VIU2 converts the control command into specific information such as steering, braking, etc. to release the information to the actuator, and performs operations such as braking, steering, etc. It should be noted that, the main area controller VIU1 and the redundant area controller VIU2 may be checked with each other to obtain the state of the other party, and if the redundant area controller VIU2 checks to obtain that the main area controller VIU1 fails, the control link is switched to the driving state of the redundant link control vehicle.

In summary, the application designs two sets of redundant perception decision systems, and the perception fusion calculation is performed in the central computing unit, wherein the two sets of perception fusion systems are respectively realized based on a main chip and a redundant chip, and the main chip and the redundant chip are independent and can realize mutual verification. The main area controller and the redundant area controller are respectively positioned in a set of perception decision system. The control strategy of the transverse and longitudinal movement of the vehicle can be realized through the main area controller. Likewise, the redundant area controller may also implement a control strategy for lateral and longitudinal movement of the vehicle. Through the architecture design of the intelligent driving system, two decision systems respectively operate, so that the complexity of the architecture system is reduced, and meanwhile, the safety of advanced intelligent driving is improved.

Optionally, the sensing unit includes: a main sensing unit and a redundant sensing unit; the control unit includes: a main control unit and a redundant control unit; the main chip is connected with the main sensing unit, and the main area controller is connected with the main control unit; the redundant chip is connected with the redundant sensing unit, and the redundant area controller is connected with the redundant control unit.

Specifically, referring to fig. 1, the main sensing unit may be the autopilot sensor of fig. 1, the redundant sensing unit may be the autopilot redundant sensor of fig. 1, and referring to fig. 2, the main sensing unit S103 may include: the redundant sensing unit S102 may include a portion such as a laser radar, a camera, a radar, a high-precision map, and the like. The main sensing unit S101 and the redundant sensing unit S102 directly access sensor data in the central domain controller for sensing processing. The main sensing unit S101 is connected to a main ai+ computing unit (main chip) of the central computing unit, and the redundant sensing unit S102 is connected to a redundant ai+ computing unit (redundant chip) of the central computing platform as a backup of S101, so as to form sensing redundancy. Meanwhile, the state sensed by the redundant sensing unit S102 can be informed to the main chip in real time, so that latent failure is avoided.

Further, referring to fig. 1 and 2, the control unit includes: a main control unit and a redundant control unit; the main control unit may include: steering controller, braking controller and rear-drive controller; the redundancy control unit may include: steering redundancy controller, braking redundancy controller and rear-drive redundancy controller. S106 is used as a braking system in the actuating mechanism, and the braking and redundant braking controllers are simultaneously connected into the VIU1 and the VIU2, so that the redundant independent requirement is met. S106 is used as a braking system in the actuating mechanism, and the braking and redundant braking controllers are simultaneously connected into the VIU1 and the VIU2, so that the redundant independent requirement is met. S107 is used as a steering system in the executing mechanism, and the steering controller and the redundant steering controller are simultaneously connected into the VIU1 and the VIU2, so that the redundant independent requirement is met. S108 is used as a power system in the actuating mechanism, the precursor controller and the rear-drive controller are redundant, and are simultaneously connected with the VIU1 and the VIU2, so that the redundant independence requirement is met.

In the application, the power, steering and braking controllers are respectively connected to 2 different CAN lines, and the two CAN lines are simultaneously connected to the two VIUs. The brake and the brake redundancy, the steering and the steering redundancy, and the precursor and the rear drive are respectively hung on different CAN channels, and any one VIU+1 CAN line module CAN realize transverse and longitudinal control so as to avoid common cause failure caused by CAN channel faults. The main CAN and the redundant CAN of the power chassis are simultaneously connected to the VIU1 and the VIU2, and the VIU1/VIU2 CAN carry out real-time check and monitoring on the information of the main CAN and the redundant CAN, so that a rapid diagnosis and post-processing strategy is realized aiming at abnormality or signal loss.

Optionally, referring to fig. 1, the at least one redundant area controller includes: a first redundant area controller and a second redundant area controller; the first end of the central computing unit is connected with the first end of the main area controller VIU1, the second end of the main area controller VIU1 is connected with the first end of the second redundant area controller VIU3, the second end of the second redundant area controller VIU3 is connected with the first end of the first redundant area controller VIU2, and the second end of the first redundant area controller VIU1 is connected with the second end of the central computing unit.

Specifically, referring to fig. 2, S103 is a central computing unit, and an AI unit+computing unit (main chip) in the main control link that satisfies ASIL D (security level) is responsible for processing the sensing data and planning and deciding, and bears a real-time computing hub in a normal state in the present architecture. The inside of the platform is electrically isolated to form an AI unit and a computing unit (redundant chip) which meet ASIL B and serve as a redundant link. When the primary link fails, the redundancy takes over the central computing platform immediately and makes planning and decisions to enter the Fail-Operation security state.

The intelligent driving control strategy and the control strategy of the intelligent driving control system are deployed in the VIU, decision arbitration can be realized in the VIU by the intelligent driving control strategy and the intelligent driving control strategy, the VIU is used as a whole vehicle motion control and decision center, and the complexity of mutual verification between controllers for respectively sending the intelligent driving control instruction and the intelligent driving control instruction by different controllers is reduced, so that the safety is improved.

Optionally, referring to fig. 1, further includes: a main power supply and a redundant power supply; a third terminal of the second redundant area controller VIU3 is connected to the main power supply, and a fourth terminal of the second redundant area controller VIU3 is connected to the redundant power supply DCDC.

Optionally, the main power supply is connected with the main area controller VIU1, the central computing unit, the main sensing unit and the main control unit; the redundant power supply is connected with the redundant area controller VIU2, the central computing unit, the redundant sensing unit and the redundant control unit.

Specifically, the application also relates to a redundant power supply scheme, the whole vehicle load is distributed on two independent loops to supply power, wherein like a central computing unit realizes two-way input, in other loads with redundant demands, a main functional load is connected into a main loop, a redundant functional load is connected into a redundant loop, the main loop is a loop supported by a main power supply, the redundant loop is a loop supported by the redundant power supply, and a quick isolation device VIU3 is added into the two loops to realize main and auxiliary isolation, namely, an area controller VIU3 is connected between the main power supply and the redundant power supply, so that main and auxiliary isolation is realized.

Correspondingly, both loops are provided with a power supply to independently supply power to the loops, so that the problem that the power supply end is affected by the under-voltage fault synchronization after the loop breaks down is avoided. When any electric loop has faults such as ground short circuit and the like at the wire harness end or the load end, short circuit current flows to a short circuit point from the power supply end through the quick isolation device, when the quick isolation device VIU3 monitors that the current is overlarge and exceeds a certain set safety threshold, the device can control the internal MOS to be quickly turned off, the fault loop is isolated, parallel operation of the two loops is avoided, and the abnormal voltage of the fault loop influences the voltage of a normal loop. At the moment, the electric network also maintains a normal loop, the loop power supply continues to supply power to loop loads, and the remained loads can realize the functional targets of stopping the vehicle by the side and even continuing to run. The power supply scheme of the invention forms power supply redundancy by DCDC and a main power supply and is isolated by one of the VIUs. The architecture scheme realizes the full-link and full-aspect safety redundancy design.

Optionally, referring to fig. 1, the main zone controller VIU1 and the at least one redundant zone controller VIU2 are connected by a bus; the bus comprises: a first bus a and a second bus B; the main control unit is connected to the first bus A, and the redundant control unit is connected to the second bus B.

Specifically, referring to fig. 1, the main area controller VIU1 and the redundant area controller VIU2 may be connected through a bus, so as to implement mutual checking between the main area controller VIU1 and the redundant area controller VIU 2. In addition, steering, braking and rear driving of the main control unit are all connected to the first bus A, and a steering redundancy controller, a braking redundancy controller and a front driving of the redundancy control unit are connected to the second bus B, wherein the front driving and the rear driving are redundant. Through braking and braking redundancy, steering and steering redundancy, and precursor and rear drive respectively hang down in different CAN channels, any one VIU+1 CAN line module CAN realize horizontal and vertical control to avoid the common cause inefficacy that CAN channel trouble led to, improve the security of vehicle control.

Optionally, when the main area controller VIU1 and the central computing unit communicate through the main link, the central computing unit and the main area controller VIU1 support the same network protocol; when the main area controller VIU1 and the central computing unit communicate via the redundant link, the central computing unit, the main area controller VIU1 and at least one redundant area controller support the same network protocol.

Specifically, referring to fig. 3, fig. 3 shows a schematic diagram of a switch setting provided in an embodiment of the present application. The ethernet ring of the architecture may be composed of multiple sub-rings, i.e. the ethernet ring is composed of multiple sub-ethernet rings, and each sub-ethernet ring is also an ethernet ring. The switch support protocol may be a Time sensitive network (Time-Sensitive Network, TSN) protocol, and the switch support protocol may also be an ethernet multi-ring protection (Ethernet Ring Protection Switching, ERPS) protocol, via redundancy demand links and a redundancy protocol supported by the switch. Referring to fig. 3, only a Switch (Switch) 5 does not support a TSN-CB protocol, and determines that a target protocol of the Switch 5 is ERPS and target protocols of other switches are TSN-CB protocols; if the main link is a VIU 2-central computing platform and the link has redundancy requirement, when the link fails, the redundant link VIU2-VIU3-VIU 1-central computing platform is required to normally communicate, and according to the target protocol supported by the sub ethernet ring network related by the redundant link, the final protocol of the ring network is selected as the ERPS protocol, namely, the final target protocol of the switches 1,2,3 and 5 is the ERPS when the ring network cannot fully support the TSN-CB protocol. Thus, for the multi-ring Ethernet, in the data transmission process, each Ethernet ring in the multi-ring Ethernet can use the same protocol or different protocols, so that the communication of the Ethernet ring is redundant.

The multi-ring Ethernet redundancy network can be used for data with larger bandwidth occupation. The multi-ring Ethernet redundancy is realized by detecting redundancy demand links and protocols supported by switches in the Ethernet ring, selecting a target protocol of each switch according to the protocols supported by all switches of each Ethernet ring and the redundancy demand links, determining a final protocol of the switch according to the target protocol of each switch, and realizing Ethernet ring redundancy based on the determined final protocol.

Alternatively, referring to fig. 2, the main sensing unit S101 includes: at least one of radar, map and camera; the redundant sensing unit S102 includes: at least one of a redundant radar and a redundant camera; the main control unit includes: a brake controller, a steering controller and a power controller; the redundancy control unit includes: redundant brake controller, redundant steering controller and redundant power controller.

Optionally, the method further comprises: a third redundant area controller; the third redundant area controller, the main area controller, the second redundant area controller and the first redundant area controller are connected in an annular mode.

Referring to fig. 1, the third redundant area controller may be the VIU4 in fig. 1, where the third redundant area controller VIU4, the main area controller VIU1, the second redundant area controller VIU3, and the first redundant area controller VIU2 are annularly connected, and when the functions of the VIU or the VIU2 that need management and control are more, the decision of part of the functions may be deployed on the third redundant area controller VIU4, so that the vehicle is ensured to meet the fast low-delay response of multiple intelligent functions, and meanwhile, the running safety and reliability of the vehicle are effectively ensured.

Referring to fig. 4, a control method provided in an embodiment of the present application includes:

t101, receiving sensing data acquired by a sensing unit and generating a control instruction based on the sensing data;

t102, under the condition that the main area controller is normal, sending the control instruction to the main area controller through a main chip, so that the main area controller controls the running state of the vehicle based on the control instruction and the control unit;

and T103, in the case of failure of the main area controller, sending the control instruction to the redundant area controller through the redundant chip, so that the redundant area controller controls the running state of the vehicle based on the control instruction and the control unit.

Specifically, in the embodiment of the invention, the central computing unit can receive the sensing data collected by the sensing unit and generate a control instruction based on the sensing data; the main area controller and the redundant area controller can mutually verify each other so as to obtain the state of the other party, and under the condition that the main area controller is normal, a control instruction is sent to the main area controller through a main chip, so that the main area controller converts the control instruction into specific steering and braking information and provides the specific steering and braking information for a control unit, and the control unit can control a braking mechanism, a steering mechanism and the like to execute actions. Under the condition that the main area controller fails, a control instruction is sent to the redundant area controller through the redundant chip, so that the redundant area controller converts the control instruction into specific steering and braking information and provides the specific steering and braking information for the control unit, and the control unit can control the braking mechanism, the steering mechanism and the like to execute actions.

Optionally, the method further comprises:

t104, obtaining a current value passing through the second redundant area controller;

and T105, cutting off the internal current path of the second redundant area controller when the current value exceeds a safety threshold value.

In the embodiment of the invention, the main link and the redundant link are respectively provided with a power supply for independently supplying power to the loop, so that the problem that the power supply end is affected by under-voltage fault synchronization after the loop fails is avoided. After the harness end or the load end of any electric loop is subjected to faults such as ground short circuit and the like, short circuit current flows to a short circuit point from a power supply end through a quick isolation device (a redundant area controller (VIU 3) can be used as the quick isolation device in the application), when the quick isolation device (VIU 3) monitors that the current is too large to exceed a certain set safety threshold value, the device can control the internal MOS to be quickly turned off, the fault loop is isolated, parallel operation of the two loops is avoided, and the abnormal voltage of the fault loop influences the voltage of a normal loop. At the moment, the electric network also maintains a normal loop, the loop power supply continues to supply power to loop loads, and the remained loads can realize the functional targets of stopping the vehicle by the side and even continuing to run. The power supply scheme of the invention forms power supply redundancy by the DCDC and the main power supply, and is isolated by one of the VIUs, thereby realizing the full-link and full-aspect safety redundancy design.

Further, referring to fig. 5, fig. 5 shows a flowchart of yet another control method provided in the present application, including:

s201, the central computing platform performs perception fusion and path planning judgment based on perception input, and calculates actions to be executed based on road conditions and perception fusion information;

s202 is a motion control arbitration module that issues a request for torque, braking to the zone controller VIU based on the result of the calculation execution of S201.

S203 is a control of the driver' S operation of stepping on the acceleration and brake pedal of the vehicle, and the operation is transmitted to the VIU via a hard-wired signal of the pedal.

S204 is a motion control arbitration module that internally communicates S203 the driver request signal to the VIU.

S205 is to arbitrate the automatic driving request of S202 and the driving request of S204, determine the execution result with higher priority based on the arbitration policy, and output the result as the final execution instruction to the driving and braking controller.

Referring to fig. 6, the present application further discloses a vehicle, including the above-mentioned automotive electronics and electrical architecture.

According to the method, the whole vehicle load is distributed on two independent loops to supply power, the loads such as a central computing source and VIU3 realize two-way input, in other loads with redundancy requirements, a main functional load is connected into the main loop, a redundancy functional load is connected into the redundancy loop, and a quick isolation device VIU3 is added into the two loops to realize main and auxiliary isolation. Correspondingly, both loops are provided with a power supply to independently supply power to the loops, so that the problem that the power supply end is affected by the under-voltage fault synchronization after the loop breaks down is avoided. When the current is monitored to be overlarge and exceeds a certain set safety threshold value by the quick isolating device, the device can control the internal MOS to be quickly turned off, the fault loop is isolated, parallel operation of the two loops is avoided, and the abnormal voltage of the fault loop influences the voltage of a normal loop. At this time, the electric network also maintains a normal loop, the loop power supply continues to supply power to the loop load, and the remained load is used for realizing the functional goal of stopping the vehicle by the side or even continuing to run.

The invention relates to a high-safety central+regional ring network architecture solution, which is shown in figure 1 and consists of 1 central computing platform and a plurality of regional controllers. The central computing platform is used as a computing control center of high-order intelligent driving, performs scene and decision computation and issues a control instruction to the regional controller VIU. The central computing platform, the VIU (regional controller), the Ethernet and the CAN/CANFD are taken as basic frames, and multiple paths of sensing inputs and multiple execution mechanisms CAN be deployed on the basic frames to form sensing and executing safety redundancy. The control and central computation are separated, forming a perceptually-central computation-control-implemented link redundancy. The redundant power supply technology of the whole vehicle low-voltage loop is based on the decomposition of the whole vehicle functional safety target, and mainly realizes redundant power supply for a power system, a braking system, a steering system and a central computing platform. After any single point failure can be met, the high-order intelligent driving system has a corresponding safety mechanism and enables the control to meet the safety state of Fail-Operation.

Referring to fig. 7, there is shown a control device 30 provided in an embodiment of the present application, the device including:

Fig. 8 is a block diagram of an electronic device 600, according to an example embodiment. For example, the electronic device 600 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, an exercise device, a personal digital assistant, and the like.

Referring to fig. 8, an electronic device 600 may include one or more of the following components: a processing component 602, a memory 604, a power component 606, a multimedia component 608, an audio component 610, an input/output (I/O) interface 612, a sensor component 614, and a communication component 616.

The processing component 602 generally controls overall operation of the electronic device 600, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing component 602 may include one or more processors 620 to execute instructions to perform all or part of the steps of the methods described above. Further, the processing component 602 can include one or more modules that facilitate interaction between the processing component 602 and other components. For example, the processing component 602 may include a multimedia module to facilitate interaction between the multimedia component 608 and the processing component 602.

The memory 604 is used to store various types of data to support operations at the electronic device 600. Examples of such data include instructions for any application or method operating on the electronic device 600, contact data, phonebook data, messages, pictures, multimedia, and so forth. The memory 604 may be implemented by any type or combination of volatile or nonvolatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.

The power supply component 606 provides power to the various components of the electronic device 600. The power supply components 606 can include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 600.

The multimedia component 608 includes a screen between the electronic device 600 and the user that provides an output interface. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may not only sense demarcations of touch or sliding actions, but also detect durations and pressures associated with the touch or sliding operations. In some embodiments, the multimedia component 608 includes a front camera and/or a rear camera. When the electronic device 600 is in an operational mode, such as a shooting mode or a multimedia mode, the front-facing camera and/or the rear-facing camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

The audio component 610 is for outputting and/or inputting audio signals. For example, the audio component 610 includes a Microphone (MIC) for receiving external audio signals when the electronic device 600 is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals may be further stored in the memory 604 or transmitted via the communication component 616. In some embodiments, audio component 610 further includes a speaker for outputting audio signals.

The I/O interface 612 provides an interface between the processing component 602 and peripheral interface modules, which may be a keyboard, click wheel, buttons, etc. These buttons may include, but are not limited to: homepage button, volume button, start button, and lock button.

The sensor assembly 614 includes one or more sensors for providing status assessment of various aspects of the electronic device 600. For example, the sensor assembly 614 may detect an on/off state of the electronic device 600, a relative positioning of the components, such as a display and keypad of the electronic device 600, the sensor assembly 614 may also detect a change in position of the electronic device 600 or a component of the electronic device 600, the presence or absence of a user's contact with the electronic device 600, an orientation or acceleration/deceleration of the electronic device 600, and a change in temperature of the electronic device 600. The sensor assembly 614 may include a proximity sensor configured to detect the presence of nearby objects in the absence of any physical contact. The sensor assembly 614 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 614 may also include an acceleration sensor, a gyroscopic sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

The communication component 616 is utilized to facilitate communication between the electronic device 600 and other devices, either in a wired or wireless manner. The electronic device 600 may access a wireless network based on a communication standard, such as WiFi, an operator network (e.g., 2G, 3G, 4G, or 5G), or a combination thereof. In one exemplary embodiment, the communication component 616 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component 616 further includes a Near Field Communication (NFC) module to facilitate short range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra Wideband (UWB) technology, bluetooth (BT) technology, and other technologies.

In an exemplary embodiment, the electronic device 600 may be implemented by one or more Application Specific Integrated Circuits (ASICs), digital Signal Processors (DSPs), digital Signal Processing Devices (DSPDs), programmable Logic Devices (PLDs), field Programmable Gate Arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic elements for implementing a control method as provided by an embodiment of the present application.

In an exemplary embodiment, a non-transitory computer-readable storage medium is also provided, such as memory 604, including instructions executable by processor 620 of electronic device 600 to perform the above-described method. For example, the non-transitory storage medium may be ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

Fig. 9 is a block diagram of an electronic device 700, according to an example embodiment. For example, the electronic device 700 may be provided as a server. Referring to fig. 9, electronic device 700 includes a processing component 722 that further includes one or more processors and memory resources represented by memory 732 for storing instructions, such as application programs, executable by processing component 722. The application programs stored in memory 732 may include one or more modules that each correspond to a set of instructions. In addition, the processing component 722 is configured to execute instructions to perform a control method provided by embodiments of the present application.

The electronic device 700 may also include a power supply component 726 configured to perform power management of the electronic device 700, a wired or wireless network interface 750 configured to connect the electronic device 700 to a network, and an input output (I/O) interface 758. The electronic device 700 may operate based on an operating system stored in memory 732, such as Windows Server, mac OS XTM, unixTM, linuxTM, freeBSDTM, or the like.

The embodiment of the application also provides a computer program product, which comprises a computer program, wherein the computer program realizes the control method when being executed by a processor.

Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

It is to be understood that the present application is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

1. An automotive electronics electrical architecture, comprising:

the central computing unit comprises a main chip and a redundant chip; the main chip and the redundant chip are respectively and commonly connected with the sensing unit; the main chip is connected with the main area controller and is used for sending a control instruction to the main area controller based on the data of the sensing unit; the redundant chip is connected with the redundant area controller and is used for sending a control instruction to the redundant area controller based on the data of the sensing unit after the link where the main area controller is located fails; the control unit is respectively connected with the main area controller and the redundant area controller and is used for controlling the running state of the vehicle based on the control instruction.

2. The automotive electronics electrical architecture of claim 1, wherein the sensing unit comprises: a main sensing unit and a redundant sensing unit; the control unit includes: a main control unit and a redundant control unit;

3. The automotive electronics electrical architecture of claim 1, wherein the at least one redundant area controller comprises: a first redundant area controller and a second redundant area controller;

4. The automotive electronics electrical architecture of claim 3, further comprising:

A main power supply and a redundant power supply;

5. The automotive electronics electrical architecture of claim 4 in which,

the main power supply is connected with the main area controller, the central computing unit, the main sensing unit and the main control unit;

6. The automotive electronics electrical architecture of claim 2, wherein the primary zone controller and the at least one redundant zone controller are connected by a bus; the bus includes: a first bus and a second bus;

7. The automotive electronics electrical architecture of claim 1 in which,

when the main area controller and the central computing unit communicate through a main link, the central computing unit and the main area controller support the same network protocol;

8. The automotive electronics electrical architecture of claim 2, wherein the primary sensing unit comprises: at least one of radar, map and camera;

9. The automotive electronics electrical architecture of claim 3, further comprising: a third redundant area controller;

10. A control method applied to the automotive electronic and electric architecture according to any one of claims 1 to 9, said method comprising:

11. The method according to claim 10, wherein the method further comprises:

acquiring a current value passing through a second redundant area controller;

and cutting off the internal current path of the second redundant area controller when the current value exceeds a safety threshold value.

12. A vehicle, characterized in that the vehicle comprises: automotive electronics and electrical architecture as claimed in any one of claims 1-9.