CN221293483U - Vehicle redundancy control system and vehicle - Google Patents

Abstract

The application discloses a vehicle redundancy control system and a vehicle, wherein the redundancy control system comprises: a drive assembly configured to drive the vehicle; a main ECU connected to the drive assembly and configured to output control failure information when a control failure occurs; and the backup ECU is respectively connected with the main ECU and the driving assembly and is configured to output control effective information to the driving assembly when receiving the control failure information or the communication failure of the main ECU so as to instruct the driving assembly to drive the vehicle to run based on the driving control instruction of the backup ECU. According to the redundant control system, the redundant control of the vehicle is realized through the backup ECU, and the problem that the vehicle loses power due to single-point failure of the whole vehicle controller and cannot continue running in the related technology is solved.

Description

Vehicle redundancy control system and vehicle

Technical Field

The application relates to the technical field of vehicles, in particular to a vehicle redundancy control system and a vehicle.

Background

At present, in a vehicle control system of a vehicle, a vehicle controller is used for cooperative control of vehicle power and a chassis so as to ensure the safety and stability of vehicle operation. However, under the condition that a single point failure of the whole vehicle controller occurs, the whole vehicle control system cannot work normally, and the vehicle cannot continue to run due to power loss.

Disclosure of utility model

In view of the above problems, the application provides a vehicle redundancy control system and a vehicle, in which a backup ECU takes over the drive control function of a main ECU under the condition that the main ECU fails in control or fails in communication, a drive assembly drives the vehicle to run based on the drive control instruction of the backup ECU, and the problem that the vehicle loses power due to single-point failure of a whole vehicle controller and cannot continue running in the related art is solved.

In a first aspect, the present application provides a redundant control system for a vehicle, the redundant control system comprising: a drive assembly configured to drive the vehicle; a main ECU (Electronic Control Unit, an electronic control unit) connected to the drive assembly, configured to output control failure information when a control failure occurs; and the backup ECU is respectively connected with the main ECU and the driving assembly and is configured to output control effective information to the driving assembly when receiving the control failure information or the communication failure of the main ECU so as to instruct the driving assembly to drive the vehicle to run based on the driving control instruction of the backup ECU.

According to the technical scheme, safety redundancy control of the driving assembly is achieved through the main ECU and the backup ECU, the driving assembly drives the vehicle to run according to the driving control instruction output by the main ECU under the condition that the control of the main ECU is effective and the communication is normal, the backup ECU takes over the driving control function of the main ECU and outputs control effective information to the driving assembly under the condition that the control failure or the communication failure occurs in the main ECU, and the driving assembly determines the effectiveness of the driving control instruction of the backup ECU based on the control effective information output by the backup ECU and drives the vehicle to run according to the driving control instruction of the backup ECU.

Therefore, under the condition that the main ECU fails in control or communication, the embodiment can control the vehicle to continue running based on the backup ECU, and the problem that the vehicle loses power due to single-point failure of the whole vehicle controller and cannot continue running in the related art is solved.

In some embodiments, the master ECU includes a master chip and a master communication component, the master communication component being connected to the master chip, the backup ECU, and the drive component, respectively, the master chip being configured to control the drive component through the master communication component and output the control failure information; the backup ECU comprises a backup chip and a backup communication assembly, wherein the backup communication assembly is respectively connected with the backup chip, the main ECU and the driving assembly, and the backup chip is configured to receive the control failure information, detect the communication state of the main ECU and output the control effective information to the driving assembly through the backup communication assembly.

In some embodiments, the redundant control system further comprises: and the brake assembly is respectively connected with the main ECU and the backup ECU and is configured to output brake information to the main ECU and the backup ECU.

The main ECU and the backup ECU output corresponding drive control instructions based on the brake information of the brake assembly to perform brake control on the drive assembly.

In some embodiments, the redundant control system further comprises: the high-voltage power supply assembly is respectively connected with the main ECU and the backup ECU, and the backup ECU is further configured to output the control effective information to the high-voltage power supply assembly so as to instruct the high-voltage power supply assembly to conduct high-voltage power down based on a power down request of the backup ECU.

When the control of the main ECU is effective and the communication is normal, the high-voltage power supply assembly performs high-voltage power-on based on a power-on request of the main ECU and performs high-voltage power-off based on a power-off request of the main ECU; when the control failure or communication failure occurs in the main ECU, the high-voltage power supply assembly can determine the validity of a power-down request of the backup ECU based on the control valid information of the backup ECU, and execute high-voltage power-down based on the power-down request of the backup ECU so as to realize safe power-down and improve the control safety of the vehicle.

In some embodiments, the high voltage power supply assembly includes a battery management system and a high voltage distribution switch, the high voltage distribution switch being respectively connected to a power battery of the vehicle and the battery management system, the battery management system being configured to control the high voltage distribution switch to be turned off for high voltage reduction based on a power down request of the backup ECU when the control valid information is received.

In some embodiments, the redundant control system further comprises: the low-voltage power supply assembly is respectively connected with the main ECU and the backup ECU, and the backup ECU is further configured to output the control effective information to the low-voltage power supply assembly so as to instruct the low-voltage power supply assembly to perform low-voltage power supply or stop power supply based on a power supply voltage request or a power supply stop request of the backup ECU.

The low-voltage power supply component can determine the validity of a power supply voltage request or a power supply stop request of the backup ECU based on the control valid information of the backup ECU under the condition that the main ECU fails in control or fails in communication, and further performs low-voltage power supply or stops power supply based on the power supply voltage request or the power supply stop request of the backup ECU.

In some embodiments, the low-voltage power supply assembly includes a low-voltage distribution controller and a voltage conversion module, the voltage conversion module is respectively connected with the high-voltage power supply assembly and the low-voltage distribution controller, and the low-voltage distribution controller is configured to control the voltage conversion module to perform low-voltage power supply or stop power supply based on a power supply voltage request or a power supply stop request of the backup ECU when the control effective information is received.

In some embodiments, the redundant control system further comprises: and the thermal management component is respectively connected with the main ECU and the backup ECU, and the backup ECU is further configured to output the control effective information to the thermal management component so as to instruct the thermal management component to perform thermal management on the driving component based on the thermal management request of the backup ECU.

In the event of a control failure or communication failure of the main ECU, the backup ECU takes over the thermal management functions of the main ECU to thermally manage the drive assembly.

In some embodiments, the thermal management assembly includes a thermal management controller and a cooling assembly, the cooling assembly is disposed corresponding to the driving assembly, the thermal management controller is respectively connected with the cooling assembly and the high-voltage power supply assembly, and is configured to control the cooling assembly to cool the driving assembly based on a thermal management request of the backup ECU when the control effective information is received, and output a power-down request to the high-voltage power supply assembly when the driving assembly is over-temperature, so as to instruct the high-voltage power supply assembly to perform high-voltage power down.

And under the condition that the main ECU fails in control or fails in communication, the thermal management controller controls the cooling assembly based on the thermal management request of the backup ECU, and meanwhile, the over-temperature protection strategy is combined, and the high-voltage power-down is actively controlled under the condition that the driving assembly is over-temperature.

In a second aspect, the present application provides a vehicle comprising a vehicle redundancy control system as described above.

The foregoing description is only an overview of the present application, and is intended to be implemented in accordance with the teachings of the present application in order that the same may be more clearly understood and to make the same and other objects, features and advantages of the present application more readily apparent.

Drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the application. Also, like reference numerals are used to designate like parts throughout the accompanying drawings. In the drawings:

FIG. 1 is a block schematic diagram of a redundant control system for a vehicle according to some embodiments of the present application;

FIG. 2 is a block diagram second of a redundant control system for a vehicle according to some embodiments of the present application;

FIG. 3 is a block diagram third schematic diagram of a redundant control system for a vehicle according to some embodiments of the present application;

FIG. 4 is a block diagram of a redundant control system for a vehicle according to some embodiments of the present application;

FIG. 5 is a block diagram fifth of a redundant control system for a vehicle according to some embodiments of the present application;

FIG. 6 is a block diagram sixth of a redundant control system for a vehicle according to some embodiments of the present application;

FIG. 7 is a block diagram seventh of a redundant control system for a vehicle according to some embodiments of the present application;

FIG. 8 is a block schematic diagram eighth of a redundant control system for a vehicle according to some embodiments of the application;

FIG. 9 is a block diagram nine of a redundant control system for a vehicle according to some embodiments of the application;

Fig. 10 is a block schematic diagram of a vehicle according to some embodiments of the application.

Reference numerals:

the vehicle redundancy control system 100, the drive assembly 10, the main ECU20, the main chip 21, the main communication assembly 22, the backup ECU30, the backup chip 31, the backup communication assembly 32, the brake assembly 40, the high-voltage power supply assembly 50, the battery management system 51, the high-voltage distribution switch 52, the low-voltage power supply assembly 60, the low-voltage distribution controller 61, the voltage conversion module 62, the thermal management assembly 70, the thermal management controller 71, the cooling assembly 72, the power battery 80, and the vehicle 1000.

Detailed Description

Embodiments of the technical scheme of the present application will be described in detail below with reference to the accompanying drawings. The following examples are only for more clearly illustrating the technical aspects of the present application, and thus are merely examples, and are not intended to limit the scope of the present application.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having" and any variations thereof in the description of the application and the claims and the description of the drawings above are intended to cover a non-exclusive inclusion.

In the description of embodiments of the present application, the technical terms "first," "second," and the like are used merely to distinguish between different objects and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated, a particular order or a primary or secondary relationship. In the description of the embodiments of the present application, the meaning of "plurality" is two or more unless explicitly defined otherwise.

Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the application. The appearances of such phrases in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those of skill in the art will explicitly and implicitly appreciate that the embodiments described herein may be combined with other embodiments.

In the description of the embodiments of the present application, the term "and/or" is merely an association relationship describing an association object, and indicates that three relationships may exist, for example, a and/or B may indicate: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" herein generally indicates that the front and rear associated objects are an "or" relationship.

In the description of the embodiments of the present application, the term "plurality" means two or more (including two), and similarly, "plural sets" means two or more (including two), and "plural sheets" means two or more (including two).

In the description of the embodiments of the present application, the orientation or positional relationship indicated by the technical terms "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc. are based on the orientation or positional relationship shown in the drawings, and are merely for convenience of description and simplification of the description, and do not indicate or imply that the apparatus or element referred to must have a specific orientation, be configured and operated in a specific orientation, and therefore should not be construed as limiting the embodiments of the present application.

In the description of the embodiments of the present application, unless explicitly specified and limited otherwise, the terms "mounted," "connected," "secured" and the like should be construed broadly and may be, for example, fixedly connected, detachably connected, or integrally formed; or may be mechanically or electrically connected; can be directly connected or indirectly connected through an intermediate medium, and can be communicated with the inside of two elements or the interaction relationship of the two elements. The specific meaning of the above terms in the embodiments of the present application will be understood by those of ordinary skill in the art according to specific circumstances.

At present, in a vehicle control system of a vehicle, a vehicle controller is used for cooperative control of vehicle power and a chassis so as to ensure the safety and stability of vehicle operation. However, under the condition that single-point failure of the whole vehicle controller occurs, the whole vehicle control system cannot work normally, the vehicle cannot continue to run due to power loss, and the safety of the whole vehicle is reduced.

Therefore, the application provides a vehicle redundancy control system, which realizes safe redundancy control on a driving component through a main ECU and a backup ECU, wherein the driving component drives a vehicle to run according to a driving control instruction output by the main ECU under the condition that the control of the main ECU is effective and the communication is normal, and the backup ECU takes over the driving control function of the main ECU and outputs control effective information to the driving component under the condition that the control failure or the communication failure of the main ECU occurs, and the driving component determines the effectiveness of the driving control instruction of the backup ECU based on the control effective information output by the backup ECU and drives the vehicle to run according to the driving control instruction of the backup ECU. Therefore, under the condition that the main ECU fails in control or communication, the embodiment can control the vehicle to continue running based on the backup ECU, and the problems that the vehicle loses power and cannot continue running due to single-point failure of the whole vehicle controller in the related art are solved.

The following examples are presented for convenience of explanation and are provided in connection with the accompanying drawings to illustrate the redundant control system for a vehicle of the present application.

As shown in fig. 1, the vehicle redundancy control system 100 of the present application may include: a drive assembly 10, a main ECU20, and a backup ECU30.

Wherein the drive assembly 10 is configured to drive a vehicle. The main ECU20 is connected to the drive assembly 10, and the main ECU20 is configured to output control failure information when a control failure occurs. The backup ECU30 is connected to the main ECU20 and the drive assembly 10, respectively, and the backup ECU30 is configured to output control effective information to the drive assembly 10 to instruct the drive assembly 10 to drive the vehicle to run based on a drive control instruction of the backup ECU30 when the control failure information is received or the main ECU20 fails in communication.

The driving assembly 10 is used for driving the vehicle to run according to the received driving control command, and the driving assembly 10 may include a driving motor, a power battery, an engine, and the like.

The main ECU20 and the backup ECU30 may generate corresponding driving control commands according to the whole vehicle information and the received control commands, in combination with a control strategy, to drive the vehicle to run through the driving assembly 10, where the driving control commands may be driving motor running commands, discharging commands, and the like, and are not limited herein.

The control failure of the main ECU20 may include one or more of failure cases of torque control failure, high-low voltage control failure, thermal management failure, etc., and the setting of the failure condition may be made based on actual conditions. The control failure or control validity of the main ECU20 may be achieved based on its own control self-checking function, and when the control failure is determined, control failure information is generated and sent to the backup ECU30, so that the backup ECU30 may determine that the main ECU20 has failed in control based on the control failure information. Alternatively, when the control of the main ECU20 fails, the control failure information may be synchronously sent to the driving assembly 10, so that the driving assembly 10 may ignore the driving control instruction of the main ECU20 based on the control failure information, and avoid abnormal driving.

The communication failure of the main ECU20 may include a failure type in which communication data is lost and unrecoverable, communication is impossible, and the like, and may be specifically defined based on the actual application. The communication failure of the main ECU20 may be implemented based on self-test of communication, or may be determined based on the communication receiving end according to the received communication signal of the main ECU20, which is not limited herein. For example, when the communication failure of the main ECU20 is realized based on the self-detection of the communication itself, a corresponding communication failure signal may be generated to the backup ECU30 when it is determined that the communication failure occurs, and the backup ECU30 determines that the communication failure occurs in the main ECU20 based on the communication failure signal. In another implementation manner, a communication channel is established between the main ECU20 and the backup ECU30, and test signals are transmitted and received according to a preset transmission period, and the backup ECU30 determines the communication state of the main ECU20 according to the test signals transmitted by the main ECU 20.

In the case where the control of the main ECU20 is effective and the communication is normal, the drive assembly 10 drives the vehicle to travel based on the drive control instruction of the main ECU 20. In the case where the control of the main ECU20 fails, the main ECU20 cannot generate a correct drive control command, and in the case where the communication failure of the main ECU20 occurs, even if the main ECU20 can generate a correct drive control command, the correct drive control command cannot be transmitted to the drive module 10, and therefore, in the case where the control of the main ECU20 fails or the communication failure occurs, the backup ECU30 takes over the drive control function of the main ECU20, outputs control effective information to the drive module 10, so that the drive module 10 can recognize the validity of the drive control command of the backup ECU30 based on the control effective information, and further drive the vehicle to travel based on the drive control command of the backup ECU 30.

According to the embodiment, the redundant control of the driving assembly 10 of the vehicle is realized through the main ECU20 and the backup ECU30, so that the problem that the vehicle loses power and cannot continue to run under the condition of single-point failure of the whole vehicle controller can be effectively solved, and the driving safety is improved.

According to some embodiments of the present application, referring to fig. 2, the main ECU20 includes a main chip 21 and a main communication module 22, the main communication module 22 being connected to the main chip 21, the backup ECU30 and the drive module 10, respectively, the main chip 21 being configured to control the drive module 10 through the main communication module 22 and output control failure information; the backup ECU30 includes a backup chip 31 and a backup communication component 32, the backup communication component 32 being connected to the backup chip 31, the main ECU20 and the drive component 10, respectively, the backup chip 31 being configured to receive control failure information through the backup communication component 32, detect a communication state of the main ECU20, and output control effective information to the drive component 10.

The main ECU20 realizes the transceiving of signals through the main communication component 22, the backup ECU30 realizes the transceiving of signals through the backup communication component 32, and the setting of the communication components CAN be set based on the communication protocol and the communication requirement of the vehicle, for example, the main communication component 22 and the backup communication component 32 CAN adopt CAN (Controller Area Network ) communication components, and include CAN transceivers, the signals generated by the main chip 21 and the backup chip 31 are converted into differential signals through the CAN transceivers, and then transmitted to the CAN communication bus of the vehicle, and meanwhile, the differential signals transmitted through the CAN communication bus are converted into digital signals, and the converted digital signals are transmitted to corresponding chips.

Taking the drive control function of the main ECU20 as an example of the torque control function, when the torque control function of the main ECU20 is normal, the main ECU20 sets the torque control validity flag bit to 1 to characterize that the torque control is valid. When the main ECU20 self-checks that a software failure, a hardware failure, or the like occurs, it determines that the torque control function is abnormal, and sets the torque control validity flag bit to 0 to characterize the torque control failure. The main chip 21 outputs the torque control valid flag bit as control failure information through the main communication component 22.

The backup chip 31 receives the control failure information of the main ECU20 through the backup communication module 32, and determines the torque control function state of the main ECU20 by identifying the torque control validity flag of the main ECU20, and confirms that the control of the main ECU20 is valid when the torque control validity flag of the main ECU20 is identified as 1, and confirms that the control of the main ECU20 is failed when the torque control validity flag of the main ECU20 is identified as 0. At the same time, the backup chip 31 recognizes the communication state of the main ECU20, and determines the communication state of the main ECU20 based on, for example, a test signal transmitted from the main ECU 20. Upon determining that the control of the main ECU20 fails or that the communication failure of the main ECU20 occurs, the backup chip 31 outputs control-effective information to the drive assembly 10 to make the drive assembly 10 determine that the drive control instruction of the backup ECU30 is effective based on the control-effective information to drive the vehicle to travel based on the drive control instruction of the backup ECU 30.

For example, if the control failure information is 1 in the case where the control is valid, and if the control failure information is 0 in the case where the control failure information is valid, the main ECU20 transmits the control failure information to the backup ECU30 and also transmits the control failure information to the drive module 10, and the drive module 10 may determine whether the control function of the main ECU20 is valid based on the control failure information and drive the vehicle to run based on the drive control instruction output from the main ECU20 in the case where the control failure information is 1. When the control of the main ECU20 fails or the main ECU20 fails in communication, the control failure information is 0 or a drive control command of the main ECU20 cannot be received, and the backup ECU30 outputs control effective information of 1, the drive module 20 drives the vehicle to travel based on the drive control command output by the backup ECU 30.

In this embodiment, the drive assembly 10 may receive the drive control instructions of the main ECU20 and the backup ECU30 at the same time, and determine the validity and priority of the drive control instructions, the drive control instructions of the main ECU20 having the highest priority. When the drive control command of the main ECU20 is invalid or the drive control command of the main ECU20 is lost, the drive assembly 10 needs to respond to the drive control command of the backup ECU30 based on the control valid information of the backup ECU 30.

According to some embodiments of the present application, referring to fig. 3, the vehicle redundancy control system 100 further includes: and a brake assembly 40, the brake assembly 40 being connected to the main ECU20 and the backup ECU30, respectively, and configured to output brake information to the main ECU20 and the backup ECU30, and to receive brake control instructions output from the main ECU20 and the backup ECU 30.

The brake assembly 40 may include a brake pedal, determines a braking demand based on a brake pedal travel to output braking information, and may also include a TCS (Traction Control System ), DTC (Diagnostic Trouble Code, fault diagnostic system), etc., determining braking information based on a torque request output by the TCS, DTC of the vehicle.

The main ECU20 and the backup ECU30 receive the brake information output from the brake assembly 40, and the main ECU20 and the backup ECU30 output torque control instructions to the drive assembly 10 according to the brake information, respectively, to control the drive assembly 10 to perform torque control based on the torque control instructions of the main ECU20 or the torque control instructions of the backup ECU 30.

In this embodiment, the main ECU20 and the backup ECU30 respectively output torque control instructions to the drive unit 10 according to the brake information, and the drive unit 10 determines the validity and the priority of the received two torque control instructions, and when the torque control function of the main ECU20 is invalid or the torque control instruction of the main ECU20 is lost, the drive unit 10 needs to respond to the torque control instruction of the backup ECU30 based on the validity of the torque control instruction of the backup ECU 30. During specific control, the backup ECU30 may generate torque control commands in combination with the power mode, the vehicle speed, and the vehicle state, for example, when the power mode, the vehicle speed is zero, and the vehicle state is a braking state, the backup ECU30 generates torque control commands to control EPB (ELECTRICAL PARK Brake, electronic parking Brake system) to perform braking.

According to some embodiments of the present application, as shown in fig. 4, the vehicle redundancy control system 100 further includes: the high-voltage power supply assembly 50, the high-voltage power supply assembly 50 is connected with the main ECU20 and the backup ECU30 respectively, and the backup ECU30 is further configured to output control effective information to the high-voltage power supply assembly 50 to instruct the high-voltage power supply assembly 50 to perform high-voltage power down based on a power down request of the backup ECU 30.

The high voltage power supply assembly 50 may include a power battery, a high voltage distribution box, a DC/AC (Direct Current-ALTERNATING CURRENT) module, etc., and in particular, the high voltage power supply assembly 50 may be used to convert high voltage Direct Current provided by the power battery into low voltage Direct Current and provide power to an electric unit of a vehicle, or to convert high voltage Direct Current provided by the power battery into alternating Current to power an electric device of the vehicle.

The high-voltage power supply assembly 50 is respectively connected with the main ECU20 and the backup ECU30, and the high-voltage power supply assembly 50 can perform power-on and power-off actions based on a power-on request or a power-off request output by the main ECU20 under the condition that the control of the main ECU20 is effective and the communication is normal. In the event of failure of control of the main ECU20 or communication failure of the main ECU20, the main ECU20 cannot respond to and execute a power-down request of the vehicle, and the backup ECU30 takes over a high-voltage power-down flow, that is, outputs control effective information and the power-down request to the high-voltage power supply assembly 50, and the high-voltage power supply assembly 50 performs high-voltage power-down based on the control effective information and the power-down request of the backup ECU30, so that driving safety is improved. Further, the backup ECU30 may also combine the power mode and the vehicle speed to realize normal power-down of the vehicle, for example, when the power mode is an off mode and the vehicle speed is zero, the backup ECU30 outputs a power-down request.

According to some embodiments of the present application, as shown in fig. 5, the high-voltage power supply assembly 50 includes a battery management system 51 and a high-voltage distribution switch 52, the high-voltage distribution switch 52 being connected to a power battery 80 of the vehicle and the battery management system 51, respectively, the battery management system 51 being configured to control the high-voltage distribution switch 52 to be turned off for high-voltage power down based on a power down request of the backup ECU30 upon receiving the control valid information.

The battery management system 51 has functions of battery monitoring, sleep power management, intelligent charging, static power management, dynamic power management, etc., and can manage the charging and discharging of the power battery 80 based on parameters such as battery status, vehicle demand, etc. The high-voltage distribution switch 52 is used to open or close a high-voltage circuit, such as a high-voltage relay, a gas-insulated switch, a solid-insulated switch, or the like, that is formed between the power battery 80 and the load.

Under the condition that the control of the main ECU20 is effective and the communication is normal, the battery management system 51 can control the high-voltage distribution switch 52 to be closed based on the power-on request output by the main ECU20 so as to enable the power battery 80 to supply power to the load to realize high-voltage power up, and control the high-voltage distribution switch 52 to be opened according to the power-off request output by the main ECU20 so as to enable the power battery 80 to stop supplying power to the load to realize high-voltage power down.

In the case where the main ECU20 controls failure or communication failure, the battery management system 51 no longer responds to the power-on and power-off request output from the main ECU20, and controls the high-voltage distribution switch 52 to be turned off according to the power-off request of the backup ECU30 based on the control effective information, to realize high-voltage power-off.

According to some embodiments of the present application, as shown in fig. 6, the vehicle redundancy control system 100 further includes: the low-voltage power supply assembly 60, the low-voltage power supply assembly 60 is connected with the main ECU20 and the backup ECU30, respectively, and the backup ECU30 is further configured to output control effective information to the low-voltage power supply assembly 60 to instruct the low-voltage power supply assembly 60 to perform low-voltage power supply or stop power supply based on a power supply voltage request or a power supply stop request of the backup ECU 30.

The low voltage power supply assembly 60 is used for providing low voltage power required for operation of a low voltage power unit in a vehicle, and the low voltage power supply assembly 60 may include a DC/DC (Direct Current-Direct Current) module, a low voltage circuit breaker, a disconnector, and the like. For example, after the power battery 80 is powered on, the power battery 80 outputs high-voltage direct current to the DC/DC module of the low-voltage power supply assembly 60 through the high-voltage power supply assembly 50, and converts the high-voltage direct current into low-voltage direct current through the DC/DC module in the low-voltage power supply assembly 60 to power the low-voltage power consumption unit of the vehicle.

When the control of the main ECU20 is effective and the communication is normal, the low-voltage power supply module 60 performs operations such as low-voltage power supply, power supply voltage adjustment, power supply stop, and the like based on a power supply request output from the main ECU 20. In the case where the main ECU20 is in control failure or communication failure, the low-voltage power supply module 60 performs low-voltage power supply or stops power supply based on a power supply voltage request or a power supply stop request.

According to some embodiments of the present application, as shown in fig. 7, the low voltage power supply assembly 60 includes a low voltage distribution controller 61 and a voltage conversion module 62, the voltage conversion module 62 is connected to the high voltage power supply assembly 50 and the low voltage distribution controller 61, respectively, and the low voltage distribution controller 61 is configured to control the voltage conversion module 62 to perform low voltage power supply or stop power supply based on a power supply voltage request or a power supply stop request of the backup ECU30 when receiving control effective information.

The voltage conversion module 62 may be a DC/DC module to perform voltage conversion on the received direct current to meet the power demand of the low voltage power unit. The low-voltage distribution controller 61 may control a low-voltage circuit that supplies power to the low-voltage power consumption unit based on the received power supply instruction to achieve power supply or stop power supply to the low-voltage power consumption unit. Specifically, the low-voltage distribution controller 61 may control the corresponding voltage conversion module 62 based on the received supply voltage request, so that the voltage conversion module 62 outputs the low-voltage direct current corresponding to the supply voltage request to supply power to the target low-voltage power unit; the voltage conversion module 62 is controlled to stop outputting based on the received power supply stop request to stop supplying power to the target low-voltage power use unit.

In the case where the control of the main ECU20 is effective and the communication is normal, the low-voltage distribution controller 61 controls the voltage conversion module 62 in accordance with a power supply voltage request or a power supply stop request output from the main ECU 20. In the case where the main ECU20 is in control failure or communication failure, the backup ECU30 takes over the low-voltage control flow of the main ECU20, and the low-voltage power supply module 60 controls based on the power supply voltage request or the power supply stop request voltage conversion module 62 output by the backup ECU 30.

As shown in fig. 8, the vehicle redundancy control system 100 further includes: the thermal management assembly 70, the thermal management assembly 70 is respectively connected to the main ECU20 and the backup ECU30, and the backup ECU30 is further configured to output control effective information to the thermal management assembly 70 to instruct the thermal management assembly 70 to thermally manage the drive assembly 10 based on the thermal management request of the backup ECU 30. The thermal management assembly 70 is used to effect temperature regulation and may include an on-board air conditioner, a battery cooling assembly, and the like.

In the case where the control of the main ECU20 is effective and the communication is normal, the thermal management assembly 70 performs thermal management actions such as heating, cooling, temperature adjustment, and the like based on the thermal management request output from the main ECU 20. In the case where the main ECU20 is in control failure or communication failure, the backup ECU30 takes over the thermal management control function, and the thermal management assembly 70 thermally manages the drive assembly 10, such as cooling, heating, etc., of the drive assembly 10 based on the thermal management request of the backup ECU 30.

As shown in fig. 9, according to some embodiments of the present application, the thermal management assembly 70 includes a thermal management controller 71 and a cooling assembly 72, the cooling assembly 72 is disposed corresponding to the driving assembly 10, the thermal management controller 71 is respectively connected to the cooling assembly 72 and the high-voltage power supply assembly 50, and is configured to control the cooling assembly 72 to cool the driving assembly 10 based on a thermal management request of the backup ECU30 when receiving control effective information, and to output a power-down request to the high-voltage power supply assembly 50 to instruct the high-voltage power supply assembly 50 to perform high-voltage power down when the driving assembly 10 is over-temperature. Or the thermal management controller 71 is respectively connected to the cooling module 72 and the high-voltage power supply module 50, and is configured to control the cooling module 72 to cool the driving module 10 based on the thermal management request of the backup ECU30 when receiving the control valid information, and to output a power-down request to the backup ECU30 when the driving module 10 is over-temperature, and the backup ECU30 outputs a high-voltage power-down instruction to instruct the high-voltage power supply module 50 to perform high-voltage power-down.

The thermal management controller 71 is configured to receive a thermal management request and control a thermal management assembly based on the thermal management request, wherein the thermal management assembly may include a heating assembly, a cooling assembly, and the like. The cooling module 72 is used for cooling the corresponding driving module 10, such as a water cooling system, an air cooling system, etc. of the power battery.

Taking the driving assembly 10 as a power battery, the cooling assembly 72 is a water cooling system arranged on the power battery, and under the condition that the control of the main ECU20 fails or the communication fails, the backup ECU30 cooperates with the thermal management controller 71 to execute a thermal management function so as to adjust parameters such as the refrigerant flow rate, the refrigerant temperature and the like of the water cooling system to meet the cooling requirement of the battery. Based on the over-temperature protection strategy of the battery management system, when the thermal management controller 71 determines that the power battery is over-temperature, a corresponding over-temperature protection signal is output to control the high-voltage power supply assembly 50 to actively disconnect a positive/negative relay arranged at the output end of the power battery so as to perform high-voltage power reduction.

The application also proposes a vehicle 1000 corresponding to the above embodiment.

As shown in fig. 10, a vehicle 1000 of an embodiment of the application includes the vehicle redundancy control system 100 described above.

Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present application, and not for limiting the same; although the application has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some or all of the technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit of the application, and are intended to be included within the scope of the appended claims and description. In particular, the technical features mentioned in the respective embodiments may be combined in any manner as long as there is no structural conflict. The present application is not limited to the specific embodiments disclosed herein, but encompasses all technical solutions falling within the scope of the claims.

Claims (10)

1. A redundant control system for a vehicle, the redundant control system comprising:

a drive assembly configured to drive the vehicle;

A main ECU connected to the drive assembly and configured to output control failure information when a control failure occurs;

And the backup ECU is respectively connected with the main ECU and the driving assembly and is configured to output control effective information to the driving assembly when receiving the control failure information or the communication failure of the main ECU so as to instruct the driving assembly to drive the vehicle to run based on the driving control instruction of the backup ECU.

2. The system of claim 1, wherein the master ECU includes a master chip and a master communication component, the master communication component being respectively connected to the master chip, the backup ECU, and the drive component, the master chip being configured to control the drive component through the master communication component and output the control failure information;

The backup ECU comprises a backup chip and a backup communication assembly, wherein the backup communication assembly is respectively connected with the backup chip, the main ECU and the driving assembly, and the backup chip is configured to receive the control failure information, detect the communication state of the main ECU and output the control effective information to the driving assembly through the backup communication assembly.

3. The system of claim 1 or 2, wherein the redundant control system further comprises:

and the brake assembly is respectively connected with the main ECU and the backup ECU and is configured to output brake information to the main ECU and the backup ECU.

4. The system of claim 1 or 2, wherein the redundant control system further comprises:

The high-voltage power supply assembly is respectively connected with the main ECU and the backup ECU, and the backup ECU is further configured to output the control effective information to the high-voltage power supply assembly so as to instruct the high-voltage power supply assembly to conduct high-voltage power down based on a power down request of the backup ECU.

5. The system of claim 4, wherein the high voltage power supply assembly comprises a battery management system and a high voltage distribution switch, the high voltage distribution switch being respectively connected to a power battery of the vehicle and the battery management system, the battery management system being configured to control the high voltage distribution switch to be turned off for high voltage power down based on a power down request of the backup ECU upon receipt of the control valid information.

6. The system of claim 4, wherein the redundant control system further comprises:

The low-voltage power supply assembly is respectively connected with the main ECU and the backup ECU, and the backup ECU is further configured to output the control effective information to the low-voltage power supply assembly so as to instruct the low-voltage power supply assembly to perform low-voltage power supply or stop power supply based on a power supply voltage request or a power supply stop request of the backup ECU.

7. The system of claim 6, wherein the low voltage power supply assembly comprises a low voltage distribution controller and a voltage conversion module, the voltage conversion module being respectively connected to the high voltage power supply assembly and the low voltage distribution controller, the low voltage distribution controller being configured to control the voltage conversion module to perform low voltage power supply or to stop power supply based on a power supply voltage request or a power supply stop request of the backup ECU upon receiving the control effective information.

8. The system of claim 4, wherein the redundant control system further comprises:

And the thermal management component is respectively connected with the main ECU and the backup ECU, and the backup ECU is further configured to output the control effective information to the thermal management component so as to instruct the thermal management component to perform thermal management on the driving component based on the thermal management request of the backup ECU.

9. The system of claim 8, wherein the thermal management assembly includes a thermal management controller and a cooling assembly, the cooling assembly being disposed in correspondence with the drive assembly, the thermal management controller being respectively coupled to the cooling assembly and the high voltage power assembly and configured to control the cooling assembly to cool the drive assembly based on a thermal management request of the backup ECU upon receipt of the control valid information, and to output a power down request to the high voltage power assembly upon an over-temperature of the drive assembly to instruct the high voltage power assembly to perform a high voltage power down.

10. A vehicle comprising a redundant control system for a vehicle according to any one of claims 1-9.