SOA-based vehicle body domain control hierarchical service system and state management method thereof
By adopting a three-tier service architecture based on SOA, the hardware protection strategy and business logic in the Body Controller (BCM) are separated, which solves the compatibility problem of BCM between traditional and new architectures, improves system security and flexibility, and supports seamless transition and OTA upgrades.
Patent Information
- Application Number
- CN202511501068.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-21
- Publication Date
- 2026-02-10
AI Technical Summary
Existing technologies cannot decouple security policies from business logic in the Body Domain Controller (BCM), enabling it to operate as an independent intelligent node while seamlessly integrating into a centralized architecture. This results in functional rigidity or increases the complexity and security risks of the central computer.
A three-tier service architecture based on SOA is adopted, including a device abstraction layer, an atomic service layer, a business logic judgment service layer, and a state management unit. This achieves the separation of hardware protection strategies from business logic, and ensures data consistency and security status query through the state management unit.
It achieves the flexibility and security of BCM, supports a seamless transition from traditional architecture to new architecture, reduces the load on the central computer, and supports OTA upgrades and feature customization.
Smart Images
Figure CN121500828A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of automotive electronics technology, specifically relating to a layered service system for a body domain controller (BCM) based on SOA (Service-Oriented Architecture) that is compatible with both traditional distributed and future centralized architectures, and its state management method. Background Technology
[0002] With the development of automotive intelligence, the electronic and electrical architecture is evolving from the traditional "distributed ECU" to "domain control" and even "central computing + regional control". Against this backdrop, the role of the Body Domain Controller (BCM) is undergoing a fundamental change: from a functional controller that integrates all business logic (such as door locks' welcome and speed-sensitive locking) to an intelligent execution unit that primarily provides execution capabilities and is directed by a central computer.
[0003] However, current BCM design faces a dilemma:
[0004] Traditional model: The Business Module (BCM) internally contains a large amount of business scenario logic. The advantage is that it can work independently; the disadvantages are that it is functionally rigid, cannot respond to the flexible scheduling of the central computer, and is difficult to upgrade via OTA, making it incompatible with new architectures.
[0005] Pure execution mode: All low-level BCM operations (such as "locking the motor to power on for 10ms") are encapsulated as SOA services for external calls. The advantage is flexibility; the disadvantage is that all security policies (such as motor thermal protection, anti-pinch algorithm) and business judgments (such as whether unlocking is currently allowed) are handled by the central computer, which greatly increases the complexity of the central computer and the network load, and poses serious security risks.
[0006] Existing technologies lack a solution that can decouple security policies, hardware management, and business logic within the BCM, enabling it to operate as an independent intelligent node while seamlessly integrating into a new centralized architecture to efficiently and securely execute upper-layer instructions. Summary of the Invention
[0007] In view of this, the purpose of this invention is to provide a SOA-based vehicle domain control hierarchical service system and its state management method. This invention, through an innovative three-layer service architecture and a unified state management unit, achieves the separation of hardware protection strategies, business logic, and execution services, making BCM an "evolvable and adaptable" intelligent execution platform.
[0008] This invention provides a SOA-based vehicle domain control layered service system, including a device abstraction layer, an atomic service layer, a business logic judgment service layer, a state management unit, and an external service adaptation layer;
[0009] Device Abstraction Layer: Provides basic services for direct interaction with hardware, completing the lowest-level driver operations;
[0010] Atomic Service Layer: Used to call the device abstraction layer service and query the policy status of the state management unit to determine whether to execute an action;
[0011] Business logic judgment service layer: used to implement the calculation of all safety policies, vehicle status judgment and traditional scenario logic, and output the calculation results to the status management unit;
[0012] State Management Unit: Used to receive and cache all state and strategy results calculated by the business logic judgment service layer, and to provide a state query interface for the atomic service layer;
[0013] External Service Adapter Layer: Used to receive service call requests from the central computer or other domain controllers and route them to the corresponding atomic services.
[0014] Furthermore, the basic services provided by the device abstraction layer include motor control and I / O input / output services.
[0015] Furthermore, the atomic service layer includes several independent minimal functional unit services that can be called externally, and each unit service corresponds to a complete vehicle body action.
[0016] Furthermore, the business logic judgment service layer runs inside the vehicle domain controller and is called periodically.
[0017] This invention also provides a state management method for a SOA-based vehicle domain control hierarchical service system, comprising the following steps:
[0018] S1. The status management unit protects data consistency;
[0019] The state cache updates variables belonging to the same time period and stores the latest state values subscribed from various services.
[0020] S2. The business logic judgment service layer runs periodically to calculate the safety status based on sensor data, internal timers, and preset strategies.
[0021] The safety status includes the enabling status of various safety protections;
[0022] Due to differences in automotive electronic and electrical architectures, the implementation of scenario logic falls into the following three categories:
[0023] I. If the scene logic call atomic service is implemented by the central domain controller, then the business logic judgment service layer of the vehicle domain controller does not contain the scene module, and the vehicle domain controller only plays the role of a controller.
[0024] II. If the scene logic calls the atomic service, which is implemented by the vehicle domain controller, then the business logic judgment service layer of the vehicle domain controller needs to implement various scene modules; if the scene module meets the conditions, then the corresponding atomic service is directly called through the event bus to execute the action.
[0025] III. The atomic service for scene logic calls is jointly implemented by the central domain controller and the body domain controller. Some business scenarios with low real-time requirements are handled by the central domain controller, while other business scenarios with high real-time requirements are handled by the body domain controller.
[0026] S3. The business logic judgment service layer publishes the calculated state to the state management unit for updating;
[0027] S4. When an external or internal request arrives, an atomic service is invoked.
[0028] S5. Security Protection Status Inquiry;
[0029] After receiving the request, the vehicle domain controller queries the relevant policy status from the state management unit of the software components involved in the relevant atomic service;
[0030] S6. Atomic services make decisions based on query results;
[0031] If the security protection status of the relevant device is enabled, the atomic service will not call the device abstraction service and will return a failure response and reason to the caller; otherwise, it will call the device abstraction service to control the motor drive or change the I / O port level.
[0032] Beneficial effects:
[0033] 1. Perfect compatibility and smooth evolution: Stable atomic service interfaces shield the system from changes in underlying strategies. OEMs can gradually migrate their business logic from BCM to the central computer without any modifications to the upper-layer software, achieving a seamless transition from traditional architecture to the new architecture.
[0034] 2. Security policies are decentralized to ensure security: All critical hardware protection policies (thermal protection, anti-pinch, short-circuit protection) are embedded in the BCM to ensure that all calls from any source must comply with security rules, greatly improving the security and reliability of the system.
[0035] 3. Reduced central computing load and network pressure: The central computer does not need to care about the underlying hardware status. It only needs to call high-level instructions such as "unlock the car door" without having to determine "whether the motor temperature is too high". This significantly reduces the complexity of the central software and the bus load.
[0036] 4. Supports OTA upgrades and feature customization: The business logic judgment service layer can be upgraded as an independent module via OTA to add new strategies or scenarios. Simultaneously, OEMs can choose to disable scenario modules within the BCM, allowing the central computer to implement personalized functions entirely, supporting feature customization.
[0037] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description
[0038] Figure 1 This is a schematic diagram of the architecture of the vehicle body domain control hierarchical service system of the present invention;
[0039] Figure 2 This is a flowchart of the state management method of the vehicle body domain control hierarchical service system of the present invention;
[0040] Figure 3 A flowchart illustrating the logic of decision-making for atomic services. Detailed Implementation
[0041] To make the technical solutions, advantages, and objectives of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the protection scope of this application.
[0042] like Figure 1 As shown, the present invention provides a vehicle body domain control layered service system based on SOA, including a device abstraction layer, an atomic service layer, a business logic judgment service layer, a state management unit, and an external service adaptation layer.
[0043] Device Abstraction Layer: Provides basic services for direct interaction with hardware, including motor control, I / O input / output services, and completes the lowest-level drive operations.
[0044] Atomic Service Layer: Consists of several independent, minimal functional unit services that can be called externally. Each atomic service corresponds to a complete vehicle body action. The atomic service calls the device abstraction layer service and queries the policy status of the status management unit to determine whether to execute the action. For example, for the unlocking atomic service, the "hot protection status" in the status management unit is queried before execution. If it is under protection, execution is refused and an error code is returned.
[0045] The interfaces provided by the atomic service layer are stable. No matter how the strategies and scenarios inside the business logic judgment service layer change or are upgraded, the external calling method remains unchanged.
[0046] Business Logic Judgment Service Layer: Running within the BCM, this layer is periodically invoked to implement all safety policies, vehicle status judgments, and traditional scenario logic. This layer does not directly call the driver; instead, it outputs its calculation results to a unified state management unit. For example, in the door lock module, this layer includes a "motor thermal protection management module" that periodically calculates the number of times the motor is driven within a short period and writes the Boolean state "whether motor operation is allowed" to the state management unit. This layer also includes modules such as speed-sensitive locking, which trigger the locking atomic service via event invocation when the vehicle speed condition is met.
[0047] The State Management Unit (SMU) serves as the sole trusted state source for each functional module within the Business Module Management (BCM), acting as a centralized data bus. It receives and caches all state and policy results calculated by the business logic decision-making service layer and provides a state query interface for atomic service layers. By maintaining a series of variables in memory through state caching, it stores the latest state values subscribed from various services, making service providers more intelligent. Internal caching and periodic checks reliably handle joint judgments based on multiple conditions, avoiding network storms and timing issues.
[0048] External Service Adapter Layer: Used to receive service call requests from the central computer or other domain controllers and route them to the corresponding atomic services.
[0049] like Figure 2 As shown, the present invention also provides a state management method for a vehicle body domain control hierarchical service system based on SOA, comprising the following steps:
[0050] S1. The status management unit protects data consistency;
[0051] Each software component has its own state cache, which updates the signals transmitted from the Real-Time Equip (RTE). This cache stores signals from subscriptions to various services or internal data variables, representing the latest state values at the same time point. The state cache ensures the real-time nature of the signals through periodic calls.
[0052] S2. The business logic judgment service layer runs periodically and calculates the safety status (such as thermal protection status) based on sensor data, internal timers and preset strategies. The safety status includes the enabling status of various safety protections.
[0053] At the same time, due to the different automotive electronic and electrical architectures, it is determined whether the business logic judgment service layer of the body domain controller includes a scenario module.
[0054] If the scene logic call atomic service is implemented by the central domain controller, then the business logic judgment service layer of the vehicle domain controller does not contain the scene module, and the vehicle domain controller only plays the role of a controller.
[0055] If the scene logic calls to atomic services are implemented by the vehicle body controller, then the business logic judgment service layer of the vehicle body domain controller needs to implement various scene modules (such as welcome interlocking, welcome light signals, etc.). If the scene module meets the conditions, it directly calls the corresponding atomic service to execute the action through the event bus. In this case, the vehicle body domain controller also has functional logic processing capabilities.
[0056] A more common application scenario lies between the two. Since external service calls take a certain amount of time, some business scenarios with low real-time requirements are handled by the central domain controller, while other business scenarios with high real-time requirements (such as collision unlocking) are handled by the vehicle domain controller.
[0057] S3. The business logic judgment service layer publishes the calculated state to the state management unit for updating;
[0058] S4. When an external or internal request arrives, an atomic service is invoked (such as a latch command);
[0059] S5. Security Protection Status Inquiry;
[0060] After receiving the request, the vehicle domain controller queries the state management unit of the software components involved in the relevant atomic service for the relevant policy status (such as whether the door lock thermal protection is activated).
[0061] S6. Atomic services make decisions based on query results;
[0062] If the security protection status of the relevant device is enabled, the atomic service will not call the device abstraction service and will return a failure response and reason to the caller; otherwise, it will call the device abstraction service to control the motor drive or change the I / O port level.
[0063] The following is in conjunction with the appendix Figure 3 The implementation process of the method of the present invention will be explained in detail using "car door unlocking" as an example. The specific steps are as follows:
[0064] S1. Business Logic Layer Operation: The "Motor Thermal Management Module" determines that the motor is overheating based on the motor's recent operating frequency and writes the thermal protection status into the status management unit.
[0065] S2. Central Computer Request: When the user clicks "Unlock All Doors" on the central control screen, the central computer sends an atomic service request to the BCM to unlock all four doors.
[0066] S3. Atomic Service Decision: Upon receiving a request, the unlock atomic service immediately queries the thermal protection status in the status management unit.
[0067] S4. Secure Execution: If the query result is TRUE, the atomic service will no longer call the motor drive service of the device abstraction layer, but will directly reply to the central computer with "Operation failed: Motor is under thermal protection".
[0068] S5. Execution of BCM Scenario Logic under Traditional Electronic and Electrical Architecture: Simultaneously, the "speed-based locking" module within the BCM detects that the vehicle speed exceeds the threshold, meeting the locking condition. It directly calls the locking atomic service through internal events. This atomic service also queries the thermal protection status; if it is FALSE, the locking is executed normally.
[0069] Through the above methods, regardless of whether the instructions come from internal or external sources, they are all subject to unified security policy control, achieving a perfect balance between security and flexibility.
[0070] The present invention provides a key BCM design paradigm for both traditional electronic and electrical architectures and next-generation automotive electronic and electrical architectures. It is compatible with both and has extremely high industrial application value.
[0071] It is hereby declared that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.
Claims
1. A SOA-based hierarchical service system for vehicle body domain control, characterized in that: It includes a device abstraction layer, an atomic service layer, a business logic judgment service layer, a state management unit, and an external service adaptation layer; Device Abstraction Layer: Provides basic services for direct interaction with hardware, completing the lowest-level driver operations; Atomic Service Layer: Used to call the device abstraction layer service and query the policy status of the state management unit to determine whether to execute an action; Business logic judgment service layer: used to implement the calculation of all safety policies, vehicle status judgment and traditional scenario logic, and output the calculation results to the status management unit; State Management Unit: Used to receive and cache all state and strategy results calculated by the business logic judgment service layer, and to provide a state query interface for the atomic service layer; External Service Adapter Layer: Used to receive service call requests from the central computer or other domain controllers and route them to the corresponding atomic services.
2. The SOA-based vehicle domain control hierarchical service system according to claim 1, characterized in that: The basic services provided by the device abstraction layer include motor control and I / O input / output services.
3. The SOA-based vehicle domain control hierarchical service system according to claim 2, characterized in that: The atomic service layer includes several independent, minimal functional unit services that can be called from outside, and each unit service corresponds to a complete vehicle body action.
4. The SOA-based vehicle domain control hierarchical service system according to claim 3, characterized in that: The business logic judgment service layer runs inside the vehicle domain controller and is called periodically.
5. A state management method for a vehicle body domain control hierarchical service system based on SOA as described in any one of claims 1 to 4, characterized in that, Includes the following steps: S1. The status management unit protects data consistency; The state cache updates variables belonging to the same time period and stores the latest state values subscribed from various services. S2. The business logic judgment service layer runs periodically to calculate the safety status based on sensor data, internal timers, and preset strategies. The safety status includes the enabling status of various safety protections; Due to differences in automotive electronic and electrical architectures, the implementation of scenario logic falls into the following three categories: I. If the scene logic call atomic service is implemented by the central domain controller, then the business logic judgment service layer of the vehicle domain controller does not contain the scene module, and the vehicle domain controller only plays the role of a controller. II. If the scene logic calls the atomic service, which is implemented by the vehicle domain controller, then the business logic judgment service layer of the vehicle domain controller needs to implement various scene modules; if the scene module meets the conditions, then the corresponding atomic service is directly called through the event bus to execute the action. III. The atomic service for scene logic calls is jointly implemented by the central domain controller and the body domain controller. Some business scenarios with low real-time requirements are handled by the central domain controller, while other business scenarios with high real-time requirements are handled by the body domain controller. S3. The business logic judgment service layer publishes the calculated state to the state management unit for updating; S4. When an external or internal request arrives, an atomic service is invoked. S5. Security Protection Status Inquiry; After receiving the request, the vehicle domain controller queries the relevant policy status from the state management unit of the software components involved in the relevant atomic service; S6. Atomic services make decisions based on query results; If the security protection status of the relevant device is enabled, the atomic service will not call the device abstraction service and will return a failure response and reason to the caller; otherwise, it will call the device abstraction service to control the motor drive or change the I / O port level.