Domain controller and motor vehicle

Abstract

The present application discloses a domain controller and a motor vehicle, wherein, when the security level of the first control module is higher than the security level of the second control module, the domain controller uses a monitoring chip to monitor the first control module, and uses the first control module to monitor the second control module, thereby reducing the use of one monitoring chip and reducing the cost of the domain controller; when the security level of the first control module is the same as the security level of the second control module, the first control module and the second control module are used to monitor each other, which reduces the use of two monitoring chips compared to the domain controller in the prior art and reduces the cost of the domain controller.

Description

Technical Field

[0001] The present application relates to the technical field of microcontrollers, and more specifically, to a domain controller and a motor vehicle. Background Art

[0002] Among the hardware devices of motor vehicles, the domain controller is one of the core devices that controls other hardware to work together.

[0003] In mainstream motor vehicles, the domain controller usually consists of a main control chip and a monitoring chip. The main control chip is responsible for specific function execution, and the monitoring chip monitors whether the main control chip is working properly through a question-and-answer mechanism. The main control chip usually includes two control modules, which requires that two monitoring modules are also set in the monitoring chip to monitor the two control modules in the main control chip. The large number of monitoring modules makes the cost of the domain controller high. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides a domain controller and a motor vehicle to achieve the purpose of reducing the number of monitoring modules in the domain controller, thereby reducing the cost of the domain controller.

[0005] To achieve the above technical objectives, the present application provides the following technical solutions:

[0006] A domain controller comprises: a first control module, a second control module, a first communication module and a second communication module; wherein:

[0007] The security level of the first control module is higher than that of the second control module, or the security level of the first control module is the same as that of the second control module; the first control module communicates with other modules through the first communication module, and the second control module communicates with other modules through the second communication module;

[0008] When the security level of the first control module is higher than the security level of the second control module, the domain controller further includes: a monitoring chip;

[0009] The monitoring chip is connected to the first control module and the first communication module, and is used to monitor the response state of the first control module, and restart the first control module or shut down the first communication module when the response state of the first control module is abnormal;

[0010] The first control module is connected to the second control module, and is used to monitor the response status of the second control module, and restart the second control module or shut down the second communication module when the response status of the second control module is abnormal;

[0011] When the security level of the first control module is the same as the security level of the second control module, the first control module is connected to the second control module, and the first control module is used to monitor the response state of the second control module, and restart the second control module or shut down the second communication module when the response state of the second control module is abnormal;

[0012] The second control module is used to monitor the response status of the first control module, and restart the first control module or shut down the first communication module when the response status of the first control module is abnormal.

[0013] Optionally, when the security level of the first control module is higher than the security level of the second control module,

[0014] The monitoring chip is specifically used to send an inquiry instruction to the first control module at a first preset time interval, and determine whether a response instruction sent by the first control module is received within a second preset time, if not, determine that the response state of the first control module is abnormal, when the number of abnormal response states of the first control module exceeds a first preset threshold within a third preset time, restart the first control module, and determine whether the response state of the first control module is abnormal after the restart, if yes, shut down the first communication module;

[0015] The first control module is specifically used to send an inquiry instruction to the second control module every fourth preset time, and determine whether a response instruction sent by the second control module is received within a fifth preset time. If not, it is determined that the response state of the second control module is abnormal. When the number of abnormal response states of the second control module exceeds a second preset threshold within a sixth preset time, the second control module is restarted, and it is determined whether the response state of the second control module is abnormal after the restart. If so, the second communication module is turned off.

[0016] Optionally, the third preset time and the first preset threshold satisfy a first preset formula;

[0017] The sixth preset time and the second preset threshold satisfy a second preset formula;

[0018] The first preset formula is T3×N1<100ms, where T3 represents the third preset time, and N1 represents the first preset threshold;

[0019] The second preset formula is T6×N2<100ms, where T6 represents the sixth preset time, and N2 represents the second preset threshold.

[0020] Optionally, the first control module is further configured to send first failure information to the monitoring chip when the first control module detects that its own response state is abnormal;

[0021] When the monitoring chip receives the first failure information, shutting down the first communication module;

[0022] The second control module is further configured to send second failure information to the first control module when the second control module detects that its own response state is abnormal;

[0023] The first control module is further configured to shut down the second communication module upon receiving the second failure information.

[0024] Optionally, the monitoring chip is connected to the first communication module via a first connection line, and is connected to the first control module via a first feedback connection line, a first reset connection line and a first serial connection line respectively;

[0025] The first control module is connected to the second communication module via a second connection line, and is connected to the second control module via a second feedback connection line, a second reset connection line, and a second serial connection line, respectively.

[0026] Optionally, when the security level of the first control module is the same as the security level of the second control module,

[0027] The first control module is specifically used to send an inquiry instruction to the second control module every seventh preset time, and determine whether a response instruction sent by the second control module is received within an eighth preset time. If not, it is determined that the response status of the second control module is abnormal. When the number of abnormal response statuses of the second control module exceeds a third preset threshold within a ninth preset time, the second control module is restarted, and it is determined whether the response status of the second control module is abnormal after the restart. If so, the second communication module is turned off.

[0028] The second control module is specifically used to send an inquiry instruction to the first control module every tenth preset time, and determine whether a response instruction sent by the first control module is received within an eleventh preset time; if not, determine that the response status of the first control module is abnormal; when the number of abnormal response statuses of the first control module exceeds a fourth preset threshold within a twelfth preset time, restart the first control module, and determine whether the response status of the first control module is abnormal after restarting; if so, shut down the first communication module.

[0029] Optionally, the ninth preset time and the third preset threshold satisfy a third preset formula;

[0030] The twelfth preset time and the fourth preset threshold satisfy a fourth preset formula;

[0031] The third preset formula is T9×N3<100ms, where T9 represents the ninth preset time, and N3 represents the first preset threshold;

[0032] The fourth preset formula is T12×N4<100ms, where T12 represents the sixth preset time, and N4 represents the second preset threshold.

[0033] Optionally, the first control module is further configured to send a third failure message to the second control module when the first control module detects that its own response state is abnormal, and to shut down the second communication module when receiving a fourth failure message;

[0034] The second control module is further configured to send the fourth failure message to the first control module when the second control module detects that its own response state is abnormal, and to shut down the first communication module when the second control module receives the third failure message.

[0035] Optionally, the first control module is connected to the second communication module via a third connection line, and is respectively connected to the second control module via a third feedback connection line, a fourth feedback connection line, a third reset connection line and a third serial connection line;

[0036] The second control module is connected to the first communication module via a fourth connection line.

[0037] A motor vehicle, comprising: a domain controller as described in any one of the above items.

[0038] It can be seen from the above technical solution that the embodiment of the present application provides a domain controller and a motor vehicle, wherein, when the security level of the first control module is higher than the security level of the second control module, the domain controller uses a monitoring chip to monitor the first control module, and uses the first control module to monitor the second control module, thereby reducing the use of one monitoring chip and reducing the cost of the domain controller; when the security level of the first control module is the same as the security level of the second control module, the first control module and the second control module are used to monitor each other, which reduces the use of two monitoring chips compared to the domain controller in the prior art and reduces the cost of the domain controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 This is a schematic diagram of the system framework structure of the domain controller;

[0041] Figure 2 A schematic diagram of the structure of a domain controller provided for one embodiment of the present application;

[0042] Figure 3 A schematic diagram of the structure of a domain controller provided for another embodiment of the present application;

[0043] Figure 4 A schematic diagram of the structure of a domain controller provided in yet another embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of a domain controller provided for yet another embodiment of the present application. DETAILED DESCRIPTION

[0045] Domain controller system framework reference Figure 1 , including a first sensor, a second sensor, a first control module and a second control module. The first sensor is connected to the first control module to provide sensing information for the first control module. The second sensor is connected to the second control module to provide sensing information for the second control module. The main functions of the first control module include assisted driving, intelligent charging and big data prediction, etc. The main functions of the second control module include power on and off, torque request, energy management and thermal management, etc. The first control module and the second control module mainly communicate through a serial communication interface (Serial Peripheral Interface, SPI). The first control module interacts with other modules through CAN FD and Ethernet, and the second control module also interacts with other modules through CAN FD and Ethernet. To ensure torque safety, Figure 1 In the solution shown, the second control module is responsible for the specific torque calculation. The first control module does not directly participate in the torque calculation, but can have a certain influence on the torque analysis of the second control module through the setting of coefficients.

[0046] In the solution in the prior art, monitoring of the first control module and the second control module requires two monitoring chips to monitor whether the first control module and the second control module are working normally through a question-and-answer mechanism. A large number of monitoring chips leads to an increase in the cost of the domain controller.

[0047] In view of this, an embodiment of the present application provides a domain controller, including: a first control module, a second control module, a first communication module and a second communication module; wherein:

[0048] The security level of the first control module is higher than that of the second control module, or the security level of the first control module is the same as that of the second control module; the first control module communicates with other modules through the first communication module, and the second control module communicates with other modules through the second communication module;

[0049] When the security level of the first control module is higher than the security level of the second control module, the domain controller further includes: a monitoring chip;

[0050] The monitoring chip is connected to the first control module and the first communication module, and is used to monitor the response state of the first control module, and restart the first control module or shut down the first communication module when the response state of the first control module is abnormal;

[0051] The first control module is connected to the second control module, and is used to monitor the response status of the second control module, and restart the second control module or shut down the second communication module when the response status of the second control module is abnormal;

[0052] When the security level of the first control module is the same as the security level of the second control module, the first control module is connected to the second control module, and the first control module is used to monitor the response state of the second control module, and restart the second control module or shut down the second communication module when the response state of the second control module is abnormal;

[0053] The second control module is used to monitor the response status of the first control module, and restart the first control module or shut down the first communication module when the response status of the first control module is abnormal.

[0054] When the security level of the first control module is higher than the security level of the second control module, the domain controller uses a monitoring chip to monitor the first control module, and uses the first control module to monitor the second control module, thereby reducing the use of one monitoring chip and reducing the cost of the domain controller; when the security level of the first control module is the same as the security level of the second control module, the first control module and the second control module are used to monitor each other, which reduces the use of two monitoring chips compared to the domain controller in the prior art and reduces the cost of the domain controller.

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] The present application embodiment provides a domain controller, such as Figure 2 and Figure 3 As shown, the domain controller includes: a first control module 10, a second control module 20, a first communication module 30 and a second communication module 40; wherein,

[0057] The security level of the first control module 10 is higher than the security level of the second control module 20, or the security level of the first control module 10 is the same as the security level of the second control module 20; the first control module 10 communicates with other modules through the first communication module 30, and the second control module 20 communicates with other modules through the second communication module 40;

[0058] like Figure 2 As shown, when the security level of the first control module 10 is higher than the security level of the second control module 20, the domain controller further includes: a monitoring chip 50;

[0059] The monitoring chip 50 is connected to the first control module 10 and the first communication module 30. The monitoring chip 50 is used to monitor the response state of the first control module 10, and restart the first control module 10 or shut down the first communication module 30 when the response state of the first control module 10 is abnormal;

[0060] The first control module 10 is connected to the second control module 20, and is used to monitor the response status of the second control module 20, and restart the second control module 20 or shut down the second communication module 40 when the response status of the second control module 20 is abnormal;

[0061] like Figure 3 As shown, when the security level of the first control module 10 is the same as the security level of the second control module 20, the first control module 10 is connected to the second control module 20, and the first control module 10 is used to monitor the response state of the second control module 20, and restart the second control module 20 or shut down the second communication module 40 when the response state of the second control module 20 is abnormal;

[0062] The second control module 20 is used to monitor the response status of the first control module 10 , and restart the first control module 10 or shut down the first communication module 30 when the response status of the first control module 10 is abnormal.

[0063] exist Figure 2 In the embodiment, the safety level of the first control module 10 can be ASIL D, ASIL C, etc. In order to ensure the overall working safety of the domain controller, the safety level of the first control module 10 is preferably ASIL D; the safety level of the second control module 20 can be ASIL B, ASIL A, ASIL QM, etc., as long as the safety level of the second control module 20 is lower than the safety level of the first control module 10.

[0064] exist Figure 3 In order to ensure the overall working safety of the domain controller, it is preferred that the safety levels of the first control module 10 and the second control module 20 are both ASIL D.

[0065] exist Figure 2 In the illustrated embodiment, the first control module 10 may be a powertrain control unit (PCU), whose main functions include power on and off, torque request, energy management, and thermal management, etc.; the second control module 20 may be a microprocessor (MPU), whose main functions include assisted driving, intelligent charging, and big data prediction, etc.

[0066] Optionally, the first control module 10 may also be a microprocessor, in which case the main functions include assisted driving, intelligent charging, big data prediction and torque request; the second control module 20 may also be a power system control unit, in which case the main functions include power on and off, energy management and thermal management, etc.

[0067] exist Figure 3 In the embodiment shown, the first control module 10 may be a power system control unit, and its main functions include power on and off, torque request, energy management and thermal management, etc.; the second control module 20 may be a microprocessor, and its main functions include assisted driving, intelligent charging, big data prediction, etc. In addition, the first control module 10 may also be a microprocessor, and its main functions include assisted driving, intelligent charging, big data prediction, etc.; the second control module 20 may also be a power system control unit, and its main functions include power on and off, torque request, energy management and thermal management, etc.

[0068] On the basis of the above embodiment, in one embodiment of the present application, when the security level of the first control module 10 is higher than the security level of the second control module 20,

[0069] The monitoring chip 50 is specifically used to send an inquiry instruction to the first control module 10 at a first preset time interval, and determine whether a response instruction sent by the first control module 10 is received within a second preset time, if not, determine that the response state of the first control module 10 is abnormal, when the number of abnormal response states of the first control module 10 exceeds a first preset threshold within a third preset time, restart the first control module 10, and determine whether the response state of the first control module 10 is abnormal after the restart, if yes, shut down the first communication module 30;

[0070] The first control module 10 is specifically used to send an inquiry instruction to the second control module 20 every fourth preset time, and determine whether a response instruction sent by the second control module 20 is received within a fifth preset time. If not, it is determined that the response state of the second control module 20 is abnormal. When the number of abnormal response states of the second control module 20 exceeds a second preset threshold within a sixth preset time, restart the second control module 20, and determine whether the response state of the second control module 20 is abnormal after restarting. If so, shut down the second communication module 40.

[0071] In this embodiment, the first preset time may be the same as the value of the fourth preset time, the second preset time may be the same as the value of the fifth preset time, the third preset time may be the same as the value of the sixth preset time, and the first preset threshold may be the same as the value of the second preset threshold. Of course, the values ​​of the first preset time, the second preset time, the third preset time, the fourth preset time, the fifth preset time, the sixth preset time, the first preset threshold, and the second preset threshold may all be different, and this application does not limit this.

[0072] Optionally, the third preset time and the first preset threshold satisfy a first preset formula;

[0073] The sixth preset time and the second preset threshold satisfy a second preset formula;

[0074] The first preset formula is T3×N1<100ms, where T3 represents the third preset time, and N1 represents the first preset threshold;

[0075] The second preset formula is T6×N2<100ms, where T6 represents the sixth preset time, and N2 represents the second preset threshold.

[0076] On the basis of the above embodiment, in another embodiment of the present application, the first control module 10 is further configured to send first failure information to the monitoring chip 50 when the first control module 10 detects that its own response state is abnormal;

[0077] When the monitoring chip 50 receives the first failure information, the first communication module 30 is turned off;

[0078] The second control module 20 is further configured to send second failure information to the first control module 10 when the second control module 20 detects that its own response state is abnormal;

[0079] The first control module 10 is further configured to shut down the second communication module 40 upon receiving the second failure information.

[0080] Based on the above embodiment, an optional embodiment of the present application proposes a specific connection method, referring to Figure 4 , the monitoring chip 50 is connected to the first communication module 30 through the first connection line 14, and is connected to the first control module 10 through the first feedback connection line 13, the first reset connection line 12 and the first serial connection line 11 respectively;

[0081] The first control module 10 is connected to the second communication module 40 via a second connection line 24 , and is connected to the second control module 20 via a second feedback connection line 23 , a second reset connection line 22 , and a second serial connection line 21 .

[0082] In this embodiment, the monitoring chip 50 controls the shutdown of the first communication module 30 through the first connection line 14, sends an inquiry instruction to the first control module 10 through the first serial connection line 11, and controls the first control module 10 to restart through the first reset connection line 12; the first control module 10 sends a response instruction to the monitoring chip 50 through the first serial connection line 11, and sends the first failure information to the monitoring chip 50 through the first feedback connection line 13;

[0083] The first communication module 30 controls the shutdown of the second communication module 40 through the second connection line 24, sends an inquiry instruction to the second control module 20 through the second serial connection line 21, and controls the restart of the second control module 20 through the second reset connection line 22; the second control module 20 sends a response instruction to the monitoring chip 50 through the second serial connection line 21, and sends second failure information to the monitoring chip 50 through the second feedback connection line 23.

[0084] On the basis of the above embodiment, in another embodiment of the present application, when the security level of the first control module 10 is the same as the security level of the second control module 20,

[0085] The first control module 10 is specifically used to send an inquiry instruction to the second control module 20 every seventh preset time, and determine whether a response instruction sent by the second control module 20 is received within an eighth preset time. If not, it is determined that the response state of the second control module 20 is abnormal. When the number of abnormal response states of the second control module 20 exceeds a third preset threshold within a ninth preset time, restart the second control module 20, and determine whether the response state of the second control module 20 is abnormal after restarting. If so, shut down the second communication module 40.

[0086] The second control module 20 is specifically used to send an inquiry instruction to the first control module 10 every tenth preset time, and determine whether a response instruction sent by the first control module 10 is received within an eleventh preset time. If not, it is determined that the response state of the first control module 10 is abnormal. When the number of abnormal response states of the first control module 10 exceeds a fourth preset threshold within a twelfth preset time, restart the first control module 10, and determine whether the response state of the first control module 10 is abnormal after restarting. If so, shut down the first communication module 30.

[0087] In this embodiment, the seventh preset time may be the same as the value of the tenth preset time, the eighth preset time may be the same as the value of the eleventh preset time, the ninth preset time may be the same as the value of the twelfth preset time, and the third preset threshold may be the same as the value of the fourth preset threshold. Of course, the values ​​of the seventh preset time, the eighth preset time, the ninth preset time, the tenth preset time, the eleventh preset time, the twelfth preset time, the third preset threshold, and the fourth preset threshold may all be different, and this application does not limit this.

[0088] Optionally, the ninth preset time and the third preset threshold satisfy a third preset formula;

[0089] The twelfth preset time and the fourth preset threshold satisfy a fourth preset formula;

[0090] The third preset formula is T9×N3<100ms, where T9 represents the ninth preset time, and N3 represents the first preset threshold;

[0091] The fourth preset formula is T12×N4<100ms, where T12 represents the sixth preset time, and N4 represents the second preset threshold.

[0092] On the basis of the above embodiment, in another optional embodiment of the present application, the first control module 10 is further used to send a third failure message to the second control module 20 when the first control module 10 monitors that the response state of the first control module 10 is abnormal, and is used to shut down the second communication module 40 when receiving a fourth failure message;

[0093] The second control module 20 is further configured to send the fourth failure message to the first control module 10 when the second control module 20 detects that its own response state is abnormal, and to shut down the first communication module 30 when receiving the third failure message.

[0094] Based on the above embodiment, another optional embodiment of the present application proposes a specific connection method, referring to Figure 5 , the first control module 10 is connected to the second communication module 40 through the third connection line 36, and is connected to the second control module 20 through the third feedback connection line 33, the fourth feedback connection line 34, the third reset connection line 32 and the third serial connection line 31 respectively;

[0095] The second control module 20 is connected to the first communication module 30 via a fourth connection line 35 .

[0096] In this embodiment, the first control module 10 controls the shutdown of the second communication module 40 through the third connection line 36, sends an inquiry instruction to the second control module 20 through the third serial connection line 31, and controls the restart of the second control module 20 through the third reset connection line 32; the second control module 20 sends a response instruction to the first control module 10 through the third serial connection line 31, and sends fourth failure information to the first control module 10 through the fourth feedback connection line 34.

[0097] The second control module 20 controls the shutdown of the first communication module 30 through the fourth connection line 35, sends an inquiry instruction to the second control module 20 through the third serial connection line 31, and controls the restart of the first control module 10 through the third reset connection line 32; the first control module 10 sends a response instruction to the second control module 20 through the third serial connection line 31, and sends a third failure message to the second control module 20 through the third feedback connection line 33.

[0098] Correspondingly, an embodiment of the present application also provides a motor vehicle, comprising a domain controller as described in any of the above embodiments.

[0099] In summary, the embodiments of the present application provide a domain controller and a motor vehicle, wherein, when the security level of the first control module is higher than the security level of the second control module, the domain controller uses a monitoring chip to monitor the first control module, and uses the first control module to monitor the second control module, thereby reducing the use of one monitoring chip and reducing the cost of the domain controller; when the security level of the first control module is the same as the security level of the second control module, the first control module and the second control module are used to monitor each other, which reduces the use of two monitoring chips compared to the domain controller in the prior art and reduces the cost of the domain controller.

[0100] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0101] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A domain controller, characterized in that: include: A first control module, a second control module, a first communication module and a second communication module; wherein, The security level of the first control module is higher than that of the second control module, or the security level of the first control module is the same as that of the second control module; the first control module communicates with other modules through the first communication module, and the second control module communicates with other modules through the second communication module; When the security level of the first control module is higher than the security level of the second control module, the domain controller further includes: a monitoring chip; The monitoring chip is connected to the first control module and the first communication module, and is used to monitor the response state of the first control module, and restart the first control module or shut down the first communication module when the response state of the first control module is abnormal; The first control module is connected to the second control module, and is used to monitor the response status of the second control module, and restart the second control module or shut down the second communication module when the response status of the second control module is abnormal; When the security level of the first control module is the same as the security level of the second control module, the first control module is connected to the second control module, and the first control module is used to monitor the response state of the second control module, and restart the second control module or shut down the second communication module when the response state of the second control module is abnormal; The second control module is used to monitor the response status of the first control module, and restart the first control module or shut down the first communication module when the response status of the first control module is abnormal.

2. The domain controller according to claim 1, characterized in that: When the security level of the first control module is higher than the security level of the second control module, The monitoring chip is specifically used to send an inquiry instruction to the first control module at a first preset time interval, and determine whether a response instruction sent by the first control module is received within a second preset time, if not, determine that the response state of the first control module is abnormal, when the number of abnormal response states of the first control module exceeds a first preset threshold within a third preset time, restart the first control module, and determine whether the response state of the first control module is abnormal after the restart, if yes, shut down the first communication module; The first control module is specifically used to send an inquiry instruction to the second control module every fourth preset time, and determine whether a response instruction sent by the second control module is received within a fifth preset time. If not, it is determined that the response state of the second control module is abnormal. When the number of abnormal response states of the second control module exceeds a second preset threshold within a sixth preset time, the second control module is restarted, and it is determined whether the response state of the second control module is abnormal after the restart. If so, the second communication module is turned off.

3. The domain controller according to claim 2, characterized in that: The third preset time and the first preset threshold satisfy a first preset formula; The sixth preset time and the second preset threshold satisfy a second preset formula; The first preset formula is T3×N1<100ms, where T3 represents the third preset time, and N1 represents the first preset threshold; The second preset formula is T6×N2<100ms, where T6 represents the sixth preset time, and N2 represents the second preset threshold.

4. The domain controller according to claim 2, characterized in that: The first control module is also used to send first failure information to the monitoring chip when monitoring that its own response state is abnormal; When the monitoring chip receives the first failure information, shutting down the first communication module; The second control module is further configured to send second failure information to the first control module when the second control module detects that its own response state is abnormal; The first control module is further configured to shut down the second communication module upon receiving the second failure information.

5. The domain controller according to claim 4, characterized in that: The monitoring chip is connected to the first communication module via a first connection line, and is connected to the first control module via a first feedback connection line, a first reset connection line and a first serial connection line respectively; The first control module is connected to the second communication module via a second connection line, and is connected to the second control module via a second feedback connection line, a second reset connection line, and a second serial connection line, respectively.

6. The domain controller according to claim 1, characterized in that: When the security level of the first control module is the same as the security level of the second control module, The first control module is specifically used to send an inquiry instruction to the second control module every seventh preset time, and determine whether a response instruction sent by the second control module is received within an eighth preset time, if not, determine that the response state of the second control module is abnormal, when the number of abnormal response states of the second control module exceeds a third preset threshold within a ninth preset time, restart the second control module, and determine whether the response state of the second control module is abnormal after the restart, if yes, shut down the second communication module; The second control module is specifically used to send an inquiry instruction to the first control module every tenth preset time, and determine whether a response instruction sent by the first control module is received within an eleventh preset time; if not, determine that the response status of the first control module is abnormal; when the number of abnormal response statuses of the first control module exceeds a fourth preset threshold within a twelfth preset time, restart the first control module, and determine whether the response status of the first control module is abnormal after restarting; if so, shut down the first communication module.

7. The domain controller according to claim 6, characterized in that: The ninth preset time and the third preset threshold satisfy a third preset formula; The twelfth preset time and the fourth preset threshold satisfy a fourth preset formula; The third preset formula is T9×N3<100ms, where T9 represents the ninth preset time, and N3 represents the third preset threshold; The fourth preset formula is T12×N4<100ms, wherein T12 represents the twelfth preset time, and N4 represents the fourth preset threshold.

8. The domain controller according to claim 6, characterized in that: The first control module is further configured to send a third failure message to the second control module when the first control module detects that its own response state is abnormal, and to shut down the second communication module when receiving a fourth failure message; The second control module is further configured to send the fourth failure message to the first control module when the second control module detects that its own response state is abnormal, and to shut down the first communication module when the second control module receives the third failure message.

9. The domain controller according to claim 8, characterized in that: The first control module is connected to the second communication module via a third connection line, and is respectively connected to the second control module via a third feedback connection line, a fourth feedback connection line, a third reset connection line and a third serial connection line; The second control module is connected to the first communication module via a fourth connection line.

10. A motor vehicle, characterized in that: include: A domain controller as claimed in any one of claims 1 to 9.

Images