A fault recovery method of a vehicle-mounted microcontroller and a vehicle-mounted microcontroller

Abstract

This invention provides a fault repair method and apparatus for an in-vehicle microcontroller, comprising: deploying multiple virtual machines in the microcontroller and allocating corresponding hardware resources to each virtual machine; configuring a management program to uniformly manage the multiple virtual machines; and responding to a fault in the hardware resources corresponding to one or more virtual machines, allocating hardware resources equivalent to the faulty hardware from the unallocated hardware resources to the one or more virtual machines for recombination to repair the fault, wherein the hardware resources used for replacement are independent of the hardware resources being replaced.

Description

Technical Field

[0001] This invention relates to the field of automotive microcontrollers, and more particularly to a fault repair method for automotive microcontrollers and an automotive microcontroller. Background Technology

[0002] With the advancement of automotive intelligence technologies, especially autonomous driving systems, new fail-operable requirements are being placed on onboard controllers. For example, microcontrollers responsible for DC / DC, steering, braking, and drive functions require higher fault redundancy. Compared to the basic requirements of fail-safe, fail-operability requires that onboard controllers can no longer rely on simply shutting down the output as a safe state, but rather require more redundant designs to achieve fail-operability.

[0003] In existing technologies, the response of automotive microcontrollers (MCUs) to internal faults is global. When an MCU experiences an internal hardware failure, it is difficult to achieve fail-safe operation, thus requiring two MCU chips for redundancy, increasing the weight and cost of the device. Secondly, currently, if a controller experiences an internal hardware failure in the MCU, the only solution is generally to replace the faulty component, resulting in high maintenance time and costs, causing inconvenience to users.

[0004] Meanwhile, virtualization technology, already maturely applied in the computer field and microprocessors (MPUs) in automotive domain controllers / in-vehicle computers, is gradually being migrated to the automotive microcontroller field due to its inherent advantages. Unlike computers or MPUs, the development of automotive microcontrollers (MCUs) has two key requirements: high real-time performance and high security. The hardware resources of virtual machines running on automotive microcontrollers are statically allocated during the development phase, and online modification and redeployment of the virtual machine software are not possible after software release. Furthermore, the overall computing power and hardware virtualization support of microcontroller chips are lower than those of computers and MPUs, which have higher computing power. Therefore, the application of virtualization technology in microcontrollers is less advanced than in computers or MPUs, and some existing virtualization control strategies cannot be applied to the virtualization field of microcontrollers.

[0005] To overcome the aforementioned deficiencies in existing technologies, there is an urgent need in this field for a fault repair method for automotive microcontrollers and an automotive microcontroller in general. This method involves deploying multiple virtual machines within the automotive microcontroller. When the hardware resources corresponding to a particular virtual machine fail, the remaining available hardware resources are used to reassemble the virtual machine, thereby repairing the failure. Simultaneously, multiple redundant virtual machines are provided for fault replacement, and an independent and isolated hardware resource architecture is configured. This approach achieves operability even when internal functions of the microcontroller fail, while reducing device costs and improving the availability of the automotive microcontroller, thus providing convenience for user reliability and after-sales maintenance. Summary of the Invention

[0006] The following provides a brief overview of one or more aspects to offer a basic understanding of them. This overview is not an exhaustive summary of all conceived aspects, nor is it intended to identify key or decisive elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form to prepare for the more detailed descriptions that follow.

[0007] To overcome the aforementioned deficiencies in the prior art, the present invention provides a fault repair method for an in-vehicle microcontroller, comprising: deploying multiple virtual machines in the microcontroller and allocating corresponding hardware resources to each virtual machine; configuring a management program to uniformly manage the multiple virtual machines; and responding to a fault in the hardware resources corresponding to one or more virtual machines, allocating hardware resources equivalent to the faulty hardware from the unallocated hardware resources to the one or more virtual machines for recombination to repair the fault, wherein the hardware resources used for replacement are independent of the hardware resources being replaced.

[0008] In one embodiment, preferably, the hardware resources include a kernel, a storage unit, a peripheral interface, a power supply unit, a clock source, and a bus; the hardware resources used for replacement are independent of each other, including: the hardware resources used for replacement and the hardware resources being replaced are located in different kernels and different storage areas, and use different peripheral interfaces, power supply units, clock sources, and buses.

[0009] In one embodiment, preferably, the fault repair method includes: after the microcontroller detects fault information, it feeds back the fault to an external control device, and the external control device controls the allocation and recombination of equivalent hardware resources, the external control device including a cloud controller, a domain controller and an in-vehicle computer.

[0010] In one embodiment, preferably, the fault repair method further includes: configuring multiple main control unit virtual machines and multiple redundant control unit virtual machines in the multiple virtual machines, and configuring one or more redundant control unit virtual machines for performing the same control function for each main control unit virtual machine, and in response to a fault in one of the main control unit virtual machines, the control function performed by the main control unit virtual machine is replaced by its corresponding redundant control unit virtual machine.

[0011] In one embodiment, the fault repair method may optionally include: after the main control unit virtual machine detects and determines that it has failed, it sends a request to the management program; after receiving the request, the management program shuts down the main control unit virtual machine and its corresponding hardware output, and at the same time starts up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform the replacement.

[0012] In one embodiment, optionally, the main control unit virtual machine and its corresponding redundant control unit virtual machine run simultaneously. The fault repair method further includes: in response to the redundant control unit virtual machine detecting a fault in the main control unit virtual machine, the redundant control unit virtual machine sends a request to the management program to shut down the main control unit virtual machine and its corresponding hardware output.

[0013] Optionally, in one embodiment, the fault repair method further includes: after the management program detects that the main control unit virtual machine has failed, shutting down the main control unit virtual machine and its corresponding hardware output, and simultaneously starting up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform replacement.

[0014] In one embodiment, preferably, the fault repair method further includes: after the redundant control unit virtual machine replaces the faulty main control unit virtual machine to perform the corresponding control function, it is determined again to confirm whether the faulty main control unit virtual machine and its corresponding hardware output are turned off; if not turned off, the management program is requested again to turn off the faulty main control unit virtual machine and its corresponding hardware output.

[0015] In one embodiment, preferably, the fault occurring in the main control unit virtual machine includes a hardware resource fault, the hardware resources including the kernel, storage unit, peripheral interface, power supply unit, clock source and bus; the allocation of corresponding hardware resources to each virtual machine includes: allocating hardware resources with different kernels or different storage areas, or with different peripheral interfaces, power supply units, clock sources and buses to the main control unit virtual machine and the corresponding redundant control unit virtual machine.

[0016] In one embodiment, preferably, the hardware resources further include functional circuits located outside the microcontroller, including power management circuits, sensor and sampling circuits, communication circuits, actuator and drive circuits, safety protection and shutdown circuits, and power supply circuits; allocating corresponding hardware resources to each virtual machine further includes: allocating mutually independent functional circuits to the main control unit virtual machine and the corresponding redundant control unit virtual machine.

[0017] In one embodiment, preferably, the microcontroller is configured with multiple sets of independent hardware resources, including multiple independent cores, storage units, peripheral interfaces, and independently partitioned power supply units, clock sources, and buses.

[0018] Another aspect of the present invention provides an in-vehicle microcontroller, comprising: a plurality of virtual machines deployed in the microcontroller, wherein the microcontroller allocates corresponding hardware resources to each virtual machine and configures a management program to uniformly manage the plurality of virtual machines; in response to a failure of the hardware resources corresponding to one or more virtual machines, allocating hardware resources equivalent to the failed hardware from the unallocated hardware resources to the one or more virtual machines for recombination to repair the failure, wherein the hardware resources used for replacement are independent of the hardware resources being replaced.

[0019] In one embodiment, preferably, the hardware resources include a kernel, a storage unit, a peripheral interface, a power supply unit, a clock source, and a bus; the microcontroller is configured such that the hardware resource to be replaced and the hardware resource to be replaced are located in different kernels and different storage areas, and use different peripheral interfaces, power supply units, clock sources, and buses.

[0020] In one embodiment, preferably, the microcontroller is configured to: upon detecting fault information, feed back the fault to an external control device, the external control device controlling the allocation and recombination of equivalent hardware resources, the external control device including a cloud controller, a domain controller, and an in-vehicle computer.

[0021] In one embodiment, preferably, the vehicle-mounted microcontroller further includes: a plurality of main control unit virtual machines and a plurality of redundant control unit virtual machines configured in the plurality of virtual machines, each of the main control unit virtual machines being configured with one or more redundant control unit virtual machines for performing the same control function, and the microcontroller being configured to: in response to a failure of one of the main control unit virtual machines, the control function performed by the main control unit virtual machine is replaced by one of its corresponding redundant control unit virtual machines.

[0022] In one embodiment, the microcontroller is optionally configured such that: after the main control unit virtual machine detects and determines that it has failed, it sends a request to the management program; upon receiving the request, the management program shuts down the main control unit virtual machine and its corresponding hardware output, and simultaneously starts up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform a replacement.

[0023] In one embodiment, the microcontroller is optionally further configured such that the main control unit virtual machine and its corresponding redundant control unit virtual machine run simultaneously, and in response to the redundant control unit virtual machine detecting a failure in the main control unit virtual machine, the redundant control unit virtual machine sends a request to the hypervisor to shut down the main control unit virtual machine and its corresponding hardware output.

[0024] In one embodiment, the microcontroller is optionally configured such that: after the management program detects a failure in the main control unit virtual machine, it shuts down the main control unit virtual machine and its corresponding hardware output, and simultaneously starts up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform a replacement.

[0025] In one embodiment, preferably, the microcontroller is further configured such that: after the redundant control unit virtual machine replaces the faulty main control unit virtual machine to perform the corresponding control function, it again determines whether the faulty main control unit virtual machine and its corresponding hardware output are shut down; if not shut down, it again requests the management program to shut down the faulty main control unit virtual machine and its corresponding hardware output.

[0026] In one embodiment, preferably, the fault occurring in the main control unit virtual machine includes a hardware resource fault, which includes a kernel, storage unit, peripheral interface, power supply unit, clock source and bus; the hardware resources allocated in the microcontroller to the main control unit virtual machine and the corresponding redundant control unit virtual machine are located in different kernels, storage areas, and use different peripheral interfaces, power supply units, clock sources and buses.

[0027] In one embodiment, preferably, the hardware resource further includes functional circuits located outside the microcontroller, including power management circuits, sensor and sampling circuits, communication circuits, actuator and drive circuits, safety protection and shutdown circuits, and power supply circuits; the functional circuits allocated to the main control unit virtual machine and the corresponding redundant control unit virtual machine in the microcontroller are independent of each other.

[0028] In one embodiment, preferably, the microcontroller is configured with multiple sets of independent hardware resources, including multiple independent cores, storage units, peripheral interfaces, and independently partitioned power supply units, clock sources, and buses. Attached Figure Description

[0029] The above-described features and advantages of the present invention will be better understood after reading the following detailed description of embodiments of the present disclosure in conjunction with the accompanying drawings. In the drawings, components are not necessarily drawn to scale, and components having similar related characteristics or features may have the same or similar reference numerals.

[0030] Figure 1 This is a schematic flowchart illustrating a method for repairing faults in an on-board microcontroller according to one aspect of the present invention;

[0031] Figure 2 This is a schematic flowchart illustrating a method for repairing a fault in an on-board microcontroller according to an embodiment of the present invention.

[0032] Figure 3 This is a schematic diagram of the device structure of an in-vehicle microcontroller according to another embodiment of the present invention; and

[0033] Figure 4 This is a schematic diagram of the hardware resource configuration device in an on-board microcontroller according to an embodiment of the present invention.

[0034] For clarity, a brief explanation of the reference numerals in the accompanying drawings is provided below:

[0035] 300 vehicle-mounted microcontroller

[0036] 301 Main Control Unit Virtual Machine

[0037] 302 Redundant Control Unit Virtual Machine

[0038] 303 Management Procedure

[0039] 304 First Hardware Resource

[0040] 305 Second Hardware Resource

[0041] 306 Third Hardware Resources

[0042] 307 First Functional Circuit

[0043] 308 Second Functional Circuit

[0044] 309 Third Functional Circuit

[0045] 400 vehicle-mounted microcontroller

[0046] 401 First Division

[0047] 4011 First Power Supply

[0048] 402 Second Division

[0049] 4021 Second Power Supply Detailed Implementation

[0050] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Although the description of the present invention is presented in conjunction with preferred embodiments, this does not mean that the features of the invention are limited to these embodiments. On the contrary, the purpose of describing the invention in conjunction with embodiments is to cover other options or modifications that may be derived based on the claims of the present invention. To provide a thorough understanding of the invention, many specific details will be included in the following description. The invention may also be implemented without using these details. Furthermore, to avoid confusion or obscuring the focus of the invention, some specific details will be omitted in the description.

[0051] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0052] Furthermore, the terms "upper," "lower," "left," "right," "top," "bottom," "horizontal," and "vertical" used in the following description should be understood as the orientations shown in the relevant paragraphs and accompanying drawings. These relative terms are for illustrative purposes only and do not imply that the described apparatus must be manufactured or operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0053] It is understood that although terms such as "first," "second," and "third" may be used herein to describe various components, regions, layers, and / or parts, these components, regions, layers, and / or parts should not be limited by these terms, and these terms are only used to distinguish different components, regions, layers, and / or parts. Therefore, the first components, regions, layers, and / or parts discussed below may be referred to as second components, regions, layers, and / or parts without departing from some embodiments of the present invention.

[0054] To overcome the aforementioned deficiencies in the existing technology, this invention provides a fault repair method for an automotive microcontroller and an automotive microcontroller. Multiple virtual machines are deployed within the automotive microcontroller. When the hardware resources corresponding to a particular virtual machine fail, the remaining available hardware resources are used to reassemble the virtual machine to repair the failure. Simultaneously, multiple redundant virtual machines are provided for fault replacement, and an independent and isolated hardware resource architecture is configured. This approach reduces device costs while ensuring operability even when internal functions of the microcontroller fail, improves the availability of the automotive microcontroller, and provides convenience for user reliability and after-sales maintenance.

[0055] Figure 1 This is a schematic flowchart illustrating a method for troubleshooting a vehicle-mounted microcontroller according to one aspect of the present invention.

[0056] like Figure 1 As shown, the fault repair method 100 for vehicle-mounted microcontrollers provided by the present invention mainly includes:

[0057] Step 101: Deploy multiple virtual machines in the microcontroller, allocate corresponding hardware resources to each virtual machine, and configure a management program to manage these multiple virtual machines uniformly; and

[0058] Step 102: In response to a failure of the hardware resources corresponding to one or more virtual machines, allocate hardware resources equivalent to the failed hardware from the unallocated hardware resources to the one or more virtual machines to reassemble them and thus repair the failure, wherein the hardware resources used for replacement are independent of the hardware resources being replaced.

[0059] Those skilled in the art will understand that the hardware resources in an automotive microcontroller may include a kernel, memory units, peripheral interfaces, power supply units, clock sources, and buses. In the fault repair method for an automotive microcontroller provided by this invention, the hardware resources used for replacement are independent of the hardware resources being replaced, and may include: the hardware resources used for replacement and the hardware resources being replaced being located in different kernels and different memory areas, and employing different peripheral interfaces, power supply units, clock sources, and buses.

[0060] For example, in one embodiment, if a microcontroller has three independent cores, and initially two of them are used to run virtual machines VM1 and VM2 respectively, if the core deploying VM1 fails, VM1 can be deployed to the remaining cores, while maintaining the aforementioned independence requirement. That is, the replacement core is a different, independent core from the faulty core; more preferably, it can be a heterogeneous core. Similarly, if a storage unit corresponding to a virtual machine fails, the storage unit used to replace it can be located in a different storage sector, ensuring their independence. Or, if the faulty unit is an ADC unit, the replacement ADC unit can be located in a different ADC sampling group channel, or it can be a different type of ADC unit.

[0061] The fault here can be a hardware resource failure corresponding to a specific virtual machine, or a hardware failure shared by multiple virtual machines. Accordingly, the relevant resources that can be equivalently replaced from the unallocated hardware resources are searched and equivalent replacements are performed to restore the normal function of the multiple virtual machines.

[0062] It is easily understood that, due to the low overall computing power and hardware virtualization support of microcontroller chips, in a preferred embodiment, in the fault repair method provided by the present invention, after the microcontroller detects the fault information, it feeds back the fault to an external control device, and then the external control device controls the allocation and recombination of equivalent hardware resources. The external control device includes processing devices with higher computing power, such as cloud controllers, domain controllers, and vehicle computers.

[0063] It should be noted that the entity performing the fault detection is not specifically limited. It can be detected by the virtual machine itself that has experienced a hardware failure, or by other virtual machines in the same microcontroller during their interaction with the virtual machine, or by a management program configured in the microcontroller to manage multiple virtual machines and then report it to an external control device.

[0064] Upon receiving a fault report, the external control device performs the allocation and recombination of equivalent hardware resources. This includes coordinating hardware and software operations such as locating and allocating hardware resources within the microcontroller, reconfiguring the corresponding virtual machine software program, and reconfiguring the corresponding management program. This ensures a smooth transition and successful execution of fault replacement. For example, the virtual machine software and management program software can be modified, compiled, and integrated, and then downloaded to the vehicle-mounted microcontroller via OTA or other methods for updating, thereby repairing the virtual machine that previously failed due to hardware resource failure.

[0065] Figure 2This is a schematic flowchart illustrating a method for troubleshooting a vehicle-mounted microcontroller according to an embodiment of the present invention.

[0066] like Figure 2 As shown, in this embodiment, after the fault repair method provided by the present invention starts, step 201 is executed first: determine whether the hardware corresponding to a certain virtual machine (VM) in the microcontroller (MCU) has failed. As described above, the subject of this step can be the virtual machine itself or the management program in the microcontroller, etc.

[0067] If no fault is detected, the process ends. However, if a hardware fault is detected in the microcontroller, step 202 is executed: the fault is located and the fault information is reported to an external high-computing-power control device, which may include the fault source. Then, step 203 is executed: it is determined whether the faulty hardware has a corresponding remaining unit in the microcontroller; this step can be performed by an external controller. Since the hardware resources in the microcontroller are initially statically allocated to each virtual machine, for example, when a virtual machine's storage unit fails, it is necessary to determine whether there are any unallocated storage units in the microcontroller that can be used to equivalently replace the failed storage unit.

[0068] Furthermore, if it is determined in step 203 that there are none, the process ends, the fault cannot be repaired by this fault repair method, and further maintenance is required. If the relevant hardware resources exist, then step 204 is executed: the external control device controls the corresponding remaining hardware and the virtual machine to recombine to repair the fault, including specific operations such as hardware allocation and software program rewriting.

[0069] In a preferred embodiment, the fault repair method for the vehicle-mounted microcontroller provided by the present invention may further include: configuring multiple main control unit virtual machines and multiple redundant control unit virtual machines in the plurality of virtual machines, and configuring one or more redundant control unit virtual machines for performing the same control function for each main control unit virtual machine; in response to a fault in one of the main control unit virtual machines, the control function performed by the main control unit virtual machine is replaced by its corresponding redundant control unit virtual machine. The following is in conjunction with... Figure 3 Please provide a more detailed explanation.

[0070] Figure 3 This is a schematic diagram of the device structure of an in-vehicle microcontroller according to another embodiment of the present invention.

[0071] exist Figure 3In the embodiment shown, the vehicle microcontroller 300 used in the fault repair method provided by the present invention is configured with a main control unit virtual machine 301 and a corresponding redundant control unit virtual machine 302. The main control unit virtual machine 301 and the redundant control unit virtual machine 302 are used to perform the same control functions. For example, for microprocessors that perform functions such as DC / DC, steering, braking, and driving that have high requirements for failure operability, the corresponding main control unit virtual machine and redundant control unit virtual machine can be configured.

[0072] It should be noted that there is no limit to the number of main control unit virtual machines and redundant control unit virtual machines. One main control unit virtual machine can be configured with one or more redundant control unit virtual machines that can perform the same function. Similarly, there is no limit to the set of main control unit virtual machines and redundant control unit virtual machines. One or more sets of main control unit virtual machines and redundant control unit virtual machines can be configured in one vehicle microcontroller.

[0073] Please refer to Figure 3 The microcontroller is configured with a hypervisor 303 to manage multiple virtual machines in a unified manner. For example, the hypervisor 303 can be hypervisor software.

[0074] As will be understood by those skilled in the art, an in-vehicle microcontroller may include software and hardware. The main control unit virtual machine, the redundant control unit virtual machine, and the management program may correspond to the software part. At the same time, the microcontroller is also configured with corresponding hardware resources.

[0075] For example, such as Figure 3 As shown, the hardware resources within the vehicle-mounted microcontroller 300 may include a first hardware resource 304, a second hardware resource 305, and a third hardware resource 306. The first hardware resource 304 can be configured to work in conjunction with the main control unit virtual machine 301, and the second hardware resource 305 can be configured to work in conjunction with the redundant control unit virtual machine 302.

[0076] It is particularly important to note that the first hardware resource 304 and the second hardware resource 305, which are respectively allocated to the main control unit virtual machine 301 and the redundant control unit virtual machine 302, are independent of each other. In other words, the hardware resources allocated to the corresponding main control unit virtual machine and redundant control unit virtual machine must be guaranteed to be independent of each other.

[0077] The hardware resources here are independent, similar to the hardware resources used for fault tolerance mentioned above. For example, these hardware resources may include the kernel, storage units, peripheral interfaces, power supply units, clock sources, and buses. Each virtual machine is allocated corresponding hardware resources, including: hardware resources with different kernels or different storage regions, or with different peripheral interfaces, power supply units, clock sources, and buses, are allocated to the main control unit virtual machine and its corresponding redundant control unit virtual machine. More specifically, for example, CPUs with different kernels or storage units with different storage sectors, ensuring that they are independent of each other, allows for equivalent replacement in the event of a hardware failure in a virtual machine.

[0078] It should be noted that the hardware resources that may appear in the vehicle microcontroller are only illustrated in this article. The purpose is to explain how the fault repair method provided by this invention can repair the hardware faults that may occur in the microcontroller, and not to limit the scope of protection of this invention. In fact, the hardware resources to which the fault repair method of this invention can be applied are not limited to the hardware examples mentioned in this article. Other hardware devices that may appear can be configured and repaired using the fault repair method provided by this invention. Similarly, the fault repair method should also be included within the scope of protection of this invention.

[0079] Figure 4 This is a schematic diagram of the hardware resource configuration device in an on-board microcontroller according to an embodiment of the present invention.

[0080] Please refer to Figure 4 To further ensure that the hardware resources used for fault replacement and allocated to paired master and redundant virtual machines are independent of each other, in a preferred embodiment, the vehicle microcontroller 400 to which the fault repair method provided by the present invention is applied is configured with multiple sets of independent hardware resources, including multiple independent cores, storage units, peripheral interfaces, and independently partitioned power supply units, clock sources and buses.

[0081] For example, in Figure 4 In the illustrated embodiment, two independent sets of hardware resources are provided. Each set of hardware resources includes a bus, kernel, storage, power supply, clock, and peripherals. Each set of hardware resources is located in a different partition, for example, Figure 4 The microcontroller 400 comprises a first partition 401 and a second partition 402. These two partitions are physically independent but can communicate with each other for necessary signal interaction. Meanwhile, a first power supply 4011 and a second power supply 4021 are externally located on the vehicle-mounted microcontroller 400 to supply power to the first partition 401 and the second partition 402, respectively. This ensures that the internal hardware resources of the microcontroller are independent, thereby guaranteeing effective fault repair through equivalent replacement.

[0082] It should be noted that the number of partitions mentioned here is only an illustrative example and is not intended to limit the scope of protection of this invention. In practical applications, multiple hardware partitions can be set as needed to meet the fault repair requirements of redundancy replacement.

[0083] Please return to Figure 3 It is easy to understand that the first hardware resource 304 and the second hardware resource 305, respectively allocated to the main control unit virtual machine 301 and the redundant control unit virtual machine 302, are relatively independent hardware resources that are not related to each other. However, the vehicle microcontroller 300 may also include hardware resources that are related, such as... Figure 3 The third hardware resource 306 in the microcontroller has strong interdependencies among its hardware devices, which cannot be independently divided and allocated to multiple different virtual machines. Instead, it can be shared by multiple virtual machines and other components in the microcontroller.

[0084] In addition, in a preferred embodiment, the hardware resources also include functional circuits located outside the vehicle microcontroller 300, including power management circuits, sensor and sampling circuits, communication chips and circuits, actuators and drive circuits, safety protection and shutdown circuits, and power supply circuits; the allocation of corresponding hardware resources to each virtual machine also includes: allocating mutually independent functional circuits to the main control unit virtual machine and the corresponding redundant control unit virtual machine.

[0085] like Figure 3 As shown, the vehicle-mounted microcontroller used in the fault repair method provided by this invention, in addition to its internal hardware resources, also features targeted design of corresponding external functional circuits. For example, externally, the main control unit virtual machine 301 and the redundant control unit virtual machine 302 are equipped with independent first functional circuits 307 and 308, respectively. The first functional circuit 307 is specifically used for the functional interaction between the main control unit virtual machine 301 and the first hardware resource 304, while the second functional circuit 308 is specifically used for the functional interaction between the redundant control unit virtual machine 302 and the second hardware resource 305. The first functional circuit 307 and the second functional circuit 308 are independent of each other and have no correlation. Simultaneously, a third functional circuit 309 is also configured externally to the vehicle-mounted microcontroller. The related hardware circuits in the third functional circuit 309 are highly correlated and cannot be independently separated, enabling it to handle functions shared by multiple virtual machines or requiring mutual cooperation.

[0086] It should be noted that the above hardware resource settings are mainly for hardware resource failures corresponding to the main control unit virtual machine and the redundant control unit virtual machine. However, the fault repair method for the vehicle microcontroller provided by this invention is not limited to hardware resource failures. Regarding the matching settings of the main control unit virtual machine and the redundant control unit virtual machine, if a software or other aspect of a virtual machine fails, the matching design can also perform equivalent replacements of the virtual machine and its matching resources to repair the fault. The specific process of repairing faults in the main control unit virtual machine and the redundant control unit virtual machine is described below.

[0087] In one embodiment, optionally, the fault repair method for the vehicle-mounted microcontroller provided by the present invention may include: after the main control unit virtual machine detects and determines that it has malfunctioned, it sends a request to the management program; upon receiving the request, the management program shuts down the main control unit virtual machine and its corresponding hardware output, and simultaneously starts the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform a replacement. Furthermore, in this embodiment, when the main control unit virtual machine detects its own fault, it can also directly start the corresponding redundant control unit virtual machine, allowing for flexible configuration as needed.

[0088] For example, if the main control unit virtual machine performing DC / DC control functions detects an overvoltage or undervoltage anomaly in its 12V output, it can determine that the corresponding hardware has failed. Consequently, the main control unit virtual machine and its corresponding hardware output are shut down, while the redundant control unit virtual machine corresponding to the main control unit virtual machine is activated to perform the replacement. In this embodiment, the main control unit virtual machine and its corresponding redundant control unit virtual machine may not be activated simultaneously initially.

[0089] In another embodiment, optionally, the main control unit virtual machine and its corresponding redundant control unit virtual machine run simultaneously. The fault repair method for the vehicle microcontroller provided by the present invention may further include: in response to the redundant control unit virtual machine detecting a fault in the main control unit virtual machine, the redundant control unit virtual machine sends a request to the management program to shut down the main control unit virtual machine and its corresponding hardware output. Similarly, in this embodiment, the redundant control unit virtual machine can also directly shut down the main control unit virtual machine and its corresponding hardware output after detecting a fault, without the need for additional management program intervention, allowing for flexible configuration as needed.

[0090] In another embodiment, optionally, the fault repair method for the vehicle-mounted microcontroller provided by the present invention may further include: after the management program detects that the main control unit virtual machine has failed, shutting down the main control unit virtual machine and its corresponding hardware output, and simultaneously turning on the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform replacement.

[0091] As can be seen from the above three embodiments, fault detection in the fault repair method for the vehicle-mounted microcontroller provided by the present invention can be performed by different entities. The above three embodiments are merely illustrative examples of the fault repair method provided by the present invention, intended to more clearly illustrate how the fault repair method provided by the present invention performs fault redundancy replacement between the main control unit virtual machine and its corresponding redundant control unit virtual machine, rather than to limit the scope of protection of the present invention. In fact, fault detection within the vehicle-mounted microcontroller can also be performed by entities other than those in the above three embodiments. The present invention does not limit which part performs the fault detection. As long as a fault is detected, any scheme that can perform equivalent fault replacement through redundancy settings similar to those of the main control unit virtual machine and the redundant control unit virtual machine can be applied to the fault repair method provided by the present invention and should also be included within the scope of protection of the present invention.

[0092] In addition, in a preferred embodiment, the fault repair method for the vehicle microcontroller provided by the present invention may further include: after the redundant control unit virtual machine replaces the faulty main control unit virtual machine to perform the corresponding control function, it is judged again to confirm whether the faulty main control unit virtual machine and its corresponding hardware output are turned off; if not turned off, the management program is requested again to turn off the faulty main control unit virtual machine and its corresponding hardware output.

[0093] In other words, after the redundant control unit virtual machine performs an equivalent replacement for the faulty main control unit virtual machine, it is necessary to reconfirm whether the faulty main control unit virtual machine and its corresponding hardware output have been turned off, so as to avoid the faulty part from continuing to work or outputting and affecting the system's security performance, thereby affecting the execution and implementation of the microcontroller's normal functions.

[0094] Although the methods described above are illustrated and depicted as a series of actions for the sake of simplicity, it should be understood and appreciated that these methods are not limited by the order of the actions, as some actions may occur in a different order and / or concurrently with other actions from the illustrations and descriptions herein or not illustrated and described herein but which may be understood by those skilled in the art, according to one or more embodiments.

[0095] Another aspect of the present invention provides an in-vehicle microcontroller configured to execute the fault repair method described in any of the preceding claims. Specifically, the in-vehicle microcontroller includes: multiple virtual machines deployed within the microcontroller; the microcontroller allocates corresponding hardware resources to each virtual machine and configures a management program to uniformly manage the multiple virtual machines; in response to a fault in the hardware resources corresponding to one or more virtual machines, it allocates hardware resources equivalent to the faulty hardware from unallocated hardware resources to the one or more virtual machines for recombination to repair the fault, wherein the replacement hardware resources and the replaced hardware resources are independent of each other.

[0096] Figure 3 This is a schematic diagram illustrating the device structure of an in-vehicle microcontroller according to another embodiment of the present invention. The relevant details have been elaborated above and will not be repeated here.

[0097] The present invention provides a fault repair method and an on-board microcontroller for vehicle-mounted microcontrollers. Multiple virtual machines are deployed within the on-board microcontroller. When the hardware resources corresponding to a particular virtual machine fail, the remaining available hardware resources are used to reassemble the virtual machine to repair the failure. Simultaneously, multiple redundant virtual machines are provided for fault replacement, and an independent and isolated hardware resource architecture is configured. This approach reduces device costs while ensuring operability even when internal functions of the microcontroller fail, improves the availability of the on-board microcontroller, and provides convenience for user reliability and after-sales maintenance.

[0098] The prior description of this disclosure is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not intended to be limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for troubleshooting a vehicle-mounted microcontroller, characterized in that, include: Multiple virtual machines are deployed in the microcontroller, and corresponding hardware resources are allocated to each virtual machine. A configuration management program is used to manage the multiple virtual machines in a unified manner. Multiple main control unit virtual machines and multiple redundant control unit virtual machines are configured in the multiple virtual machines, and one or more redundant control unit virtual machines are configured for each main control unit virtual machine to perform the same control function. In response to a failure of the hardware resources corresponding to one or more of the main control unit virtual machines, an equivalent hardware resource to the failed hardware is allocated from the unallocated hardware resources, and the redundant control unit virtual machines corresponding to the one or more main control unit virtual machines are recombined to repair the failure, wherein the hardware resources used for replacement are independent of the hardware resources being replaced. as well as In response to a failure of one of the main control unit virtual machines, the control functions performed by that main control unit virtual machine are replaced by its corresponding redundant control unit virtual machine. The hardware resources include a kernel, storage units, peripheral interfaces, power supply units, clock sources, buses, and functional circuits located outside the microcontroller. Allocating corresponding hardware resources to each virtual machine includes: Hardware resources such as different kernels, different storage areas, or different peripheral interfaces, power supply units, clock sources, and buses are allocated to the main control unit virtual machine and the corresponding redundant control unit virtual machine. The independent first functional circuit and the second functional circuit are respectively assigned to the main control unit virtual machine and the corresponding redundant control unit virtual machine. The first functional circuit is used for the functional interaction between the main control unit virtual machine and its corresponding hardware resources, and the second functional circuit is used for the functional interaction between the redundant control unit virtual machine and its corresponding hardware resources.

2. The fault repair method as described in claim 1, characterized in that, The hardware resources used for replacement are independent of the hardware resources being replaced, including: The hardware resources used for replacement are located in different kernels and different storage areas than the hardware resources being replaced, and they use different peripheral interfaces, power supply units, clock sources and buses.

3. The fault repair method as described in claim 1, characterized in that, The fault repair method includes: After detecting the fault information, the microcontroller feeds back the fault to an external control device. The external control device controls the allocation and recombination of equivalent hardware resources, including a cloud controller, a domain controller, and an in-vehicle computer.

4. The fault repair method as described in claim 1, characterized in that, The fault repair method also includes: After the main control unit virtual machine detects and determines that it has failed, it sends a request to the management program. Upon receiving the request, the management program shuts down the main control unit virtual machine and its corresponding hardware output, and simultaneously starts up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform the replacement.

5. The fault repair method as described in claim 1, characterized in that, The main control unit virtual machine and its corresponding redundant control unit virtual machine run simultaneously, and the fault repair method further includes: In response to the redundant control unit virtual machine detecting a failure in the main control unit virtual machine, the redundant control unit virtual machine sends a request to the hypervisor to shut down the main control unit virtual machine and its corresponding hardware outputs.

6. The fault repair method as described in claim 1, characterized in that, The fault repair method also includes: After the management program detects a fault in the main control unit virtual machine, it shuts down the main control unit virtual machine and its corresponding hardware output, and simultaneously starts up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform the replacement.

7. The fault repair method according to any one of claims 4 to 6, characterized in that, The fault repair method also includes: After the redundant control unit virtual machine replaces the faulty main control unit virtual machine to perform the corresponding control function, it checks again to confirm whether the faulty main control unit virtual machine and its corresponding hardware output are turned off. If they are not turned off, it requests the management program to turn off the faulty main control unit virtual machine and its corresponding hardware output again.

8. The fault repair method as described in claim 1, characterized in that, The functional circuit includes a power management circuit, a sensor and sampling circuit, a communication circuit, an actuator and drive circuit, a safety protection and shutdown circuit, and a power supply circuit.

9. The fault repair method as described in claim 1, characterized in that, The microcontroller is configured with multiple independent hardware resources, including multiple independent cores, storage units, peripheral interfaces, and independently partitioned power supply units, clock sources, and buses.

10. A vehicle-mounted microcontroller, characterized in that, include: Multiple virtual machines are deployed in the microcontroller, and the microcontroller allocates corresponding hardware resources to each virtual machine and configures a management program to manage the multiple virtual machines in a unified manner. Multiple main control unit virtual machines and multiple redundant control unit virtual machines are configured in the plurality of virtual machines. Each main control unit virtual machine is configured with one or more redundant control unit virtual machines for performing the same control function. In response to a hardware resource failure corresponding to one or more of the main control unit virtual machines, hardware resources equivalent to the failed hardware are allocated from the unallocated hardware resources, and these resources are recombined with the redundant control unit virtual machines corresponding to the one or more main control unit virtual machines to repair the failure. The hardware resources used for replacement are independent of the hardware resources being replaced. The microcontroller is also configured to: in response to a failure of one of the main control unit virtual machines, the control functions performed by the main control unit virtual machine are replaced by a corresponding redundant control unit virtual machine; The hardware resources include a kernel, storage unit, peripheral interface, power supply unit, clock source, bus, and functional circuits located outside the microcontroller. The hardware resources allocated to the main control unit virtual machine and the corresponding redundant control unit virtual machine in the microcontroller are located in different kernels and storage areas, and use different peripheral interfaces, power supply units, clock sources, and buses. The first and second functional circuits allocated to the main control unit virtual machine and the corresponding redundant control unit virtual machine in the microcontroller are independent of each other. The first functional circuit is used for the functional interaction between the main control unit virtual machine and its corresponding hardware resources, and the second functional circuit is used for the functional interaction between the redundant control unit virtual machine and its corresponding hardware resources.

11. The vehicle-mounted microcontroller as described in claim 10, characterized in that, The microcontroller is configured such that the hardware resource used for replacement and the hardware resource being replaced are located in different kernels and different storage areas, and use different peripheral interfaces, power supply units, clock sources and buses.

12. The vehicle-mounted microcontroller as described in claim 10, characterized in that, The microcontroller is configured to: After detecting the fault information, the fault is fed back to the external control device, which controls the allocation and recombination of equivalent hardware resources. The external control device includes a cloud controller, a domain controller, and an on-board computer.

13. The vehicle-mounted microcontroller as described in claim 10, characterized in that, The microcontroller is also configured such that: After the main control unit virtual machine detects and determines that it has failed, it sends a request to the management program. Upon receiving the request, the management program shuts down the main control unit virtual machine and its corresponding hardware output, and simultaneously starts up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform the replacement.

14. The vehicle-mounted microcontroller as described in claim 10, characterized in that, The microcontroller is also configured such that: The main control unit virtual machine and its corresponding redundant control unit virtual machine run simultaneously. In response to the redundant control unit virtual machine detecting a failure in the main control unit virtual machine, the redundant control unit virtual machine sends a request to the management program to shut down the main control unit virtual machine and its corresponding hardware output.

15. The vehicle-mounted microcontroller as described in claim 10, characterized in that, The microcontroller is also configured such that: After the management program detects a fault in the main control unit virtual machine, it shuts down the main control unit virtual machine and its corresponding hardware output, and simultaneously starts up the redundant control unit virtual machine corresponding to the main control unit virtual machine to perform the replacement.

16. The vehicle-mounted microcontroller as described in any one of claims 13 to 15, characterized in that, The microcontroller is also configured such that: After the redundant control unit virtual machine replaces the faulty main control unit virtual machine to perform the corresponding control function, it checks again to confirm whether the faulty main control unit virtual machine and its corresponding hardware output are shut down. If not shut down, it requests the management program to shut down the faulty main control unit virtual machine and its corresponding hardware output.

17. The vehicle-mounted microcontroller as described in claim 10, characterized in that, The functional circuit includes a power management circuit, a sensor and sampling circuit, a communication circuit, an actuator and drive circuit, a safety protection and shutdown circuit, and a power supply circuit.

18. The vehicle-mounted microcontroller as described in claim 10, characterized in that, The microcontroller is configured with multiple independent hardware resources, including multiple independent cores, storage units, peripheral interfaces, and independently partitioned power supply units, clock sources, and buses.

Images