A service-oriented area controller for vehicles

Abstract

The application discloses a service type area controller for vehicles, a multi-core heterogeneous microprocessor integrating a micro control unit and a micro processing unit core is used as a core chip of the service type area controller, a built-in dual-core lockstep micro control unit meeting functional safety requirements is used as a control core of a regional power distribution module, a safety redundant output module and a regional gateway, and software functions with specific requirements on real-time performance and safety performance are run; the built-in micro processing unit is used to provide computing power support for controller and sensor data processing in the region, and to provide a service interface for a domain controller or a central computer; power supply management, network management, power consumption management and functional safety management are performed on the controllers, intelligent sensors and intelligent actuators in the region, a service interface is provided for controllers outside the region through a high-speed Ethernet, and the demand of a software defined vehicle is met.

Description

Technical Field

[0001] This invention relates to a vehicle controller, and more particularly to a vehicle service area controller for use in modern automobiles. Background Technology

[0002] Current automotive electronic and electrical architecture mainly includes electronic units composed of numerous distributed computing and control units, electrical units composed of engines, servo motors, and solenoid valves, and actuators composed of mechanical, hydraulic, and valve mechanisms. For example... Figure 1 Most automobiles, as shown, generally employ a distributed electronic and electrical architecture, with dozens or even hundreds of vehicle controllers (electronic units) divided into functional domains based on their control of the body, chassis, powertrain, infotainment, etc. These controllers are connected to an onboard gateway via buses such as CAN and LIN, which handles message and signal routing between the buses. Each vehicle controller, along with its connected sensors and actuators, is powered independently, resulting in a highly complex vehicle architecture and significant design and manufacturing costs. The vehicle controllers mentioned in this application refer to the aforementioned vehicle controllers.

[0003] As the functions that automobiles need to perform become increasingly complex, the number of automotive controllers is also increasing, such as... Figure 2 The illustrated portion of the vehicle begins to integrate various functional domains. Each functional domain is implemented by a high-performance domain controller, which connects multiple sensors and actuators via a CAN bus and enables cross-domain information exchange via Ethernet and a high-performance Ethernet gateway. While existing domain controllers divide the vehicle into several functional domains based on the functions of electronic components, and then use a core processor with superior processing capabilities to control each domain, aiming to replace the current distributed automotive electronic and electrical architecture, the development of domain controllers is very difficult due to the numerous functions of controllers within each domain (e.g., chassis domain controller, powertrain domain controller, body domain controller, information domain controller, autonomous driving domain controller, etc.), especially the highly complex functions of the powertrain domain controllers. Currently, only a portion of the controllers within a domain can be integrated into a single domain controller, achieving some reduction in controller and wiring harness weight, cost, and power consumption. The domain controllers mentioned in the following technical solutions refer to the aforementioned domain controllers.

[0004] With the development trend of vehicle intelligence and connectivity, software-defined vehicles (where vehicle functions can be configured via software) have placed new demands on the electronic and electrical architecture of automobiles. This architecture is also evolving from distributed to centralized systems, leading to the concept of zoned vehicle management. For example... Figure 3As shown in the diagram, in a centralized electronic and electrical architecture, area controllers in different areas such as the left front area, left rear area, right front area, and right rear area are connected to the central computer via a backbone Ethernet. Intelligent sensors and actuators within the areas are connected to the area controllers via CAN, LIN, or FlexRay networks. Dual-power redundant power supply and intelligent hierarchical power supply are implemented within the areas. The area controllers act as gateways within their areas, responsible for distributing communication data from controllers, sensors, and actuators, and providing real-time services to the central computer via Time-Sensitive Networking (TSN). They also act as intelligent distribution boxes within their areas, typically employing a distributed hierarchical power distribution network. The primary distribution network uses dual-power redundant supply to deliver power to the area controllers, while the secondary distribution network, managed by the area controllers, continues to distribute power to the various controllers, actuators, and sensors within the area. Furthermore, the area controllers must implement functional characteristic control for specific areas. For functions with high functional safety requirements, the area controllers must have safety output functions to ensure functional safety objectives are met. However, currently, in-vehicle intelligent power distribution boxes and gateways are all independent unit components. When a power distribution fault occurs, it cannot be detected in a timely manner and cannot provide redundant safety outputs to functional safety-related controllers. At the same time, the vehicle wiring harness is also overly complex, which can easily lead to increased complexity of the vehicle's distribution structure, increased vehicle weight, and increased vehicle manufacturing costs. The area controllers mentioned in the following technical solutions refer to the aforementioned area controllers, and the areas mentioned refer to the aforementioned areas. Summary of the Invention

[0005] This invention addresses the shortcomings of existing vehicle service controllers, such as gateways being independent functional components, inability to promptly detect power distribution faults and provide redundant safety outputs to functional safety-related area controllers, and excessively complex vehicle wiring harnesses, which increase the complexity of the vehicle's distributed structure, weight, and manufacturing costs. It provides a functional management mode that combines area power distribution management, area gateway management, and safety output management. This reduces the complexity of the vehicle wiring harness, decreases the overall size and weight of the vehicle service controller, and improves the speed, efficiency, and safety of power distribution control.

[0006] The specific technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows: a vehicle-mounted service area controller, characterized in that it includes a multi-core heterogeneous microprocessor, a power module, an area gateway module, an area power distribution module, and a safety output module;

[0007] Multi-core heterogeneous microprocessors integrate microcontrollers and microprocessor units;

[0008] The microcontroller unit adopts a dual-core lockstep mode to handle the functional strategies of the area power distribution module, safety output module, and area gateway module, which have requirements for real-time performance and safety performance.

[0009] The microprocessor unit communicates with the microcontroller unit via an internal bus and message mechanism to preprocess signals from vehicle controllers or sensors within the area.

[0010] The power module is used to supply power to the microprocessor and peripheral devices;

[0011] The safety output module uses an H-bridge motor driver chip that drives two H-bridge motors simultaneously. The H-bridge motor driver chip communicates with the microprocessor via an SPI bus. The motor drive PWM signal is connected to the microprocessor's PWM output pin via the PWM1 pin. The motor drive output current is output to the microprocessor's ADC acquisition channel via the CSO1 pin, providing real-time feedback of the output current value.

[0012] This vehicle-mounted service area controller adopts a functional management model that combines regional power distribution management, regional gateway management, and safety output management. This reduces the complexity of the vehicle wiring harness, decreases the overall size and weight of the vehicle-mounted service controller, and improves the speed, efficiency, and safety of power distribution control. It utilizes a built-in dual-core lockstep microcontroller unit that meets functional safety requirements as the control core for the regional power distribution module, safety output module, and regional gateway. The safety redundancy output module effectively manages safety redundancy outputs and runs software functions with specific requirements for real-time and safety performance. The built-in microprocessor unit provides processing support for data processing from controllers and sensors within the area and provides service interfaces for domain controllers or central computers. It performs power supply management, network management, power consumption management, and functional safety management for controllers, smart sensors, and smart actuators within the area, and provides a high-speed processing service interface to controllers outside the area via high-speed Ethernet. When a power supply failure occurs to a controller or smart actuator within the area, the controller or smart actuator function is redundantly replaced according to functional safety requirements to ensure that functional safety objectives are met. This improves the effectiveness of safety output management in the vehicle-mounted service area controller.

[0013] Preferably, the multi-core heterogeneous microprocessor includes at least three dual-core lockstep microcontrollers with an ASIL B safety level or higher, and at least one microprocessor unit. For example, NXP's S32G274A chip includes three ARM Cortex-M7 dual-core lockstep microcontrollers and four ARM Cortex-A53 core microprocessor units, with the microcontrollers meeting the ASIL D safety level. This improves the energy efficiency of microprocessor management for automotive service area controllers.

[0014] Preferably, the power module uses the NXP VR5510 power chip, which has a built-in watchdog timer. This time-window-based question-and-answer communication monitors the microprocessor's operating status, and a reset signal is used to control the microprocessor's reset when an abnormality occurs. This improves the power management efficiency of various functional modules in the vehicle-mounted service area controller.

[0015] Preferably, the power module is connected to the microprocessor via I2C communication. The microprocessor configures the power module and performs watchdog timer feeding via I2C communication. When the microprocessor resets, the power module provides continuous power to the intelligent high-side drive chip, ensuring a stable and reliable power supply to the various functional modules of the vehicle area controller.

[0016] Preferably, the aforementioned area power distribution module uses an intelligent high-side drive chip with diagnostic, protection, and current sampling functions to replace the traditional relay and fuse combination, managing the power supply to controllers, intelligent actuators, and intelligent sensors within the area. This improves the effectiveness of the vehicle-mounted service area controller's diagnostic, protection, and functional safety output functions for the power supply within the area.

[0017] Preferably, the microprocessor is connected to the IS function pin of the intelligent high-side drive chip used in the regional power distribution module via the ADC function pin, for acquiring output current values ​​and determining fault states based on specific current values. This improves the effectiveness of the regional power distribution module in monitoring power supply current and detecting power supply faults.

[0018] Preferably, the area power distribution module and the safety output module use their own independent power lines, which can still provide functional safety output functions when the area power distribution power line connection is abnormal. The area power distribution power line uses a first power line, and the safety output module uses a second power line. This improves the effectiveness of the vehicle-mounted service area controller in providing the required functional safety output management even when the area power distribution is abnormal.

[0019] Preferably, the area gateway module is equipped with an Ethernet gateway, CAN / CANFD gateway, LIN gateway, FlexRay vehicle network bus, and SENT communication interface. This enhances the comprehensive security, reliability, and effectiveness of network communication services for vehicle-mounted service area controllers.

[0020] Preferably, the Ethernet gateway supports at least 3 1000Base-T1 and at least 4 100Base-T1 Ethernet interfaces, and the CAN / CANFD gateway supports at least 16 CAN / CANFD interfaces, with a maximum transmission rate of 5 MBits / s. This improves the regional control transmission efficiency of the vehicle-mounted service area controller.

[0021] The beneficial effects of this invention are as follows: It adopts a functional management mode that combines regional power distribution management, regional gateway management, and safety output management, which reduces the complexity of the vehicle wiring harness, decreases the overall size and weight of the vehicle service controller, and improves the speed, efficiency, and safety of power distribution control in the vehicle service regional controller. It utilizes a built-in dual-core lockstep microcontroller unit that meets functional safety requirements as the control core for the regional power distribution module, safety output module, and regional gateway. The safety redundancy output module effectively implements safety redundancy output management and runs software functions with specific requirements for real-time and safety performance. The built-in microprocessor unit provides processing support for data processing of controllers and sensors within the regional area and provides a service interface for the domain controller or central computer. It performs power supply management, network management, power consumption management, and functional safety management for controllers, intelligent sensors, and intelligent actuators within the regional area, and is configured to provide a service interface to controllers outside the regional area via high-speed Ethernet, further meeting the needs of software-defined vehicles. Attached image description:

[0022] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0023] Figure 1 This is a schematic diagram of a distributed electronic and electrical architecture divided by domain in the prior art;

[0024] Figure 2 This is a schematic diagram of a domain-centralized electronic and electrical architecture with a domain controller at its core in the existing technology;

[0025] Figure 3 This is a schematic diagram of a vehicle-mounted service area controller of the present invention applied to a centralized electronic and electrical architecture with a central computer as the core.

[0026] Figure 4 This is a schematic diagram of the structure of a vehicle-mounted service area controller according to the present invention;

[0027] Figure 5 This is a schematic diagram of the power module structure in a vehicle-mounted service area controller according to the present invention;

[0028] Figure 6 This is a schematic diagram of the power distribution module structure in a vehicle-mounted service area controller according to the present invention;

[0029] Figure 7 This is a schematic diagram of the safety output module structure in a vehicle-mounted service area controller according to the present invention;

[0030] Figure 8 This is a schematic diagram of the regional gateway module structure in a vehicle-mounted service-type regional controller according to the present invention. Detailed Implementation

[0031] Example:

[0032] Figure 4 , Figure 5 , Figure 6 , Figure 7 , Figure 8 In the illustrated embodiment, a vehicle-mounted service area controller includes a multi-core heterogeneous microprocessor 20, a power module 10, an area gateway module 50, an area power distribution module 40, and a safety output module 40. The multi-core heterogeneous microprocessor integrates a microcontroller unit and a microprocessor unit. The microcontroller unit employs a dual-core lockstep mode to process the functional policy software strategies of the area power distribution module, safety output module, and area gateway module, which have specific requirements for real-time performance and safety performance. The microprocessor unit communicates with the microcontroller unit via an internal bus and message mechanism to preprocess vehicle controller or sensor signals within the area and provide service interfaces to other area controllers or a central computer. The power module is used for... It supplies power to the microprocessor and other peripheral devices; the safety output module uses an H-bridge motor driver chip that simultaneously drives two H-bridge motors. The H-bridge motor driver chip is model TLE92104-232QX. The H-bridge motor driver chip communicates with the microprocessor 20 via the SPI bus. The motor drive PWM signal is connected to the PWM output pin of the microprocessor 20 through the PWM1 pin. The motor drive output current is output to the ADC acquisition channel of the microprocessor 20 through the CSO1 pin, and the output current value is fed back in real time. When the power supply to the controller or intelligent actuator in the area fails, the controller or intelligent actuator function is redundantly replaced according to functional safety requirements to ensure that functional safety objectives are met.

[0033] Multi-core heterogeneous microprocessors contain at least three dual-core lockstep microcontrollers with an ASIL B or higher security level, and at least one microprocessor unit. For example, NXP's S32G274A chip contains three ARM Cortex-M7 dual-core lockstep microcontrollers (see...). Figure 4 The microcontroller unit shown includes microcontroller 1, microcontroller 2, and microcontroller 3, and four ARM Cortex-A53 core microprocessor units (see...). Figure 4 The microprocessor units 1-4 shown meet ASIL D safety level. Microprocessor 20 is connected to the safety output module via, but is not limited to, output control lines, diagnostic control lines, a current sampling interface, and an SPI serial peripheral interface. Microprocessor 20 is also connected to the area power distribution module via, but is not limited to, output control lines, diagnostic control lines, and a current sampling interface.

[0034] The power module uses NXP's VR5510 power chip, which has a built-in watchdog timer. This watchdog timer uses time-window-based question-and-answer communication to monitor the microprocessor's operating status. If the microprocessor malfunctions, a reset signal is used to control its reset. The power module and microprocessor are connected via I2C communication. The microprocessor configures the power module and performs watchdog timer feeding via I2C. During initialization, the microprocessor configures the watchdog timer cycle and the watchdog timer duty cycle via I2C. Within the valid time window, the microprocessor reads the seed register from the power module via I2C and calculates the result according to a predetermined algorithm, writing it to the power module's result register. The watchdog timer checks the result in the result register for correctness; if correct, the watchdog timer is successfully fed, and a 16-bit pseudo-random number is generated to update the power module's seed register. The "watchdog feeding" mentioned above refers to the process of calculating the time required for the watchdog counter to reach full count based on the number of bits in the watchdog counter and the system clock cycle during program design. This means the watchdog counter will not be full within this time. Then, during this time, the counter is reset to zero. This process is called "watchdog feeding." By feeding the watchdog periodically, it will never reach full count as long as the program runs normally. However, if a fault such as an infinite loop occurs and the counter is not reset in time, it will overflow and the system will restart. This is the watchdog principle.

[0035] The regional power distribution module uses the Infineon BTS70012-1ESP intelligent high-side drive chip, which has diagnostic, protection, and current sampling functions, to replace the traditional relay and fuse combination, managing the power supply to controllers, intelligent actuators, and intelligent sensors within the area. The microprocessor 20 is connected to the IS function pin of the intelligent high-side drive chip used in the regional power distribution module via the ADC function pin, for acquiring output current values ​​and determining fault conditions based on specific current values.

[0036] The area power distribution module and the safety output module each use their own independent power lines. They can still provide functional safety output even if the area power distribution power line connection is abnormal. The area power distribution power line uses power line 1 (Power1), and the safety output module uses power line 2 (Power2). (See...) Figure 4 The area gateway module is equipped with interfaces for Ethernet gateway, CAN / CANFD gateway, LIN gateway, FlexRay vehicle network bus, and SENT communication. The Ethernet gateway supports at least 3 1000Base-T1 and at least 4 100Base-T1 Ethernet interfaces, and the CAN / CANFD gateway supports at least 16 CAN / CANFD interfaces with a maximum transmission rate of 5MBits / s.

[0037] like Figure 4As shown, this application provides a service area controller, which is responsible for hierarchical power distribution, data distribution and implementation of functional characteristics of vehicle-specific areas for controllers, actuators and sensors within the area. It mainly includes: a power module 10, a microprocessor 20, an area power distribution module 30, a safety output module 40 and an area gateway module 50.

[0038] The power module 10 uses the NXP VR5510 power management chip to process the input power and supply power to the microprocessor 20 and peripheral chips; it also has a built-in window watchdog 11 based on time window question and answer to monitor the microprocessor's operating status.

[0039] The microprocessor module 20 uses the NXP S32G274A multi-core heterogeneous chip, with three built-in dual-core ARM Cortex-M7 cores that meet the ASIL D functional safety level, used to run regional power distribution, safety output and regional gateway function software; and four built-in ARM Cortex-A53 cores, used to process function software with low real-time requirements but high computational demands.

[0040] The area power distribution module 30 is used to manage the power supply of controllers, actuators and sensors within the area. Each power supply interface can be set with an overcurrent value according to the load conditions, including power supply safety within the power distribution area.

[0041] In accordance with functional safety requirements, the safety output module 40 executes a safety strategy and provides backup output functionality when the internal modules of the controller and microprocessor 20 within the area fail, ensuring that the functional safety objectives within the area are achieved.

[0042] The area gateway module 50 is responsible for data distribution to controllers, actuators and sensors within the area, and includes multiple interfaces such as CAN, LIN, Ethernet, FlexRay vehicle network and SENT; it also provides a 1000Base-T1 interface for connecting to other area controllers and the central computer, providing them with the service interface for the area.

[0043] Based on the above description, this application discloses a vehicle-mounted service area controller (VGA). Under a centralized electronic and electrical architecture, it manages vehicle zones by region, acting as a gateway, switch, and intelligent power distribution box within each zone. It provides data distribution and power management, and implements the functional characteristics of specific vehicle zones. The VGA encapsulates the functions of controllers and actuators within the zone, providing service interfaces to the central computer. It also preprocesses sensor data within the zone and provides it to the central computer through the service interface. Furthermore, the VGA is responsible for remotely upgrading controllers within the zone, enabling flexible configuration of functions within the zone and meeting the needs of personalized vehicle function configuration and continuous upgrades. The specific implementation of each module is described in detail below.

[0044] Power module 10 filters the 12V DC power input from the previous stage and then inputs it to the VR5510 power management chip, such as... Figure 5 As shown, the chip first performs DC-DC preprocessing on the 12V input power supply to step down to a 3.3V power supply VPRE. The power management chip has three built-in step-down modules BUCK1, BUCK2 and BUCK3, with VPRE as the input power supply. BUCK1 and BUCK2 are connected in parallel to output a voltage of 0.8V to power the core of the microprocessor 20, and BUCK3 outputs 1.1V to power the LPDDR (Low Power Double Data Rate SDRAM) chip on the periphery of the microprocessor 20.

[0045] The power management chip has three built-in LDO (Low Dropout Regulator) modules, LDO1, LDO2 and LDO3, with VPRE as the input power supply. LDO1 outputs 1.8V to power the processor 20, LDO2 outputs 1.8V to power the LPDDR chip around the microprocessor 20, and LDO3 outputs 3.3V to power the I / O chip around the microprocessor 20.

[0046] The power management chip has a built-in boost module VBOOST, which uses VPWR as the input power supply and outputs 5V to power the peripheral chips of the microprocessor 20. The power management chip also has a built-in high-voltage low-dropout linear regulator HVLDO, which uses VPRE as the input power supply and outputs 0.8V after processing by HVLDO to power the core of the microprocessor 20 in standby mode.

[0047] The power module management chip has a built-in window watchdog timer based on a time-window question-and-answer mechanism 11. The microprocessor 20 is connected to the power module management chip via an I2C bus interface (see...). Figure 4 Within a set time window, the microprocessor 20 sends seed data to the power module 10 management chip, then calculates the result according to a specified algorithm and sends it to the power module management chip. The power module management chip counts errors of the window watchdog 11. When the error value reaches the set maximum value, it outputs a reset signal RESET and a safety output signal Power Supply according to the set strategy. The reset signal RESET will reset the microprocessor 20 to restore it to normal operation. The safety output signal Power Supply is used to enable each functional module to output a safe state during the microprocessor 20 reset, such as driving the area power distribution module to continue to supply power to the controller in the area.

[0048] The area power distribution module 30 uses Infineon's BTS70012-1ESP intelligent high-side drive chip U1 to control the power supply of controllers, actuators, and sensors within the area. For example... Figure 6 As shown, the VS pin of the intelligent high-side driver chip is connected to the power supply 1 Power1 of the previous stage power distribution input. The microprocessor 20 is connected to the IN pin of the intelligent high-side driver chip through a GPIO to control the power output. In addition, the microprocessor 20 is connected to the DEN pin of the intelligent high-side driver chip through a GPIO to control the diagnostic function of the chip. The microprocessor 20 is connected to the IS pin of the intelligent high-side driver chip through an ADC to collect the output current value and determine the fault status based on the specific current value.

[0049] The safety output module 40 mainly includes high-side drive, low-side drive, H-bridge motor drive, and three-phase brushless DC motor (BLDC) drive, configured according to the specific functional requirements of a specific area. For example... Figure 7 As shown, the H-bridge motor M driver uses the Infineon TLE92104-232QX pre-driver chip U5, which can drive two H-bridges. This chip communicates with the microprocessor 20 via the SPI bus. The motor drive PWM signal is connected to the PWM output pin of the microprocessor 20 through the PWM1 pin. The motor drive output current is output to the ADC acquisition channel of the microprocessor 20 through the CSO1 pin, and the output current value is fed back in real time.

[0050] The area gateway module 50 supports message and signal routing between various networks, including CAN, CANFD, FlexRay in-vehicle network, LIN, SENT communication, and in-vehicle Ethernet. The in-vehicle Ethernet supports multiple physical layer methods, such as IEEE 100Base-T1 and IEEE 1000Base-T, meeting the communication needs of controllers, actuators, and sensors within the area. Figure 8 As shown, the microprocessor 20 has a built-in LLCE (Low Latency Communication Engine) that routes CAN / CANFD, LIN, and FlexRay communications within the area according to the set routing table. This transfers most of the routing operations from the microcontroller unit inside the microprocessor 20 to the LLCE, eliminating the need to transmit the messages back to the microcontroller unit. However, for signal routing or messages that the microcontroller unit needs to receive and process, the LLCE will transmit the messages to the microcontroller unit for processing according to the routing table configuration.

[0051] The microprocessor 20 has a built-in PFE (Packet Forwarding Engine) module that supports three selectable Ethernet interfaces: MII (Media Independent Interface), RMII (Reduced Media Independent Interface), RGMII (Reduced Gigabit Media Independent Interface), and SGMII (Serial Gigabit Media Independent Interface), namely PFE_MAC0, PFE_MAC1, and PFE_MAC2. It also has built-in switching functions that meet the requirements of AVB (Audio Video Bridging) and TSN (Time Sensitive Network). Figure 8 This example illustrates the implementation of vehicular Ethernet in the area gateway module 50. PFE_MAC0 is configured in SGMII mode to connect to Port 7 of an external Marvel 88Q5050 switching chip, while the switching chip is configured via the SMI (Serial Management Interface). PFE_MAC1 and PFE_MAC2 are configured as RGMII interfaces to connect to an external Marvel 88Q2110 Ethernet transceiver, enabling IEEE 1000Base-T communication. The Marvel 88Q5050 is an 8-port switching chip. Port 7 is an SGMII interface for connecting to the microprocessor 20; ports 5 and 8 are configured as RGMII interfaces to connect to the external Marvel 88Q2110 Ethernet transceiver, enabling IEEE 1000Base-T communication. Ports 1 to 4 have built-in IEEE 100Base-T1 transceivers, providing four IEEE 100Base-T1 communication interfaces; port 6 has a built-in IEEE 100Base-Tx transceiver for external diagnostic communication. In summary, this example provides 4 IEEE 1000Base-T communication interfaces, 4 IEEE 100Base-T1 communication interfaces, and 1 IEEE 100Base-Tx communication interface.

[0052] This application provides a vehicle-mounted service area controller. The above description, in conjunction with the accompanying drawings, provides a further detailed description of the relevant parts of the claims. For specific circuit connections, please refer to... Figure 4 , Figure 5 , Figure 6 , Figure 7 , Figure 8The circuit structure is shown below; detailed descriptions of every circuit connection are omitted. It should be noted that the described implementation examples represent only a portion of the implementation details related to the solution in this application, and are not a complete technical implementation.

[0053] The above content and structure describe the basic principles, main features, and advantages of the product of this invention, which should be understood by those skilled in the art. The examples and descriptions above are merely illustrative of the principles of this invention. Various changes and modifications can be made to this invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A vehicle-mounted service area controller, characterized in that: It includes a multi-core heterogeneous microprocessor, a power module, a regional gateway module, a regional power distribution module, and a safety output module; Multi-core heterogeneous microprocessors integrate microcontrollers and microprocessor units; The microcontroller unit adopts a dual-core lockstep mode to handle the functional strategies of the area power distribution module, safety output module, and area gateway module, which have requirements for real-time performance and safety performance. The microprocessor unit communicates with the microcontroller unit via an internal bus and message mechanism to preprocess signals from vehicle controllers or sensors within the area. The power module is used to supply power to the microprocessor and peripheral devices; The safety output module uses an H-bridge motor driver chip that can drive two H-bridge motors simultaneously. The H-bridge motor driver chip communicates with the microprocessor via the SPI bus. The motor drive PWM signal is connected to the microprocessor's PWM output pin via the PWM1 pin. The motor drive output current is output to the microprocessor's ADC acquisition channel via the CSO1 pin to provide real-time feedback of the output current value. The microprocessor includes at least three dual-core lockstep microcontrollers with an ASIL B or higher security level, and at least one microprocessor unit. The aforementioned regional power distribution module uses an intelligent high-side drive chip with diagnostic, protection, and current sampling functions to replace the traditional relay and fuse combination, and manages the power supply of controllers, intelligent actuators, and intelligent sensors within the region; The microprocessor is connected to the IS function pin of the intelligent high-side drive chip used in the regional power distribution module via the ADC function pin, and is used to collect the output current value and determine the fault status based on the specific current value. The area power distribution module and the safety output module each use their own independent power lines. They can still provide functional safety output when the area power distribution power line is abnormally connected. The area power distribution power line uses the first power line, and the safety output module uses the second power line.

2. The vehicle-mounted service area controller according to claim 1, characterized in that: The power module uses NXP's VR5510 power chip, which has a built-in watchdog timer. It monitors the microprocessor's operating status through time-window-based question-and-answer communication and controls the microprocessor to reset when the microprocessor malfunctions.

3. The vehicle-mounted service area controller according to claim 1, characterized in that: The power module is connected to the microprocessor via I2C communication. The microprocessor configures the power module and performs watchdog timer feeding via I2C communication.

4. The vehicle-mounted service area controller according to claim 1, characterized in that: The area gateway module is equipped with Ethernet gateway, CAN / CANFD gateway, LIN gateway, FlexRay vehicle network bus and SENT communication interface functions.

5. The vehicle-mounted service area controller according to claim 4, characterized in that: The Ethernet gateway supports at least 3 1000Base-T1 and at least 4 100Base-T1 Ethernet interfaces, and the CAN / CANFD gateway supports at least 16 CAN / CANFD interfaces with a maximum transmission rate of 5MBits / s.

Images