A vehicle-mounted domain controller chip device, system and functional safety method

Abstract

The present invention provides a vehicle-mounted domain controller chip device, system and functional safety method. The solution features layered processing and modular design, including application layer, driver layer and hardware layer. Information transmission and fault handling are carried out between each layer through communication links. The design adds watchdog and heartbeat monitoring components to ensure the safe operation of the system; a diagnostic module is set to provide support for the driver layer to achieve functional safety; when a system fails, error information can be reported in time, and backup components or fault recovery processes can be started to reduce performance impact. This application is characterized by high systematization, modularization, intelligence and security, which improves the stability and security of the vehicle-mounted domain controller.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent driving domain controllers, and in particular to a vehicle-mounted domain controller chip device, system and functional safety method. Background Art

[0002] As the country vigorously promotes the automotive industry towards the "new four trends" (intelligence, networking, electrification, and sharing), the automotive industry is undergoing drastic changes. The traditional automotive electronic and electrical architecture can no longer meet the needs of increasingly intelligent vehicles, especially the personalized multi-scenario advanced assisted driving needs in the field of intelligent driving. The old single ECU (Electronic Control Unit) is difficult to meet these needs, and the solution is to integrate multiple ECUs. These ECUs are connected to each other through buses such as CAN (Controller Area Network) and LIN (Local Interconnect Network), which will undoubtedly greatly increase the complexity of the system, resulting in an increase in the cost of BOM (Bill of Material) and reduced market competitiveness.

[0003] With this as a guide, the automotive industry began to promote the design concept of domain controllers, integrating multiple ECUs on a hardware motherboard. However, in order to enhance brand competitiveness, major automakers continue to launch new features in the field of intelligent driving, which are generally integrated on a chip. As a result, under complex driving conditions, the chip needs to continue to operate at a high intensity, which will undoubtedly increase the chip calculation false alarm rate and even cause failures. This is a great threat to the automotive industry because it may threaten the safety of people and property. Recently, the Internet is full of news about car accidents caused by intelligent driving functions, such as failure to brake automatically and brake failure.

[0004] Although intelligent assisted driving can relieve fatigue during driving, the increase in car accidents caused by it threatens personal and property safety. Therefore, when enabling assisted driving functions, we must design more remedial measures to deal with possible abnormalities to avoid losses caused by them as much as possible. The prevention and intervention functions of intelligent driving are crucial to ensure safety, and we must pay great attention to this.

[0005] In view of the shortcomings of existing vehicle-mounted domain controllers, the present invention discloses a vehicle-mounted domain controller chip device, system and functional safety method, so that when an abnormal failure occurs, the system can quickly feedback and take effective measures to minimize the loss, thereby improving traffic safety and reducing accidents. Summary of the invention

[0006] In view of this, the embodiments of the present application provide a vehicle domain controller chip device, system and functional safety method to improve the stability and safety of the vehicle domain controller, so that error information can be reported in time when a system failure occurs. The embodiments of the present application provide the following technical solutions:

[0007] On the one hand, an embodiment of the present application provides a vehicle-mounted domain controller chip device, including an application layer, a driver layer, a hardware layer and a communication link, wherein the application layer includes a fault processing module; the driver layer includes a first diagnostic module and a second diagnostic module; the hardware layer includes a fault collection module, characterized in that the fault processing module has the highest security level and receives diagnostic information and error feedback from the chip device, the first diagnostic module collects diagnostic information of the driver layer, the second diagnostic module initializes the fault type of the fault collection module, and the fault collection module receives diagnostic information of the hardware layer.

[0008] Furthermore, the fault handling module includes a watchdog component and a heartbeat monitoring component.

[0009] Furthermore, the first diagnostic module includes a diagnostic driver and an IP driver error collection function for implementing the functional safety of the driver layer and determining the nature and possible causes of the fault.

[0010] Furthermore, the second diagnosis module can also set the error reporting level of the fault collection module, detect the temperature anomaly of the chip system and the operation of the fault processing module.

[0011] Furthermore, the hardware layer errors collected by the fault collection module are handed over to the fault processing module for processing.

[0012] On the other hand, an embodiment of the present application provides a vehicle-mounted domain controller system, including a micro control unit, a sensor, a recording system and a driving system, characterized in that:

[0013] The microcontroller receives and processes information from various sensors, and issues control instructions based on the information, and can also provide real-time system monitoring and fault diagnosis functions;

[0014] The sensor detects and records various motion states of the vehicle, such as speed, turning angle, temperature, etc., and sends these data to the micro control unit in real time;

[0015] The recording system is used to store data generated by the microcontroller unit and the sensor, including operating information, fault codes and maintenance history of the vehicle;

[0016] The driving system is responsible for receiving control instructions from the micro control unit and adjusting the running state of the vehicle according to the control instructions;

[0017] It also includes any of the above-mentioned vehicle-mounted domain controller chip devices, which is used to handle chip failures.

[0018] Furthermore, the vehicle-mounted domain controller system also includes: a communication interface for sending vehicle status data to other systems or devices; and security devices for protecting the security of vehicle data, such as firewalls and data encryption devices.

[0019] On the other hand, an embodiment of the present application provides a vehicle domain controller chip functional safety method, characterized in that the method steps include:

[0020] S1. Fault detection: The chip device is verified by using a dual mechanism of watchdog component and heartbeat monitoring component;

[0021] S2. Fault identification: When the chip device is started, it will cycle through the internal self-check, and any fault errors will be automatically saved in the register;

[0022] S3. Fault response: The fault error generated when the chip device is running is submitted to the fault processing module;

[0023] S4. Fault reporting: The fault handling module reports serious errors to the microcontroller unit outside the chip.

[0024] Furthermore, the S1 fault detection is implemented by hardware, software or both, and the detection methods and technologies used include built-in self-test, error correction code, parity check, and lock-step operation.

[0025] Further, the S2 fault identification determines the nature and possible causes of the fault.

[0026] Furthermore, the S3 fault response is to start a chip backup component, adjust the working mode of the vehicle domain controller system to reduce the impact on performance, or start a fault recovery process to repair the fault.

[0027] Furthermore, the S4 fault report generally includes detailed information of the fault, such as the time, device, nature of the fault, and response measures taken.

[0028] Compared with the prior art, the at least one technical solution adopted in the embodiment of the present application can achieve the following beneficial effects:

[0029] 1. The present invention uses layered processing and modular design: The solution designs the vehicle-mounted domain controller chip device into a layered mode, including an application layer, a driver layer and a hardware layer, and each layer adopts a modular design. The setting of the fault processing module, the diagnosis module and the fault collection module makes the fault collection and processing process more systematic and efficient.

[0030] 2. The vehicle-mounted domain controller chip device solution of the present invention adds a watchdog component and a heartbeat monitoring component, which can greatly improve the security of the system. These two components can detect abnormal behavior of the system and ensure the normal operation of the system at all times.

[0031] 3. The diagnostic driver and IP driver error collection functions of the present invention can achieve functional safety of the driver layer and help determine the nature and possible causes of the fault. At the same time, the second diagnostic module can set the error reporting level of the fault collection module, detect temperature anomalies of the chip system, and monitor the operation of the fault processing module, further improving the comprehensive safety of the function.

[0032] 4. In the vehicle-mounted domain controller system of the present invention, not only is the information transmission between internal modules clear, but it can also interact with the external MCU module through a communication link to achieve timely feedback and processing of errors.

[0033] 5. When a fault occurs in the vehicle domain controller system of the present invention, the system can not only start the chip backup component to reduce the impact on performance, but also start the fault recovery process to repair the fault. This multiple strategy enables the system to make a timely and effective response when facing a problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 is a schematic diagram of a vehicle-mounted domain controller chip device of the present invention;

[0036] Figure 2 is a schematic diagram of a vehicle-mounted domain controller system of the present invention;

[0037] Figure 3 It is a process diagram of a vehicle domain controller functional safety method of the present invention. DETAILED DESCRIPTION

[0038] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0039] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0040] On the one hand, referring to Figure 1 An embodiment of the present application provides a vehicle-mounted domain controller chip device, including an application layer, a driver layer, a hardware layer and a communication link, wherein the application layer includes a fault processing module; the driver layer includes a first diagnostic module and a second diagnostic module; the hardware layer includes a fault collection module, characterized in that the fault processing module has the highest security level and receives diagnostic information and error feedback from the chip device, the first diagnostic module collects diagnostic information from the driver layer, the second diagnostic module initializes the fault type of the fault collection module, and the fault collection module receives diagnostic information from the hardware layer.

[0041] At the hardware level, the embodiment of the present application designs a fault collection module, which is responsible for collecting any hardware fault information that may occur in the chip. At the driver level, the embodiment of the present application configures a first diagnostic module and a second diagnostic module, which are responsible for collecting diagnostic information of the driver layer and initializing the fault type of the fault collection module.

[0042] At the application level, the embodiment of the present application sets up a fault handling module. The fault handling module is a module with a higher security level, which receives diagnostic information and error feedback from the chip device, and is configured with a watchdog component and a heartbeat monitoring component to monitor the system status in real time.

[0043] Each layer adopts modular design. The setting of fault handling module, diagnosis module and fault collection module makes the fault collection and processing process more systematic and efficient.

[0044] Suppose that during a navigation process, the chip encounters some faults, such as overheating or memory errors. At this time, the fault collection module will collect these fault information and pass them to the diagnosis module of the driver layer. The diagnosis module will analyze these fault information and try to find possible causes, such as overheating caused by the chip working in a high temperature environment for a long time.

[0045] These diagnostic information and error feedback will then be received and processed by the fault handling module. The watchdog component and heartbeat monitoring component will monitor the working status of the chip and issue an alarm in time. The addition of watchdog components and heartbeat monitoring components to the vehicle-mounted domain controller chip device solution can greatly improve the security of the system. These two components can detect abnormal behavior of the system and ensure the normal operation of the system at all times. Finally, the fault handling module will decide whether to start the backup component or perform the fault recovery process based on the severity of the fault to ensure the normal operation of the navigation system.

[0046] On the other hand, an embodiment of the present application provides a vehicle-mounted domain controller system, which is mainly composed of a microcontroller unit (MCU), a sensor, a recording system and a driving system, and is equipped with the aforementioned vehicle-mounted domain controller chip device.

[0047] The microcontroller unit (MCU) is the "brain" of the system. It receives and processes information from various sensors, generates and issues corresponding control instructions based on this information, and can also provide real-time system monitoring and fault diagnosis functions to ensure the normal operation of the system.

[0048] Sensors are important components used to observe and monitor the vehicle's motion status, such as vehicle speed, turning angle, temperature and other parameters. These data are collected in real time and sent to the microcontroller unit.

[0049] The recording system is an information storage unit that is used to store various data generated by microcontroller units and sensors, such as vehicle operation information, fault codes, and vehicle maintenance history, which can provide important basis for subsequent problem analysis.

[0050] The drive system is responsible for implementing specific actions. It receives control instructions from the microcontroller unit and adjusts the vehicle's operating state according to the instructions, for example, controlling the speed and direction of the wheels in response to instructions from the navigation system.

[0051] This system also includes the vehicle domain controller chip device described above, which provides a solution for chip failures, including fault diagnosis, processing and reporting, which helps the system maintain normal operation when a failure occurs and ensures driving safety. In the vehicle domain controller system, not only is the information transmission between internal modules clear, but it can also interact with external MCU modules through communication links to achieve timely feedback and processing of errors.

[0052] The vehicle domain controller system also includes: a communication interface for sending vehicle status data to other systems or devices; and security devices for protecting the security of vehicle data, such as firewalls and data encryption devices.

[0053] The vehicle-mounted domain controller system is designed to provide a more efficient, safer and more stable vehicle-mounted domain control method, improving the vehicle's autonomous driving capabilities and laying a solid foundation for it to achieve a higher degree of intelligence and safety.

[0054] On the other hand, the embodiment of the present application provides a functional safety method for a vehicle-mounted domain controller chip, characterized in that, S1, fault detection: This step mainly uses a watchdog component and a heartbeat monitoring component to perform a comprehensive check on the chip device. The watchdog component is a timer device that can be updated or reset at regular intervals. If the watchdog timer is not updated or reset within a predetermined time limit, the watchdog will trigger a system restart or other protective measures. Heartbeat monitoring uses a timed "heartbeat" signal to monitor whether the chip device is still working properly.

[0055] S2, Fault Identification: When the chip device is started, it will perform an internal self-check. If a fault error is detected, this information will be automatically saved in the register for subsequent identification and processing.

[0056] S3, Fault response: Fault errors that occur during the operation of the chip device will be submitted to the fault processing module. This module is used to process fault information. It will analyze the cause of the fault and the possible impact, and then decide what measures should be taken.

[0057] S4, Fault Report: In the fault handling module, if a major error is found, the error will be reported to the outside of the chip device, that is, the micro control unit. The micro control unit can further handle the major error or inform the driver to ensure the normal operation of the system and the safety of the user.

[0058] Furthermore, S1 fault detection is implemented by hardware, software, or both, and the detection methods and technologies used include built-in self-test, error correction code, parity check, and lock-step operation.

[0059] Further, S2 fault identification determines the nature and possible cause of the fault.

[0060] Furthermore, the S3 fault response is to start a chip backup component, adjust the working mode of the vehicle domain controller system to reduce the impact on performance, or start a fault recovery process to repair the fault.

[0061] Furthermore, the S4 fault report usually includes detailed information of the fault, such as the time, device, nature of the fault, and response measures taken.

[0062] In this specification, the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the embodiments described later, the description is relatively simple, and the relevant parts can be referred to the partial description of the previous embodiments.

[0063] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A vehicle-mounted domain controller chip device, comprising an application layer, a driver layer, a hardware layer and a communication link, wherein the application layer comprises a fault processing module; the driver layer comprises a first diagnostic module and a second diagnostic module; the hardware layer comprises a fault collection module, characterized in that: The fault handling module has the highest security level and receives diagnostic information and error feedback from the chip device. The first diagnostic module collects diagnostic information from the driver layer, the fault collection module receives diagnostic information from the hardware layer, the second diagnostic module initializes the fault type of the fault collection module, and the diagnostic information and error feedback from the driver layer are passed to the fault handling module for processing; the first diagnostic module includes diagnostic driver and IP driver error collection functions, which are used to implement the functional safety of the driver layer and determine the nature and possible causes of the fault; the second diagnostic module also sets the error reporting level of the fault collection module, detects temperature anomalies in the chip system, and runs the fault handling module.

2. The vehicle-mounted domain controller chip device according to claim 1, characterized in that: The fault processing module includes a watchdog component and a heartbeat monitoring component.

3. The vehicle-mounted domain controller chip device according to claim 1, characterized in that: The hardware layer errors collected by the fault collection module are handed over to the fault processing module for processing.

4. A vehicle-mounted domain controller system, comprising a microcontroller unit, a sensor, a recording system and a driving system, characterized in that: The microcontroller receives and processes information from various sensors, issues control instructions based on the information, and also provides real-time system monitoring and fault diagnosis functions; The sensor detects and records various motion states of the vehicle and sends these data to the micro control unit in real time; The recording system is used to store data generated by the microcontroller unit and the sensor, including operating information, fault codes and maintenance history of the vehicle; The driving system is responsible for receiving control instructions from the micro control unit and adjusting the running state of the vehicle according to the control instructions; It also includes the vehicle-mounted domain controller chip device as described in any one of claims 1 to 3, which is used to handle chip failures.

5. The vehicle-mounted domain controller system according to claim 4, characterized in that: The vehicle-mounted domain controller system also includes: a communication interface for sending vehicle status data to other systems or devices; and a security device for protecting the security of vehicle data.

6. A vehicle domain controller chip functional safety method, comprising the vehicle domain controller chip device according to any one of claims 1 to 3, used for processing chip failures, characterized in that: The method steps include: S1. Fault detection: The chip device is verified by using a dual mechanism of watchdog component and heartbeat monitoring component; S2. Fault identification: When the chip device is started, it will cycle through the internal self-check, and any fault errors will be automatically saved in the register; S3. Fault response: The diagnostic information of the driver layer and the error feedback generated based on the diagnostic information of the hardware layer when the chip device is running are respectively submitted to the fault processing module; S4. Fault reporting: The fault handling module reports serious errors to the microcontroller unit outside the chip.

7. The vehicle-mounted domain controller chip functional safety method according to claim 6, characterized in that: The S1 fault detection is implemented by hardware, software or both, and the detection methods and technologies used include built-in self-test, error correction code, parity check, and lock-step operation.

8. The vehicle domain controller chip functional safety method according to claim 7, characterized in that: The S2 fault identification determines the nature and possible cause of the fault.

9. The vehicle domain controller chip functional safety method according to claim 7, characterized in that: The S3 fault response is to start a chip backup component, adjust the working mode of the vehicle domain controller system to reduce the impact on performance, or start a fault recovery process to repair the fault.

10. The vehicle domain controller chip functional safety method according to claim 7, characterized in that: The S4 fault report includes detailed information of the fault, including the time, device, nature of the fault, and response measures taken.

Images