Domain controller and method of controlling the same

Abstract

The application discloses a domain controller and a control method thereof. The domain controller comprises a plurality of subsystems, different subsystems are used for performing different functions, and the plurality of subsystems are connected in cascade; a plurality of power supply systems, the plurality of power supply systems are connected in one-to-one correspondence with the plurality of subsystems; and the plurality of subsystems are further used for determining whether to close an external communication link of a target subsystem based on a fault type in a case where the target subsystem in the plurality of subsystems is detected to have a fault. The application solves the technical problem of low reliability of the domain controller in the related art.

Description

Technical Field

[0001] This invention relates to the field of intelligent vehicles, and more specifically, to a domain controller and its control method. Background Technology

[0002] Nowadays, both consumer electronics and automotive electronics are becoming increasingly diversified with the development of chip technology. Chips are becoming more and more powerful, controllers are becoming more and more complex, and the number of components in controllers is increasing. If any component fails, it will affect the operation of the entire controller, resulting in lower security and reliability.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a domain controller and its control method to at least solve the technical problem of low reliability of domain controllers in related technologies.

[0005] According to one aspect of the present invention, a domain controller is provided, comprising: multiple subsystems, each subsystem performing different functions, the multiple subsystems being cascaded; multiple power systems, each power system being connected to the multiple subsystems in a one-to-one correspondence; the multiple subsystems are further configured to determine whether to shut down the external communication link of the target subsystem based on the fault type when a fault is detected in the target subsystem among the multiple subsystems.

[0006] Optionally, each subsystem includes: a microcontroller, with the microcontrollers of different subsystems interconnected; at least one on-chip system for performing different functions; wherein, the microcontroller of the target subsystem is used to shut down the external communication link of the target subsystem when a fault is detected in any on-chip system of the target subsystem; the microcontrollers of other subsystems in the multiple subsystems are used to control at least one on-chip system of the target subsystem and keep the external communication link of the target subsystem open when a fault is detected in the microcontroller of the target subsystem, and the other subsystems are used to characterize the subsystems other than the target subsystem in the multiple subsystems.

[0007] Optionally, each power system includes: a first power chip connected to the microcontroller for powering the microcontroller; and at least one second power chip connected to at least one on-chip system for powering different on-chip systems.

[0008] Optionally, the domain controller further includes: multiple AND gates, each corresponding to a multiple subsystem, wherein the AND gates are respectively connected to the error output pin and interrupt pin of the corresponding microcontroller, and the safety indicator pin of the corresponding first power chip; and multiple first OR gates, each corresponding to a multiple subsystem, wherein the first OR gates are respectively connected to the output of the corresponding AND gate and the enable pin of the other microcontroller, and the output of the first OR gate is connected to the external communication link of the corresponding subsystem, wherein the external communication link of the corresponding subsystem is turned on when the corresponding first OR gate outputs a high level, and turned off when the corresponding OR gate outputs a low level.

[0009] Optionally, the first power chip is also used to control the microcontroller to restart or send an interrupt signal to the microcontroller in the event of a microcontroller failure; the second power chip is also used to control the corresponding on-chip system to restart in the event of a corresponding on-chip system failure.

[0010] Optionally, the second power chip is also used to send safety indication information to the target on-chip system or target microcontroller connected to the second power chip via a safety indication pin; the target on-chip system or target microcontroller is also used to control the second power chip to restart.

[0011] Optionally, the domain controller may also include: multiple second OR gates, each corresponding to a multiple subsystem; the second OR gates are connected to the microcontrollers of the multiple subsystems; the outputs of the second OR gates are connected to a second power supply chip; the second power supply chip is used to continue operating when each second OR gate outputs a low level and to restart when each second OR gate outputs a high level.

[0012] According to another aspect of the present invention, a control method for a domain controller is also provided, applied to any of the above-described domain controllers, the method comprising: detecting whether a plurality of subsystems in the domain controller have failed; in the case that a target subsystem has failed among the plurality of subsystems, determining the failure type of the target subsystem; and determining whether to shut down the external communication link of the target subsystem based on the failure type.

[0013] According to another aspect of the present invention, a control device for a domain controller is also provided, which is applied to the control method of the domain controller according to any one of the above. The device includes: a detection module for detecting whether a fault occurs in a plurality of subsystems in the domain controller; a first determination module for determining the fault type of the target subsystem when a fault occurs in the target subsystem among the plurality of subsystems; and a second determination module for determining whether to shut down the external communication link of the target subsystem based on the fault type.

[0014] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the execution of the domain controller control method described above in the processor of the device.

[0015] According to another aspect of the present invention, an electronic device is also provided, comprising: a domain controller of any one of the above.

[0016] In this embodiment of the invention, a domain controller is provided, comprising: multiple subsystems, each performing different functions, cascaded together; multiple power systems, each connected to one of the subsystems; and multiple subsystems further configured to determine whether to shut down the external communication link of a target subsystem based on the fault type when a fault is detected in the target subsystem. It is noteworthy that by cascading the multiple subsystems and independently powering them with multiple power systems, the operation of the other subsystems remains undisturbed even if any one subsystem fails. Furthermore, when a target subsystem fails, the multiple subsystems can determine whether to shut down its external communication link; that is, even if one subsystem fails, the other subsystems can still control its operation, thereby improving the security and reliability of the domain controller and solving the technical problem of low reliability in related technologies. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0018] Figure 1 This is a schematic diagram of an optional domain controller according to an embodiment of the present invention;

[0019] Figure 2 This is a flowchart of an optional domain controller control method according to an embodiment of the present invention;

[0020] Figure 3 This is a schematic diagram of a control device for an optional domain controller according to an embodiment of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0023] Example 1

[0024] According to an embodiment of the present invention, an embodiment of a domain controller is provided. Figure 1 This is a schematic diagram of an optional domain controller according to an embodiment of the present invention, such as... Figure 1 As shown, the domain controller 10 includes:

[0025] Multiple subsystems 102, each performing different functions, are cascaded together.

[0026] The aforementioned multiple subsystems 102 can be combinations of various subsystems used for vehicle control, such as parking systems, vehicle parking systems, autonomous driving systems, intelligent voice playback systems, etc., that is, Figure 1 The subsystems 1, 2, and n are optionally used in this invention as examples of a driving system and a parking system.

[0027] The driving system encompasses various devices and systems on the vehicle to ensure normal operation and driving safety. The parking system controls the vehicle to a fixed position when the user needs to park, or pulls the vehicle to a stop when a malfunction occurs during operation. Optionally, the driving system may include the engine, transmission system, braking system, suspension system, tires, steering system, body structure, lighting system, and airbag system. These systems and devices work together to ensure normal operation and driving safety under different road and environmental conditions. Alternatively, the parking system is a system for automatically parking vehicles. It typically uses sensors and cameras to detect the surrounding environment and controls the vehicle's movement through autonomous driving technology. This system helps drivers find parking spaces more easily, even in tight spaces.

[0028] In one optional embodiment, the driving system and parking system can be cascaded via an Inter-Integrated Circuit (I2C) or a Serial Peripheral Interface (SPI). This allows the driving and parking systems to control the vehicle's normal driving and parking. Optionally, by cascading the various subsystems, when a vehicle malfunctions, the error status can be reported in a hierarchical manner, making the entire vehicle control system clearer and more reliable. While each subsystem is powered independently, monitoring and control of each subsystem can also be achieved.

[0029] Multiple power supply systems 104 are connected to multiple subsystems 102 in a one-to-one correspondence.

[0030] The aforementioned multiple power supply systems 104 can be used to supply power to multiple subsystems 102 connected thereto, for example, Figure 1 The power system 1, power system 2, and power system n are optional. Multiple power systems 104 are connected to multiple subsystems 102 in a one-to-one correspondence.

[0031] In one alternative embodiment, the multiple subsystems 102 are independent of each other in terms of power supply and control scheme. Therefore, by connecting the multiple power systems 104 to the multiple subsystems 102 in a one-to-one correspondence, the multiple power systems 104 can supply power to the multiple subsystems 102 connected to them.

[0032] The multiple subsystems 102 are also used to determine whether to shut down the external communication link of the target subsystem based on the fault type when a fault is detected in the target subsystem among the multiple subsystems 102.

[0033] The target subsystem mentioned above can be any one of the multiple subsystems 102. Optionally, in this invention, the target subsystem is the driving system as an example for explanation.

[0034] In an alternative embodiment, since each of the multiple subsystems 102 has a corresponding external communication link, that is, Figure 1 Among them, external communication link 1, external communication link 2, external communication link n, etc., optionally, if a fault is detected in the driving system during the process of controlling the vehicle driving through the driving system in multiple subsystems 102, it is necessary to determine whether to shut down the external communication link of the driving system according to the type of fault.

[0035] In determining whether to shut down the external communication link of the driving system based on the fault type of the driving system, it is first necessary to classify and evaluate the fault type of the driving system. Generally, the fault types of the driving system can be divided into two categories: serious faults and non-serious faults.

[0036] For serious malfunctions, such as braking system failures, steering system failures, or vehicle control system failures, the external communication links of the driving system must be shut down immediately to avoid affecting vehicle driving safety.

[0037] For non-serious malfunctions, such as those affecting the in-vehicle entertainment system, air conditioning system, or navigation system, it may be necessary to consider shutting down the external communication links of the vehicle system, depending on the specific circumstances. In some cases, appropriate measures may be taken to restrict the external communication links to reduce their impact on the vehicle system, but it is not always necessary to shut them down completely.

[0038] Furthermore, when determining whether to shut down the external communication link of the driving system, it is also necessary to consider the possible impact of shutting down the communication link, such as navigation system failure, limited remote diagnostic functions, and the inability of the vehicle monitoring system to monitor in real time. Therefore, it is necessary to comprehensively consider factors such as fault type, scope of impact, and safety to make a reasonable decision.

[0039] In this embodiment of the invention, a domain controller is provided, comprising: multiple subsystems, each performing different functions, cascaded together; multiple power systems, each connected to one of the subsystems; and multiple subsystems further configured to determine whether to shut down the external communication link of a target subsystem based on the fault type when a fault is detected in the target subsystem. It is noteworthy that by cascading the multiple subsystems and independently powering them with multiple power systems, the operation of the other subsystems remains undisturbed even if any one subsystem fails. Furthermore, when a target subsystem fails, the multiple subsystems can determine whether to shut down its external communication link; that is, even if one subsystem fails, the other subsystems can still control its operation, thereby improving the security and reliability of the domain controller and solving the technical problem of low reliability in related technologies.

[0040] Optionally, each subsystem includes: a microcontroller, with the microcontrollers of different subsystems interconnected; at least one on-chip system for performing different functions; wherein, the microcontroller of the target subsystem is used to shut down the external communication link of the target subsystem when a fault is detected in any on-chip system of the target subsystem; the microcontrollers of other subsystems in the multiple subsystems are used to control at least one on-chip system of the target subsystem and keep the external communication link of the target subsystem open when a fault is detected in the microcontroller of the target subsystem, and the other subsystems are used to characterize the subsystems other than the target subsystem in the multiple subsystems.

[0041] In one optional embodiment, each of the multiple subsystems may include a microcontroller unit (MCU) and at least one system on a chip (SoC). The microcontrollers of different subsystems are interconnected, so that when the microcontroller of one subsystem fails, the microcontroller of another subsystem can directly take over the subsystem, ensuring the normal operation of the driving or parking system. This provides a good guarantee for the safety of the entire vehicle. Optionally, at least one SoC is used to perform different functions. A power management chip with functional safety can be selected as the SoC to ensure the functional safety level of the SoC as the minimum system.

[0042] Furthermore, the microcontroller of the driving system can also be used to shut down the external communication link of the driving system when a fault is detected in any on-chip system of the driving system, thereby ensuring driving safety. The microcontrollers of other subsystems in the multiple subsystems other than the target subsystem can also be used to control at least one on-chip system of the driving system and keep the external communication link of the driving system open when a fault is detected in the microcontroller of the driving system.

[0043] In other words, when the MCU of one subsystem fails, the MCU of another subsystem directly takes over the subsystem to ensure the normal operation of the driving or parking system. This provides a good guarantee for the safety of the entire vehicle. Optionally, while controlling the power supply of the SoC system, the MCU will also quickly shut down external communication after recognizing the error signals of various systems. For example, it will shut down the Controller Area Network (CAN), Local Interconnect Network (LIN), and Ethernet to ensure that the error signals generated by the system are not sent out, further ensuring the safety of the entire vehicle.

[0044] Optionally, each power system includes: a first power chip connected to the microcontroller for powering the microcontroller; and at least one second power chip connected to at least one on-chip system for powering different on-chip systems.

[0045] The aforementioned first power chip and at least one second power chip can be an Automotive Safety Integrity Level B (ASIL B) power management chip.

[0046] In one optional embodiment, ASIL B can be selected as the first power supply and at least one second power chip. The first power chip is connected to the microcontroller so that the first power chip can power the microcontroller and control at least one second power chip to be connected to at least one on-chip system in a one-to-one correspondence. Thus, at least one second power chip can power at least one on-chip system. Optionally, the number of at least one second power chip is the same as the number of at least one on-chip chip.

[0047] Optionally, the domain controller further includes: multiple AND gates, each corresponding to a multiple subsystem, wherein the AND gates are respectively connected to the error output pin and interrupt pin of the corresponding microcontroller, and the safety indicator pin of the corresponding first power chip; and multiple first OR gates, each corresponding to a multiple subsystem, wherein the first OR gates are respectively connected to the output of the corresponding AND gate and the enable pin of the other microcontroller, and the output of the first OR gate is connected to the external communication link of the corresponding subsystem, wherein the external communication link of the corresponding subsystem is turned on when the corresponding first OR gate outputs a high level, and turned off when the corresponding OR gate outputs a low level.

[0048] The error output pins and interrupt pins of a microcontroller can be integrated terminal blocks (INTBs).

[0049] The safety indicator pin of the first power chip mentioned above can be a foot switch 0B (Footswitch 0B, abbreviated as FS0B).

[0050] The enable pin mentioned above can be the PWRON pin.

[0051] In an optional embodiment, the controller further includes multiple AND gates and multiple first OR gates. Each of the multiple AND gates is connected to the error output pin and interrupt pin of the corresponding microcontroller, and the safety indicator pin of the corresponding first power supply chip. The multiple OR gates are connected to the output of the corresponding AND gate and the enable pin of the other microcontroller. The output of the first OR gate is connected to the external communication link of the corresponding subsystem. Optionally, the FS0B pin is a functional safety indicator signal. When the MCU or SoC of one of the subsystems is working normally, it can continuously perform a watchdog operation via I2C. When the watchdog operation is interrupted, the power management integrated circuit (PMIC) pulls the FS0B signal low to indicate that the system has entered an error operating state. When the system malfunctions but does not require a reset, the INTB pin can be used. After the error is corrected, the INTB pin can be released. This is generally used as a solution for overheating of the PMIC itself or the core power supply chip.

[0052] Optionally, the first power chip is also used to control the microcontroller to restart or send an interrupt signal to the microcontroller in the event of a microcontroller failure; the second power chip is also used to control the corresponding on-chip system to restart in the event of a corresponding on-chip system failure.

[0053] In one optional embodiment, when the first power chip or SoC fails to feed the dog, that is, when the microcontroller malfunctions, the first power chip or SoC can be restarted by pulling the reset pin low. Optionally, when the PMIC program is stuck, the PMIC can be restarted by controlling the power-on enable pin. Furthermore, when the on-chip system malfunctions, the on-chip system can be restarted by controlling the second power chip corresponding to the on-chip system.

[0054] Optionally, the second power chip is also used to send safety indication information to the target on-chip system or target microcontroller connected to the second power chip via a safety indication pin; the target on-chip system or target microcontroller is also used to control the second power chip to restart.

[0055] In one optional embodiment, when the MCU and SoC are working normally, they continuously output a high-level signal. When the program crashes or other error messages occur, the hard-wired watchdog pin can be pulled low. At this time, the PMIC receives the error indication signal and can trigger the interrupt signal INTB or directly pull the reset signal low, depending on the situation. After the hard-wired watchdog pin receives a high level, the interrupt signal and the reset signal are released. That is, the second power chip is restarted by controlling the target on-chip system or the target microcontroller.

[0056] Optionally, the domain controller may also include: multiple second OR gates, each corresponding to a multiple subsystem; the second OR gates are connected to the microcontrollers of the multiple subsystems; the outputs of the second OR gates are connected to a second power supply chip; the second power supply chip is used to continue operating when each second OR gate outputs a low level and to restart when each second OR gate outputs a high level.

[0057] In one optional embodiment, the two MCUs (MCU_1 and MCU_2) for the driving system and parking system are independent of each other, serving as the main control systems for the driving and parking systems respectively. Error signals from the SoCs of both systems ultimately converge to the MCU, which then disables communication. Simultaneously, the two MCUs communicate and monitor each other using SPI. When one MCU fails, the other MCU will take over the entire controller operation. Specifically, when MCU_1 detects that MCU_2 has failed and cannot perform the watchdog timer operation, it pulls its own input / output pin high (General Purpose). The Input / Output pin (GPIO_T) has two functions. First, it ensures that the PMIC will not fail to start due to the lack of an enable signal from MCU_2, which could lead to parking system failure and potential danger. This signal is connected to the enable signal of MCU_2 via an OR gate. As long as one MCU provides an enable signal, the parking SoC can operate normally. Second, it ensures that external communication will not be accidentally shut down due to the failure of MCU_2. This signal is connected to the AND of all communication shutdown signals via an OR gate, ensuring that communication can still be maintained even if MCU_2 pulls all communication shutdown signals low. If MCU_1 fails, MCU_2 will also take the same action, taking over the driving system to ensure the safety of the entire vehicle.

[0058] Example 2

[0059] According to an embodiment of the present invention, a control method for a domain controller is provided, applicable to any of the domain controllers described above. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0060] Figure 2 This is a flowchart of an optional domain controller control method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0061] Step S202: Detect whether multiple subsystems in the domain controller have malfunctioned.

[0062] Step S204: In the case of a failure in the target subsystem among multiple subsystems, determine the failure type of the target subsystem.

[0063] Step S206: Determine whether to shut down the external communication link of the target subsystem based on the fault type.

[0064] In one optional embodiment, multiple subsystems in the controller, namely the parking system and the vehicle parking system, can communicate via I2C or SPI. When the microcontroller of one subsystem fails, the microcontroller of another subsystem can directly take over the subsystem, thereby ensuring the normal operation of the driving system or the parking system and providing a good guarantee for the safety of the whole vehicle. Optionally, while controlling the power supply of the on-chip system, the microcontroller will also quickly shut down external communication, such as CAN, LIN and Ethernet, after recognizing the error signal of each on-chip system, thereby ensuring that the error signal generated by the system is not sent and ensuring the safety of the whole vehicle.

[0065] In this embodiment of the invention, a control method for a domain controller is provided, comprising: detecting whether multiple subsystems in the domain controller have malfunctioned; determining the fault type of the target subsystem when a target subsystem malfunctions among the multiple subsystems; and determining whether to shut down the external communication link of the target subsystem based on the fault type. It is readily apparent that by detecting whether multiple subsystems in the domain controller have malfunctioned, and by determining whether to shut down the external communication link of the target subsystem based on the fault type when a target subsystem malfunctions among the multiple subsystems, the driving process of the vehicle becomes safer and more reliable.

[0066] Example 3

[0067] According to an embodiment of the present invention, a control device for a domain controller is provided. Figure 3 This is a schematic diagram of a control device for an optional domain controller according to an embodiment of the present invention, such as... Figure 3 As shown, the device includes:

[0068] Detection module 302 is used to detect whether multiple subsystems in the domain controller are malfunctioning;

[0069] The first determining module 304 is used to determine the fault type of the target subsystem when a fault occurs in the target subsystem among multiple subsystems;

[0070] The second determining module 306 is used to determine whether to shut down the external communication link of the target subsystem based on the fault type.

[0071] Example 4

[0072] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the execution of the above-described domain controller control method in the processor of the device.

[0073] Example 5

[0074] According to another aspect of the present invention, an electronic device is also provided, comprising: a domain controller of any one of the above.

[0075] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0076] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0078] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0079] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0080] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0081] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A domain controller, characterized in that, include: Multiple subsystems, each performing a different function, are cascaded together. Multiple power systems, wherein each power system is connected to a corresponding subsystem; The plurality of subsystems are also configured to determine, based on the fault type, whether to shut down the external communication link of the target subsystem when a fault is detected in the target subsystem among the plurality of subsystems. The domain controller also includes: Multiple AND gates correspond one-to-one with the multiple subsystems. The AND gates are respectively connected to the error output pin and interrupt pin of the corresponding microcontroller, as well as the safety indicator pin of the corresponding first power chip. Multiple first OR gates correspond one-to-one with the multiple subsystems. Each first OR gate is connected to the output of the corresponding AND gate and the enable pin of the other microcontroller. The output of the first OR gate is connected to the external communication link of the corresponding subsystem. The external communication link of the corresponding subsystem is turned on when the corresponding first OR gate outputs a high level and turned off when the corresponding OR gate outputs a low level.

2. The domain controller according to claim 1, characterized in that, Each subsystem includes: Microcontrollers, wherein the microcontrollers of the different subsystems are interconnected; At least one on-chip system is used to perform the different functions; The microcontroller of the target subsystem is configured to shut down the external communication link of the target subsystem when a fault is detected in any one of the on-chip systems of the target subsystem; the microcontrollers of other subsystems in the plurality of subsystems are configured to control at least one on-chip system of the target subsystem and keep the external communication link of the target subsystem open when a fault is detected in the microcontroller of the target subsystem, and the other subsystems are used to represent the subsystems other than the target subsystem in the plurality of subsystems.

3. The domain controller according to claim 2, characterized in that, Each power system includes: The first power chip is connected to the microcontroller and is used to supply power to the microcontroller; At least one second power supply chip is connected to each of the at least one on-chip systems and is used to supply power to different on-chip systems.

4. The domain controller according to claim 3, characterized in that, The first power chip is further configured to control the microcontroller to restart or send an interrupt signal to the microcontroller in the event of a failure in the microcontroller; the second power chip is further configured to control the corresponding on-chip system to restart in the event of a failure in the corresponding on-chip system.

5. The domain controller according to claim 4, characterized in that, The second power chip is also used to send security indication information to the target on-chip system or target microcontroller connected to the second power chip via a security indication pin; the target on-chip system or the target microcontroller is also used to control the second power chip to restart.

6. The domain controller according to claim 5, characterized in that, The domain controller also includes: Multiple second OR gates correspond one-to-one with the multiple subsystems. The second OR gates are connected to the microcontrollers of the multiple subsystems. The output of the second OR gate is connected to the second power chip. The second power chip is used to continue working when each second OR gate outputs a low level and to restart when each second OR gate outputs a high level.

7. A control method for a domain controller, characterized in that, Applied to the domain controller according to any one of claims 1 to 6, the method comprises: Detect whether the multiple subsystems in the domain controller are malfunctioning; In the event that a target subsystem fails among the multiple subsystems, the fault type of the target subsystem is determined. Based on the fault type, determine whether to shut down the external communication link of the target subsystem.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the execution of the control method of the domain controller of claim 7 in the processor of the device.

9. An electronic device, characterized in that, include: The domain controller according to any one of claims 1 to 6.

Images