An external watchdog monitoring system for a domain controller

Abstract

The present invention provides an external watchdog monitoring system of a domain controller, which relates to the field of vehicle technology. The domain controller includes multiple chips, and the external watchdog monitoring system of the domain controller includes: each chip is correspondingly provided with at least one internal watchdog and at least one dog feeding module; multiple external watchdogs, each chip is correspondingly provided with an external watchdog, each external watchdog is used to monitor the program running state of the corresponding chip, when the program running state of the corresponding chip is abnormal, the external watchdog generates a reset instruction, and the reset instruction is used to control the corresponding chip to reset; the dog feeding module of each chip is used to perform a dog feeding operation on the external watchdog of the corresponding chip, and the dog feeding module of each chip is used to perform a dog feeding operation on the internal watchdog of the remaining chip, and the working state of the external watchdog corresponding to another chip is determined by the dog feeding state of the internal watchdog of one chip among the multiple chips, so as to realize a monitoring mechanism for the failure of the external watchdog.

Description

Technical Field

[0001] The present invention relates to the field of vehicle technology, and in particular to an external watchdog monitoring system of a domain controller. Background Art

[0002] As the automotive electronic architecture gradually develops from a distributed architecture to a domain-centralized architecture, domain controllers composed of multi-core heterogeneous SOC chips with stronger computing power and a variety of operating systems have emerged. Usually, several heterogeneous chips are deployed on the domain controller, and each chip is connected to a separate external hardware watchdog chip. When a program runs abnormally on a chip and the hardware watchdog connected to it does not receive the correct dog feeding signal, the hardware reset operation of the corresponding chip will be triggered to ensure the normal function of the system. However, in this scenario, if the hardware watchdog fails or the hardware watchdog reset circuit fails, when the chip program runs abnormally, the chip cannot be hard reset, and there is currently a lack of monitoring mechanism for hardware watchdog failure. Summary of the invention

[0003] The main purpose of the present invention is to provide an external watchdog monitoring system for a domain controller to solve the problem of lack of hardware watchdog failure monitoring in the prior art.

[0004] To achieve the above-mentioned purpose, according to one aspect of the present invention, there is provided an external watchdog monitoring system of a domain controller, the domain controller comprises a plurality of chips, and the external watchdog monitoring system of the domain controller comprises: each chip is provided with at least one internal watchdog and at least one dog feeding module; a plurality of external watchdogs, each chip is provided with an external watchdog, each external watchdog is used to monitor the program running state of the corresponding chip, when the program running state of the corresponding chip is abnormal, the external watchdog generates a reset instruction, and the reset instruction is used to control the corresponding chip to reset; the dog feeding module of each chip is used to feed the external watchdog of the corresponding chip, and the dog feeding module of each chip is used to feed the internal watchdog of the remaining chip, and the working state of the external watchdog corresponding to another chip is determined by the dog feeding state of the internal watchdog of one chip among the plurality of chips.

[0005] Furthermore, the external watchdog monitoring system of the domain controller includes: a judgment module, which is used to judge whether the internal watchdog of one chip among the multiple chips is fed correctly. When it is determined that one chip among the multiple chips is fed correctly, the working state of the external watchdog corresponding to another chip is normal; when it is determined that one chip among the multiple chips is not fed correctly, the working state of the external watchdog corresponding to another chip is abnormal.

[0006] Furthermore, when the communication between each chip and the external watchdog of the corresponding chip is abnormal, the corresponding external watchdog generates a reset instruction, and the reset instruction is used to control the corresponding chip to reset and control the entire system to reset.

[0007] Furthermore, when the program of each chip runs abnormally and the external watchdog corresponding to each chip is abnormal, the dog feeding module of each chip cannot correctly feed the internal watchdog of the remaining chip, and the external watchdog corresponding to each chip becomes invalid.

[0008] Furthermore, when the program of each chip runs abnormally and the hardware reset circuit is abnormal, the dog feeding module of each chip cannot correctly feed the internal watchdog of the remaining chip, and the external watchdog corresponding to each chip becomes invalid.

[0009] Furthermore, when the internal watchdog of one of the multiple chips is not properly fed for a period exceeding a preset value, the external watchdog of another chip becomes ineffective.

[0010] Furthermore, the external watchdog monitoring system of the domain controller also includes: a storage module. When the external watchdog corresponding to each chip fails, the remaining chip stores the failure information of the external watchdog corresponding to each chip in the storage module.

[0011] Furthermore, when it is determined that the external watchdog corresponding to each chip fails, the remaining chip generates a full reset instruction, and the full reset instruction is used to control the reset of all chips.

[0012] Furthermore, the external watchdog monitoring system of the domain controller further includes: a confirmation module, which is used to confirm whether the storage module stores the failure information; and a reporting module, which is used to report the failure information.

[0013] According to another aspect of the present invention, a vehicle is provided, comprising an external watchdog monitoring system of a domain controller, wherein the external watchdog monitoring system of the domain controller is the external watchdog monitoring system of the domain controller of the above embodiment.

[0014] By applying the technical solution of the present invention, the dog feeding modules of each chip are controlled to feed the external watchdog of the corresponding chip and the internal watchdog of the remaining chip at the same time, and the working state of the external watchdog corresponding to another chip is determined by the dog feeding state of the internal watchdog of one chip among the multiple chips, wherein, when the internal watchdog of one chip among the multiple chips can be correctly fed, the external watchdog corresponding to the other chip works normally, and when the internal watchdog of one chip among the multiple chips cannot be correctly fed, the external watchdog corresponding to the other chip fails, thus realizing a mechanism for monitoring the failure of the external watchdog and enhancing the reliability of the system. At the same time, the monitoring mechanism can cover the entire process of the chip program running, with a wide coverage range, thereby increasing the robustness of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0016] Figure 1 A schematic diagram of the logical structure of an external watchdog monitoring system of a domain controller according to the present invention is shown.

[0017] The above drawings include the following reference numerals:

[0018] 10. External watchdog;

[0019] 11. Internal watchdog;

[0020] 12. Dog feeding module. DETAILED DESCRIPTION

[0021] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] Now, exemplary embodiments according to the present application will be described in more detail with reference to the accompanying drawings. However, these exemplary embodiments may be implemented in a variety of different forms and should not be construed as being limited to the embodiments described herein. It should be understood that these embodiments are provided to make the disclosure of the present application thorough and complete, and to fully convey the concepts of these exemplary embodiments to those of ordinary skill in the art. In the accompanying drawings, for the sake of clarity, the thickness of the layers and regions may be enlarged, and the same reference numerals are used to represent the same devices, and thus their descriptions will be omitted.

[0025] It should be noted that a watchdog is a safety mechanism that is commonly used in electronic devices and computer systems to detect and respond to system anomalies or program failures. In microcontroller (MCU) or other microcontroller systems, a watchdog timer is a commonly used watchdog implementation.

[0026] The main functions of the watchdog include:

[0027] 1. System monitoring: The watchdog timer can monitor the operating status of the system to ensure that the program will not fall into errors or dead loops for a long time.

[0028] 2. Fault recovery: When the system fails or the program falls into an infinite loop, the watchdog can trigger a hardware reset (usually an NMI, non-mask interrupt) to try to restore normal operation of the system.

[0029] 3. Improved stability: By resetting the system periodically, the watchdog can maintain the stability of the system and prevent accumulated errors caused by long-term operation.

[0030] 4. Safety assurance: In some critical applications, such as medical equipment or automotive electronic systems, watchdogs can be used as a safety mechanism to ensure that the system can respond promptly when an abnormality occurs.

[0031] 5. Debugging assistance: During the development and debugging process, the watchdog can help developers locate and solve problems. By setting the watchdog timeout, the performance of the system in certain situations can be simulated.

[0032] The watchdog timer usually has a preset time value, and the program needs to reset it before the timer overflows to prevent triggering a reset. If the timer is not reset in time due to a program error or system abnormality, the watchdog will trigger a hardware reset to try to restore normal operation of the system.

[0033] Watchdog and Kick the Dog are technologies used in computers and embedded systems to prevent programs from getting stuck (also called "freezing" or "hanging") for a long time. The watchdog timer is usually initialized and starts counting down when the system starts. If the system does not kick the watchdog within the predetermined time, the watchdog timer will time out, triggering a system reset. Kick the Dog means resetting the timer through software instructions before the watchdog timer times out, so that it starts counting down again.

[0034] During system operation, the watchdog timer needs to be fed periodically to keep the watchdog timer reset. If the feeding operation fails (perhaps due to a software error or the system is busy with other tasks), the watchdog timer may time out, causing the system to reset.

[0035] The watchdog and feeding mechanism can improve the security and stability of the system. If the system has a serious error or deadlock, resulting in failure to work properly, the watchdog mechanism can force the system to reset to avoid long-term system stagnation.

[0036] Example 1

[0037] Combination Figure 1 As shown, according to a specific embodiment of the present invention, an external watchdog monitoring system for a domain controller is provided.

[0038] Specifically, Figure 1As shown, the external watchdog monitoring system of the domain controller, the domain controller includes multiple chips, and the external watchdog monitoring system of the domain controller includes: each chip is correspondingly provided with at least one internal watchdog 11 and at least one dog feeding module 12; multiple external watchdogs 10, each chip is correspondingly provided with an external watchdog 10, each external watchdog 10 is used to monitor the program running state of the corresponding chip, when the program running state of the corresponding chip is abnormal, the external watchdog 10 generates a reset instruction, and the reset instruction is used to control the corresponding chip to reset; the dog feeding module 12 of each chip is used to feed the external watchdog 10 of the corresponding chip, and the dog feeding module 12 of each chip is used to feed the internal watchdog 11 of the remaining chip, and the working state of the external watchdog 10 corresponding to another chip is determined by the dog feeding state of the internal watchdog 11 of one chip among the multiple chips.

[0039] In this embodiment, the dog feeding module 12 of each chip is controlled to feed the external watchdog 10 of the corresponding chip and the internal watchdog 11 of the remaining chip at the same time, and the working state of the external watchdog corresponding to another chip is determined by the feeding state of the internal watchdog 11 of one chip among the multiple chips. When the internal watchdog 11 of one chip among the multiple chips can be correctly fed, the external watchdog 10 corresponding to the other chip works normally. When the internal watchdog 11 of one chip among the multiple chips cannot be correctly fed, the external watchdog 10 corresponding to the other chip fails. In this way, a mechanism for monitoring the failure of the external watchdog is implemented to enhance the reliability of the system. At the same time, the monitoring mechanism can cover the entire process of the chip program running, with a wide coverage range, thereby increasing the robustness of the system.

[0040] Furthermore, the external watchdog monitoring system of the domain controller includes: a judgment module, which is used to judge whether the internal watchdog 11 of one of the multiple chips is correctly fed. When it is determined that one of the multiple chips is correctly fed, the working state of the external watchdog 10 corresponding to the other chip is normal. When it is determined that one of the multiple chips is not correctly fed, the working state of the external watchdog 10 corresponding to the other chip is abnormal. This setting realizes a mechanism for monitoring the failure of the external watchdog through the internal watchdog. The external watchdog monitoring system can ensure that multiple chips in the system can work normally. When a chip is found to be abnormal, it can be processed in time to maintain the stability of the system. The external watchdog monitoring system can promptly detect the abnormal situation of the internal watchdog of the chip, so as to take timely measures to avoid system crash or data loss caused by internal watchdog failure.

[0041] Furthermore, when the communication between each chip and the external watchdog 10 of the corresponding chip is abnormal, the corresponding external watchdog 10 generates a reset instruction, and the reset instruction is used to control the corresponding chip to reset, and the entire system is reset, which can ensure system safety. When the chip communicates abnormally with the external watchdog, the dog feeding information cannot be correctly transmitted to the external watchdog. At this time, the external watchdog will reset, and no special processing is required.

[0042] Furthermore, when the program of each chip runs abnormally, and the external watchdog 10 corresponding to each chip is abnormal, the dog feeding module 12 of each chip cannot correctly feed the internal watchdog 11 of the remaining chip, and the external watchdog 10 corresponding to each chip fails. The external watchdog itself is abnormal and cannot trigger the reset of the main chip. In this case, a special method is required to monitor and process the failure of the watchdog.

[0043] Furthermore, when the program of each chip runs abnormally and the hardware reset circuit is abnormal, the dog feeding module 12 of each chip cannot correctly feed the internal watchdog 11 of the remaining chip, and the external watchdog 10 corresponding to each chip fails. There is no problem with the external watchdog, but the hardware reset circuit is abnormal and cannot trigger the hardware reset. In this case, a special method is required to monitor and process the watchdog failure.

[0044] Furthermore, when the internal watchdog 11 of one of the multiple chips is not correctly fed for a period exceeding a preset value, the external watchdog 10 of another chip becomes ineffective.

[0045] Furthermore, the external watchdog monitoring system of the domain controller also includes: a storage module. When the external watchdog 10 corresponding to each chip fails, one of the remaining chips stores the failure information of the external watchdog 10 corresponding to each chip in the storage module. This external watchdog monitoring system can improve the reliability and stability of the domain controller. When the external watchdog corresponding to a certain chip fails, the system can store the failure information in time for subsequent fault diagnosis and repair. This can reduce system failures caused by external watchdog failures and improve the reliability and stability of the system.

[0046] Furthermore, when it is determined that the external watchdog 10 corresponding to each chip fails, the remaining chip generates a full reset instruction, and the full reset instruction is used to control the reset of all chips. This technical effect is that when a system failure occurs, all chips can be quickly and effectively reset to restore the normal operation of the system. This can improve the stability and reliability of the system, reduce the impact of the failure on the system, and shorten the time it takes for the system to resume normal operation.

[0047] Furthermore, the external watchdog monitoring system of the domain controller also includes: a confirmation module, which is used to confirm whether the storage module stores failure information; and a reporting module, which is used to report failure information. This setting can monitor and confirm the failure information of the storage module in a timely manner, so as to report it to relevant personnel for processing in a timely manner, thereby improving the stability and reliability of the system.

[0048] Example 2

[0049] According to another aspect of the present invention, a vehicle is provided, including an external watchdog monitoring system of a domain controller, and the external watchdog monitoring system of the domain controller is the external watchdog monitoring system of the domain controller of the above embodiment. The external watchdog monitoring system of the domain controller, the domain controller includes multiple chips, and the external watchdog monitoring system of the domain controller includes: each chip is correspondingly provided with at least one internal watchdog 11 and at least one dog feeding module 12; multiple external watchdogs 10, each chip is correspondingly provided with an external watchdog 10, each external watchdog 10 is used to monitor the program running state of the corresponding chip, when the program running state of the corresponding chip is abnormal, the external watchdog 10 generates a reset instruction, and the reset instruction is used to control the corresponding chip to reset; the dog feeding module 12 of each chip is used to feed the external watchdog 10 of the corresponding chip, and the dog feeding module 12 of each chip is used to feed the internal watchdog 11 of the remaining chip, and the working state of the external watchdog 10 corresponding to another chip is determined by the dog feeding state of the internal watchdog 11 of one chip among the multiple chips.

[0050] By controlling the dog feeding module 12 of each chip, the external watchdog 10 of the corresponding chip and the internal watchdog 11 of the remaining chip are fed at the same time, and the working state of the external watchdog corresponding to another chip is determined by the dog feeding state of the internal watchdog 11 of one chip among the multiple chips. When the internal watchdog 11 of one chip among the multiple chips can be fed correctly, the external watchdog 10 corresponding to the other chip works normally. When the internal watchdog 11 of one chip among the multiple chips cannot be fed correctly, the external watchdog 10 corresponding to the other chip fails. In this way, a mechanism for monitoring the failure of the external watchdog is implemented, thereby enhancing the reliability of the system. At the same time, the monitoring mechanism can cover the entire process of the chip program running, with a wide coverage range, thereby increasing the robustness of the system.

[0051] Current automotive domain controllers usually include multiple heterogeneous chips, each of which is connected to an independent external watchdog chip. Each chip feeds the external watchdog connected to it separately. When the external watchdog detects that the program of the chip connected to it is running abnormally, it generates a reset signal to reset the chip connected to it.

[0052] Each chip contains an internal watchdog. When the internal watchdog is started, if it is not fed according to the settings, the internal watchdog can also reset the chip.

[0053] When any chip in the system generates an internal or external watchdog reset, it will notify other chips. After other chips receive the internal or external watchdog reset information of a certain chip, they will perform a reset operation, and all chips in the entire system will be reset.

[0054] The method provided by the present invention monitors whether an external watchdog of an automobile domain controller including multiple chips fails.

[0055] The watchdog feeding data flow and hardware circuit are abnormal. There are three main situations that lead to external watchdog feeding abnormality:

[0056] 1) The communication between the chip and the external watchdog is abnormal, and the dog feeding information cannot be correctly transmitted to the watchdog chip. At this time, the external watchdog will be reset and no special processing is required.

[0057] 2) The external watchdog itself is abnormal and cannot trigger the main chip reset. In this case, a special method is required to monitor and handle the watchdog failure.

[0058] 3) There is no problem with the external watchdog, but the hardware reset circuit is abnormal and cannot trigger the hardware reset. In this case, a special method is required to monitor and handle the watchdog failure.

[0059] When the chip program runs abnormally and cannot feed the watchdog correctly, and the external watchdog fails, the system needs to be able to detect the failure of the external watchdog and handle it.

[0060] For the situations in points 2 and 3 mentioned above, if the domain controller includes n chips, the internal watchdog of each chip is started.

[0061] The first chip (the monitored chip) provides a dog feeding operation for the internal watchdog of the second chip (the monitoring chip), and the dog feeding trigger time is consistent with the chip's external watchdog feeding trigger. The second chip (the monitored chip) provides a dog feeding operation for the internal watchdog of the third chip (the monitoring chip), and the dog feeding trigger time is consistent with the chip's external watchdog feeding trigger. And so on, the nth chip (the monitored chip) provides a dog feeding operation for the internal watchdog of the first chip (the monitoring chip).

[0062] The internal watchdog of the monitoring chip is used to monitor the effectiveness of the external watchdog of the monitored chip, and the internal and external watchdogs use the same dog feeding strategy.

[0063] In this way, when the program of the first chip runs abnormally and the external watchdog cannot trigger the chip hardware reset due to its own abnormality or the abnormality of the hardware reset circuit, the first chip cannot correctly feed the internal watchdog of the second chip.

[0064] If the internal watchdog of the second chip is not fed correctly within the specified period, and no system reset notification is received from chip 1, the external watchdog of chip 1 is considered to be failed. At this time, chip 2 stores the failure of the external watchdog of chip 1 in the non-volatile storage unit, and notifies other chips that a system reset is required, triggering the reset of this chip. After receiving the reset information, other chips trigger reset respectively, and the entire system is reset.

[0065] It should be noted that the reliability of the internal watchdog feeding communication between chip 1 and chip 2 is ensured by other functional safety mechanisms and is beyond the scope of the present invention. This method assumes that the communication is reliable.

[0066] The external watchdog failure detection and processing methods of each chip are consistent with the descriptions in points 2 and 3 above.

[0067] After the system is reset and restarted, each chip first reads the data in the corresponding non-volatile storage unit to confirm whether there is any external watchdog failure information of the monitored chip. If there is external watchdog failure information, the problem is reported for upper-level application processing.

[0068] The current automotive electronic architecture has developed from a distributed architecture to a centralized architecture. For a centralized architecture, multiple applications are usually integrated into a domain controller. A domain controller includes multiple heterogeneous chips. Each chip is connected to an external hardware watchdog to monitor the program running status of the chip. If the hardware watchdog function fails, it will be impossible to monitor program anomalies, which may cause harm to the driver and the vehicle, and does not meet the functional safety requirements. The present invention utilizes the physical architecture of the domain controller's multiple chips and proposes a method for monitoring the failure of an external watchdog. It can promptly detect whether the external watchdog has failed when the program runs abnormally, and quickly handle the program running abnormality when the external watchdog fails, thereby ensuring the safety and reliability of the system.

[0069] like Figure 1 As shown in FIG. 1 , each chip has a dog feeding module inside, which performs the same dog feeding operation on both the external watchdog and the internal watchdog. The dog feeding strategies used by the external watchdog and the internal watchdog are also the same.

[0070] In the figure, relative to chip 2, chip 1 is the monitored chip, and chip 2 is the monitoring chip. Every time the watchdog feeding module of chip 1 triggers the feeding operation, it will feed the external watchdog 10 connected to chip 1 and the internal watchdog of chip 2. If the program of chip 1 runs normally, neither the external watchdog 10 nor the internal watchdog of chip 2 will report an error.

[0071] When there is a problem with the external watchdog feeding communication of chip 1, the external watchdog of chip 1 will reset and notify other chips that they need to be reset. The entire system is reset, which can ensure system safety without special processing.

[0072] When the external watchdog 10 itself has a problem and cannot trigger a reset, or the reset signal hardware circuit of the external watchdog 10 has a problem, and the program of chip 1 runs abnormally, the external watchdog 10 cannot reset chip 1. The internal watchdog of chip 2 cannot be fed correctly, and it does not receive the reset notification sent by chip 1, so it is considered that the external watchdog of chip 1 is invalid. At this time, chip 2 stores the failure information of the external watchdog 10 of chip 1 in the non-volatile storage unit, and sends a reset notification to all other chips. All chips in the system perform a reset operation, and the entire system is reset.

[0073] After the system is reset and restarted, each chip first reads the data in its own non-volatile storage unit to confirm whether there is an external watchdog failure of the monitored chip. If not, each chip in the system starts and runs normally. If one or several monitored chips have an external watchdog failure, the failure is reported to the system and handled by the upper-level application.

[0074] Each chip in the system is monitored in turn, chip 2 monitors chip 1, chip 3 monitors chip 2, and so on, chip n monitors chip 1, ensuring that all external watchdog failures in the system can be identified.

[0075] When the program of the monitored chip runs abnormally before the internal watchdog of the monitoring chip is initialized, and the external watchdog connected to it fails, this method can still identify the problem after the internal watchdog of the monitoring chip is initialized.

[0076] For ease of description, spatially relative terms such as "above", "above", "on the upper surface of", "above", etc. may be used here to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" can include both "above" and "below". The device can also be positioned in other different ways (rotated 90 degrees or in other orientations), and the spatially relative descriptions used here are interpreted accordingly.

[0077] In addition to the above, it should be noted that "one embodiment", "another embodiment", "embodiment", etc. mentioned in this specification refer to the specific features, structures or characteristics described in conjunction with the embodiment included in at least one embodiment generally described in this application. The same expression appearing in multiple places in the specification does not necessarily refer to the same embodiment. Further, when describing a specific feature, structure or characteristic in conjunction with any embodiment, it is claimed that the realization of such feature, structure or characteristic in conjunction with other embodiments also falls within the scope of the present invention.

[0078] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0079] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An external watchdog monitoring system for a domain controller, the domain controller comprising a plurality of chips, characterized in that: include: Each of the chips is correspondingly provided with at least one internal watchdog (11) and at least one dog feeding module (12); A plurality of external watchdogs (10), each chip being provided with one external watchdog (10); Each of the external watchdogs (10) is used to monitor the program running state of the corresponding chip. When the program running state of the corresponding chip is abnormal, the external watchdog (10) generates a reset instruction, and the reset instruction is used to control the corresponding chip to reset; The dog feeding module (12) of each chip is used to perform a dog feeding operation on the external watchdog (10) corresponding to the chip, and the dog feeding module (12) of each chip is used to perform a dog feeding operation on the internal watchdog (11) of the remaining chip, and the working state of the external watchdog (10) corresponding to another chip is determined by the dog feeding state of the internal watchdog (11) of one of the multiple chips; A judgment module, the judgment module is used to judge whether the internal watchdog (11) of one of the multiple chips is correctly fed, when it is determined that one of the multiple chips is correctly fed, the working state of the external watchdog (10) corresponding to another chip is normal, when it is determined that one of the multiple chips is not correctly fed, the working state of the external watchdog (10) corresponding to another chip is abnormal.

2. The external watchdog monitoring system of a domain controller according to claim 1, characterized in that: When the communication between each chip and the external watchdog (10) corresponding to the chip is abnormal, the corresponding external watchdog (10) generates the reset instruction, and the reset instruction is used to control the corresponding chip to reset and control the entire system to reset.

3. The external watchdog monitoring system of a domain controller according to claim 1, characterized in that: When the program of each chip runs abnormally and the external watchdog (10) corresponding to each chip is abnormal, the dog feeding module (12) of each chip cannot correctly feed the internal watchdog (11) of the remaining chip, and the external watchdog (10) corresponding to each chip becomes invalid.

4. The external watchdog monitoring system of a domain controller according to claim 1, characterized in that: When the program of each chip runs abnormally and the hardware reset circuit is abnormal, the dog feeding module (12) of each chip cannot correctly feed the internal watchdog (11) of the remaining chip, and the external watchdog (10) corresponding to each chip becomes invalid.

5. The external watchdog monitoring system of a domain controller according to claim 1, characterized in that: When the internal watchdog (11) of one of the plurality of chips is not properly fed for a period exceeding a preset value, the external watchdog (10) of another chip becomes ineffective.

6. The external watchdog monitoring system of a domain controller according to any one of claims 3 to 5, characterized in that: The external watchdog monitoring system of the domain controller also includes: A storage module, when the external watchdog (10) corresponding to each chip fails, one of the remaining chips stores the failure information of the external watchdog (10) corresponding to each chip in the storage module.

7. The external watchdog monitoring system of a domain controller according to claim 6, characterized in that: When it is determined that the external watchdog (10) corresponding to each chip fails, one of the remaining chips generates a full reset instruction, and the full reset instruction is used to control the reset of all the chips.

8. The external watchdog monitoring system of a domain controller according to claim 6, characterized in that: The external watchdog monitoring system of the domain controller also includes: A confirmation module, the confirmation module is used to confirm whether the storage module stores the failure information; A reporting module, wherein the reporting module is used to report the failure information.

9. A vehicle, characterized in that: The invention comprises an external watchdog monitoring system of a domain controller, wherein the external watchdog monitoring system of the domain controller is the external watchdog monitoring system of the domain controller according to any one of claims 1 to 8.

Images