A control method, device, chip and computer program product

Abstract

The present application discloses a control method, device, chip and computer program product, the control method is applied to a multi-core heterogeneous system chip, the system chip includes multiple hardware domains and CAN interfaces, the hardware domains are respectively provided with communication interfaces for inter-core communication with other hardware domains, the same or different operating systems and CAN controllers are respectively installed in the hardware domains, the hardware domains communicate with external CAN devices through the CAN interface, the method includes: monitoring a first node of a first hardware domain, wherein the first hardware domain is any one of the multiple hardware domains; when determining that the first node is abnormal, opening a second node of the first hardware domain. The present application combines Socket CAN and Socket-based VirCAN technology, utilizes the CAN resources of the SOC under multi-core heterogeneity and external CAN devices to form a CAN communication network, interacts between different domains and detects the security and reliability of communication, thereby improving the reliability of communication.

Description

Technical Field

[0001] The present application relates to the field of communication control technology, and in particular to a control method, device, chip and computer program product. Background Art

[0002] With the rapid development of automotive electronic technology, controller area network (CAN) has become a widely used communication protocol in automobiles and other industrial control systems.

[0003] Conventional CAN controllers communicate with external CAN devices based on a single domain or a single system. The security and reliability of CAN communication can only be guaranteed by the stability of the single domain system and the stability of the CAN controller's own functions and security.

[0004] Once a single system is unstable or a problem occurs with the CAN controller resources in the single system, the communication between the CAN controller and the external CAN device will be interrupted, resulting in loss of business functions. Summary of the invention

[0005] The purpose of the embodiment of the present application is to provide a control method, which is applied to a multi-core heterogeneous system chip, wherein the system chip includes multiple hardware domains and CAN interfaces, wherein each of the hardware domains is provided with a communication interface for inter-core communication with other hardware domains, wherein the same or different operating systems and CAN controllers are installed in each of the hardware domains, and the hardware domain communicates with an external CAN device through the CAN interface, wherein the method includes:

[0006] Monitoring a first node of a first hardware domain, wherein the first hardware domain is any one of the multiple hardware domains;

[0007] When determining that the first node is abnormal, starting the second node of the first hardware domain;

[0008] Determine, based on the second node, a running state of a first operating system of the first hardware domain, wherein the first hardware domain is configured with the first operating system;

[0009] When it is determined that the first operating system is abnormal, the control right of the CAN controller of the first hardware domain is switched to the second hardware domain;

[0010] The first hardware domain communicates with the CAN interface through a third node of the second hardware domain.

[0011] As an optional embodiment, the method further includes:

[0012] When determining that the first node is normal, enabling the communication interface of the first hardware domain;

[0013] monitoring the communication interface;

[0014] When it is determined that the first hardware domain communicates normally with the second hardware domain through the communication interface, the first hardware domain communicates with the CAN interface through the third node of the second hardware domain.

[0015] As an optional embodiment, the method further includes:

[0016] When it is determined that the first operating system of the first hardware domain is normal, the first hardware domain communicates with the CAN interface through the second node.

[0017] As an optional embodiment, the method further includes:

[0018] monitoring a first operating system of the first hardware domain;

[0019] The second hardware domain obtains a first signal, wherein the first signal is used to indicate that the first operating system of the first hardware domain is abnormal, and the first signal is sent by the first hardware domain;

[0020] When it is determined that the second hardware domain obtains the first signal, the control right of the CAN controller of the first hardware domain is switched to the second hardware domain;

[0021] The first hardware domain communicates with the CAN interface through a third node of the second hardware domain.

[0022] As an optional embodiment, the method further includes:

[0023] When it is determined that the second hardware domain has not acquired the first signal, the first hardware domain communicates with the CAN interface through the second node.

[0024] As an optional embodiment, the method further includes:

[0025] Obtaining a list of interfaces of the first hardware domain;

[0026] Based on the interface list, determining an enable state of the first node;

[0027] Based on data interaction between the first hardware domain and the second hardware domain, a communication state of the first node is determined.

[0028] As an optional embodiment, the method further includes:

[0029] When the control right of the CAN controller of the hardware domain is switched, the second node of the first hardware domain and the third node of the second hardware domain are both in an open state.

[0030] The purpose of the embodiment of the present application is to provide a control device, which is applied to a multi-core heterogeneous system chip, wherein the system chip includes multiple hardware domains and CAN interfaces, wherein each of the hardware domains is provided with a communication interface for inter-core communication with other hardware domains, wherein the same or different operating systems and CAN controllers are installed in each of the hardware domains, and the hardware domain communicates with an external CAN device through the CAN interface, wherein the device includes:

[0031] A monitoring module configured to monitor a first node of a first hardware domain, wherein the first hardware domain is any one of the multiple hardware domains;

[0032] an enabling module, configured to enable a second node in the first hardware domain when determining that the first node is abnormal;

[0033] a determination module configured to determine, based on the second node, a running state of a first operating system of the first hardware domain, wherein the first hardware domain is configured with the first operating system;

[0034] a switching module configured to switch the control right of the CAN controller of the first hardware domain to the second hardware domain when it is determined that the first operating system of the first hardware domain is abnormal;

[0035] A communication module is configured so that the first hardware domain communicates with the CAN interface through a third node of the second hardware domain.

[0036] The purpose of the embodiment of the present application is to provide a chip, the chip comprising multiple hardware domains and a CAN interface, the hardware domain comprising at least:

[0037] An application domain, configured with a first operating system, wherein a first hardware resource manager and a first CAN controller are provided in the application domain, and the first hardware resource manager is used to switch control rights of the first CAN controller;

[0038] A security domain is configured with a second operating system, a second hardware resource manager and a second CAN controller are arranged in the security domain, the first operating system is different from the second operating system, and the second hardware resource manager is used to switch control of the second CAN controller;

[0039] The application domain and the security domain perform inter-core communication via a communication interface, and both the application domain and the security domain communicate with an external CAN device via the CAN interface.

[0040] The purpose of the embodiments of the present application is to provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the control method as described in any of the above items.

[0041] The beneficial effects of the embodiments of the present application are:

[0042] This application combines Socket CAN and Socket-based VirCAN technology, and uses the CAN resources of the SOC under multi-core heterogeneity and external CAN devices to form a CAN communication network, interacting between different domains and detecting the security and reliability of each other's communication, thereby improving the reliability of communication.

[0043] In the event of a communication failure between the CAN controller and an external CAN device in a certain domain system, the communication of the established CAN network will not be affected and will be immediately detected by other domains so that other domains can quickly take over and continue to establish secure and reliable communication with external CAN devices, achieving rapid response and connection, thereby ensuring normal business functions, reducing the risk of loss of business functions due to communication interruption, and improving safety of use. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 The process of the control method of the embodiment of the present application is Figure 1 ;

[0045] Figure 2 A flow chart of a control method according to another embodiment of the present application;

[0046] Figure 3 This is a flow chart of a control method according to another embodiment of the present application;

[0047] Figure 4 This is a flow chart of a control method according to another embodiment of the present application;

[0048] Figure 5 is a structural block diagram of a control device according to an embodiment of the present application;

[0049] Figure 6 A structural block diagram of a chip according to an embodiment of the present application;

[0050] Figure 7 The process of the control method of the embodiment of the present application is Figure 2 . DETAILED DESCRIPTION

[0051] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0052] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0053] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0054] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0055] It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to readily implement many other equivalent forms of the present application.

[0056] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0057] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0058] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0059] The communication between existing CAN controllers and external CAN devices is usually limited to a single domain or a single system, and there is no cross-domain interaction to jointly ensure the security and reliability of CAN communication, which means that the reliability and security of communication depends on the stability of the single domain system.

[0060] Existing CAN communication technology methods are often based on only one CAN communication method, such as a common CAN communication method under a real-time operating system (RTOS) or a Socket CAN communication method under a general operating system (Linux).

[0061] In a single domain system, the stability and security of CAN communication is highly dependent on the stability of the system itself. If the system is unstable, such as software failure, hardware failure or power supply problem, the entire CAN communication link may be affected.

[0062] The resources of the CAN controller include processing power, memory and communication bandwidth, which also have a direct impact on the stability and security of communication. If the CAN controller has insufficient resources or fails, it will also cause communication interruption.

[0063] Once the communication between the CAN controller and the external CAN device is interrupted, it may lead to the loss of key business functions, such as vehicle control, safety systems, infotainment systems, etc. in the automotive field, which not only affects the user experience but also may endanger safety.

[0064] However, existing system-on-chip (SOC) often integrates multiple CAN controller resources, and the existing technology does not fully utilize these resources to establish a network with external CAN devices.

[0065] In view of the above content, the embodiment of the present application provides a control method, which is applied to a multi-core heterogeneous system chip, such as Figure 1 , Figure 6 and Figure 7 As shown, the system chip includes multiple hardware domains and CAN interfaces. The hardware domains are respectively provided with communication interfaces for inter-core communication with other hardware domains. The same or different operating systems and CAN controllers are respectively installed in the hardware domains. The hardware domains communicate with external CAN devices through the CAN interfaces.

[0066] Among them, multi-core heterogeneity refers to a chip architecture design in which multiple processing cores (cores) are integrated and at least two of these cores are different in structure, function or performance.

[0067] The hardware domain refers to a collection of processor cores with independent functions and their related hardware resources. Each hardware domain can run different operating systems and communicate with external CAN devices through the CAN interface.

[0068] The hardware domains exchange data and work together through the inter-processor communication (IPC) mechanism. The hardware domains include but are not limited to application domains and security domains.

[0069] An application domain is one or more hardware domains, which means that the hardware domain has strong computing performance and can support applications with high computing performance requirements. A security domain is one or more hardware domains, including at least one of the following features: having a high functional safety architecture, running an operating system that meets high functional safety requirements, and processing tasks with high functional safety requirements.

[0070] The operating system includes but is not limited to a general operating system (Linux Operating System) and a real-time operating system (RTOS). The real-time operating system is an operating system specially designed to process real-time tasks.

[0071] like Figure 1 As shown, the control method includes:

[0072] S11. Monitor a first node of a first hardware domain, wherein the first hardware domain is any one of the multiple hardware domains.

[0073] In this embodiment, the first hardware domain may be an application domain (such as AP1, AP2), and the first node may be a virtual CAN (VirCAN) node responsible for monitoring and preliminarily processing CAN communications.

[0074] S12: When it is determined that the first node is abnormal, start the second node of the first hardware domain.

[0075] In this embodiment, if the first node is abnormal, the second node of the same hardware domain will be enabled. In the case where the first hardware domain is an application domain, the second node can be a Socket CAN node, in which case the SocketCAN node is bound to the physical CAN for further processing of CAN communications.

[0076] The abnormality of the first node includes that the node cannot normally perform its expected function, resulting in failure to open normally or failure to perform effective CAN communication with other nodes. These abnormalities may be caused by a variety of reasons, including but not limited to hardware failure, software error, etc.

[0077] S13. Determine, based on the second node, a running state of a first operating system of the first hardware domain, wherein the first hardware domain is configured with the first operating system;

[0078] In this embodiment, the first operating system may be a general operating system (Linux Operating System). If an abnormality occurs in the first operating system, such as a problem occurs during the startup phase or after the startup is completed, the next step will be executed.

[0079] The first operating system abnormality generally refers to an unexpected situation encountered by the system during operation, which causes the system to be unable to work normally.

[0080] S14: When it is determined that the first operating system is abnormal, the control right of the CAN controller of the first hardware domain is switched to the second hardware domain.

[0081] In this embodiment, when it is determined that the first operating system is abnormal, the control right of the CAN controller of the first hardware domain is switched to the second hardware domain. This means that if a problem occurs in the first hardware domain (such as the application domain), it will no longer directly control the CAN communication, but will hand over the control right to the second hardware domain (such as the security domain).

[0082] S15. The first hardware domain communicates with the CAN interface through the third node of the second hardware domain.

[0083] In this embodiment, the first hardware domain communicates with the CAN interface through the third node of the second hardware domain. The third node can be a common CAN (CAN based on Rtos) node under a real-time operating system (Rtos), responsible for actual physical CAN communication.

[0084] Therefore, the control process of the control method is specifically as follows:

[0085] Monitor the running status of each hardware domain, including the status of the operating system and the CAN controller, wherein the physical CAN is usually set on the second hardware domain (the security domain) by default. When an abnormality is detected in the first node of the first hardware domain, open the second node of the first hardware domain.

[0086] The state of the first operating system is determined according to the second node. When the first operating system is abnormal, the control right of the CAN controller of the first hardware domain is switched to the second hardware domain. At this time, the physical CAN is on the second hardware domain. During use, the physical CAN can only be set on one hardware domain.

[0087] The first hardware domain performs CAN communication through the third node of the second hardware domain to ensure that the communication between the first hardware domain and the external CAN device is not interrupted.

[0088] When the control right is switched, it is ensured that the second node of the first hardware domain and the third node of the second hardware domain are both in the on state to maintain the continuity of communication.

[0089] For example, an electronic control unit (ECU) of a car contains multiple hardware domains, where the application domain is responsible for high-level processing tasks, and the safety domain is responsible for safety-critical tasks. The application domain has a VirCAN node for monitoring CAN communication, and the application domain has a Socket CAN node, and the safety domain has an Rtos-based CAN node. The application domain is configured with a general operating system, and the safety domain is configured with a real-time operating system.

[0090] If the VirCAN node of the application domain is abnormal (cannot be opened normally or cannot communicate normally), an attempt will be made to solve the problem through its Socket CAN node, that is, to open the Socket CAN node and set the physical CAN on the application domain. The first hardware domain can perform CAN communication through the Socket CAN node.

[0091] However, when the general operating system is determined to be abnormal according to the Socket CAN node, the application domain will hand over the control of the CAN controller to the security domain. Then, the physical CAN is on the security domain, and the application domain will communicate with external CAN devices through the Rtos-based CAN node of the security domain to ensure the continuity and reliability of communication.

[0092] This application combines the technologies of socket CAN and socket-based VirCAN, uses the multi-channel CAN controller resources inside the SOC to establish a network with external CAN devices, and ensures the uninterrupted CAN communication through redundancy mechanisms and fault recovery strategies, thereby ensuring the continuity of business functions and the security of the system. Interaction between different domains and mutual detection of communication are safe and reliable. Once the CAN communication under a domain system fails, other domains can immediately detect and quickly take over the communication between the CAN of the failed domain and the external CAN device.

[0093] In one embodiment, if Figure 2 As shown, the method also includes:

[0094] S21. When it is determined that the first node is normal, enable the communication interface of the first hardware domain.

[0095] In this embodiment, the control method is further refined, and a processing flow for the first node when it works normally is added, as well as a step of how to communicate with the second hardware domain through the inter-core communication interface.

[0096] Specifically, when it is determined that the first node (VirCAN node) of the first hardware domain is normal, the communication interface of the first hardware domain is enabled. Based on the communication interface, the inter-core communication state between the first hardware domain and other hardware domains (such as the second hardware domain) can be determined.

[0097] S22: Monitor the communication interface.

[0098] In this embodiment, after the communication interface is enabled, it is necessary to monitor the communication interface to ensure timely knowing whether the communication between the first hardware domain and the second hardware domain is normal.

[0099] S23: When it is determined that the first hardware domain communicates normally with the second hardware domain through the communication interface, the first hardware domain communicates with the CAN interface through a third node of the second hardware domain.

[0100] In this embodiment, when it is determined that the first hardware domain communicates normally with the second hardware domain through the communication interface, that is, there is data interaction between the first hardware domain and the second hardware domain.

[0101] The first hardware domain will communicate with the CAN interface through the third node (Rtos-based CAN node) of the second hardware domain. This means that even if the operating system and CAN controller of the first hardware domain are working properly, it will communicate with external CAN devices through the CAN controller of the second hardware domain to achieve a higher level of redundancy and reliability. At this time, the physical CAN is set on the second hardware domain.

[0102] For example, in an automobile ECU, the VirCAN node of the application domain works normally, and the communication interface of the application domain is enabled to communicate with the security domain. This communication interface can be a high-speed serial communication link, such as PCIe or other dedicated communication protocols.

[0103] The application domain communicates with the security domain through this communication interface to ensure that the data exchange between the two domains is normal. If the communication is normal, the application domain will communicate with the external CAN device through the Rtos-based CAN node of the security domain. In this way, even if there is a problem with the operating system or CAN controller of the application domain, the security domain can still ensure that the communication with the external CAN device is not affected.

[0104] The first hardware domain of the present application communicates through the second hardware domain when working normally, and the system increases redundancy and improves overall reliability. The monitoring and use of the inter-core communication interface can ensure real-time performance, because any communication problems can be quickly detected and handled.

[0105] In one embodiment, the method further comprises:

[0106] When it is determined that the first operating system of the first hardware domain is normal, the first hardware domain communicates with the CAN interface through the second node.

[0107] In this embodiment, a step is added on how to communicate with the CAN interface through the second node (Socket CAN node) when the first operating system of the first hardware domain works normally.

[0108] Specifically, the first node of the first hardware domain is monitored, and when it is determined that the first node is abnormal, the second node of the first hardware domain is started. According to the second node, it is determined that the first operating system of the first hardware domain is normal, and at this time, the first hardware domain communicates with the CAN interface through the second node (Socket CAN node).

[0109] For example, the application domain (first hardware domain) of an automotive electronic control unit (ECU) runs a real-time operating system (Rtos), while the safety domain (second hardware domain) runs a general-purpose operating system (LINUX). The application domain has a VirCAN node for monitoring CAN communication, and the application domain also has a Socket CAN node, and the safety domain has a CAN node based on Rtos.

[0110] If the VirCAN node of the application domain is abnormal, the application domain will open the Socket CAN node. After determining that the general operating system is normal according to the SocketCAN node, the application domain directly communicates with the external CAN device through its Socket CAN node.

[0111] In this way, even in a multi-core heterogeneous environment, the application domain can independently handle CAN communication without relying on the security domain, providing higher flexibility and efficiency.

[0112] This application allows the first hardware domain to communicate directly with the CAN interface through the second node when the operating system is normal, reducing the dependence on the second hardware domain and improving the efficiency of the overall system. Allowing different hardware domains to dynamically participate in CAN communication based on the status of their operating systems and CAN controllers improves the flexibility and scalability of the system. If the general operating system of the first hardware domain is abnormal, the system can quickly switch to the third node of the second hardware domain for communication, thereby ensuring the continuity and reliability of CAN communication.

[0113] In one embodiment, during the startup of the operating system of the first hardware domain, before the first node and the second node are turned on, if an abnormality is detected in the operating system of the first hardware domain, the third node can be used to communicate with the external CAN device under the second hardware domain.

[0114] like Figure 3 As shown, the method is specifically as follows:

[0115] S31. Monitor the first operating system of the first hardware domain.

[0116] In this embodiment, the first operating system (such as Linux system) of the first hardware domain (application domain) is continuously monitored.

[0117] S32: The second hardware domain obtains a first signal, wherein the first signal is used to indicate that a first operating system of the first hardware domain is abnormal, and the first signal is sent by the first hardware domain.

[0118] In this embodiment,

[0119] S33: When it is determined that the second hardware domain obtains the first signal, control of the CAN controller of the first hardware domain is switched to the second hardware domain.

[0120] In this embodiment, the second hardware domain (security domain) waits for a signal from the first hardware domain, and the first signal indicates that an abnormality occurs in the first operating system. The first signal may be triggered by a detection mechanism during the system startup process. For example, in a general operating system (Linux) system, if an abnormality is detected during the startup phase, the system will send a signal through a specific interrupt or error code.

[0121] Once the second hardware domain receives the abnormal signal sent by the first hardware domain, it confirms that there is a problem with the first operating system, and then switches the control of the CAN controller of the first hardware domain to the second hardware domain. This step ensures that even if there is a problem in the application domain, the system can still maintain communication with external CAN devices through the security domain.

[0122] S34. The first hardware domain communicates with the CAN interface through the third node of the second hardware domain.

[0123] In this embodiment, after the control right is switched, the first hardware domain will communicate with the CAN interface through the third node (the CAN node based on Rtos) of the second hardware domain to ensure the continuous operation of the system and uninterrupted external communication.

[0124] Assume that during the startup of an electronic control unit (ECU) of a car, the Linux system in its application domain fails, such as failing to initialize the Socket CAN node. In this case, the system will detect the exception and send a signal to the security domain.

[0125] After receiving this signal, the security domain immediately switches the control of the CAN controller from the application domain to itself, and then communicates with the external CAN device through its own third node to ensure that the vehicle's CAN communication system will not be interrupted due to a failure in the application domain.

[0126] This application quickly switches control when an abnormality is detected, and the system can quickly respond to abnormal situations and reduce the risk of system failure. Even if an operating system-level failure occurs in one hardware domain, the other hardware domain can still maintain communication with external devices, which is particularly important for automotive and industrial control systems that require high reliability.

[0127] In one embodiment, the method further comprises:

[0128] When it is determined that the second hardware domain has not acquired the first signal, the first hardware domain communicates with the CAN interface through the second node.

[0129] In this embodiment, an additional step is added to handle the situation when the second hardware domain does not receive the abnormal signal from the first hardware domain.

[0130] Specifically, the first operating system of the first hardware domain is continuously monitored, and the second hardware domain checks whether an abnormal signal sent by the first hardware domain is received. If the second hardware domain does not receive the abnormal signal, it means that the operating system of the first hardware domain is running normally without any abnormality.

[0131] When the operating system of the first hardware domain is normal, it will use its own second node for CAN communication. Doing so can keep the system running efficiently, because each hardware domain can handle its own CAN communication tasks independently without relying on another hardware domain.

[0132] For example, during the system startup process of the automotive ECU, if the Linux system of the application domain starts normally and no abnormalities occur, the security domain will not receive any abnormal signals. In this case, if the VirCAN node of the application domain is abnormal, the application domain will communicate directly with the external CAN device through its own Socket CAN node (second node). This method allows the application domain to handle CAN communication independently without the intervention of the security domain, thereby improving the efficiency and response speed of the overall system.

[0133] This application allows the first hardware domain to communicate independently through its own second node when the system is running normally, which can reduce the dependence on the second hardware domain and improve the overall efficiency of the system. Therefore, when the system is running normally, no additional control right switching is required, and the communication request of the external CAN device can be responded to more quickly, reducing communication delays.

[0134] In one embodiment, if Figure 4 As shown, the method also includes:

[0135] S41. Obtain an interface list of the first hardware domain.

[0136] In this embodiment, the control method is further refined, with particular attention paid to the start-up state and communication state of the first node (VirCAN node).

[0137] It is necessary to obtain a list of all available interfaces of the first hardware domain (eg, application domain), which may include all available communication interfaces in the domain, such as CAN, Ethernet, serial port, etc.

[0138] S42: Determine the enable status of the first node based on the interface list.

[0139] In this embodiment, by analyzing the interface list, it can be determined whether the first node (VirCAN node) is turned on. If the interface of the VirCAN node is in the list and the state is activated, then it can be considered that the first node is turned on.

[0140] S43: Determine the communication status of the first node based on the data interaction between the first hardware domain and the second hardware domain.

[0141] In this embodiment, after confirming that the first node is turned on, the communication status of the first node is tested and verified by exchanging data between the first hardware domain (e.g., application domain) and the second hardware domain (e.g., security domain). This can be done by sending a test message or a specific diagnostic command and checking whether an expected response is received.

[0142] Based on the data received by the second hardware domain from the first hardware domain and the analysis of the data, it can be determined whether the communication status of the first node is normal. If the data interaction is successful, it indicates that the communication status of the first node is good; if the interaction fails, it may indicate that there is a communication problem with the first node.

[0143] For example, in an automotive ECU system, the application domain is responsible for processing data for the Advanced Driver Assistance System (ADAS), while the safety domain is responsible for processing safety-critical information. The application domain has a VirCAN node for communicating with other ECUs in the vehicle.

[0144] After the system starts, the application domain requests to obtain the interface list and confirms that the VirCAN node is turned on through the interface list. Then, the security domain sends a test message to the application domain, and the application domain receives and responds to this message correctly through the VirCAN node. This successful data interaction process confirms that the communication status of the VirCAN node is normal.

[0145] By detecting the startup state and communication state of the first node, the present application can ensure that at critical moments, such as in safety-critical communication scenarios, the system can rely on a normally operating communication node.

[0146] Furthermore, potential communication problems can be discovered in advance, and measures can be taken before the problems affect system operation, such as switching to backup communication nodes, thereby avoiding possible system failures.

[0147] In one embodiment, the method further comprises:

[0148] When the control right of the CAN controller of the hardware domain is switched, the second node of the first hardware domain and the third node of the second hardware domain are both in an open state.

[0149] In this embodiment, when executing the control right switch of the CAN controller of the hardware domain, it is required that the second node (e.g., Socket CAN node) of the first hardware domain (e.g., application domain) and the third node (e.g., Rtos-based CAN node) of the second hardware domain (e.g., security domain) must be in the turned-on state.

[0150] The start of the second node indicates that the node has been initialized and can receive and send CAN messages. The first hardware domain is ready to transmit data through its CAN communication node.

[0151] Similarly, the start of the third node means that the second hardware domain is also ready for CAN communication. This ensures that during the control switching process, the second hardware domain can immediately take over the CAN communication without causing communication interruption due to the node not being ready.

[0152] Only when the second and third nodes are both turned on, and the operating system of a domain is abnormal or the CAN communication of a domain is abnormal, the system will execute the control switch of the CAN controller. This ensures that the CAN communication will not be interrupted when the control is transferred from one domain to another, thus ensuring the reliability of the system and the continuity of data.

[0153] Assume that, in an automotive ECU system, the physical CAN interface is set on the safety domain to ensure that critical safety communications are always available. If there is a problem in the application domain, the safety domain can directly take over the CAN communication task of the application domain.

[0154] On the contrary, if a problem occurs in the security domain, the system needs to adjust the physical CAN set on the security domain to the physical CAN set on the application domain so that the application domain can take over the security domain and communicate with external CAN devices.

[0155] In this process, the system will switch control rights only when both the Socket CAN node (second node) of the application domain and the Rtos-based CAN node (third node) of the security domain are in the turned-on state to ensure the continuity of CAN communication.

[0156] The present application can avoid communication interruption during the switching process by ensuring that both nodes are in an on state when the control right is switched, thereby ensuring the continuity of communication. This method reduces the potential risks caused by the switching of control rights and improves the reliability of the entire system.

[0157] In summary, if Figure 7 As shown, the control method includes the following situations when used:

[0158] In the first case, the first node of the first hardware domain is normally opened, the communication interface of the first hardware domain is normally opened, and the inter-core communication between the first hardware domain and the second hardware domain is normal. At this time, the physical CAN is set on the second hardware domain and the third node is normally opened, and the first hardware domain performs CAN communication through the third node of the second hardware domain.

[0159] In the second case, the first node of the first hardware domain is abnormal, the second node of the first hardware domain is normal, and the first operating system of the first hardware domain is normal. At this time, the first hardware domain performs CAN communication through the second node, and the physical CAN is set on the first hardware domain.

[0160] In the third case, the first node of the first hardware domain is abnormal, and the second node of the first hardware domain is abnormal, resulting in the first operating system of the first hardware domain being abnormal. At this time, it is necessary to switch the control of the CAN controller of the first hardware domain to the second hardware domain. The first hardware domain performs CAN communication through the third node of the second hardware domain, and the physical CAN is set on the second hardware domain.

[0161] In a fourth case, during the startup of the first operating system of the first hardware domain, when the first operating system is normal, the first hardware domain performs CAN communication through its own second node. At this time, the physical CAN is set on the first hardware domain.

[0162] In the fifth case, during the startup of the first operating system in the first hardware domain, when the first operating system is abnormal, the control of the CAN controller of the first hardware domain is switched to the second hardware domain, and the first hardware domain performs CAN communication through the third node of the second hardware domain. At this time, the physical CAN is set on the second hardware domain.

[0163] The present application also provides a control device for a multi-core heterogeneous system chip, wherein the system chip includes multiple hardware domains and CAN interfaces, wherein each of the hardware domains is provided with a communication interface for inter-core communication with other hardware domains, wherein the same or different operating systems and CAN controllers are installed in each of the hardware domains, and the hardware domain communicates with an external CAN device through the CAN interface, such as Figure 5 As shown, the device comprises:

[0164] A monitoring module configured to monitor a first node of a first hardware domain, wherein the first hardware domain is any one of the multiple hardware domains;

[0165] an enabling module, configured to enable a second node in the first hardware domain when determining that the first node is abnormal;

[0166] a determination module configured to determine, based on the second node, a running state of a first operating system of the first hardware domain, wherein the first hardware domain is configured with the first operating system;

[0167] a switching module configured to switch the control right of the CAN controller of the first hardware domain to the second hardware domain when it is determined that the first operating system of the first hardware domain is abnormal;

[0168] A communication module is configured so that the first hardware domain communicates with the CAN interface through a third node of the second hardware domain.

[0169] The embodiment of the present application further provides a chip, the chip comprising multiple hardware domains and a CAN interface, the hardware domain comprising at least:

[0170] An application domain, configured with a first operating system, wherein a first hardware resource manager and a first CAN controller are provided in the application domain, and the first hardware resource manager is used to switch control rights of the first CAN controller;

[0171] A security domain is configured with a second operating system, a second hardware resource manager and a second CAN controller are arranged in the security domain, the first operating system is different from the second operating system, and the second hardware resource manager is used to switch control of the second CAN controller;

[0172] The application domain and the security domain perform inter-core communication via a communication interface, and both the application domain and the security domain communicate with an external CAN device via the CAN interface.

[0173] An embodiment of the present application further provides an electronic device, including a processor and a memory, wherein the memory stores an executable program, and the memory executes the executable program to perform the steps of the method described above.

[0174] An embodiment of the present application further provides a storage medium, wherein the storage medium carries one or more computer programs, and when the one or more computer programs are executed by a processor, the steps of the method described above are implemented.

[0175] An embodiment of the present application also provides a computer program product, including a computer program / instruction, characterized in that when the computer program / instruction is executed by a processor, the steps of the control method as described above are implemented.

[0176] The vehicle in the embodiments of the present application may be "car", "vehicle" and "entire vehicle" or other similar terms including general motor vehicles, such as sedans, SUVs, MPVs, buses, trucks and other cargo or passenger vehicles, watercraft including various ships and boats, and aircraft, etc., including hybrid vehicles, electric vehicles, fuel vehicles, plug-in hybrid vehicles, fuel cell vehicles and other alternative fuel vehicles. Among them, hybrid vehicles refer to vehicles with two or more power sources, and electric vehicles include pure electric vehicles, extended-range electric vehicles, etc., which are not specifically limited in the present application.

[0177] It should be understood that in the embodiments of the present application, the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.

[0178] It should also be understood that the memory mentioned in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM).

[0179] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0180] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0181] In addition to the data bus, the bus may also include a power bus, a control bus, a status signal bus, etc. However, for the sake of clarity, various buses are marked as buses in the figure.

[0182] It should also be understood that the first, second, third, fourth and various numerical numbers involved in this document are only distinctions made for the convenience of description and are not intended to limit the scope of the present application.

[0183] It should be understood that the term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0184] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0185] In various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0186] Those skilled in the art will appreciate that the various illustrative logical blocks (ILBs) and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0187] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0188] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0189] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0190] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape) or an optical medium (e.g., a DVD) or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0191] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A control method, characterized in that: A system chip applied to multi-core heterogeneous system, the system chip includes multiple hardware domains and CAN interfaces, each of the hardware domains is provided with a communication interface for inter-core communication with other hardware domains, the same or different operating systems and CAN controllers are installed in each of the hardware domains, and the hardware domain communicates with an external CAN device through the CAN interface, the method includes: Monitoring a first node of a first hardware domain, wherein the first hardware domain is any one of the multiple hardware domains; When determining that the first node is abnormal, starting the second node of the first hardware domain; Determine, based on the second node, a running state of a first operating system of the first hardware domain, wherein the first hardware domain is configured with the first operating system; When it is determined that the first operating system is abnormal, the control right of the CAN controller of the first hardware domain is switched to the second hardware domain; The first hardware domain communicates with the CAN interface via a third node of the second hardware domain; When determining that the first node is normal, enabling the communication interface of the first hardware domain; monitoring the communication interface; When it is determined that the first hardware domain communicates normally with the second hardware domain through the communication interface, the first hardware domain communicates with the CAN interface through the third node of the second hardware domain; When it is determined that the first operating system of the first hardware domain is normal, the first hardware domain communicates with the CAN interface through the second node.

2. The control method according to claim 1, characterized in that: The method further comprises: monitoring a first operating system of the first hardware domain; The second hardware domain obtains a first signal, wherein the first signal is used to indicate that the first operating system of the first hardware domain is abnormal, and the first signal is sent by the first hardware domain; When it is determined that the second hardware domain obtains the first signal, the control right of the CAN controller of the first hardware domain is switched to the second hardware domain; The first hardware domain communicates with the CAN interface through a third node of the second hardware domain.

3. The control method according to claim 2, characterized in that: The method further comprises: When it is determined that the second hardware domain has not acquired the first signal, the first hardware domain communicates with the CAN interface through the second node.

4. The control method according to claim 1, characterized in that: The method further comprises: Obtaining a list of interfaces of the first hardware domain; Based on the interface list, determining an enable state of the first node; Based on data interaction between the first hardware domain and the second hardware domain, a communication state of the first node is determined.

5. The control method according to claim 1, characterized in that: The method further comprises: When the control right of the CAN controller of the hardware domain is switched, the second node of the first hardware domain and the third node of the second hardware domain are both in an open state.

6. A control device, characterized in that: A system chip applied to multi-core heterogeneous system, the system chip includes multiple hardware domains and CAN interfaces, each of the hardware domains is provided with a communication interface for inter-core communication with other hardware domains, the same or different operating systems and CAN controllers are installed in each of the hardware domains, and the hardware domain communicates with an external CAN device through the CAN interface. The device includes: A monitoring module configured to monitor a first node of a first hardware domain, wherein the first hardware domain is any one of the multiple hardware domains; the monitoring module is further configured to monitor the communication interface; an enabling module, configured to enable the second node of the first hardware domain when it is determined that the first node is abnormal; the enabling module is further configured to enable the communication interface of the first hardware domain when it is determined that the first node is normal; a determination module configured to determine, based on the second node, a running state of a first operating system of the first hardware domain, wherein the first hardware domain is configured with the first operating system; a switching module configured to switch the control right of the CAN controller of the first hardware domain to the second hardware domain when it is determined that the first operating system of the first hardware domain is abnormal; A communication module is configured so that the first hardware domain communicates with the CAN interface through the third node of the second hardware domain; the communication module is further configured so that when it is determined that the first hardware domain communicates normally with the second hardware domain through the communication interface, the first hardware domain communicates with the CAN interface through the third node of the second hardware domain; the communication module is further configured so that when it is determined that the first operating system of the first hardware domain is normal, the first hardware domain communicates with the CAN interface through the second node.

7. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the control method as claimed in any one of claims 1 to 5 are implemented.

Images