Vehicle domain control system and vehicle

Abstract

The invention provides a vehicle domain control system and a vehicle, and relates to the technical field of domain controllers. The vehicle domain control system comprises a safety monitoring module, a fault diagnosis module and a safety degradation module. The safety monitoring module is configured to monitor operation parameters of the vehicle domain control system and generate first fault information under the condition that abnormal operation parameters are monitored; the fault diagnosis module is configured to determine a first fault severity level of the vehicle domain control system based on the first fault information, and the first fault severity level is in positive correlation with the fault severity of the vehicle domain control system; the safety degradation module is configured to determine a target safety state matched with the first fault severity level and a current safety state where the vehicle domain control system is currently located, and under the condition that the fault severity level corresponding to the current safety state is lower than the first fault severity level, the vehicle domain control system is in the target safety state. And the vehicle domain control system is controlled to be converted into the target safety state from the current safety state, so that the function safety and reliability of the vehicle domain control system are improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of domain controllers, and in particular to a vehicle domain control system and a vehicle. Background Art

[0002] With the increasing degree of automotive electronics and the diversification of functions, the application of autonomous driving and other intelligent modules requires more sensors and processors in vehicles. Traditional distributed automotive electronic controllers are no longer sufficient to meet the intelligent needs of vehicles. A more integrated and intelligent solution - domain controller came into being.

[0003] The domain controller needs to process data from various sensors in real time and implement complex intelligent functions, which undoubtedly increases the error rate of domain controller chip operations. As the core of the autonomous driving system, the safety performance of the domain controller has become an issue that must be taken seriously. At present, the design of vehicle domain control systems tends to consider function realization and performance improvement. Therefore, a vehicle domain control system that meets functional safety requirements is urgently needed. Summary of the invention

[0004] In view of this, the embodiments of the present disclosure provide a vehicle domain control system and a vehicle to improve the functional safety and reliability of the vehicle domain control system.

[0005] In a first aspect, a vehicle domain control system is provided, comprising a safety monitoring module, a fault diagnosis module and a safety degradation module. The safety monitoring module is configured to monitor the operating parameters of the vehicle domain control system, and generate first fault information when abnormal operating parameters are monitored; the fault diagnosis module is configured to determine a first fault severity level of the vehicle domain control system based on the first fault information, and the first fault severity level is positively correlated with the fault severity of the vehicle domain control system; the safety degradation module is configured to determine a target safety state matching the first fault severity level and the current safety state of the vehicle domain control system, and control the vehicle domain control system to change from the current safety state to the target safety state when the fault severity level corresponding to the current safety state is lower than the first fault severity level.

[0006] In combination with the first aspect, in certain implementations of the first aspect, the safety monitoring module is further configured to: monitor the fault module corresponding to the abnormal operating parameters; when the current operating parameters of the fault module change compared to the abnormal operating parameters, generate second fault information corresponding to the current operating parameters of the fault module; the fault diagnosis module is also configured to determine the second fault severity level of the vehicle domain control system based on the second fault information.

[0007] In combination with the first aspect, in certain implementations of the first aspect, the safety degradation module is further configured to: when the second fault severity level indicates that the vehicle domain control system is operating normally, control the vehicle domain control system to change from a target safety state to a normal operating state.

[0008] In combination with the first aspect, in certain implementations of the first aspect, the safety monitoring module is further configured to: monitor other operating parameters in the vehicle domain control system except abnormal operating parameters; when there are abnormalities in other operating parameters, generate third fault information; the fault diagnosis module is also configured to generate a third fault severity level for the vehicle domain control system based on the first fault information and the third fault information.

[0009] In combination with the first aspect, in certain implementations of the first aspect, the vehicle domain control system includes a functional safety domain and a non-functional safety domain, the safety monitoring module, the fault diagnosis module and the safety degradation module are deployed in the functional safety domain, and the fault module corresponding to the abnormal operating parameters is deployed in the non-functional safety domain; wherein, the functional safety domain is decoupled from the non-functional safety domain to ensure that the operation of the safety monitoring module, the fault diagnosis module and the safety degradation module are not interfered with by the non-functional safety domain.

[0010] In combination with the first aspect, in some implementations of the first aspect, the target safety state includes any one of a first degraded state, a second degraded state, a third degraded state, and a fourth degraded state, and the fault severity levels corresponding to the first degraded state, the second degraded state, the third degraded state, and the fourth degraded state are increased in sequence; wherein, when the vehicle domain control system is in the first degraded state, the vehicle domain control system operates normally; when the vehicle domain control system is in the second degraded state, the vehicle domain control system operates normally, and the safety degradation module generates fault reminder information corresponding to the first fault information; when the vehicle domain control system is in the third degraded state, the safety degradation module generates a first communication management request, and generates fault reminder information and a first takeover request corresponding to the first fault information, the first communication management request including a request to cut off external communication of a fault module corresponding to an abnormal operating parameter; when the vehicle domain control system is in the fourth degraded state, the safety degradation module generates a second communication management request, and generates fault reminder information and a second takeover request corresponding to the first fault information, the second communication management request including a request to cut off external communication of all function implementation modules in the vehicle domain control system.

[0011] In combination with the first aspect, in certain implementations of the first aspect, the vehicle domain control system includes a functional safety domain and a non-functional safety domain, the functional safety domain is decoupled from the non-functional safety domain, the safety monitoring module, the fault diagnosis module and the safety degradation module are deployed in the functional safety domain, and the fault module and the function implementation module are deployed in the non-functional safety domain; wherein the functional safety domain also includes: a communication management module, configured to cut off the external communication of the fault module in response to a first communication management request; and / or, in response to a second communication management request, cut off the external communication of all function implementation modules in the vehicle domain control system.

[0012] In combination with the first aspect, in certain implementations of the first aspect, the vehicle domain control system includes a functional safety domain and a non-functional safety domain, the functional safety domain is decoupled from the non-functional safety domain, and the safety monitoring module, the fault diagnosis module and the safety degradation module are deployed in the functional safety domain; wherein the safety monitoring module includes a system monitoring sub-module, and the non-functional safety domain includes a function implementation module; the system monitoring sub-module is configured to monitor the function implementation module, and when it is monitored that the function implementation module has a fault, the faulty function implementation module is reset, and fault information corresponding to the faulty function implementation module is generated; and / or the system monitoring sub-module is further configured to periodically generate an operating status signal, and when the faulty function implementation module is reset and the fault still exists, the operating status signal is stopped from being generated, so that the external monitoring module outside the vehicle domain control system recognizes that the operating status signal stops being generated, and resets the vehicle domain control system.

[0013] In combination with the first aspect, in certain implementations of the first aspect, the safety monitoring module includes: a power supply monitoring sub-module, configured to monitor whether there is an abnormality in the power supply by sampling and calculating the power supply voltage of the power supply of the vehicle domain control system, and generate fault information corresponding to the power supply when the power supply is monitored to be abnormal; and / or a temperature monitoring sub-module, configured to monitor whether there is an abnormality in the ambient temperature by sampling and calculating the ambient temperature of the vehicle domain control system, and generate fault information corresponding to the ambient temperature when the ambient temperature is monitored to be abnormal.

[0014] In a second aspect, a vehicle is provided, comprising the vehicle domain control system provided in the first aspect.

[0015] In the vehicle domain control system provided by the present invention, the safety monitoring module monitors the operating parameters of the vehicle domain control system in real time; the fault diagnosis module determines the first fault severity level of the vehicle domain control system according to the first fault information determined by the safety monitoring module; the safety degradation module enables the vehicle domain control system to take corresponding fault response measures according to the first fault severity level based on the first fault severity level, thereby reducing the potential safety risks caused by the fault indicated by the first fault information to the vehicle domain control system, so that the software architecture of the vehicle domain control system has functional safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Shown is a schematic diagram of the structure of a vehicle domain control system provided by an embodiment of the present disclosure.

[0017] Figure 2 Shown is a schematic structural diagram of a vehicle domain control system provided by another embodiment of the present disclosure.

[0018] Figure 3 Shown is a schematic structural diagram of a vehicle domain control system provided in yet another embodiment of the present disclosure. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0020] Figure 1 FIG. 1 is a schematic diagram of the structure of a vehicle domain control system provided by an embodiment of the present disclosure. Figure 1 As shown, in this embodiment, the vehicle domain control system 100 includes a safety monitoring module 111, a fault diagnosis module 112 and a safety degradation module 113. The safety monitoring module 111 is connected to the fault diagnosis module 112 in communication, and the fault diagnosis module 112 is connected to the safety degradation module 113 in communication.

[0021] In addition to the above-mentioned security monitoring module 111, fault diagnosis module 112 and security degradation module 113, the vehicle domain control system 100 may also include a function implementation module 121, a middleware module 122 and the like.

[0022] The function realization module 121 is used to realize various auxiliary driving functions of the vehicle, which can be customized according to actual needs. Exemplarily, the function realization module 121 may include a fusion perception module, a positioning module, a prediction module, a regulation and control module, a state machine management module, etc. Exemplarily, the fusion perception module can perceive the environment around the vehicle by integrating data from multiple sensors (such as lidar, cameras, etc.) and provide a comprehensive understanding of the surrounding environment; the positioning module can determine the precise position coordinates of the vehicle based on the positioning signal.

[0023] The middleware module 122 can provide standardized interfaces and services for different function implementation modules 121. The main function of the middleware module 122 is to shield the complexity of the underlying hardware of the domain controller and help various function implementation modules 121 to run on different hardware platforms without having to adjust for specific hardware. Exemplarily, the middleware module 122 may include a database middleware module, a message queue middleware module, etc.

[0024] The safety monitoring module 111 is configured to monitor the operating parameters of the vehicle domain control system 100 and generate first fault information when abnormal operating parameters are monitored.

[0025] The operating parameters of the vehicle domain control system 100 include the power supply voltage signal, ambient temperature, clock signal, available memory space, read and write operations of stored data, etc. of the vehicle domain control system 100. In one embodiment, the operating parameters of the vehicle domain control system 100 may be operating parameters of each module included in the vehicle domain control system 100. For example, the operating parameters also include operating parameters of the above-mentioned function implementation module 121 and middleware module 122, such as operating cycle parameters, operating time parameters, data flow, control flow and execution flow parameters during operation, etc.

[0026] In the process of the safety monitoring module 111 monitoring the operating parameters, if a certain operating parameter exceeds the normal threshold range corresponding to the operating parameter, the operating parameter is an abnormal operating parameter; exemplarily, when the power supply voltage signal is monitored to be not within the rated voltage range, the power supply voltage signal is an abnormal operating parameter. Alternatively, the operating parameter can also be processed to determine whether the operating parameter is abnormal; exemplarily, the clock frequency is calculated according to the clock signal, and when the calculated clock frequency does not match the normal clock frequency, the clock signal is an abnormal operating parameter. Alternatively, when the operating parameters of the function implementation module 121 or the middleware module 122 are monitored to indicate that the operation of the function implementation module 121 or the middleware module 122 has a fault, it is determined that the operating parameter is an abnormal operating parameter; exemplarily, when the operating time parameter exceeds the normal time range, the operating time parameter is an abnormal operating parameter.

[0027] When the safety monitoring module 111 monitors abnormal operating parameters, first fault information is generated based on the abnormal operating parameters, and the first fault information is sent to the fault diagnosis module 112. The first fault information records the abnormal operating parameters and related information of the abnormal operating parameters, such as the generation time of the abnormal operating parameters, the description information of the abnormal operating parameters, the fault module corresponding to the abnormal operating parameters, etc.

[0028] The fault diagnosis module 112 is configured to determine a first fault severity level of the vehicle domain control system 100 based on the first fault information.

[0029] Specifically, when the safety monitoring module 111 monitors abnormal operating parameters, it indicates that a fault occurs in the vehicle domain control system 100. At this time, the fault diagnosis module 112 can analyze factors such as the fault location, fault duration, and the impact of the fault on the functional safety of the vehicle domain control system 100 according to the first fault information, and comprehensively determine the first fault severity level of the vehicle domain control system 100.

[0030] The first fault severity level is positively correlated with the fault severity of the vehicle domain control system 100. The higher the first fault severity level, the more serious the current fault severity of the vehicle domain control system 100. Exemplarily, multiple fault severity levels can be set according to different fault types or the degree of impact of the fault on functional safety. For example, when the first fault severity level is the lowest level of fault severity, the vehicle domain control system 100 can operate normally; when the first fault severity level is the highest level of fault severity, the vehicle domain control system 100 completely fails and cannot work.

[0031] The first fault severity level is determined based on the first fault information. For example, when determining the first fault severity level, the duration of the fault may be considered. Exemplarily, the duration of the fault is determined based on the first fault information, and the fault is classified into a "transient fault" or a "continuous fault" based on the duration of the fault, and the fault severity level corresponding to the "transient fault" is lower than the fault severity level corresponding to the "continuous fault".

[0032] Alternatively, when determining the first fault severity level, the scope of influence of the fault on the assisted driving function of the vehicle domain control system 100 may be considered. Exemplarily, the assisted driving function affected by the fault is determined based on the first fault information, and the more assisted driving functions affected by the fault, the higher the fault severity level. If the fault is so serious that the fault diagnosis module 112 cannot accurately determine the affected assisted driving function in the vehicle domain control system 100, the first fault severity level is determined to be the highest level of fault severity level.

[0033] It is understandable that the above-listed methods for determining the first fault severity level based on fault duration and / or impact range are only illustrative, and those skilled in the art can design them according to actual needs. In addition to the above-mentioned fault duration and the impact range on the auxiliary driving function, the first fault severity level can also be determined based on other influencing factors, as long as the first fault information has a corresponding relationship with the first fault severity level, and the present disclosure does not make specific restrictions on this.

[0034] After determining the first fault severity level, the fault diagnosis module 112 sends the first fault severity level to the safety degradation module 113 .

[0035] The safety degradation module 113 is configured to determine the target safety state that matches the first fault severity level and the current safety state of the vehicle domain control system. When the fault severity level corresponding to the current safety state is lower than the first fault severity level, the vehicle domain control system is controlled to change from the current safety state to the target safety state. The vehicle domain control system 100 sets a variety of safety states for different levels of fault severity. Among them, the safety state is a safe operation mode adopted by the vehicle domain control system 100 to deal with faults, so as to reduce the safety risks caused by the fault to the vehicle domain control system 100.

[0036] There is a corresponding relationship between the fault severity level and the safety state of the vehicle domain control system 100. Based on this, after receiving the first fault severity level, the safety degradation module 113 can use the safety state matching the first fault severity level as the target safety state based on the first fault severity level.

[0037] The safety degradation module 113 may also determine the current safety state of the vehicle domain control system 100. The current safety state refers to the safety state of the vehicle domain control system 100 before taking corresponding fault response measures for the first fault information.

[0038] The current safety state is also one of the multiple safety states preset by the vehicle domain control system 100, so the fault severity level corresponding to the current safety state can be determined. The fault severity level corresponding to the current safety state is compared with the first fault severity level. If the fault severity level corresponding to the current safety state is lower than the first fault severity level, it means that the fault shown in the first fault information will have a greater impact on the functional safety of the vehicle domain control system 100, and the current safety state of the vehicle domain control system 100 is not enough to cope with it. At this time, the safety degradation module 113 needs to control the vehicle domain control system 100 to change from the current safety state to the target safety state to reduce the safety risks faced by the vehicle domain control system 100.

[0039] If the fault severity level corresponding to the current safety state is higher than or equal to the first fault severity level, the current safety state of the vehicle domain control system 100 is sufficient to deal with the fault indicated by the first fault information. At this time, the safety degradation module 113 does not need to control the vehicle domain control system 100 to change from the current safety state to the target safety state.

[0040] In the disclosed embodiment, the safety monitoring module monitors the operating parameters of the vehicle domain control system in real time; the fault diagnosis module determines the first fault severity level of the vehicle domain control system according to the first fault information determined by the safety monitoring module; the safety downgrade module enables the vehicle domain control system to take corresponding fault response measures according to the first fault severity level based on the first fault severity level, thereby reducing the potential safety risks caused by the fault indicated by the first fault information to the vehicle domain control system, so that the software architecture of the vehicle domain control system has functional safety.

[0041] In addition, the safety monitoring module, fault diagnosis module and safety degradation module are set up independently from each other. This kind of modular design is easy to develop and maintain. Through the different designs of the safety monitoring module, fault diagnosis module and safety degradation module, combined with the hardware design of the vehicle domain controller, the requirements of different functional safety levels (Automotive Safety Integrity Level, ASIL) for the vehicle domain controller can be met, and the highest level can be ASIL D, which is the highest safety level.

[0042] After monitoring the abnormal operating parameters, the safety monitoring module 111 continues to monitor the operating parameters of the vehicle domain control system 100. After detecting a new change in the fault condition of the vehicle domain control system 100, the safety monitoring module 111 continues to generate fault information corresponding to the new fault condition, so that the fault diagnosis module 112 and the safety degradation module 113 take corresponding fault response measures for the new fault condition. The following continues to introduce several ways in which the fault condition of the vehicle domain control system 100 changes and the corresponding measures.

[0043] In some embodiments, the safety monitoring module 111 is further configured to monitor the fault module corresponding to the abnormal operation parameter; when the current operation parameter of the fault module changes compared to the abnormal operation parameter, the second fault information corresponding to the current operation parameter of the fault module is generated. The fault module corresponding to the abnormal operation parameter refers to the function implementation module 121 or the middleware module 122 that generates the abnormal operation parameter. Exemplarily, in the process of monitoring the function implementation module 121, when the safety monitoring module 111 determines that the fusion perception module cannot correctly obtain the data collected by the left sensor of the vehicle by monitoring the operation parameter of the fusion perception module, the operation parameter of the fusion perception module is determined as the abnormal operation parameter, and the fusion perception module is the fault module corresponding to the abnormal operation parameter. The safety monitoring module 111 monitors the current operation parameter of the fault module in real time. If the current operation parameter changes compared to the abnormal operation parameter, it means that the fault condition of the fault module has changed. At this time, the safety monitoring module 111 generates the second fault information corresponding to the current operation parameter of the fault module. The second fault information can reflect the new fault condition of the fault module. After generating the second fault information, the safety monitoring module 111 sends the second fault information to the fault diagnosis module 112.

[0044] The fault diagnosis module 112 is further configured to determine, based on the second fault information, a second fault severity level of the vehicle domain control system 100. The second fault severity level is determined in a manner similar to the first fault severity level, which will not be described in detail herein.

[0045] After determining the second fault severity level, the fault diagnosis module 112 sends the second fault severity level to the safety degradation module 113 so that the safety degradation module 113 takes corresponding fault response measures based on the second fault severity level.

[0046] In the disclosed embodiment, the safety monitoring module monitors the current operating parameters of the fault module in real time to determine whether the fault condition has changed, so that the safety degradation module can promptly adjust the fault response measures of the vehicle domain control system according to the changed fault condition, thereby improving the functional safety and reliability of the vehicle domain control system.

[0047] Next, the safety degradation module 113 receives the second fault severity level and determines a target safety state matching the second fault severity level.

[0048] In some embodiments, if the fault condition of the faulty module becomes more severe over time, the second fault severity level should be equal to or higher than the first fault severity level.

[0049] If the second fault severity level is equal to the first fault severity level, it means that the target safety state of the vehicle domain control system 100 that matches the first fault severity level is sufficient to cope with the new fault condition. At this time, the safety degradation module 113 does not need to control the vehicle domain control system 100 to change the safety state.

[0050] If the second fault severity level is higher than the first fault severity level, it means that the target safety state of the vehicle domain control system 100 that matches the first fault severity level is not sufficient to cope with the new fault situation. At this time, the safety degradation module 113 controls the vehicle domain control system 100 from the target safety state that matches the first fault severity level to the target safety state that matches the second fault severity level.

[0051] In other embodiments, the fault of the faulty module can be repaired by resetting and other measures. After the faulty module is repaired, the current operating parameters of the faulty module change accordingly.

[0052] In this case, the safety degradation module 113 is further configured to control the vehicle domain control system 100 to change from the target safety state to the normal operating state when the second fault severity level indicates that the vehicle domain control system 100 is operating normally.

[0053] For example, if the second fault severity level is the lowest fault severity level, it means that the vehicle domain control system 100 can operate normally. At this time, the safety degradation module 113 controls the vehicle domain control system 100 to change from the target safety state matching the first fault severity level to the normal operating state.

[0054] In the disclosed embodiment, the safety degradation module controls the vehicle domain control system to take corresponding fault response measures according to the fault change of the fault module based on the second fault severity level, thereby reducing the potential safety risk of the vehicle domain control system. Furthermore, after the safety degradation module detects that the fault of the fault module has been repaired based on the second fault severity level and the vehicle domain control system is operating normally, the vehicle domain control system is controlled to change to a normal operating state, thereby improving the overall performance and operating efficiency of the vehicle domain control system.

[0055] The above embodiment introduces that the security monitoring module 111 can continue to monitor the fault module so as to detect the fault changes of the fault module in time. During the operation of the function implementation module 121 and the middleware module 122, there are dependencies between the modules; when a module in the function implementation module 121 and the middleware module 122 fails, the failure may spread to other modules through the dependency relationship, causing cascading failures. In addition, in the function implementation module 121 and the middleware module 122, other modules except the fault module may also fail due to other reasons.

[0056] Therefore, in some embodiments, the safety monitoring module 111 is also configured to monitor other operating parameters in the vehicle domain control system except for the abnormal operating parameters; and generate third fault information when there is an abnormality in other operating parameters.

[0057] Specifically, when the safety monitoring module 111 detects abnormal operating parameters, it will continue to monitor other operating parameters of the vehicle domain control system 100 except the abnormal operating parameters. In other words, in combination with the above-mentioned embodiment, in addition to monitoring the current operating parameters of the faulty module, the safety monitoring module 111 will also monitor the operating parameters of other modules except the faulty module in the function implementation module 121 and the middleware module 122, as well as the operating parameters of the vehicle domain control system 100, such as power supply voltage signal, ambient temperature, clock signal, available memory space, read and write operations of stored data, etc.

[0058] If other operating parameters are monitored to be abnormal, it means that in addition to the fault shown by the first fault information, a new fault has occurred in the vehicle domain control system 100. At this time, the safety monitoring module 111 generates third fault information according to the abnormal operating parameters and sends the third fault information to the fault diagnosis module 112.

[0059] The fault diagnosis module 112 is further configured to generate a third fault severity level of the vehicle domain control system 100 based on the first fault information and the third fault information.

[0060] The fault indicated by the third fault information is different from the fault indicated by the first fault information. Therefore, in the process of determining the fault severity level of the vehicle domain control system, the fault diagnosis module 112 needs to comprehensively consider the impact of the faults indicated by the first fault information and the third fault information on the functional safety of the vehicle domain control system 100 to obtain the third fault severity level.

[0061] In the disclosed embodiment, the safety monitoring module monitors other operating parameters in real time except for abnormal operating parameters, so as to promptly detect other faults that may occur in the vehicle domain control system in addition to the fault indicated by the first fault information, so that the fault diagnosis module can comprehensively consider the impact of multiple faults on the functional safety of the vehicle domain control system, so that the safety degradation module can timely adjust the fault response measures of the vehicle domain control system according to the fault situation, thereby improving the functional safety and reliability of the vehicle domain control system.

[0062] The above describes several countermeasures taken by the safety monitoring module, the fault diagnosis module and the safety degradation module when the fault conditions of the vehicle domain control system change. As described in the above embodiments, if there is a dependency relationship between two modules, the failure of one module may cause the failure of another module.

[0063] In order to prevent faults in the function implementation module or the middleware module from affecting the safety monitoring module, the fault diagnosis module and the safety downgrade module, thereby rendering the fault response measures of the vehicle domain control system ineffective, in some embodiments, the vehicle domain control system is divided into functional safety domains and non-functional safety domains to isolate the safety monitoring module, the fault diagnosis module and the safety downgrade module from the function implementation module and the middleware module.

[0064] Specifically, Figure 2 FIG. 1 is a schematic diagram of the structure of a vehicle domain control system provided by another embodiment of the present disclosure. Figure 2 As shown, in this embodiment, the vehicle domain control system 100 includes a functional safety domain 110 and a non-functional safety domain 120. The safety monitoring module 111, the fault diagnosis module 112 and the safety degradation module 113 are deployed in the functional safety domain 110, and the function implementation module 121 and the middleware module 122 are deployed in the non-functional safety domain 120. The fault module corresponding to the abnormal operation parameter is the module in which the fault occurs in the function implementation module 121 and the middleware module 122. In other words, the fault module corresponding to the abnormal operation parameter is deployed in the non-functional safety domain 120.

[0065] The functional safety domain 110 is decoupled from the non-functional safety domain 120 to ensure that the operation of the safety monitoring module 111, the fault diagnosis module 112, and the safety degradation module 113 are not interfered with by the non-functional safety domain 120. That is, when a module in the non-functional safety domain 120 fails, the failure will not affect the normal operation of the module in the functional safety domain 110.

[0066] In the disclosed embodiment, the vehicle domain control system adopts a hierarchical and modular design scheme, and the functional safety domain is decoupled from the non-functional safety domain, which is helpful for the design and maintenance of the safety monitoring module, the fault diagnosis module, and the safety degradation module. In addition, the functional safety domain is isolated from the non-functional safety domain, ensuring that the modules in the functional safety domain will not fail due to the influence of faults in the non-functional safety domain, thereby improving the reliability of the vehicle domain control system.

[0067] In some embodiments, the non-functional safety domain 120 can be further divided into an application software domain and a middleware domain. The function implementation module 121 is deployed in the application software domain, and the middleware module 122 is deployed in the middleware domain to further improve the modularity of the vehicle domain control system and make it easier to maintain and upgrade.

[0068] The above describes that the safety degradation module can control the vehicle domain control system to enter a safety state that matches the fault severity level according to the fault severity level, so as to reduce the safety risk caused by the fault to the vehicle domain control system. The following will continue to introduce a fault severity level classification scheme and the setting of the safety state corresponding to the fault severity level.

[0069] In some embodiments, the fault severity level includes five levels. For the convenience of description, in this embodiment, the five fault severity levels are named in sequence: no fault, slight fault, general fault, relatively serious fault, and very serious fault. The fault severity of the vehicle domain control system 100 represented by these five fault severity levels increases in sequence. It can be understood that the naming of the above fault severity levels is only illustrative, and those skilled in the art can adjust them at their own discretion.

[0070] Each fault severity level corresponds to a different safety state. In this embodiment, five safety states are set for different fault severity levels, including: normal operation state, first degradation state, second degradation state, third degradation state and fourth degradation state. Among them, the fault severity levels corresponding to the normal operation state, first degradation state, second degradation state, third degradation state and fourth degradation state increase in sequence.

[0071] Specifically, if the vehicle domain control system 100 has no fault, it means that the vehicle domain control system 100 can operate normally. That is, the safety state corresponding to the fault severity level "no fault" is "normal operation state".

[0072] In addition, the safety state corresponding to a "minor fault" is the "first degraded state", the safety state corresponding to a "general fault" is the "second degraded state", the safety state corresponding to a "relatively serious fault" is the "third degraded state", and the safety state corresponding to a "very serious fault" is the "fourth degraded state".

[0073] When the safety monitoring module 111 monitors abnormal operating parameters, it indicates that a fault occurs in the vehicle domain control system 100. At this time, the target safety state matching the first fault severity level should be any one of the first degraded state, the second degraded state, the third degraded state, and the fourth degraded state. The current safety state of the vehicle domain control system 100 can be any one of the normal operating state, the first degraded state, the second degraded state, the third degraded state, and the fourth degraded state.

[0074] The vehicle domain control system 100 has different fault response measures for different fault severity levels. The following will continue to introduce the specific fault response measures taken by the vehicle domain control system 100 for different fault severity levels.

[0075] If the fault severity level is "minor fault", it means that the fault shown in the first fault information will not significantly increase the probability of safety risks in the vehicle domain control system 100, and will not affect the normal operation of the assisted driving function of the vehicle domain control system 100. Therefore, when the vehicle domain control system 100 is in the first degraded state corresponding to "minor fault", the vehicle domain control system 100 operates normally. At this time, the safety degradation module 113 can record the first fault information in the system log of the vehicle domain control system 100 for subsequent maintenance.

[0076] If the fault severity level is "general fault", it means that the fault shown in the first fault information may affect the functional safety of the vehicle domain control system 100, but usually does not lead to serious consequences. Therefore, when the vehicle domain control system 100 is in the second degraded state corresponding to "general fault", the vehicle domain control system 100 operates normally, and the safety degradation module 113 generates fault reminder information corresponding to the first fault information.

[0077] Among them, the fault reminder information can be output through the vehicle-mounted terminal or other output devices to remind the driver or technician that the vehicle domain control system 100 has a fault, so as to alert the driver or technician.

[0078] If the fault severity level is "relatively serious fault", it means that the fault shown in the first fault information has a significant impact on the functional safety of the vehicle domain control system 100, and will affect the normal operation of some auxiliary driving functions. Therefore, when the vehicle domain control system 100 is in the third degraded state corresponding to "relatively serious fault", the safety degradation module 113 generates a first communication management request, and generates fault reminder information and a first takeover request corresponding to the first fault information.

[0079] The first communication management request includes a request to cut off the external communication of the fault module corresponding to the abnormal operating parameters. External communication refers to the sending and receiving of messages of the fault module. As introduced in the previous embodiment, the external communication of the fault module may cause cascading failures. After cutting off the external communication of the fault module, the spread of the fault can be prevented and a wider range of system problems can be avoided. Avoid the assisted driving function related to the fault module from failing to operate normally.

[0080] The first takeover request is used to remind the driver to take over some of the vehicle's assisted driving functions, which are assisted driving functions related to the faulty module and cannot operate normally. For example, for the vehicle's automatic lane change function, if the fusion perception module fails and cannot correctly obtain the data from the sensor on the left side of the vehicle, the vehicle cannot perceive the environment on the left side of the vehicle, resulting in the inability to operate the left lane change function in the automatic lane change function. At this time, the first takeover request reminds the driver to take over the vehicle's left lane change operation.

[0081] If the fault severity level is "very serious fault", it means that the fault shown in the first fault information has a serious impact on the functional safety of the vehicle domain control system 100, and it is uncertain whether the assisted driving function of the vehicle domain control system 100 can operate normally. Therefore, when the vehicle domain control system 100 is in the fourth degraded state corresponding to "very serious fault", the safety degradation module 113 generates a second communication management request, and generates fault reminder information and a second takeover request corresponding to the first fault information.

[0082] The second communication management request includes a request to cut off the external communication of all function implementation modules in the vehicle domain control system. At this time, all auxiliary driving functions in the vehicle domain control system 100 stop running. The second takeover request is used to remind the driver to take over all functions of the vehicle.

[0083] In the disclosed embodiment, corresponding safety states are set for different fault severity levels, so that the vehicle domain control system can make reasonable fault responses for different fault severity levels, thereby improving the functional safety of the vehicle domain control system. In the case of a more serious fault, the driver can be reminded in time to take over the vehicle, thereby reducing the safety risk of the vehicle caused by the failure of the auxiliary driving function of the vehicle domain control system.

[0084] It is understandable that when a very serious fault occurs in the vehicle domain control system, it cannot be restored by a simple repair method. Therefore, when the vehicle domain control system enters the fourth degraded state, it is usually necessary to wait for relevant technicians to handle it, and the fourth degraded state generally will not be transformed into other safe states.

[0085] When a serious or very serious fault occurs in the vehicle domain control system, it is necessary to cut off the external communication of the faulty module or all functional implementation modules. Based on this requirement, a communication management module is further deployed in the functional safety domain.

[0086] Continue to refer Figure 2 , the functional safety domain 110 also includes a communication management module 114. The communication management module 114 is configured to cut off the external communication of the faulty module in response to the first communication management request; and / or, in response to the second communication management request, cut off the external communication of all the function implementation modules 121 in the vehicle domain control system 100. For example, the communication management module 114 can cut off the connection between the faulty module and the communication interface for data transmission to control the information sending and receiving of the faulty module.

[0087] Specifically, when the vehicle domain control system 100 is in the third degradation state, the safety degradation module 113 sends a first communication management request to the communication management module 114, requesting to cut off the external communication of the faulty module. After receiving the first communication management request, the communication management module 114 cuts off the external communication of the faulty module.

[0088] When the vehicle domain control system 100 is in the fourth degradation state, the security degradation module 113 sends a second communication management request to the communication management module 114. After receiving the second communication management request, the communication management module 114 cuts off the external communication of all function implementation modules 121 in the vehicle domain control system 100.

[0089] In the disclosed embodiment, the communication management module is capable of receiving and executing the first communication management request and the second communication management request generated by the safety downgrade module, so that after the vehicle domain control system enters the third downgraded state, the faulty module can be quickly isolated. After the vehicle domain control system enters the fourth downgraded state, all function implementation modules can be isolated from other modules in the non-functional safety domain to prevent the spread of faults, thereby improving the functional safety of the vehicle domain control system.

[0090] The following will introduce other modules in the functional safety domain.

[0091] Figure 3 FIG. 1 is a schematic diagram of the structure of a vehicle domain control system provided by another embodiment of the present disclosure. Figure 3 As shown, the vehicle domain control system 100 includes a functional safety domain 110 and a non-functional safety domain 120, the functional safety domain 110 is decoupled from the non-functional safety domain 120, and a safety monitoring module 111, a fault diagnosis module 112, and a safety degradation module 113 are deployed in the functional safety domain 110. The non-functional safety domain 120 includes a function implementation module 121 and a middleware module 122.

[0092] The security monitoring module 111 includes a system monitoring submodule 1111 .

[0093] The system monitoring submodule 1111 is configured to monitor the function implementation module 121 , and when it is detected that the function implementation module 121 has a fault, reset the faulty function implementation module and generate fault information corresponding to the faulty function implementation module.

[0094] Exemplarily, the system monitoring submodule 1111 performs program flow monitoring, deadline monitoring, or alive monitoring on the function implementation module 121 to determine whether there is an abnormality in the operating parameters of the function implementation module 121, and further determines whether there is a fault in the function implementation module 121. When it is monitored that the function implementation module 121 has a fault, fault information corresponding to the faulty function implementation module, i.e., first fault information, is generated.

[0095] Among them, program flow monitoring is used to monitor the dependencies and execution order between the tasks of the function implementation module 121, Deadline monitoring is used to monitor the execution time of event-type tasks, and Alive monitoring is used to monitor whether periodic tasks run according to the expected periodicity, so as to comprehensively monitor whether the function implementation module 121 is running normally.

[0096] Resetting a function implementation module with a fault refers to the process of restoring the state of the function implementation module with a fault to the initial or predefined safe state. Resetting helps to clear the error state inside the function implementation module with a fault and eliminate the error impact caused by the fault. Through the reset process, it is expected that the function implementation module with a fault can resume normal working state and prevent the error from spreading to other modules.

[0097] In some embodiments, the system monitoring submodule 1111 is also configured to periodically generate an operating status signal, and to stop generating the operating status signal if the fault still exists after the faulty function implementation module is reset, so that the external monitoring module outside the vehicle domain control system can recognize that the operating status signal stops being generated and reset the vehicle domain control system.

[0098] Among them, the operating status signal may include information such as the operating status, load conditions, resource utilization rate, etc. of the vehicle domain control system 100.

[0099] The external monitoring module is independently configured from the vehicle domain control system 100. The system monitoring submodule 1111 periodically sends an operation status signal to the external monitoring module to indicate that the vehicle domain control system 100 is in a normal working state. If the external monitoring module does not receive the operation status signal within a predetermined time, it indicates that a fault may occur in the vehicle domain control system 100. At this time, the external monitoring module will automatically trigger a preset safety response measure to reset the vehicle domain control system 100 so that the vehicle domain control system 100 can be restored to a normal working state.

[0100] In the disclosed embodiment, the system monitoring submodule can monitor in real time whether the function implementation module fails, and repair it in time by means of reset or the like. If the reset process cannot repair the fault, the vehicle domain control system as a whole can also be reset by an external monitoring module outside the vehicle domain control system. The system monitoring submodule provides a means of repairing the fault of the function implementation module, reduces the frequency of the vehicle domain control system entering a degraded state, and improves the overall reliability of the vehicle domain control system.

[0101] In some embodiments, continue to refer to Figure 3 The safety monitoring module 111 also includes a power monitoring submodule 1112 and / or a temperature monitoring submodule 1113 .

[0102] Specifically, the power supply monitoring submodule 1112 is configured to monitor whether there is an abnormality in the power supply by sampling and calculating the power supply voltage of the power supply of the vehicle domain control system. Exemplarily, by sampling and calculating the power supply voltage, if it is determined that the input voltage of the power supply is not within the rated voltage range, it is determined that there is an abnormality in the power supply. In the case of monitoring that there is an abnormality in the power supply, fault information corresponding to the power supply, i.e., first fault information, is generated.

[0103] The temperature monitoring submodule 1113 is configured to monitor whether the ambient temperature is abnormal by sampling and calculating the ambient temperature of the vehicle domain control system. Exemplarily, if the monitored ambient temperature exceeds the preset normal operating temperature range, it is determined that the ambient temperature is abnormal. In the case that the monitored ambient temperature is abnormal, fault information corresponding to the ambient temperature is generated, that is, the first fault information.

[0104] In the disclosed embodiment, the power monitoring submodule and the temperature monitoring submodule can monitor the power supply and ambient temperature of the vehicle domain control system, prevent vehicle domain control system failures caused by voltage or environmental factors, and ensure the stability and safety of the vehicle domain control system.

[0105] In some embodiments, the security monitoring module 111 also includes a communication protection submodule.

[0106] The communication protection submodule is configured to perform communication verification on the communication data of the modules in the functional safety domain. During the operation of the vehicle domain control system, the safety monitoring module needs to exchange information with the monitored modules in the process of monitoring the modules in the non-functional safety domain; and in the case of monitoring abnormal operating parameters, the safety monitoring module, the fault diagnosis module and the safety degradation module also need to interact with each other, for example, the system monitoring submodule 1111 sends the first fault information to the fault diagnosis module 112. In this process, the communication protection submodule can perform communication verification on the communication data of the modules in the functional safety domain.

[0107] In other embodiments, the communication protection submodule is further configured to perform communication verification on the security-related data input from the vehicle domain control system. Specifically, when the vehicle domain control system 100 is communicating with an external device, the external device may input security-related data into the vehicle domain control system 100, such as configuration information of the security degradation module; in this case, communication verification is required for the security-related data input from the vehicle domain control system. In the event of a communication verification failure, fault information corresponding to the communication fault is generated.

[0108] Exemplarily, communication verification may be performed by means of a cyclic redundancy check (CRC), a checksum, a rolling counter, or the like.

[0109] In the disclosed embodiment, the communication protection submodule can perform communication verification on the communication data between the modules within the vehicle domain control system and the communication data between the vehicle domain control system and external devices to ensure the integrity, authenticity and reliability of the communication data and prevent communication data errors or losses caused by factors such as software and hardware failures, electromagnetic interference or external attacks.

[0110] In some embodiments, the safety monitoring module 111 further includes a storage detection submodule. The storage detection submodule is configured to monitor the read and write operations of the internal storage or external extended storage data of the vehicle domain control system, and generate fault information corresponding to the storage error when a storage error is detected.

[0111] In some embodiments, the safety monitoring module 111 further includes a clock monitoring submodule. The clock monitoring submodule is configured to monitor the clock signal outside the vehicle domain control system and the clock signal inside the vehicle domain control system. Exemplarily, the clock frequency of the clock signal input can be calculated to determine whether the clock signal is abnormal. When the clock signal abnormality is detected, fault information corresponding to the clock signal is generated.

[0112] In addition, the clock monitoring submodule can monitor and diagnose the time synchronization signals inside and outside the system by monitoring the clock signals inside and outside the vehicle domain control system. When an abnormality of the time synchronization signal is detected, fault information corresponding to the time synchronization signal is generated.

[0113] In some embodiments, the safety monitoring module 111 also includes an OTA monitoring submodule. When remote OTA software flashing is required, the OTA monitoring submodule can judge the OTA flashing conditions; if the flashing conditions are met, the vehicle domain control system can safely enter the OTA state, and if the flashing conditions are not met, fault information corresponding to the abnormal flashing conditions is generated.

[0114] In addition, the OTA monitoring submodule can also perform security checks on the received OTA software packages to prevent incorrect software from being flashed into the vehicle domain control system during the flashing process; and if an error is detected in the OTA software package, it will generate fault information corresponding to the OTA software package.

[0115] The above embodiments introduce multiple modules that may be included in a functional safety domain. The multiple modules can respectively monitor different operating parameters of the vehicle domain control system, and each module is independent of each other, which is helpful for the design and maintenance of each module.

[0116] Based on the same inventive concept, the embodiment of the present disclosure also provides a vehicle, including the vehicle domain control system described in any of the above embodiments. The principle of solving the problem in this vehicle embodiment is similar to that in the above vehicle domain control system embodiment, so the implementation of this embodiment can refer to the implementation of the above vehicle domain control system embodiment, and the repeated parts will not be repeated.

[0117] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0118] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A vehicle domain control system, characterized in that: Including safety monitoring module, fault diagnosis module and safety degradation module; The safety monitoring module is configured to monitor the operating parameters of the vehicle domain control system and generate first fault information when abnormal operating parameters are monitored; The fault diagnosis module is configured to determine a first fault severity level of the vehicle domain control system based on the first fault information, wherein the first fault severity level is positively correlated with a fault severity of the vehicle domain control system; The safety downgrade module is configured to determine a target safety state matching the first fault severity level and a current safety state of the vehicle domain control system, and control the vehicle domain control system to change from the current safety state to the target safety state when the fault severity level corresponding to the current safety state is lower than the first fault severity level.

2. The vehicle domain control system according to claim 1, characterized in that: The security monitoring module is also configured to: Monitoring the fault module corresponding to the abnormal operating parameters; When the current operating parameter of the fault module changes compared to the abnormal operating parameter, generating second fault information corresponding to the current operating parameter of the fault module; The fault diagnosis module is also configured to determine a second fault severity level of the vehicle domain control system based on the second fault information.

3. The vehicle domain control system according to claim 2, characterized in that: The security downgrade module is further configured to: When the second fault severity level indicates that the vehicle domain control system is operating normally, the vehicle domain control system is controlled to change from the target safety state to a normal operating state.

4. The vehicle domain control system according to claim 1, characterized in that: The security monitoring module is also configured to: Monitoring other operating parameters in the vehicle domain control system except the abnormal operating parameters; When the other operating parameters are abnormal, generating third fault information; The fault diagnosis module is also configured to generate a third fault severity level of the vehicle domain control system based on the first fault information and the third fault information.

5. The vehicle domain control system according to claim 1, characterized in that: The vehicle domain control system includes a functional safety domain and a non-functional safety domain, the safety monitoring module, the fault diagnosis module and the safety degradation module are deployed in the functional safety domain, and the fault module corresponding to the abnormal operating parameter is deployed in the non-functional safety domain; The functional safety domain is decoupled from the non-functional safety domain to ensure that the operation of the safety monitoring module, the fault diagnosis module and the safety degradation module are not interfered by the non-functional safety domain.

6. The vehicle domain control system according to claim 1, characterized in that: The target safety state includes any one of a first degraded state, a second degraded state, a third degraded state, and a fourth degraded state, and the fault severity levels corresponding to the first degraded state, the second degraded state, the third degraded state, and the fourth degraded state are increased in sequence; wherein, When the vehicle domain control system is in the first degraded state, the vehicle domain control system operates normally; When the vehicle domain control system is in the second degradation state, the vehicle domain control system operates normally, and the safety degradation module generates fault reminder information corresponding to the first fault information; When the vehicle domain control system is in the third degraded state, the safety degradation module generates a first communication management request, and generates fault reminder information corresponding to the first fault information and a first takeover request, wherein the first communication management request includes a request to cut off external communication of the fault module corresponding to the abnormal operation parameter; When the vehicle domain control system is in the fourth degraded state, the safety downgrade module generates a second communication management request, and generates fault reminder information and a second takeover request corresponding to the first fault information, and the second communication management request includes a request to cut off external communications of all function implementation modules in the vehicle domain control system.

7. The vehicle domain control system according to claim 6, characterized in that: The vehicle domain control system includes a functional safety domain and a non-functional safety domain, the functional safety domain is decoupled from the non-functional safety domain, the safety monitoring module, the fault diagnosis module and the safety degradation module are deployed in the functional safety domain, and the fault module and the function implementation module are deployed in the non-functional safety domain; The functional safety domain also includes: The communication management module is configured to cut off the external communication of the fault module in response to the first communication management request; and / or, in response to the second communication management request, cut off the external communication of all function implementation modules in the vehicle domain control system.

8. The vehicle domain control system according to claim 1, characterized in that: The vehicle domain control system includes a functional safety domain and a non-functional safety domain, the functional safety domain is decoupled from the non-functional safety domain, and the safety monitoring module, the fault diagnosis module and the safety degradation module are deployed in the functional safety domain; Wherein, the security monitoring module includes a system monitoring submodule, and the non-functional security domain includes a function implementation module; The system monitoring submodule is configured to monitor the function implementation module, and when a fault is detected in the function implementation module, reset the faulty function implementation module and generate fault information corresponding to the faulty function implementation module; and / or The system monitoring submodule is also configured to periodically generate an operating status signal, and to stop generating the operating status signal if the fault still exists after the faulty function implementation module is reset, so that the external monitoring module outside the vehicle domain control system can reset the vehicle domain control system when it recognizes that the operating status signal stops being generated.

9. The vehicle domain control system according to claim 1, characterized in that: The security monitoring module includes: A power supply monitoring submodule is configured to monitor whether there is an abnormality in the power supply of the vehicle domain control system by sampling and calculating the power supply voltage of the power supply of the vehicle domain control system, and generate fault information corresponding to the power supply when the power supply is monitored to be abnormal; and / or The temperature monitoring submodule is configured to monitor whether the ambient temperature is abnormal by sampling and calculating the ambient temperature of the vehicle domain control system, and generate fault information corresponding to the ambient temperature when the ambient temperature is abnormal.

10. A vehicle, characterized in that: A vehicle domain control system comprising any one of claims 1 to 9.

Images