Monitoring architecture, domain controller system and vehicle

Abstract

The invention provides a monitoring architecture, a domain controller system and a vehicle, and relates to the technical field of automobile safety. The monitoring architecture comprises a function layer and a function monitoring layer, the function monitoring layer is used for preprocessing a safety input signal to generate a first preprocessed signal and transmitting a copy of the first preprocessed signal to a memory partition of the function layer, and the safety input signal represents an input signal related to the safety of target equipment; the function layer is used for determining safety function output according to the copy of the first preprocessing signal; the function monitoring layer is further used for determining a safety boundary of the safety function output according to the first preprocessing signal and controlling an output stage corresponding to the function layer according to the safety boundary, and the output stage is used for outputting the safety function output to control the target equipment. According to the invention, the input signals of the function layer and the function monitoring layer can be ensured to be homologous and logically synchronous, and the probability of function safety false alarm faults is effectively reduced from the source.

Description

Technical Field

[0001] The present invention relates to the field of automobile safety technology, and in particular to a monitoring architecture, a domain controller system and a vehicle. Background Art

[0002] The E-GAS three-layer monitoring architecture usually includes the functional layer (Level 1), the functional monitoring layer (Level 2) and the safety environment monitoring layer (Level 3). The functional layer (Level 1) includes all application layer control functions. The functional monitoring layer (Level 2) is mainly used to monitor the safety-related functional features (such as torque control, high-voltage control, etc.) in the functional layer (Level 1). The safety environment monitoring layer (Level 3) is used to monitor the underlying software and hardware environment (such as software scheduling, hardware resources, etc.) on which the safety software of the functional monitoring layer (Level 2) relies.

[0003] Since safety-related input signals are preprocessed at the functional layer (Level 1) and the functional monitoring layer (Level 2) respectively, the input signals may no longer remain the same or synchronized after preprocessing, which in turn causes a mismatch between the functional output calculated at the functional layer (Level 1) and the safety boundary calculated at the functional monitoring layer (Level 2), thereby increasing the probability of false alarms of functional safety failures in some scenarios. Summary of the invention

[0004] The problem solved by the present invention is how to reduce the probability of false alarm failure of functional safety.

[0005] To solve the above problems, the present invention provides a monitoring architecture, a domain controller system and a vehicle.

[0006] In a first aspect, the present invention provides a monitoring architecture, comprising a functional layer and a functional monitoring layer;

[0007] The functional monitoring layer is used to pre-process the security input signal to generate a first pre-processed signal, and transmit a copy of the first pre-processed signal to the memory partition of the functional layer, wherein the security input signal represents an input signal related to the security of the target device;

[0008] The functional layer is used to determine a safety function output based on the copy of the first pre-processed signal;

[0009] The function monitoring layer is also used to determine the safety boundary of the safety function output according to the first preprocessing signal, and control the output level corresponding to the function layer according to the safety boundary, wherein the output level is used to output the safety function output to control the target device.

[0010] Optionally, determining the safety function output according to the copy of the first preprocessed signal comprises:

[0011] calling the copy of the first preprocessed signal stored in the memory partition;

[0012] The safety function output corresponding to the safety function control is determined according to the copy of the first pre-processed signal, wherein the safety function control represents a function control that will cause the target device to face a safety risk.

[0013] Optionally, the functional layer is further used for:

[0014] preprocessing a non-safety input signal to generate a second pre-processed signal, wherein the non-safety input signal represents an input signal not related to the safety of the target device;

[0015] A non-safety function output corresponding to a non-safety function control is determined according to the second preprocessing signal, wherein the non-safety function control represents a function control that will not cause the target device to face a safety risk.

[0016] Optionally, the functional layer is further used for:

[0017] preprocessing the non-safety input signal to generate a second preprocessed signal;

[0018] A safety function output and a non-safety function output are determined based on the copy of the first pre-processed signal and the second pre-processed signal.

[0019] Optionally, controlling the output level corresponding to the functional layer according to the safety boundary includes:

[0020] comparing the safety function output to the safety boundary;

[0021] When the safety function output exceeds the safety boundary, the output stage is shut down.

[0022] Optionally, controlling the output level corresponding to the functional layer according to the safety boundary further includes:

[0023] comparing an actual state of the target device with the security boundary;

[0024] When the actual state exceeds the safety limit, the output stage is shut down.

[0025] Optionally, preprocessing the safety input signal to generate a first preprocessed signal includes:

[0026] The safety input signal is at least one of filtered, diagnosed, limited, fault assigned, and multi-input arbitrated to determine the first pre-processed signal.

[0027] Optionally, the monitoring architecture further includes a security environment monitoring layer, and the security environment monitoring layer is used to monitor the underlying software and hardware environment corresponding to the security software of the functional monitoring layer.

[0028] In a second aspect, the present invention provides a domain controller system, comprising the above-mentioned monitoring architecture.

[0029] In a third aspect, the present invention provides a vehicle comprising the above-mentioned domain controller system.

[0030] The monitoring architecture of the present invention has the following beneficial effects: after the functional monitoring layer (Level2) pre-processes the input signal (i.e., the safety input signal) related to the safety of the target device to generate a first pre-processed signal, a copy of the first pre-processed signal is transmitted to the memory partition of the functional layer (Level1); the functional layer (Level1) can determine the safety function output according to the copy of the first pre-processed signal; the functional monitoring layer (Level2) determines the safety boundary of the safety function output according to the first pre-processed signal, and controls the output level of the functional layer (Level1) according to the safety boundary, and outputs the safety function output through the output level to control the target device; by multiplexing the first pre-processed signal, it can be ensured that the input signals of the functional layer (Level1) and the functional monitoring layer (Level2) are of the same source and logically synchronized; the safety function output determined by the functional layer (Level1) and the safety boundary determined by the functional monitoring layer (Level2) are more in line with the design expectations, effectively reducing the probability of functional safety false alarm failures from the source, and reducing unnecessary redundant software development in the functional layer (Level1) to a certain extent, effectively reducing the workload of functional safety development of complex and large systems, and meeting the functional safety requirements for interference-free software between different ASIL software. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The monitoring architecture of the embodiment of the present invention is shown as follows Figure 1 ;

[0032] Figure 2 A schematic diagram of a monitoring architecture according to an embodiment of the present invention;

[0033] Figure 3 The monitoring architecture of the embodiment of the present invention is shown as follows Figure 2 ;

[0034] Figure 4 This is a schematic diagram of the existing monitoring architecture;

[0035] Figure 5 The following is a schematic diagram of the existing monitoring architecture. DETAILED DESCRIPTION

[0036] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be interpreted as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0037] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0038] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to"; the term "based on" means "based at least in part on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments"; the term "optionally" means "optional embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0039] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0040] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0041] In the related technology, combined Figure 4 and Figure 5As shown in the figure, in the traditional E-GAS three-layer monitoring architecture, after the safety-related input signals are preprocessed in the function control layer (Level 1), they will participate in the safety-related and non-safety-related function control together with other non-safety-related signals. On the other hand, the safety-related input signals will also be similarly preprocessed in the function monitoring layer (Level 2), and then the safety boundary of the safety-related functions will be calculated based on the preprocessed signals. Since the software of the function control layer (Level 1) and the function monitoring layer (Level 2) have the requirements of heterogeneous redundancy and independence, the logic algorithms (such as diagnostic verification algorithm, filtering algorithm, signal analysis algorithm, etc.) used in the signal preprocessing of the function control layer (Level 1) and the signal preprocessing of the function monitoring layer (Level 2) are not exactly the same, resulting in the safety-related input signals no longer being the same or synchronized after being preprocessed in the function control layer (Level 1) and the function monitoring layer (Level 2), which in turn leads to the mismatch between the functional output calculated by the function control layer (Level 1) and the safety boundary calculated by the function monitoring layer (Level 2), thereby increasing the probability of false alarm of functional safety failure in certain scenarios. In addition, since the software of the function control layer (Level 1) and the function monitoring layer (Level 2) both have pre-processing logic for safety-related input signals, the cost of repeated software development will increase.

[0042] In response to the problems existing in the above-mentioned related technologies, this embodiment provides a monitoring architecture, a domain controller system and a vehicle.

[0043] like Figure 1 As shown, a monitoring architecture provided by an embodiment of the present invention includes a function layer and a function monitoring layer;

[0044] The functional monitoring layer is used to pre-process the security input signal to generate a first pre-processed signal, and transmit a copy of the first pre-processed signal to the memory partition of the functional layer, wherein the security input signal represents an input signal related to the security of the target device;

[0045] The functional layer is used to determine a safety function output based on the copy of the first pre-processed signal;

[0046] The function monitoring layer is also used to determine the safety boundary of the safety function output according to the first preprocessing signal, and control the output level corresponding to the function layer according to the safety boundary, wherein the output level is used to output the safety function output to control the target device.

[0047] Specifically, combined Figure 2As shown, the monitoring architecture is mainly composed of a functional layer (Level 1) and a functional monitoring layer (Level 2). The functional monitoring layer (Level 2) pre-processes the safety input signal (indicating an input signal related to the safety of the target device) to generate a first pre-processed signal, stores the original of the first pre-processed signal in the ASIL partition, and copies the first pre-processed signal to generate a copy of the first pre-processed signal, and transmits the copy to the memory partition where the functional software of the functional layer (Level 1) is located. Then, the functional layer (Level 1) can determine the safety function output according to the copy of the first pre-processed signal. The functional monitoring layer (Level 2) determines the safety boundary of the safety function output according to the first pre-processed signal, and controls the output stage corresponding to the functional layer (Level 1) according to the safety boundary, and outputs the safety function output through the output stage to control the target device (such as a vehicle). For example, for the real-time torque of the functional layer (Level 1), Control, the functional monitoring layer (Level2) can calculate the maximum allowed requested torque as a safety boundary in real time according to the safety input signal (such as accelerator pedal, vehicle speed, motor feedback torque, etc.); by reusing the first pre-processed signal, it can ensure that the input signals of the functional layer (Level1) and the functional monitoring layer (Level2) are of the same source and logically synchronized, and the safety function output determined by the functional layer (Level1) and the safety boundary determined by the functional monitoring layer (Level2) are more in line with the design expectations, effectively reducing the probability of functional safety false alarm failures from the source; in addition, the reuse of the first pre-processed signal also reduces unnecessary redundant software development in the functional layer (Level1) to a certain extent, effectively reducing the workload of functional safety development of complex and large systems; in addition, since only a copy of the first pre-processed signal is reused during reuse, and the original is not directly reused, the functional safety requirements for interference-free software between different ASILs can be met. The target device can be a vehicle or other hardware device.

[0048] Among them, safety input signals refer to input signals related to the safety of the target device, that is, input signals used by the monitoring function of the functional monitoring layer (Level 2), and need to meet the functional safety level requirements defined by the requirements. Taking the target device as a vehicle as an example, common safety input signals include vehicle speed signals, brake pedal status, and accelerator pedal travel.

[0049] Among them, after the redundant parts in the functional layer (Level 1) are streamlined, the functional monitoring layer (Level 2) assumes part of the functional attributes (such as signal analysis and preprocessing). The functional layer (Level 1) and the functional monitoring layer (Level 2) jointly ensure the functional availability, and the functional monitoring layer (Level 2) can independently ensure the functional safety, so that the monitoring architecture of this embodiment is still a safe software architecture; the streamlined redundant logic in the functional monitoring layer (Level 2) needs to be designed in accordance with the requirements of ASIL (Automotive Safety Integrity Levels), such as selecting a high-coverage signal verification algorithm, a more stringent design and verification process, etc.

[0050] Among them, in addition to the safe software reuse of the signal preprocessing logic mentioned in this embodiment, the functional layer (Level 1) and the functional monitoring layer (Level 2) will also have some other redundant sub-functional features. As long as these software redundancies meet the design requirements of functional safety, they can refer to the above-mentioned architectural ideas for maximum software reuse, thereby saving development costs.

[0051] In this embodiment, after the function monitoring layer (Level2) pre-processes the input signal related to the safety of the target device (i.e., the safety input signal) to generate a first pre-processed signal, a copy of the first pre-processed signal is transmitted to the memory partition of the function layer (Level1). The function layer (Level1) can determine the safety function output according to the copy of the first pre-processed signal, and the function monitoring layer (Level2) determines the safety boundary of the safety function output according to the first pre-processed signal, and controls the output level of the function layer (Level1) according to the safety boundary, and outputs the safety function output through the output level to control the target device. By multiplexing the first pre-processed signal, it can be ensured that the input signals of the function layer (Level1) and the function monitoring layer (Level2) are of the same source and logically synchronized, and the safety function output determined by the function layer (Level1) and the safety boundary determined by the function monitoring layer (Level2) are more in line with the design expectations, effectively reducing the probability of functional safety false alarm failures from the source, and reducing unnecessary redundant software development in the function layer (Level1) to a certain extent, effectively reducing the workload of functional safety development of complex and large systems, and meeting the functional safety requirements for interference-free software between different ASILs.

[0052] Optionally, determining the safety function output according to the copy of the first preprocessed signal comprises:

[0053] calling the copy of the first preprocessed signal stored in the memory partition;

[0054] The safety function output corresponding to the safety function control is determined according to the copy of the first pre-processed signal, wherein the safety function control represents a function control that will cause the target device to face a safety risk.

[0055] Specifically, the function monitoring layer (Level2) pre-processes the safety input signal to generate a copy of the first pre-processed signal, and stores the copy of the first pre-processed signal in the memory partition of the function layer (Level1). The function layer (Level1) can obtain the required copy signal by accessing its own memory partition, and then determine the safety function output corresponding to the safety function control according to the copy of the first pre-processed signal. Since the function layer (Level1) does not directly access the safety partition of the function monitoring layer (Level2), it can ensure the functional safety FFI (Freedom From Interference) design requirement that high-security level software is not interfered by low-security level software.

[0056] Among them, safety function control refers to function control that will cause the target device to face safety risks. Taking the target device as a vehicle, for example, safety function control includes torque control, speed control, and high-voltage power on and off control. Failure of its functions will lead to abnormal output, which may cause safety risks such as unexpected acceleration, deceleration, and high-voltage accidents of the entire vehicle.

[0057] In this optional embodiment, after calling the copy of the first preprocessed signal stored in the memory partition, the functional layer (Level 1) can determine the safety function output based on the copy of the first preprocessed signal. Since the functional layer (Level 1) does not directly access the safety partition of the functional monitoring layer (Level 2), the functional safety FFI design requirement that high-security level software is not interfered with by low-security level software can be ensured.

[0058] Optionally, the functional layer is further used for:

[0059] preprocessing a non-safety input signal to generate a second pre-processed signal, wherein the non-safety input signal represents an input signal not related to the safety of the target device;

[0060] A non-safety function output corresponding to a non-safety function control is determined according to the second preprocessing signal, wherein the non-safety function control represents a function control that will not cause the target device to face a safety risk.

[0061] Specifically, the output stage is also used to output a non-safety function output to control a target device.

[0062] The functional layer (Level 1) pre-processes non-safety input signals (input signals not related to the safety of the target device) according to certain functional control usage requirements, thereby generating a second pre-processed signal. The second pre-processed signal is usually used in non-safety function control (corresponding to non-safety function output) to achieve non-safety function control.

[0063] Among them, non-safety function control refers to function control that will not cause the target device to face safety risks, that is, functional characteristics that will not cause safety risks under normal or abnormal conditions. Taking the target device as a vehicle as an example, non-safety function control includes air-conditioning temperature control and HMI (Human Machine Interface) voice interaction control, etc.

[0064] In this optional embodiment, the preprocessed non-safety input signal is applied to the non-safety function control of the functional layer (Level 1), the non-safety function output corresponding to the non-safety function control is determined, and the non-safety function control can be implemented through the output stage.

[0065] Optionally, the functional layer is further used for:

[0066] preprocessing the non-safety input signal to generate a second preprocessed signal;

[0067] A safety function output and a non-safety function output are determined based on the copy of the first pre-processed signal and the second pre-processed signal.

[0068] Specifically, the functional layer (Level 1) preprocesses the non-safety input signal according to certain functional control usage requirements to generate a second preprocessed signal. The second preprocessed signal can be used in non-safety-related functional control (corresponding to non-safety functional output) or in safety-related functional control (corresponding to safety functional output). Taking the target device as a vehicle as an example, for the vehicle speed signal (a safety input signal), the vehicle speed signal will be used regardless of whether it is a safety-related or non-safety-related function, for example, in non-safety-related functional control:

[0069] (1) Speeding reminder function: When the vehicle speed exceeds the road speed limit of the car navigation system, the system will voice remind the driver "The vehicle is speeding, please slow down"; although this function uses the vehicle speed signal, the failure of this function will not affect vehicle safety, so it is a non-safety-related function control; similar to this is the "instrument display speed function".

[0070] (2) Driving mode switching: This function allows the driver to switch between different power modes, such as power, economy, snow, sand, and racing. If this function fails, the vehicle will always be in a certain mode, but there is no safety risk. Therefore, it is a non-safety-related function control. In addition, mode switching is only allowed at low vehicle speeds (close to stationary), and the vehicle speed signal is also used.

[0071] In addition, safety-related functional control (corresponding to safety function output) will also use non-safety-related signals, that is, non-safety input signals. For example, if the torque control fails, the vehicle will have safety risks of unexpected acceleration, unexpected movement and unexpected emergency braking. Therefore, it belongs to safety-related functional control; but torque control is very complicated. In addition to using the accelerator pedal signal (safety-related signal), it will also use non-safety signals such as road slope and power feedback level (user setting) to correct the torque output style (power and comfort, etc.), and use the engine's operating mode (non-safety-related signal) to reasonably distribute the energy flow so that the engine operates in the high-efficiency zone (for hybrid vehicles) to achieve economical driving.

[0072] Among them, non-safety input signals refer to non-safety-related input signals, that is, input signals that will not be used by the monitoring function in the functional monitoring layer (Level 2); according to the demand definition, non-safety input signals have no functional safety level requirements and generally come directly from external raw inputs.

[0073] The preprocessing process of this embodiment includes filtering, diagnosis, and multi-input arbitration.

[0074] In this optional embodiment, the preprocessed non-safety input signal is applied to the safety function control and non-safety function control of the functional layer (Level 1) to determine the safety function output corresponding to the safety function control and the non-safety function output corresponding to the non-safety function control, thereby realizing safety function control and non-safety function control.

[0075] Optionally, controlling the output level corresponding to the functional layer according to the safety boundary includes:

[0076] comparing the safety function output to the safety boundary;

[0077] When the safety function output exceeds the safety boundary, the output stage is shut down.

[0078] Specifically, the function monitoring layer (Level 2) can monitor whether the function output of the function layer (Level 1) is abnormal by comparing the output of the safety-related function control of the function layer (Level 1) with the safety boundary of the function monitoring layer (Level 2). When the function monitoring layer (Level 2) monitors that the safety function output exceeds the safety boundary and determines that the function output of the function layer (Level 1) is abnormal, it will shut down the output stage and interrupt the abnormal output of the safety-related control function in the function layer (Level 1), such as prohibiting torque output, disconnecting the high-voltage relay, etc.

[0079] In this optional embodiment, the function monitoring layer (Level 2) can monitor whether the function output of the function layer (Level 1) is abnormal by comparing the output of the safety-related function control of the function layer (Level 1) and the safety boundary of the function monitoring layer (Level 2), and can then shut down the output in time when an abnormality occurs, thereby improving the safety of the target device (such as a vehicle).

[0080] Optionally, controlling the output level of the functional layer according to the safety boundary further includes:

[0081] comparing an actual state of the target device with the security boundary;

[0082] When the actual state exceeds the safety limit, the output stage is shut down.

[0083] Specifically, the function monitoring layer (Level 2) determines whether the vehicle is safe by comparing the actual state of the target device (such as a vehicle) with the allowed safety boundary. When the function monitoring layer (Level 2) monitors that the actual state of the vehicle exceeds the safety boundary, it determines that the vehicle is facing a safety risk, and will shut down the output stage to interrupt the abnormal output of the safety-related control function in the function layer (Level 1); when the function control of the function layer (Level 1) is normal and the actual state of the vehicle is within the safety boundary, the output stage will normally send the function control request of the function layer (Level 1) (including safety-related and non-safety-related requests).

[0084] In this optional embodiment, the functional monitoring layer (Level 2) determines whether the vehicle is safe by comparing the actual state of the vehicle with the allowed safety boundary, and can shut down the output in time when the vehicle faces safety risks, thereby improving vehicle safety.

[0085] Optionally, preprocessing the safety input signal to generate a first preprocessed signal includes:

[0086] The safety input signal is at least one of filtered, diagnosed, limited, fault assigned, and multi-input arbitrated to determine the first pre-processed signal.

[0087] Specifically, the functional monitoring layer (Level 2) preprocesses the safety input signal according to certain functional safety usage requirements. The preprocessing process includes at least one of filtering, diagnosis, limiting, fault assignment and multi-channel input arbitration, so as to determine a first preprocessed signal. The first preprocessed signal meets the functional safety level requirements and can directly participate in the functional monitoring of the functional monitoring layer (Level 2).

[0088] Among them, the preprocessing processes are as follows:

[0089] (1) Filtering: In order to eliminate signal noise and environmental interference, the signal needs to be processed to eliminate burrs and smooth transitions; typical examples include accelerator pedal value, vehicle speed value, etc., which all need to be filtered.

[0090] (2) Diagnosis: Before safety-related input signals are used, they need to be diagnosed for faults. Common diagnoses include communication diagnosis (such as E2E detection) and two-way consistency check.

[0091] (3) Limiting: For signals with physical meaning, the maximum and minimum values ​​of the signals need to be limited according to their physical meaning. For example, the physical range of the vehicle speed signal is 0 to 180 kph, and the physical value range of the accelerator pedal opening is 0 to 100 (the signal physical value range here is different from the range of the signal data type).

[0092] (4) Fault assignment: When a fault is detected in the input signal, a safe value needs to be assigned to the signal so as not to affect subsequent functional control.

[0093] (5) Multi-input arbitration: Some key signals, such as throttle and vehicle speed, have multiple redundant sensor inputs (typically divided into primary and backup paths); the user needs to decide when to use the primary path and when to use the backup path.

[0094] In this optional embodiment, the safety input signal is preprocessed by filtering, diagnosis, limiting, fault assignment and multi-input arbitration, thereby improving the accuracy of the safety input signal and enabling subsequent tasks to be performed more accurately and efficiently.

[0095] Optionally, the monitoring architecture further includes a security environment monitoring layer, and the security environment monitoring layer is used to monitor the underlying software and hardware environment corresponding to the security software of the functional monitoring layer.

[0096] Specifically, combined Figure 3As shown, the monitoring architecture also includes a safety environment monitoring layer (Level 3), which is used to monitor the underlying software and hardware environment (such as software scheduling, hardware resources, etc.) on which the safety software of the functional monitoring layer (Level 2) depends on to run, and when a fault is detected, the output stage is shut down through an independent channel (such as resetting, pulling down the error pin, etc.).

[0097] In this optional embodiment, the underlying software and hardware environment corresponding to the security software of the functional monitoring layer (Level 2) is monitored by the security environment monitoring layer (Level 3) to ensure the normal operation of the functional monitoring layer (Level 2).

[0098] Another embodiment of the present invention provides a domain controller system, including the above-mentioned monitoring architecture.

[0099] The advantages of the domain controller system of this embodiment compared with the prior art are the same as the advantages of the above-mentioned monitoring architecture compared with the prior art, which will not be repeated here.

[0100] Another embodiment of the present invention provides a vehicle, comprising the above-mentioned domain controller system.

[0101] The advantages of the vehicle of this embodiment over the prior art are the same as the advantages of the above-mentioned monitoring architecture over the prior art, which will not be repeated here.

[0102] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. A monitoring architecture, characterized in that: Includes a functional layer and a functional monitoring layer; The functional monitoring layer is used to pre-process the security input signal to generate a first pre-processed signal, and transmit a copy of the first pre-processed signal to the memory partition of the functional layer, wherein the security input signal represents an input signal related to the security of the target device; The functional layer is used to determine a safety function output based on the copy of the first pre-processed signal; The function monitoring layer is also used to determine the safety boundary of the safety function output according to the first preprocessing signal, and control the output level corresponding to the function layer according to the safety boundary, wherein the output level is used to output the safety function output to control the target device.

2. The monitoring architecture according to claim 1, characterized in that: Determining a safety function output based on a copy of the first pre-processed signal comprises: calling the copy of the first preprocessed signal stored in the memory partition; The safety function output corresponding to the safety function control is determined according to the copy of the first pre-processed signal, wherein the safety function control represents a function control that will cause the target device to face a safety risk.

3. The monitoring architecture according to claim 1, characterized in that: The functional layer is also used for: preprocessing a non-safety input signal to generate a second pre-processed signal, wherein the non-safety input signal represents an input signal not related to the safety of the target device; A non-safety function output corresponding to a non-safety function control is determined according to the second preprocessing signal, wherein the non-safety function control represents a function control that will not cause the target device to face a safety risk.

4. The monitoring architecture according to claim 1, characterized in that: The functional layer is also used for: preprocessing the non-safety input signal to generate a second preprocessed signal; A safety function output and a non-safety function output are determined based on the copy of the first pre-processed signal and the second pre-processed signal.

5. The monitoring architecture according to claim 2, characterized in that: The controlling the output level corresponding to the functional layer according to the safety boundary comprises: comparing the safety function output to the safety boundary; When the safety function output exceeds the safety boundary, the output stage is shut down.

6. The monitoring architecture according to claim 5, characterized in that: The controlling the output level corresponding to the functional layer according to the safety boundary further comprises: comparing an actual state of the target device with the security boundary; When the actual state exceeds the safety limit, the output stage is shut down.

7. The monitoring architecture according to any one of claims 1 to 6, characterized in that: The preprocessing of the safety input signal to generate a first preprocessed signal comprises: The safety input signal is at least one of filtered, diagnosed, limited, fault assigned, and multi-input arbitrated to determine the first pre-processed signal.

8. The monitoring architecture according to any one of claims 1 to 6, characterized in that: It also includes a security environment monitoring layer, which is used to monitor the underlying software and hardware environment corresponding to the security software of the function monitoring layer.

9. A domain controller system, characterized in that: The monitoring architecture comprises any one of claims 1 to 8.

10. A vehicle, characterized in that: Includes the domain controller system as described in claim 9.

Images