VCU function safety architecture and vehicle

Abstract

The invention relates to the technical field of vehicle control, in particular to a VCU function safety architecture and a vehicle. The VCU function safety architecture comprises an SBC chip and an MCU chip; the SBC chip is powered by an external power supply and provides external power supply voltage for the MCU chip; an ADC (Analog to Digital Converter) in the MCU chip is divided into at least two independent ADC acquisition domains, and each ADC acquisition domain comprises a plurality of paths of ADCs; and each ADC acquisition domain is powered by an independent power supply and a reference power supply, so that the other ADC acquisition domain can continue to work normally when the power supply of any ADC acquisition domain fails. According to the invention, through redundancy collection design and data interaction of an internal chip of a single controller, the purpose of higher function safety is achieved.

Description

Technical Field

[0001] The present invention relates to the field of vehicle control technology, and in particular to a VCU functional safety architecture and a vehicle. Background Art

[0002] Currently, high-level VCU functional safety often uses redundant controller monitoring, which improves reliability, but increases hardware costs, occupies space, and requires strict software synchronization and efficient data communication. The algorithm is highly complex and difficult to maintain. At the same time, the entire control loop also requires redundant design, which increases the difficulty of fault diagnosis and isolation, and increases system complexity and maintenance costs. High real-time requirements require the integration of advanced algorithms to ensure rapid response.

[0003] For example, the redundant control system disclosed in patent document CN205068150U includes a main processor, a backup processor and a redundant controller. The redundant controller is electrically connected to the main processor and the backup processor, and is used to control the switching between the main processor and the backup processor according to the operating status of the main processor and the backup processor, thereby improving the reliability of the redundant control system. However, this system still adopts the redundant controller method.

[0004] Therefore, it is necessary to develop a new VCU functional safety architecture and vehicle. Summary of the invention

[0005] The purpose of the present invention is to provide a VCU functional safety architecture and a vehicle to improve functional safety.

[0006] In a first aspect, a VCU functional safety architecture according to the present invention includes an SBC chip and an MCU chip; The SBC chip is powered by an external power supply and provides an external power supply voltage for the MCU chip; The ADC inside the MCU chip is divided into at least two independent ADC acquisition domains, and each ADC acquisition domain contains multiple ADCs; Each of the ADC acquisition domains is powered by an independent power supply and a reference power supply to ensure that when the power supply of any ADC acquisition domain fails, the other ADC acquisition domain can continue to work normally.

[0007] Optionally, the MCU chip collects the power supply voltage output by the SBC chip through one ADC, and collects the power supply voltage at the front end of the SBC chip through another ADC. The present invention collects the power supply voltage through dual-channel redundant acquisition to enhance the monitoring capability of the power supply system.

[0008] Optionally, the MCU chip collects the power supply voltage output by the SBC chip through one ADC in one ADC acquisition domain, and collects the power supply voltage of the front end of the SBC chip through one ADC in another ADC acquisition domain. The two ADCs are respectively set in different ADC acquisition domains. Since the two ADC acquisition domains are powered by independent power supplies and reference power supplies, the safety is better than setting the two ADCs in the same ADC acquisition domain.

[0009] Optionally, at least one ADC in each ADC acquisition domain acquires the reference voltage of the other ADC acquisition domain, thereby realizing mutual monitoring between the ADC acquisition domains and improving the overall security of the system.

[0010] Optionally, each ADC acquisition domain has two ADCs to acquire the reference voltage of the other ADC acquisition domain. When one ADC fails, the other ADC can still work normally, further enhancing the redundancy and accuracy of monitoring.

[0011] Optionally, two ADCs are used to collect external signals input to the MCU chip. The present invention uses two ADCs to collect external signals to avoid unreliable signal collection due to ADC failure.

[0012] Optionally, two ADCs are used to collect external signals input to the MCU chip, and the two ADCs are respectively configured in different ADC acquisition domains inside the MCU chip. The present invention sets the two ADCs in different ADC acquisition domains. Since the two ADC acquisition domains are powered by independent power supplies and reference power supplies, the safety is better than setting the two ADCs in the same ADC acquisition domain.

[0013] Optionally, two ADCs are used to collect the power supply of the external signal. The present invention designs dual redundant collection of the power supply of the external signal, and determines the reliability of the signal by the supply voltage, thereby avoiding unreliable signal collection values ​​caused by power supply failure of the signal.

[0014] Optionally, the power supply of the external signal is collected by two ADCs, and the two ADCs are respectively configured in different ADC acquisition domains inside the MCU chip. The present invention sets the two ADCs in different ADC acquisition domains. Since the two ADC acquisition domains are powered by independent power supplies and reference power supplies, the safety is better than setting the two ADCs in the same ADC acquisition domain.

[0015] In a second aspect, a vehicle described in the present invention adopts the VCU functional safety architecture described in the present invention.

[0016] Beneficial effects of the present invention: (1) The ADC inside the MCU chip is divided into at least two independent acquisition domains, each of which is powered by an independent power supply and reference power supply. This design ensures that when the power supply of one ADC acquisition domain fails, the other acquisition domain can continue to work normally, thereby ensuring the continuity and reliability of data acquisition.

[0017] (2) The MCU chip collects the power supply voltage output by the SBC chip and the power supply voltage at the front end of the SBC chip through two ADCs. This dual-channel redundant acquisition method enhances the monitoring capability of the power supply system and can accurately monitor the power supply status when any ADC fails.

[0018] (3) At least one ADC in each ADC acquisition domain acquires the reference voltage of the other acquisition domain, realizing mutual monitoring between the acquisition domains. This design improves the overall safety of the system and prevents the failure of the entire system caused by a single acquisition domain failure.

[0019] (4) Two ADCs are used to collect external signals input to the MCU chip, avoiding the problem of unreliable signal collection due to ADC failure. At the same time, the two ADCs are configured in different ADC collection domains inside the MCU chip, further improving security.

[0020] (5) Two ADCs are also used to collect the power supply of external signals, and the reliability of the signal is judged by the power supply voltage. This design can avoid the problem of unreliable signal acquisition values ​​caused by power supply failure.

[0021] In summary, the entire architecture of the present invention greatly improves the overall safety of the system through multi-layer redundant design (such as power supply redundancy, ADC acquisition redundancy, signal acquisition redundancy, etc.). Even when some components or systems fail, the normal operation of the system can be maintained through other redundant components. The present invention achieves the purpose of higher functional safety through redundant acquisition design and data interaction of the internal chips of a single controller itself. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 Schematic diagram of the acquisition domain in the VCU functional safety architecture described in the embodiment of the present application; Figure 2 The principle of dual-channel redundant acquisition of power supply voltage in the embodiment of the present application Figure 1 ; Figure 3 The principle of dual-channel redundant acquisition of power supply voltage in the embodiment of the present application Figure 2 ; Figure 4 The principle of reference power supply redundancy acquisition in the embodiment of this application Figure 1 ; Figure 5 The principle of reference power supply redundancy acquisition in the embodiment of this application Figure 2 ; Figure 6 The principle of redundant acquisition of external signals in the embodiment of the present application Figure 1 ; Figure 7 The principle of redundant acquisition of external signals in the embodiment of the present application Figure 2 ; Figure 8 The principle of dual redundant acquisition of power supply for external signals in the embodiment of the present application Figure 1 ; Fig. 9 The principle of dual redundant acquisition of power supply for external signals in the embodiment of the present application Figure 2 ; Fig.10 This is a schematic diagram of the structure of the VCU functional safety architecture in an embodiment of the present application; In the figure: 1-MCU chip, 11-A1 domain, 12-A2 domain, 2-SBC chip. DETAILED DESCRIPTION

[0023] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0024] like Figure 1 As shown in the embodiment of the present application, a VCU functional safety architecture includes an SBC chip 2 and an MCU chip 1. The SBC chip 2 is powered by an external 12V power supply (i.e. Figure 1 The ADC inside the MCU chip 1 is divided into at least two independent ADC acquisition domains, namely the A1 domain 11 and the A2 domain 12, each of which contains multiple ADCs. Each ADC acquisition domain is powered by an independent power supply and reference power supply to ensure that when the power supply of any ADC acquisition domain fails, the other ADC acquisition domain can continue to work normally, and at the same time, it can be used as a self-diagnosis to ensure the continuity and reliability of data acquisition.

[0025] like Figure 2As shown, in a possible embodiment, the MCU chip 1 collects the power supply voltage output by the SBC chip 2 through one ADC, and collects the power supply voltage at the front end of the SBC chip 2 through another ADC, thereby forming dual-channel redundant collection and enhancing the monitoring capability of the power supply system.

[0026] like Figure 3 As shown, in a possible embodiment, the MCU chip 1 collects the power supply voltage output by the SBC chip 2 through one ADC in one ADC collection domain, and collects the power supply voltage at the front end of the SBC chip 2 through one ADC in another ADC collection domain. The two ADCs are respectively set in different ADC collection domains. Since the two ADC collection domains are powered by independent power supplies and reference power supplies, compared with setting the two ADCs in the same ADC collection domain, it is safer.

[0027] like Figure 4 As shown, in a possible embodiment, at least one ADC in each ADC acquisition domain acquires the reference voltage of the other acquisition domain, thereby ensuring that the reference voltage is within a normal range, realizing mutual monitoring between ADC acquisition domains, and improving the overall safety of the system.

[0028] like Figure 5 As shown, in a possible embodiment, each ADC acquisition domain has two ADCs to acquire the reference voltage of the other acquisition domain. When one ADC fails, the other ADC can still work normally, further enhancing the redundancy and accuracy of monitoring.

[0029] like Figure 6 As shown, in a possible embodiment, each pair of external signals input to the MCU chip 1 is collected using two ADCs. The external signals are collected using two ADCs to avoid unreliable signal collection due to ADC failure.

[0030] like Figure 7 As shown, in a possible embodiment, two ADCs are used to collect external signals input to the MCU chip 1, and the two ADCs are respectively configured in different ADC acquisition domains inside the MCU chip 1. The two ADCs are respectively set in different ADC acquisition domains. Since the two ADC acquisition domains are powered by independent power supplies and reference power supplies, compared with setting the two ADCs in the same ADC acquisition domain, the two ADCs are safer.

[0031] like Figure 8 As shown, in a possible embodiment, two ADCs are used to collect the power supply of the external signal. Dual-channel redundant collection is designed for the power supply of the external signal, and the reliability of the signal is judged by the power supply voltage, which can avoid unreliable signal collection values ​​caused by power supply failure of the signal.

[0032] like Fig. 9 As shown, in a possible embodiment, two ADCs are used to collect the power supply of the external signal, and the two ADCs are respectively configured in different ADC acquisition domains inside the MCU chip 1. The two ADCs are respectively set in different ADC acquisition domains. Since the two ADC acquisition domains are powered by independent power supplies and reference power supplies, compared with setting the two ADCs in the same ADC acquisition domain, the safety is better.

[0033] In the embodiment of the present application, VCU is a vehicle control unit; SBC chip 2 is a system basic chip; ADC is an analog-to-digital converter; and MCU chip 1 is a micro control unit.

[0034] In a possible embodiment, the VCU functional safety architecture is implemented by using an SBC chip 2 and an MCU chip 1 that meet ASIL B level to cooperate with each other.

[0035] like Fig.10 As shown, the following is explained with examples: 1. 12V (VBAT) voltage redundant acquisition: 12V is used to power the SBC, which is collected by the SBC chip 2 and monitored by an ADC inside the MCU chip 1 ( Fig.10 In the example, the ADC in A1 domain 11 is selected; at the same time, another ADC in MCU chip 1 is selected ( Fig.10 The ADC in A1 domain 11 is selected as an example) and the 12V voltage at the front end of SBC chip 2 is directly collected through the filter voltage divider circuit to form a dual-channel redundant collection. An anti-reverse connection circuit and a switch are also set between the filter voltage divider circuit and VBAT.

[0036] 2. Redundant collection of ADC reference power supply: Select two ADCs in A1 domain 11 to collect the reference voltage of A2 domain 12 to ensure that the reference voltage of ADC in A2 domain 12 is within the normal range. Similarly, two ADCs in A2 domain 12 collect the reference voltage of A1 domain 11 in two ways. For output pins that meet the requirements, they can be supplied directly; for output pins that do not meet the requirements or cannot be directly connected by wires, they can be used after conversion by module circuits (such as Fig.10 The VREF_A1 voltage does not meet the power supply requirements and is used after conversion by the Tracker circuit).

[0037] 3. Redundant acquisition of external signals: (1) Use dual-channel ADC to collect external signals to avoid unreliable signals after ADC failure: Fig.10 The X analog signal and Y analog signal in the figure represent the power supply analog signal, which is collected by dual-channel redundancy. Fig.10, the X analog signal is collected by two ADCs in the A1 domain 11, and the Y analog signal is collected by two ADCs in the A1 domain 11.

[0038] Z digital signal means digital signal (such as hand-gear signal), which is collected by dual-channel redundancy. Fig.10 , select two IO ports for collection.

[0039] (2) Use dual-channel redundant acquisition for the power supply of external signals to avoid signal unreliability caused by power supply failure: like Fig.10 As shown, two X analog signals (including X analog signal 1 and X analog signal 2) represent external non-power analog signals, such as accelerator pedal signals, so the power supply of the X analog signals does not need to be monitored.

[0040] like Fig.10 As shown, two Y analog signals (including Y analog signal 1 and Y analog signal 2) are powered by two independent power supplies, and each power supply needs to be set up with dual-channel acquisition (such as power supply 1).

[0041] like Fig.10 As shown, two Z digital signals (including Z digital signal 1 and Z digital signal 2) are powered by the same power supply (such as power supply 2), and two ADCs are set for acquisition and monitoring.

[0042] In an embodiment of the present application, a vehicle adopts the VCU functional safety architecture as described in the embodiment of the present application.

[0043] The above-mentioned embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above-mentioned embodiments. Any other changes, modifications, substitutions, combinations and simplifications made without departing from the spirit and principle of the present invention shall be equivalent replacement modes and shall be included in the protection scope of the present invention.

Claims

1. A VCU functional safety architecture, comprising an SBC chip (2) and an MCU chip (1), characterized in that: The SBC chip (2) is powered by an external power supply and provides an external power supply voltage for the MCU chip (1); The ADC inside the MCU chip (1) is divided into at least two independent ADC acquisition domains, each ADC acquisition domain containing multiple ADC channels; Each of the ADC acquisition domains is powered by an independent power supply and a reference power supply to ensure that when the power supply of any ADC acquisition domain fails, the other ADC acquisition domain can continue to work normally.

2. The VCU functional safety architecture according to claim 1, characterized in that: The MCU chip (1) monitors the power supply voltage output by the SBC chip (2) through one ADC, and simultaneously collects the power supply voltage at the front end of the SBC chip (2) through another ADC.

3. The VCU functional safety architecture according to claim 1, characterized in that: The MCU chip (1) collects the power supply voltage output by the SBC chip (2) through one ADC in one ADC collection domain, and simultaneously collects the power supply voltage at the front end of the SBC chip (2) through one ADC in another ADC collection domain.

4. The VCU functional safety architecture according to claim 1, characterized in that: At least one ADC in each ADC acquisition domain acquires the reference voltage of the other ADC acquisition domain.

5. The VCU functional safety architecture according to claim 4, characterized in that: Each ADC acquisition domain has two ADCs to acquire the reference voltage of the other acquisition domain.

6. The VCU functional safety architecture according to claim 1, characterized in that: Two ADCs are used to collect external signals input to the MCU chip (1).

7. The VCU functional safety architecture according to claim 1, characterized in that: Two ADCs are used to collect external signals input to the MCU chip (1), and the two ADCs are respectively configured in different ADC collection domains inside the MCU chip (1).

8. The VCU functional safety architecture according to claim 1, characterized in that: The power supply of the external signal is collected by two ADCs.

9. The VCU functional safety architecture according to claim 1, characterized in that: The power supply of the external signal is collected using two ADCs, and the two ADCs are respectively configured in different ADC collection domains inside the MCU chip (1).

10. A vehicle, characterized in that: Adopt the VCU functional safety architecture as described in claim 8.

Images