Vehicle control apparatus, method, storage medium, and vehicle

Abstract

The present disclosure provides a control device for a vehicle configured to receive a first signal from a first detection unit; receive a second analog signal from a second detection unit, wherein the first signal and the second analog signal are associated signals independently generated in response to a same operating state of an operating component of the vehicle; and generate and send a fourth signal for controlling the vehicle to a processing device by at least a plausibility check of the first signal and a second signal generated based on the second analog signal as a digital signal, the fourth signal comprising the first signal and a third signal generated based on the first signal and the second signal, wherein a safety level of the first detection unit and the second detection unit is a first level, a safety level of the control device is a second level, and wherein the fourth signal is usable for the processing device having a third level superior to the first level and the second level.

Description

Technical Field

[0001] This invention relates to a control device, method, storage medium, program product, and vehicle for use in a vehicle. Background Technology

[0002] ASIL (Automotive Safety Integrity Level) is a concept defined in the ISO 26262 standard. It is used to assess the safety risk level of automotive electronic systems and guide the stringency of safety measures required during development. ASIL levels are divided into four levels from low to high: ASIL A, ASIL B, ASIL C, and ASIL D, with safety increasing progressively. In addition, there is a QM (Quality Management) level. Any system or function that does not require specific functional safety design or verification measures and does not need to meet the functional safety requirements of ISO 26262 is classified as QM. When determining the ASIL level, Severity (S), Exposure (E), and Controllability (C) need to be considered. By combining the levels of these three factors (S, E, C), the ASIL level of the system can be determined. ASIL levels are an important tool for ensuring the functional safety of automotive electronic systems. By properly assessing and applying ASIL levels, the safety risks of automobiles can be effectively reduced.

[0003] To achieve higher safety levels, the control system needs to guarantee a higher safety level. This means that data detection, processing, and transmission must all meet higher safety standards. For example, to achieve ASIL C level functionality, a single ASIL C level microcontroller unit (MCU) can typically be used, or a combination of an ASIL B level MCU and an ASIL A level MCU. However, the cost of an ASIL C level MCU or a combination of an ASIL B level MCU and an ASIL A level MCU can be relatively high.

[0004] Therefore, a solution is desired that can achieve high security levels at a low cost. Summary of the Invention

[0005] According to one aspect of the present disclosure, a control device for a vehicle is provided, configured to: receive a first signal from a first detection unit, the first signal having at least a data field and a verification field; receive a second analog signal from a second detection unit, wherein the first signal and the second analog signal are associated signals independently generated in response to the same operating state of an operating component of the vehicle; and generate and send to a processing device a fourth signal for controlling the vehicle, the fourth signal including the first signal and a third signal generated based on the first signal and the second signal, the third signal indicating the operating state of the operating component, wherein the security level of the first detection unit and the second detection unit is a first level, the security level of the control device is a second level, and wherein the fourth signal can be used by the processing device at a third level of security, which is superior to the first level and the second level.

[0006] For example, the control device according to an embodiment of the present disclosure further includes a first interface and a second analog-to-digital converter, wherein the control device is configured to receive the first signal from the first detection unit through the first interface, and the control device is configured to receive the second analog signal from the second detection unit through the second analog-to-digital converter and convert the second analog signal into a second signal.

[0007] For example, in a control device according to an embodiment of the present disclosure, the first level is QM level or ASIL B level, the second level is ASIL B level, and the third level is ASIL C level or ASIL D level; or the first level is ASIL C level, the second level is ASIL A level, and the third level is ASIL D level.

[0008] For example, in a control device according to an embodiment of the present disclosure, the first signal is at least one of a Serial Peripheral Interface (SPI) signal, a SENT signal, and an I2C signal.

[0009] For example, in a control device according to an embodiment of the present disclosure, the first signal is an SPI signal, and the first signal includes one or more of an indication of a high level of a data field, an indication of a high level of a count field, and an indication of a high level of a check field.

[0010] For example, in a control device according to an embodiment of the present disclosure, the verification field of the first signal includes at least one of a cyclic redundancy check field, a parity check field, and a checksum field for performing end-to-end E2E protection, and the data field of the first signal indicates the operating state of the vehicle's operating components detected by the first detection unit.

[0011] For example, in a control device according to an embodiment of the present disclosure, the third signal has at least a data field and a check field, the check field of the third signal including at least one of a cyclic redundancy check field, a parity check field, and a checksum field for performing end-to-end E2E protection, and the data field of the third signal indicating the operating state of the vehicle's operating components determined based on the first signal and the second signal.

[0012] For example, in a control device according to an embodiment of the present disclosure, the first detection unit includes an SPI sensor, the SPI sensor including a sensor whose output signal is an SPI type signal, wherein the first signal is generated by the SPI sensor in response to the operating state of the vehicle's operating components.

[0013] For example, in a control device according to an embodiment of the present disclosure, the first detection unit includes an SPI converter and a first detection circuit, wherein the first detection circuit is configured to generate a first analog signal in response to an operating state of an operating component of the vehicle, and the SPI converter is configured to convert the first analog signal into the first signal.

[0014] For example, in a control device according to an embodiment of the present disclosure, the control device further includes a first analog-to-digital converter configured to receive the first analog signal from the first detection circuit and convert the first analog signal into a fifth signal, wherein the rationality check includes: performing a rationality check on the first signal and the fifth signal, and performing a rationality check on the first signal and the second signal in response to the first signal and the fifth signal passing the rationality check.

[0015] For example, the control device according to an embodiment of the present disclosure further includes a second interface, wherein the second interface is at least one of a Controller Area Network (CAN) interface, a Local Area Network (LIN) interface, a CAN Flexible Data Rate (FD) interface, and a FlexRay interface, the control device is configured to send the fourth signal through the second interface, and wherein the fourth signal is at least one of a CAN message, a LIN message, a CAN FD message, and a FlexRay message, and the first signal and the third signal are included in the data field of at least one of the CAN message, the LIN message, the CAN FD message, and the FlexRay message.

[0016] For example, in a control device according to an embodiment of the present disclosure, the first signal in the data field of the fourth signal is self-verified at the processing device based on a verification field of the first signal, wherein, in response to at least the first signal passing the self-verification, the first signal and the third signal in the data field of the fourth signal are subjected to a rationality check at the processing device to confirm the operating state of the operating component.

[0017] For example, in a control device according to an embodiment of the present disclosure, the first signal in the data field of the fourth signal is self-verified at the processing device based on a verification field of the first signal, and the third signal is self-verified at the processing device based on a verification field of the third signal, wherein, in response to both the first signal and the third signal passing the self-verification, the first signal and the third signal in the data field of the fourth signal are subjected to a rationality check at the processing device to confirm the operating state of the operating component.

[0018] For example, in the control device according to an embodiment of the present disclosure, the operating state of the operating component includes the enabled and disabled states of the vehicle's parking control component.

[0019] For example, in a control device according to an embodiment of the present disclosure, the operating state of the operating component includes the rotation angle of the steering wheel of the vehicle.

[0020] For example, in a control device according to an embodiment of the present disclosure, the steering wheel has a transmission relationship with a large gear, a first small gear, and a second small gear, the steering wheel and the large gear have the same rotation angle, the first signal indicates a first rotation angle of the first small gear, and the second signal indicates a second rotation angle of the second small gear.

[0021] For example, the control device according to an embodiment of the present disclosure is further configured to: in response to the first signal and the second signal passing the rationality check, generate a third signal indicating a third rotation angle of the large gear based on the first rotation angle, the first rotation angle, and the transmission relationship.

[0022] For example, in a control device according to an embodiment of the present disclosure, the first signal and the third signal included in the fourth signal are respectively subjected to differential calculation in time at the processing device and a rationality check is performed based on the transmission relationship to confirm the rotation angle of the vehicle's steering wheel.

[0023] According to one aspect of the present disclosure, a method for a control device for a vehicle is provided, comprising: receiving a first signal from a first detection unit, the first signal having at least a data field and a check field; receiving a second analog signal from a second detection unit, wherein the first signal and the second analog signal are associated signals independently generated in response to the same operating state of an operating component of the vehicle; and generating and sending a fourth signal for controlling the vehicle to a processing device, at least by verifying the reasonableness of the first signal and / or a second signal generated as a digital signal based on the second analog signal, the fourth signal including the first signal and a third signal generated based on the first signal and the second signal, wherein the security level of the first detection unit and the second detection unit is a first level, the security level of the control device is a second level, and wherein the fourth signal can be used by the processing device having a security level of a third level superior to the first level and the second level.

[0024] According to one aspect of the present disclosure, a computer-readable storage medium is provided having instructions stored thereon that, when executed by a processor, cause the processor to perform the above-described method, which will not be described again here to avoid redundancy.

[0025] According to one aspect of the present disclosure, a computer program product is provided, including a computer program or instructions, wherein the computer program or instructions implement the above-described method when executed by a processor, and will not be described again here to avoid redundancy.

[0026] According to one aspect of the embodiments of this disclosure, a vehicle is provided, including the control device, the computer-readable storage medium, or the computer program product described above, which will not be described again here to avoid redundancy.

[0027] According to the control device, method, storage medium, program product, and vehicle disclosed herein, a higher safety level function can be achieved using a smaller number of lower safety level control devices. Therefore, the costs associated with improving the safety level can be significantly reduced. Attached Figure Description

[0028] The above and other aspects, features, and advantages of specific embodiments of the present disclosure will become clearer from the following description taken in conjunction with the accompanying drawings, in which:

[0029] Figure 1 A schematic diagram of a control device for a vehicle according to an embodiment of the present disclosure is shown.

[0030] Figure 2 A schematic diagram of a control device for a vehicle according to another embodiment of the present disclosure is shown.

[0031] Figure 3A A schematic diagram of the data structure of an SPI signal according to an embodiment of the present disclosure is shown.

[0032] Figure 3B A schematic diagram of the waveform of an SPI signal according to an embodiment of the present disclosure is shown.

[0033] Figure 3C A schematic diagram of the data structure of the SENT signal according to an embodiment of the present disclosure is shown.

[0034] Figure 3D A schematic diagram of the data structure of a third signal according to an embodiment of the present disclosure is shown.

[0035] Figure 3E A schematic diagram of a CAN message data structure according to an embodiment of the present disclosure is shown.

[0036] Figure 4 A schematic diagram of a second detection circuit according to an embodiment of the present disclosure is shown.

[0037] Figure 5 A schematic diagram of a control device for a vehicle according to another embodiment of the present disclosure is shown.

[0038] Figure 6 A schematic diagram of a first detection circuit according to an embodiment of the present disclosure is shown.

[0039] Figure 7 A schematic diagram of a control device for a vehicle according to another embodiment of the present disclosure is shown.

[0040] Figure 8 A schematic diagram of a steering wheel assembly of a vehicle according to an embodiment of the present disclosure is shown.

[0041] Figure 9 A schematic diagram of a method for a control device for a vehicle according to an embodiment of the present disclosure is shown.

[0042] Figure 10 A non-transitory computer-readable storage medium according to an embodiment of the present disclosure is shown.

[0043] Figure 11 A vehicle according to an embodiment of the present disclosure is shown. Detailed Implementation

[0044] Before proceeding with the detailed description below, it may be advantageous to define certain words and phrases used throughout this disclosure. The terms “comprising” and “including” and their derivatives mean, but are not limited to, “including”. The phrase “at least one”, when used with a list of items, means that different combinations of one or more of the listed items may be used, and that only one item in the list may be required. For example, “at least one of A, B, and C” includes any one of the following combinations: A, B, C, A and B, A and C, B and C, A and B and C.

[0045] Definitions of other specific words and phrases are provided throughout this disclosure. Those skilled in the art will understand that, in many, if not most, cases, such definitions apply to the prior and future use of the words and phrases thus defined.

[0046] The various embodiments of the principles of this disclosure described below in conjunction with the accompanying drawings are for illustrative purposes only and should not be construed as limiting the scope of this disclosure in any way. Those skilled in the art will understand that the principles of this disclosure can be implemented in any suitably arranged system or device. In some cases, the actions described in this disclosure may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific order or sequential sequence to achieve the desired result. In certain embodiments, multitasking and parallel processing may be advantageous.

[0047] The text and accompanying drawings are provided by way of example only to aid in understanding this disclosure. They should not be construed as limiting the scope of the claims appended to this disclosure in any way. Throughout the drawings, the same reference numerals generally indicate the same elements. Although certain embodiments and examples have been provided, it will be apparent to those skilled in the art, based on the content of this disclosure, that changes may be made to the illustrated embodiments and examples without departing from the scope of this disclosure.

[0048] Figure 1 A schematic diagram of a control device for a vehicle according to an embodiment of the present disclosure is shown.

[0049] The first detection unit 1200 and the second detection unit 1300 can independently detect the operating state of the vehicle's operating components 1100. For example, the operating components may include the vehicle's braking system, steering wheel, etc., but this disclosure is not limited thereto. The first detection unit 1200 can detect the operating state of the vehicle's operating components 1100 and generate a first signal. The second detection unit 1300 can detect the operating state of the vehicle's operating components 1100 and generate a second analog signal. That is, the first signal and the second analog signal are independently generated associated signals in response to the same operating state of the vehicle's operating components. The analog signal may include analog electrical signals, which may include level signals, but this disclosure is not limited thereto.

[0050] The control device 1400 can receive a first signal from the first detection unit 1200. The control device 1400 can receive a second analog signal from the second detection unit 1300. According to an embodiment of this disclosure, the first signal has at least a data field and a check field. The data field can be used to carry the actual valid information to be transmitted, i.e., the payload. The check field can be used to detect or correct errors that may occur in the first signal during transmission.

[0051] The control device 1400 can generate a second signal as a digital signal based on the second analog signal. That is, the control device 1400 can convert the second analog signal into a second signal as a digital signal.

[0052] The control device 1400 can generate a fourth signal by at least verifying the validity of the first signal and / or the second signal. Specifically, according to one embodiment of this disclosure, the control device 1400 can perform a validity check on the first signal and / or the second signal, and in response to the first signal and the second signal passing the validity check, the control device 1400 can generate a third signal. The third signal can indicate the operating state of the operating component. The control device 1400 can further combine the first signal and the third signal to generate a fourth signal in response to the first signal and the second signal passing the validity check. The control device 1400 can send the fourth signal for controlling the vehicle to the processing device 1500.

[0053] For example, the fourth signal can indicate the state of the vehicle's operating components, and the processing device 1500 can control the vehicle's operation based on the fourth signal. For example, the processing device 1500 can control the vehicle to perform a parking operation based on the fourth signal indicating the parking state of the parking control component. According to one embodiment of this disclosure, the fourth signal may include a first signal and a third signal generated based on the first and second signals. That is, the first and third signals may be included in the fourth signal as part of the fourth signal.

[0054] The security level of the first detection unit 1200 and the second detection unit 1300 can be at the first level. In one embodiment, the security level may include various ASIL levels (e.g., ASIL A, B, C, D, etc.) and QM levels. The security level of the control device 1400 can be at the second level. The security level of the processing device 1500 can be at the third level, which is superior to the first and second levels. That is, the fourth signal sent by the control device 1400 to the processing device 1500 can be used to perform a function at the third level of security. The first signal included in the fourth signal can perform self-verification at the processing device 1500, which has a higher third level of security, so that the processing device 1500 can confirm that the first signal has not been tampered with during transmission, for example, via the control device 1400.

[0055] According to one embodiment of this disclosure, the first level is, for example, QM level or ASIL B level, the second level is, for example, ASIL B level, and the third level is, for example, ASIL C level or ASIL D level. According to another embodiment of this disclosure, the first level can be ASIL C level, the second level can be ASIL A level, and the third level can be ASIL D level.

[0056] Generally, in the comparative embodiments, an ASIL A level first control device and an ASIL B level control device are required (e.g., an ASIL A level control device 1400 as the first control device and an ASIL B level control device 1400 as the second control device may be needed) to achieve ASIL C level functionality. Figure 1 (The embodiment used for comparison is not shown). For example, the first control device can receive a first analog detection signal and a second analog detection signal from two detection circuits that detect the operating state of the same operating component of the vehicle, respectively, and the second control device can receive the first analog detection signal and the second analog detection signal from the two detection circuits, respectively. The first control device can perform a rationality check on the first analog detection signal and the second analog detection signal to generate a signal with ASIL A level, and the second control device can perform a rationality check on the first analog detection signal and the second analog detection signal to generate a signal with ASIL B level. The subsequent processing circuitry for ASIL C level can receive the ASIL A level signal and the ASIL B level signal to perform a rationality check, thereby realizing the ASIL C level functionality. Alternatively, in the embodiment used for comparison, the ASIL C level functionality can be implemented with a single ASIL C level control device (e.g., ASIL C level control device 1400) and the subsequent processing circuitry for ASIL C level. Figure 1(An embodiment used for comparison is not shown in the diagram). However, this embodiment used for comparison requires two control devices of the second-best ASIL level or a single control device of the best ASIL level, thus incurring higher costs.

[0057] According to embodiments of this disclosure, for example, such as Figure 1 As shown, a single control device 1400 with a security level of 2 can generate and send a fourth signal capable of achieving an ASIL level of 3 to the processing device 1500 based on a first signal and a second analog signal. In other words, because a first signal capable of performing self-verification is used, the verification originally performed by a control device with an ASIL level of ASIL A or ASIL C in the comparison embodiment is... Figure 1 In some embodiments, this can be performed at the processing device 1500. Therefore, a third-level (e.g., ASIL C) function can be implemented using a single control device with a second-level (e.g., ASIL B) safety level.

[0058] Figure 2 A schematic diagram of a control device for a vehicle according to another embodiment of the present disclosure is shown. Figure 3A A schematic diagram of the data structure of an SPI signal according to an embodiment of the present disclosure is shown. Figure 3B A schematic diagram of the waveform of an SPI signal according to an embodiment of the present disclosure is shown. Figure 3C A schematic diagram of the data structure of the SENT signal according to an embodiment of the present disclosure is shown. Figure 3D A schematic diagram of the data structure of a third signal according to an embodiment of the present disclosure is shown. Figure 3E A schematic diagram of a CAN message data structure according to an embodiment of the present disclosure is shown. Figure 4 A schematic diagram of a second detection circuit according to an embodiment of the present disclosure is shown. Figure 2 Zhongyu Figure 1 Similar components will not be described again to avoid redundancy.

[0059] like Figure 2 As shown, the control device 1400 may include a first interface 1410, a second analog-to-digital converter 1420, a processor 1430, a memory 1440, and a second interface 1440.

[0060] According to one embodiment of this disclosure, the control device 1400 may be a microcontroller unit (MCU) and the processing device 1500 may be an electronic control unit (ECU).

[0061] According to one embodiment of this disclosure, the operating component 1100 may include a parking control component of the vehicle. The operating state of the operating component includes the enabled and disabled states of the parking control component. For example, the operating component may be a parking control lever located near the vehicle's steering wheel or a parking lever located between the driver's seat and the passenger seat.

[0062] According to one embodiment of this disclosure, the first detection unit may include an SPI sensor. The SPI sensor may generate a first signal based on the operating state of the vehicle's operating components 1100. For example, the SPI sensor may include a sensor whose output signal is an SPI type signal.

[0063] The second detection unit 1300 may include, for example, such as... Figure 4 The second detection circuit is shown. The second detection circuit may include a first resistor, a second resistor, and a switch S1. For example, in response to the parking control component being in either an enabled or disabled state, switch S1 may be turned off. In response to the other of the enabled and disabled states, switch S1 may be turned on. Depending on whether switch S1 is on or off, the second detection unit 1300 may output a second analog signal with a different level.

[0064] According to one embodiment of this disclosure, the security level of the first detection unit 1200 can be QM level, the security level of the second detection unit 1300 can be QM level, the security level of the control device 1400 can be ASIL B level, and the security level of the processing device 1500 can be ASIL C level. Therefore, the first detection unit 1200 can send a first signal with QM level to the control device 1400, and the second detection unit 1300 can send a second analog signal with QM level to the control device 1400. According to another embodiment of this disclosure, the security level of the first detection unit 1200 can be ASIL B level, the security level of the second detection unit 1300 can be ASIL B level, the security level of the control device 1400 can be ASIL B level, and the security level of the processing device 1500 can be ASIL D level; or the security level of the first detection unit 1200 can be ASIL C level, the security level of the second detection unit 1300 can be ASIL C level, the security level of the control device 1400 can be ASIL A level, and the security level of the processing device 1500 can be ASIL D level, but this disclosure is not limited thereto.

[0065] According to one embodiment of this disclosure, the first interface 1410 can receive a first signal from the first detection unit 1200, and the second analog-to-digital converter 1420 receives a second analog signal from the second detection unit 1300 and converts the second analog signal into a second signal.

[0066] Processor 1430 may receive a first signal from first interface 1410 and a second signal from second analog-to-digital converter 1420. Processor 1430 may include a validity check module 1431 to perform validity checks on the first and second signals and, in response to the first and second signals passing the validity check, generate a third signal indicating the operating state of an operating component based on the first and second signals. Since the third signal is generated by control device 1400 based on the validity checks of the first and second signals, the third signal has ASIL B level. Processor 1430 may further combine the third signal and the first signal to generate a fourth signal. The fourth signal may include both the first and third signals. Processor 1430 may send the fourth signal to processing device 1500 via second interface 1450.

[0067] The memory 1440 includes the code and data required for executing the rationality verification module 1431, and stores data generated by the processor 1430. The code and data are stored in the memory 1440 and can be configured to be read by the processor 1430 to perform rationality verification.

[0068] The memory 1440 and the processor 1430 can be interconnected via a bus system and / or other forms of connection mechanism (not shown). For example, the bus can be a Peripheral Component Interconnect Standard (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0069] For example, processor 1430 may be a central processing unit (CPU), a digital signal processor (DSP), a graphics processing unit (GPU), or other processing units with data processing capabilities and / or program execution capabilities, such as a field-programmable gate array (FPGA). Processor 1430 may be a general-purpose processor or a special-purpose processor that can control other components in control device 1400 to perform desired functions.

[0070] Exemplarily, memory 1440 may include any combination of one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, erasable programmable read-only memory (EPROM), portable compact read-only memory (CD-ROM), USB storage, flash memory, etc. Code or data may be stored on the computer-readable storage medium, and processor 1430 may execute the code to implement various functions for determining control device 1400. Various application programs and various data, as well as various data used and / or generated by the application programs, may also be stored in the computer-readable storage medium.

[0071] For example, control device 1400 may also include input devices such as cameras, touch screens, touchpads, keyboards, mice, webcams, microphones, accelerometers, and gyroscopes; output devices such as liquid crystal displays, speakers, and vibrators; storage devices such as magnetic tapes and hard disks (HDDs or SDDs); and communication devices such as network interface cards like LAN cards and modems. The communication devices allow control device 1400 to communicate wirelessly or wiredly with other devices to exchange data and perform communication processing via networks such as the Internet. Drives are connected to the I / O interface as needed. Removable storage media, such as disks, optical disks, magneto-optical disks, and semiconductor memories, are installed on the drive as needed so that computer programs read from them can be installed into the storage device as required.

[0072] For example, the control device 1400 may further include a peripheral interface (not shown in the figure). This peripheral interface can be various types of interfaces, such as a USB interface, a Lightning interface, etc. The communication device can communicate wirelessly with a network and other devices, such as the Internet, an intranet, and / or a wireless network such as a cellular telephone network, a wireless local area network (LAN), and / or a metropolitan area network (MAN). Wireless communication can use any of a variety of communication standards, protocols, and technologies, including but not limited to Global System for Mobile Communications (GSM), Enhanced Data GSM Environment (EDGE), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Bluetooth, Wi-Fi (e.g., based on IEEE 402.11a, IEEE 402.11b, IEEE 402.11g, and / or IEEE 402.11n standards), Voice over Internet Protocol (VoIP), Wi-MAX, protocols for email, instant messaging, and / or Short Message Service (SMS), or any other suitable communication protocol.

[0073] According to one embodiment of this disclosure, the first signal may be at least one of a Serial Peripheral Interface (SPI) signal, a SENT signal, and an I2C signal. However, this disclosure is not limited to this; other types of signals capable of performing end-to-end E2E protection or other types of protection during data transmission may also be used. End-to-end E2E protection can refer to the protection process during data transmission between the receiving end and the sending end.

[0074] For example, such as Figure 3A As shown, the first signal, serving as the SPI signal, can have a data field, a count field, and a check field. Furthermore, the SPI signal can also include a synchronization field and a status field. The data field can be used to indicate the operating status of the vehicle's operating components detected by the first detection unit 1200. The count field can detect whether the first signal has been lost or repeated through its continuity. The check field can be used to verify whether the first signal has changed or been tampered with during transmission. The synchronization field can be used to identify the start of a data frame. The status field is used to indicate the status of the device transmitting the SPI signal. For example, the check field of the first signal can include at least one of a cyclic redundancy check field, a parity check field, and a checksum field for performing E2E protection. Figure 3B As shown, the first signal as an SPI signal may include one or more of the following: a high level indicating the data field, a high level indicating the count field, a high level indicating the synchronization field, a high level indicating the status field, and a high level indicating the check field.

[0075] For example, such as Figure 3CAs shown, the first signal, serving as the SENT signal, may have one or more of the following: a data field, a check field, a synchronization field, a status field, and a pause field. The synchronization field can be used by the receiving end of the signal for time synchronization and calibration. The status field can be used to indicate the status of the device transmitting the SPI signal. The data field can be used to indicate the operating status of the vehicle's operating components detected by the first detection unit 1200. The check field can be used to verify whether the first signal has changed or been tampered with during transmission. The pause field can be used to provide a fixed time interval during data transmission so that the receiving end can correctly process the data frame.

[0076] The third signal can have, for example... Figure 3D The data structure shown is as follows. The third signal may have a data field, a count field, and a check field. The data field can be used to indicate the operating status of the vehicle's operating components determined based on the first and second signals. The count field can detect whether the first signal has been lost or repeated through its continuity. The check field can be used to verify whether the first signal has changed or been tampered with during transmission. For example, the check field of the third signal may include at least one of a cyclic redundancy check field, a parity check field, and a checksum field for performing end-to-end E2E protection.

[0077] The second interface 1450 can be a Controller Area Network (CAN) interface. The fourth signal can be a CAN message, and the first and third signals are included in the data field of the CAN message. The control device 1400 can send the fourth signal to the processing device 1450 through the second interface 1450. Figure 3E As shown, the CAN message as the fourth signal may include an arbitration field, a control field, a data field, a check field, an acknowledgment field, and a frame end field. The data field of the CAN message may include a first signal and a third signal. The arbitration field is used to determine the priority of the CAN message. The control field is used to distinguish between standard frames and extended frames. The check field is used to detect whether any changes have occurred during frame transmission. The acknowledgment field is used to confirm successful reception after data has been correctly received. The frame end field is used to indicate the end of the data frame. According to another embodiment of this disclosure, the second interface 1450 may be at least one of a Local Area Network (LIN) interface, a CAN Flexible Data Rate (FD) interface, and a FlexRay interface. Therefore, the fourth signal may correspond to one of a LIN message, a CAN FD message, and a FlexRay message, and the first signal and the third signal may be included in the data field of at least one of the LIN message, CAN FD message, and FlexRay message, but this disclosure is not limited thereto.

[0078] The first signal in the data field of the fourth signal can be self-verified based on the verification field of the first signal at the self-verification module 1510 of the processing device 1500. In response to at least the first signal passing the self-verification, the first signal and the third signal in the data field of the fourth signal can be subjected to a rationality verification at the rationality verification module 1520 of the processing device 1500 to confirm the operating status of the operating component. For example, the first signal can have an ASIL A level after passing the self-verification at the self-verification module 1510 in the processing device. After the first signal with an ASIL A level and the third signal with an ASIL B level pass the rationality verification at the processing device 1500, the processing device 1500 can confirm the operating status of the operating component with an ASIL C level.

[0079] Figure 5 A schematic diagram of a control device for a vehicle according to another embodiment of the present disclosure is shown. Figure 6 A schematic diagram of a first detection circuit according to an embodiment of the present disclosure is shown. Figure 5 Zhongyu Figure 2 as well as Figure 1 Similar components will not be described again to avoid redundancy.

[0080] like Figure 5 As shown, the control device 1400 may include a first interface 1410, a first analog-to-digital converter 1460, a second analog-to-digital converter 1420, a processor 1430, a memory 1440, and a second interface 1440.

[0081] According to one embodiment of this disclosure, the control device 1400 may be a microcontroller unit (MCU) and the processing device 1500 may be an electronic control unit (ECU). According to one embodiment of this disclosure, the operating component 1100 may include a parking control component for a vehicle.

[0082] According to one embodiment of this disclosure, the first detection unit 1200 may include an SPI converter 1220 and a first detection circuit 1210. The first detection circuit 1210 may be configured to generate a first analog signal based on the operating state of the vehicle's operating components. The first detection circuit 1210 may include, for example, […]. Figure 6 The circuit shown. The first detection circuit 1210 may include a third resistor, a fourth resistor, and a switch S2. For example, in response to the parking control component being in one of the enabled and disabled states, switch S2 may be turned off. In response to the other of the enabled and disabled states, switch S2 may be turned on. Depending on whether switch S2 is turned on or off, the first detection circuit 1210 may output a first analog signal with a different level. The second detection unit 1300 may include, for example, a... Figure 4 The second detection circuit shown will not be described again here.

[0083] The SPI converter 1220 can be configured to convert a first analog signal into a first signal. The first analog-to-digital converter 1460 can be configured to receive the first analog signal from the first detection circuit 1210 and convert the first analog signal into a fifth signal.

[0084] According to one embodiment of this disclosure, the first interface 1410 can receive a first signal from the first detection unit 1200, and the second analog-to-digital converter 1420 receives a second analog signal from the second detection unit 1300 and converts the second analog signal into a second signal.

[0085] Processor 1430 can receive a first signal from first interface 1410 and a fifth signal from first analog-to-digital converter 1460. Processor 1430 can perform a validity check on the first and fifth signals in validity check module 1432. By performing a validity check on the first and fifth signals, the accuracy of the conversion process of the SPI converter 1220 to the first analog signal can be confirmed. In response to the first and fifth signals passing the validity check, processor 1430 can perform a validity check on the first and second signals in validity check module 1431. In response to the first and second signals passing the validity check, processor 1430 can generate a third signal based on the first and second signals. Since the third signal is generated by control device 1400 based on the first and second signals passing the validity check, the third signal has an ASILB rating. The process by which processor 1430 can further generate a fourth signal based on the third and first signals, and the processing process of the fourth signal by processing device 1500, are related to... Figure 2 Similarly, this will not be repeated here.

[0086] Figure 7 A schematic diagram of a control device for a vehicle according to another embodiment of the present disclosure is shown. Figure 8 A schematic diagram of a steering wheel assembly of a vehicle according to an embodiment of the present disclosure is shown. Figure 7 Zhongyu Figure 1 , Figure 2 and Figure 5 Similar components will not be described again to avoid redundancy.

[0087] According to one embodiment of this disclosure, the control device 1400 may be a microcontroller unit (MCU) and the processing device 1500 may be an electronic control unit (ECU).

[0088] According to one embodiment of this disclosure, the operating component 1100 may include a vehicle's steering wheel. The operating state of the operating component includes the rotation angle of the vehicle's steering wheel. For example, as... Figure 8As shown, the steering wheel 8100 has a transmission relationship with the large gear 8200, the first pinion 8300, and the second pinion 8400. For example, the steering wheel 8100 and the large gear 8200 can be connected by the same shaft, so the rotation angle of the steering wheel 8100 can be the same as the rotation angle of the large gear 8200. The first pinion 8300 and the second pinion 8400 can respectively mesh with the large gear 8200 to realize the transmission relationship. Figure 8 In this diagram, the size ratios of the steering wheel 8100, the large gear 8200, the first pinion 8300, and the second pinion 8400 are merely illustrative, and this disclosure is not limited thereto. The first detection unit 1200 can detect a first rotation angle of the first pinion 8300 and output a first signal indicating the first rotation angle. The second detection unit 1300 can detect a second rotation angle of the second pinion 8400 and output a second analog signal indicating the second rotation angle.

[0089] According to one embodiment of this disclosure, the first detection unit may include an SPI sensor. The SPI sensor may generate a first signal based on the operating state of the vehicle's operating components 1100.

[0090] The second detection unit 1300 can generate a second analog signal based on the operating state of the vehicle's operating components 1100.

[0091] According to one embodiment of this disclosure, the security level of the first detection unit 1200 can be ASIL B, the security level of the second detection unit 1300 can be ASIL B, the security level of the control device 1400 can be ASIL B, and the security level of the processing device 1500 can be ASIL D. Therefore, the first detection unit 1200 can send a first signal with ASIL B level to the control device 1400, and the second detection unit 1300 can send a second analog signal with ASIL B level to the control device 1400. According to another embodiment of this disclosure, the security level of the first detection unit 1200 can be QM level, the security level of the second detection unit 1300 can be QM level, the security level of the control device 1400 can be ASIL B, and the security level of the processing device 1500 can be ASIL C; or the security level of the first detection unit 1200 can be ASIL C, the security level of the second detection unit 1300 can be ASIL C, the security level of the control device 1400 can be ASIL A, and the security level of the processing device 1500 can be ASIL D, but this disclosure is not limited thereto.

[0092] The modules in controller 1430 can be executed by the controller reading code and data from memory 1440. The first signal can be self-checked at self-checking module 1443 of processor 1430 based on its check field. Second detection unit 1300 can generate and send multiple second analog signals to control device 1400. The second signals can be self-checked at self-checking module 1444 of processor 1430 based on, for example, the correlation between multiple second signals converted from multiple second analog signals. In response to both the first and second signals passing self-checks, a rationality check can be performed on the first and second signals in rationality check module 1431. In response to the first and second signals passing rationality checks, a third signal indicating a third rotation angle of the large gear 8200 can be generated based on a first rotation angle indicated by the first signal, a second rotation angle indicated by the second signal, and a transmission relationship. The transmission relationship may include a first transmission ratio between the first pinion 8300 and the large gear 8200, and a second transmission ratio between the second pinion 8400 and the large gear 8200. The processor 1430 can further generate a fourth signal based on the third signal and the first signal. The fourth signal may include both the first signal and the third signal. The processor 1430 can send the fourth signal to the processing device 1500 through the second interface 1450.

[0093] The first signal in the data field of the fourth signal can be self-verified based on the verification field of the first signal at the self-verification module 7510 of the processing device 1500, and the third signal in the data field of the fourth signal can be self-verified based on the verification field of the third signal at the self-verification module 7520 of the processing device 1500.

[0094] In response to both the first and third signals passing self-check, the first and third signals in the data field of the fourth signal are subjected to differential calculations at the differential calculation module 7530 and differential calculation module 7540 of the processing device 1500, respectively. Specifically, differential calculations can be performed based on the first rotation angle indicated by the first signal received at the first moment, the first rotation angle indicated by the first signal received at the second moment, and the time period between the first and second moments to calculate the differential value of the first rotation angle during the time period. Differential calculations can also be performed based on the third rotation angle indicated by the third signal received at the first moment, the third rotation angle indicated by the third signal received at the second moment, and the time period between the first and second moments to calculate the differential value of the third rotation angle during the time period.

[0095] The rationality verification module 7500 of the processing device 1500 can perform a rationality verification based on the first rotation angle difference value output by the difference calculation module 7530, the third rotation angle difference value output by the difference calculation module 7540, and the transmission relationship such as the transmission ratio between the large gear 8200 and the first small gear 8300, to confirm the rotation angle of the vehicle's steering wheel 8100 at ASIL D level.

[0096] Figure 9 A schematic diagram of a method for a control device for a vehicle according to an embodiment of the present disclosure is shown.

[0097] like Figure 9 As shown, method 100 includes steps S110-S130.

[0098] At step S110, a first signal from the first detection unit can be received, the first signal having at least a data field and a check field.

[0099] At step S120, a second analog signal from the second detection unit may be received, wherein the first signal and the second analog signal are associated signals independently generated in response to the same operating state of the vehicle's operating components.

[0100] At step S130, a fourth signal for controlling the vehicle can be generated and sent to the processing device, at least by verifying the reasonableness of the first signal and / or the second signal, which is a digital signal generated based on the second analog signal.

[0101] The fourth signal may include the first signal and a third signal generated based on the first and second signals. The third signal indicates the operating state of the operating component. The first and second detection units have a security level of Level 1, and the control device has a security level of Level 2. The fourth signal can be used in processing devices with a security level of Level 3, which is superior to Level 1 and Level 2.

[0102] Figure 10 A non-transitory computer-readable storage medium according to an embodiment of the present disclosure is shown.

[0103] like Figure 10 As shown, a non-transitory readable storage medium 1000 stores computer instructions 1110, which, when executed by a processor, perform one or more steps of the various methods and their additional aspects as described above.

[0104] For example, the non-temporarily readable storage medium 1000 may be any combination of one or more computer-readable storage media, such as a computer-readable storage medium containing program code for performing the various methods described above.

[0105] For example, when the program code is read by a computer, the computer can execute the program code stored in the computer storage medium to perform one or more steps of the various methods and additional aspects described above, such as those according to at least one embodiment of the present disclosure.

[0106] For example, the non-transitory readable storage medium may include a memory card of a smartphone, a storage component of a tablet computer, a hard disk of a personal computer, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), flash memory, and other non-transitory readable storage media or any combination thereof.

[0107] Embodiments of this disclosure also provide a computer program product. The computer program product may include a computer program or instructions. When executed by a processor, the computer program or instructions can implement the methods described above, which will not be repeated here for the sake of brevity.

[0108] Figure 11 A vehicle according to an embodiment of the present disclosure is shown.

[0109] Vehicle 1010 may include, but is not limited to, cars, tractor-trailers (with or without trailers), buses, recreational vehicles, minivans, or sport utility vehicles (SUVs).

[0110] like Figure 11 As shown, vehicle 1010 may include device 1011, which may be as described above. Figure 1 , Figure 2 , Figure 5 as well as Figure 8 The control equipment shown is used to determine the vehicle or such Figure 10 The computer-readable storage medium or device 1011 may include the computer program product described above.

[0111] Although this disclosure has been described with reference to exemplary embodiments, various changes and modifications may be suggested to those skilled in the art. This disclosure is intended to cover such changes and modifications that fall within the scope of the appended claims.

[0112] Any description in this invention should not be construed as implying that any particular element, step, or function is an essential element that must be included within the scope of the claims. The scope of the patent subject matter is defined only by the claims.

Claims

1. A control device for a vehicle, configured as follows: A first signal is received from a first detection unit. The first signal has at least a data field and a check field. The check field is used to detect or correct errors that occur during the transmission of the first signal. The first signal is at least one of the following: a serial peripheral interface (SPI) signal, a SENT signal, and an I2C signal; Receive a second analog signal from a second detection unit, wherein the first signal and the second analog signal are associated signals independently generated in response to the same operating state of the vehicle's operating components; and At least by using a validity verification module running in the control device to verify the validity of the first signal and / or the second signal, which is a digital signal generated based on the second analog signal, a fourth signal for controlling the vehicle is generated and sent to the processing device. The fourth signal includes the first signal and a third signal generated by the validity verification module based on the first and second signals. The third signal indicates the operating state of the operating component, and the data field of the third signal indicates the operating state of the vehicle's operating component determined based on the first and second signals. Wherein, the first detection unit and the second detection unit have a security level of Level 1, and the control device has a security level of Level 2. The fourth signal can achieve a third level of security, which is superior to the first and second levels, and can be used in the processing device with the third level of security.

2. The control device according to claim 1 further includes a first interface and a second analog-to-digital converter, wherein, The control device is configured to receive the first signal from the first detection unit via the first interface. The control device is configured to receive the second analog signal from the second detection unit via the second analog-to-digital converter and convert the second analog signal into a second signal.

3. The control device according to claim 1, wherein, The first level is QM level or ASIL B level, the second level is ASIL B level, and the third level is ASIL C level or ASIL D level, or The first level is ASIL C, the second level is ASIL A, and the third level is ASIL D.

4. The control device according to claim 1, wherein, The first signal is an SPI signal, and the first signal includes one or more of the following: a high level indicating a data field, a high level indicating a count field, and a high level indicating a check field.

5. The control device according to claim 1, wherein, The verification field of the first signal includes at least one of a cyclic redundancy check field, a parity check field, and a checksum field for performing end-to-end E2E protection. The data field of the first signal indicates the operating status of the vehicle's operating components as detected by the first detection unit.

6. The control device according to claim 4, wherein, The third signal has at least a data field and a check field. The verification field of the third signal includes at least one of a cyclic redundancy check field, a parity check field, and a checksum field for performing end-to-end E2E protection.

7. The control device according to claim 1, wherein, The first detection unit includes an SPI sensor, which is a sensor that outputs an SPI type signal. The first signal is generated by the SPI sensor in response to the operating state of the vehicle's operating components.

8. The control device according to claim 1, wherein, The first detection unit includes an SPI converter and a first detection circuit, wherein the first detection circuit is configured to generate a first analog signal in response to the operating state of the vehicle's operating components, and the SPI converter is configured to convert the first analog signal into the first signal.

9. The control device according to claim 8, wherein, The control device further includes a first analog-to-digital converter configured to receive the first analog signal from the first detection circuit and convert the first analog signal into a fifth signal. The rationality verification includes: Perform a rationality check on the first signal and the fifth signal. In response to the first signal and the fifth signal passing the rationality check, a rationality check is performed on the first signal and the second signal.

10. The control device according to claim 1, further comprising a second interface, wherein, The second interface is at least one of a Controller Area Network (CAN) interface, a Local Area Network (LIN) interface, a CAN Flexible Data Rate (FD) interface, and a FlexRay interface. The control device is configured to transmit the fourth signal through the second interface, and The fourth signal is at least one of CAN message, LIN message, CAN FD message, and FlexRay message, and the first signal and the third signal are included in the data field of at least one of the CAN message, LIN message, CAN FD message, and FlexRay message.

11. The control device according to claim 1, wherein, The first signal in the data field of the fourth signal is self-verified at the processing device based on the verification field of the first signal. In response to at least the first signal passing self-verification, the first signal and the third signal in the data field of the fourth signal are subjected to a reasonableness check at the processing device to confirm the operating status of the operating component.

12. The control device according to claim 11, wherein, The first signal in the data field of the fourth signal is self-verified at the processing device based on the verification field of the first signal, and the third signal is self-verified at the processing device based on the verification field of the third signal. In response to both the first signal and the third signal passing self-verification, the first signal and the third signal in the data field of the fourth signal are subjected to a reasonableness check at the processing device to confirm the operating status of the operating component.

13. The control device according to claim 1, wherein, The operating state of the operating components includes the enabled and disabled states of the vehicle's parking control components.

14. The control device according to claim 1, wherein, The operating state of the operating components includes the rotation angle of the vehicle's steering wheel.

15. The control device according to claim 14, wherein, The steering wheel has a transmission relationship with the large gear, the first small gear, and the second small gear. The steering wheel and the large gear rotate at the same angle. The first signal indicates the first rotation angle of the first small gear, and the second signal indicates the second rotation angle of the second small gear.

16. The control device according to claim 15, further configured to: In response to the first signal and the second signal passing the rationality check, a third signal indicating a third rotation angle of the large gear is generated based on the first rotation angle, the second rotation angle, and the transmission relationship.

17. The control device according to claim 16, in, The first and third signals included in the fourth signal are subjected to differential calculations in time at the processing device, and a rationality check is performed based on the transmission relationship to confirm the rotation angle of the vehicle's steering wheel.

18. A method for a control device for a vehicle, comprising: A first signal is received from a first detection unit. The first signal has at least a data field and a check field. The check field is used to detect or correct errors that occur in the first signal during transmission. The first signal is at least one of a serial peripheral interface (SPI) signal, a SENT signal, and an I2C signal. Receive a second analog signal from a second detection unit, wherein the first signal and the second analog signal are associated signals independently generated in response to the same operating state of the vehicle's operating components; and At least by using a validity verification module running in the control device to verify the validity of the first signal and / or the second signal, which is a digital signal generated based on the second analog signal, a fourth signal for controlling the vehicle is generated and sent to the processing device. The fourth signal includes the first signal and a third signal generated by the validity verification module based on the first signal and the second signal, and the data field of the third signal indicates the operating state of the vehicle's operating components determined based on the first signal and the second signal. Wherein, the first detection unit and the second detection unit have a security level of Level 1, and the control device has a security level of Level 2. The fourth signal can achieve a third level of security, which is superior to the first and second levels, and can be used in the processing device with the third level of security.

19. A computer-readable storage medium having instructions stored thereon that, when executed by a processor, cause the processor to perform the method of claim 18.

20. A computer program product comprising a computer program or instructions, wherein, The computer program or instructions, when executed by a processor, implement the method as described in claim 18.

21. A vehicle comprising a control device as claimed in any one of claims 1-17, a computer-readable storage medium as claimed in claim 19, or a computer program product as claimed in claim 20.

Images