Vehicle-mounted instrument panel dual-system dynamic switching method

Abstract

The invention discloses a vehicle-mounted instrument panel dual-system dynamic switching method, and relates to the technical field of intelligent automobile cabins, and the method comprises the steps: obtaining a vehicle state signal through a vehicle bus interface, and enabling a scene state manager located in a safety virtual machine to decide a safety or entertainment mode as a system target mode according to the vehicle state signal, when the target mode is inconsistent with the current operation mode, a unified control instruction set containing resource allocation, a rendering mode, an operation state and a layer synthesis rule is generated, the instruction set is distributed through a shared memory and a hypercall mechanism, a virtual machine monitor adjusts computing resources allocated to the security and entertainment virtual machine, and the security and entertainment of the security and entertainment virtual machine is realized. And each virtual machine switches the rendering mode and the operation state. According to the invention, through centralized system-level cooperative control, the technical problems of dispersed switching logic and non-cooperative resource scheduling are solved, on-demand dynamic reconstruction of system resources and deterministic switching of operation states are realized, and driving safety, system performance and user experience are considered.

Description

Technical Field

[0001] This application relates to the field of intelligent vehicle cockpit technology, and in particular to a method for dynamic switching between dual systems of an in-vehicle instrument panel. Background Technology

[0002] As the level of automotive intelligence continues to improve, the intelligent cockpit has become the core of enhancing user experience. However, the current intelligent experience of automotive cockpits still shows limitations such as fixed functions and fragmented scenarios. Specifically, the roles and functions of the instrument panel and central control screen are basically fixed throughout the entire vehicle operation cycle, resulting in a significant lack of user experience in specific parking and leisure scenarios.

[0003] First, the existing vehicle dashboard systems are functionally limited, and their hardware resources are not fully utilized. When the vehicle is parked (such as while charging, waiting, or resting), a dashboard display screen, which typically boasts excellent size, resolution, and color reproduction, becomes idle, displaying only basic vehicle status information. This high-quality screen, directly facing the driver, cannot be used for extended functions such as entertainment or work, resulting in significant hardware resource underutilization. It also forces users to spend long periods of time looking at the central control screen from the side while parked, which is not only uncomfortable but also lacks immersion.

[0004] Secondly, even if existing technologies attempt to switch displays between different systems, they only reach the level of simple screen switching, lacking coordinated scheduling of underlying system resources. This superficial switching cannot guarantee sufficient performance support for the system when running high-load applications such as videos and games, easily leading to interactive stuttering and poor user experience. At the same time, the screen switching process may also be accompanied by visual interruptions such as black screens and flickering, disrupting the continuity and comfort of the user experience.

[0005] More importantly, introducing complex entertainment functions onto the dashboard—hardware that carries core safety information—places high demands on system security. Current technologies generally lack a reliable architectural design that prioritizes safety above all else. If the switching mechanism is not robust enough, or if a malfunction in the entertainment system interferes with the display of safety information, both will pose potential threats to driving safety. Therefore, how to provide a reliable security guarantee at the architectural level while achieving functional innovation is a pressing technological challenge. Summary of the Invention

[0006] The purpose of this invention is to provide a method for dynamic switching between dual systems in an in-vehicle dashboard, which at least solves one of the technical problems in the prior art: idle hardware resources and poor user experience due to the single function of the in-vehicle dashboard; insufficient performance and unsmooth experience due to the lack of resource coordination and scheduling during system switching; and the lack of a security mechanism when introducing entertainment functions.

[0007] To address the aforementioned technical problems, this invention provides a method for dynamic switching between dual systems in an in-vehicle instrument panel. This method is implemented on a hardware platform that includes a main processor, a storage unit, a vehicle bus interface, and a display unit.

[0008] The method includes: acquiring a vehicle status signal representing the current physical state of the vehicle through a vehicle bus interface; determining a system target mode based on the vehicle status signal, wherein the set of values ​​for the system target mode includes a security mode and an entertainment mode; when the determined system target mode is inconsistent with the current system operating mode, generating a set of control instructions, which includes resource allocation instructions, rendering mode instructions, operating status instructions, and layer compositing rule instructions; subsequently, distributing the control instruction set to the virtual machine monitor, the security virtual machine, the entertainment virtual machine, and the display compositor; finally, each component performs corresponding operations according to the received instructions: the virtual machine monitor adjusts the computing resources allocated to the security virtual machine and the entertainment virtual machine according to the resource allocation instructions; the security virtual machine switches the rendering mode according to the rendering mode instructions; the entertainment virtual machine switches the operating status according to the operating status instructions; and the display compositor, according to the layer compositing rule instructions, combines the graphics buffers generated by the security virtual machine and the entertainment virtual machine into a final output image frame, which is then presented by the display unit.

[0009] In one specific implementation of the present invention, the method is implemented based on a specific software platform architecture, which includes: a Type-1 virtual machine monitor running directly on the hardware platform; a security virtual machine and an entertainment virtual machine running on the virtual machine monitor; a scene state manager running inside the security virtual machine; and a display synthesizer. The steps of acquiring vehicle status signals, determining the target mode of the decision system, and generating control instruction sets are all executed by the scene state manager.

[0010] Furthermore, the specific logic of the decision-making system's target mode can be set as follows: when the vehicle status signal indicates the gear is in park, the vehicle speed is less than or equal to a preset speed threshold, and the handbrake is engaged, the target mode is entertainment mode; in all other cases, i.e., when the vehicle status signal indicates the gear is not in park, the vehicle speed is greater than the preset speed threshold, or the handbrake is not engaged, the target mode is safety mode. This design reflects the principle of prioritizing safety.

[0011] To improve the stability of system decision-making and avoid frequent mode switching due to instantaneous signal fluctuations, state stabilization processing can be performed on the vehicle status signal after it is acquired. Only when the vehicle status signal remains stable within a preset time window will the stable signal be used for subsequent system target mode decisions.

[0012] When the system target mode is safe mode, the switching operation is specifically manifested as follows: the virtual machine monitor allocates the main computing resources (such as more CPU time slices) to the safe virtual machine; the safe virtual machine enters full-screen rendering mode and generates a graphics buffer containing complete driving information; the entertainment virtual machine enters an inactive state, pauses operation or enters deep hibernation, and does not produce graphics output; accordingly, the display compositor uses the graphics buffer of the safe virtual machine as the only display source and directly generates the final output image frame.

[0013] When the system target mode is entertainment mode, the switching operation is specifically as follows: the virtual machine monitor allocates the main computing resources to the entertainment virtual machine; the security virtual machine switches to component rendering mode, generating only a small graphics buffer containing core vehicle status information (such as gear display); the entertainment virtual machine enters active state, runs normally, and generates a full-screen graphics buffer containing its application user interface; correspondingly, the display compositor overlays the component graphics buffer of the security virtual machine onto the full-screen graphics buffer of the entertainment virtual machine to generate the final output image frame. The overlay of the graphics buffers can be achieved by performing pixel-by-pixel alpha blending calculations on the two graphics buffers.

[0014] The specific adjustment of computing resources can be achieved by modifying the weight parameters of the scheduler within the virtual machine monitor. These weight parameters determine the proportion of CPU time slices allocated to secure virtual machines and entertainment virtual machines within a scheduling cycle.

[0015] Instruction distribution can be achieved using shared memory and a virtual machine monitor (VM) interrupt mechanism. Specifically, the scene state manager writes the generated control instruction set into a pre-defined instruction shared memory area, and then executes a hypercall instruction to trap the execution flow into the VM monitor. After the VM monitor takes over control, it first reads and executes its own instructions (such as resource allocation instructions) from the instruction shared memory area, and then injects virtual interrupts into target modules such as the entertainment VM and the display synthesizer. These virtual interrupts trigger the respective interrupt service routines of the target modules, which actively read their own new instructions from the instruction shared memory area and execute them.

[0016] To enhance user experience while ensuring safety, an asymmetric transition strategy can be employed for the display synthesizer's switching process. For example, when the system target mode switches from safety mode to entertainment mode (a non-emergency switch), the display synthesizer can execute a timed crossfade-in / fade-out animation to smoothly transition the initial full-screen instrument panel to the final entertainment-dominated screen. Conversely, when the system target mode switches from entertainment mode to safety mode (a high-priority safety switch), the display synthesizer executes an instantaneous switch without transition animation, immediately using the safety virtual machine's graphics buffer as the sole display source to ensure the complete presentation of driving information as quickly as possible.

[0017] The above solution achieves the following beneficial technical effects:

[0018] This application uses a scene state manager set within a secure virtual machine to accurately decide and execute the switch to entertainment mode based on the vehicle's parking status signal. This allows the dashboard to switch from a single driving information display function to a comprehensive infotainment platform dominated by the entertainment virtual machine under safe conditions such as parking. This breaks the functional boundaries of the traditional dashboard, transforms idle screen hardware into a high-value entertainment terminal, and utilizes the core screen resources in the cockpit.

[0019] This application not only switches the displayed content, but also dynamically reallocates computing resources through a virtual machine monitor. For example, it allocates more CPU time slices to the entertainment virtual machine in entertainment mode, thereby ensuring that the system can obtain sufficient performance support when running high-load applications such as videos and games, ensuring smooth interaction. At the same time, combined with smooth transition animations during switching, it avoids visual abruptness and elevates the in-vehicle entertainment experience to a new level.

[0020] This application places the decision-making core within a secure virtual machine and employs a strict, safety-first decision-making logic. Any pre-driving operation (such as shifting into non-parking gear) will trigger the system to switch back to the secure mode, which is completely dominated by the secure virtual machine, with the highest priority. This design, which ensures absolute priority for safety functions at the architectural level, solves the possibility of entertainment functions interfering with driving information and provides a reliable safety guarantee for the functional innovation of the dashboard. Attached Figure Description

[0021] Figure 1 This is a flowchart of a method for dynamic switching between dual systems in a vehicle dashboard according to an embodiment of the present invention;

[0022] Figure 2 This is a schematic diagram of the safe mode operation mechanism of one embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the operation mechanism of the entertainment mode according to an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of the mode switching triggering and decision-making process according to an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram of the system state under a normal vehicle driving scenario according to an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram illustrating a scenario of switching from security mode to entertainment mode according to an embodiment of the present invention;

[0027] Figure 7 This is a schematic diagram illustrating a scenario of emergency switching from entertainment mode to security mode according to an embodiment of the present invention. Detailed Implementation

[0028] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] This invention provides a method for dynamic switching between dual systems in a vehicle dashboard, which can be implemented based on this system. The system includes a hardware platform and a software platform.

[0030] The hardware platform provides physical resources for the operation of the software platform, including: the main processor (SoC), storage units, vehicle bus interface, and display unit.

[0031] The main processor is a system-on-a-chip (SoC) that integrates a multi-core central processing unit (CPU), a graphics processing unit (GPU), and a hardware virtualization support unit. The main processor is used to execute instructions from the software platform and process data from other hardware components.

[0032] The hardware virtualization support unit integrated within the main processor provides hardware-level support for the operation of the hypervisor, making it possible to create and isolate multiple virtual machines on a single physical processor. In one embodiment, this hardware virtualization support unit implements ExceptionLevel 2 (EL2) as defined in the ARMv8 architecture.

[0033] The multiple physical cores of a multi-core CPU can be allocated by a virtual machine monitor. The virtual machine monitor dynamically adjusts the CPU computing resources allocated to the secure virtual machine (VM-QNX) and the entertainment virtual machine (VM-Android) based on the current system operating mode. In a specific implementation, the allocation of CPU resources can follow these rules:

[0034] ;

[0035] ;

[0036] in, This represents the total processing power of a multi-core CPU, and the unit can be the number of clock cycles or the number of instructions executed. Represents the moment Processing capacity allocated to secure virtual machines; Represents the moment The processing power allocated to the entertainment virtual machine; This represents a time-varying allocation coefficient that takes values ​​in the [0,1] interval. This coefficient is determined by the Scene State Manager (SSM) based on the vehicle's real-time state. For example, in safe mode, The value is close to or equal to 1; in entertainment mode, The value is a preset value less than 1 (e.g., 0.3) to ensure the basic operating requirements of the secure virtual machine.

[0037] The integrated graphics processing unit (GPU) within the main processor executes graphics rendering instructions to generate two-dimensional or three-dimensional image data. This GPU supports virtualization technologies (such as SR-IOV) and can be virtualized into one or more virtual GPUs (vGPUs), which are then passed directly to a secure virtual machine and an entertainment virtual machine, respectively. This configuration allows both virtual machines to submit their respective graphics buffers to the display compositor independently and in parallel.

[0038] The main processor is physically connected to the storage unit (e.g., DDR memory controller), vehicle bus interface (e.g., CAN controller), and display unit (e.g., display controller) via an internal bus to achieve high-speed data exchange.

[0039] The storage units include dynamic random access memory (DDR RAM) and non-volatile flash memory. The storage units are physically connected to the main processor via a memory controller and are used for storing data and instructions.

[0040] Dynamic random access memory (DRAM) is used to store program code and temporary data required by the software platform (including the virtual machine monitor, secure virtual machine, and entertainment virtual machine) during runtime. Non-volatile flash memory is used for persistent storage of the operating system image files, applications, and configuration files of the virtual machine monitor, secure virtual machine, and entertainment virtual machine.

[0041] The virtual machine monitor manages the physical address space of dynamic random access memory through the main processor's Memory Management Unit (MMU). During system initialization, the virtual machine monitor allocates independent, protected physical memory regions for itself, secure virtual machines, and entertainment virtual machines.

[0042] Memory access requests originating from within the entertainment virtual machine are restricted to their own allocated memory area by the memory management unit. Any access to memory areas allocated to the security virtual machine or virtual machine monitor will be blocked by hardware, thereby achieving memory isolation between virtual machines.

[0043] In one specific embodiment, for a total capacity of The physical space allocation of dynamic random access memory follows the following relationship:

[0044] ;

[0045] in, This represents the amount of memory allocated to the virtual machine monitor. This represents the amount of memory statically allocated for use by the security virtual machine. This represents the amount of memory statically allocated to the entertainment virtual machine. This represents the memory capacity reserved in the system or used by other modules.

[0046] This allocation relationship is determined during system startup and remains fixed during system operation to ensure that the secure virtual machine has constant and undisturbed memory resources.

[0047] The vehicle bus interface includes a Controller Area Network (CAN) controller and a Local Interconnect Network (LIN) controller. The vehicle bus interface is physically connected to the main processor and connects to the vehicle's gateway or other electronic control units (ECUs) via a bus transceiver.

[0048] The vehicle bus interface is used to receive data frames broadcast on the vehicle bus. These data frames carry signals that characterize the current physical state of the vehicle, including but not limited to: gear position signal, vehicle speed signal, handbrake position signal, door position signal, and turn signal.

[0049] In one embodiment, the system receives CAN data frames via a CAN controller. A received CAN data frame. It can be represented as a pair:

[0050] ;

[0051] in, The identifier of the CAN data frame is used to uniquely identify the data type carried by the frame; The data field representing this CAN data frame is a byte sequence containing 0 to 8 bytes, which carries the specific signal value.

[0052] System internal predefined target identifier set This set contains identifiers for all CAN data frames required by the Scene State Manager (SSM) to make decisions.

[0053] ;

[0054] in, It is the CAN data frame identifier that carries the gear position status signal; It is the CAN data frame identifier that carries the vehicle speed signal; It is the CAN data frame identifier that carries the handbrake status signal.

[0055] The vehicle bus interface driver receives any CAN data frame Then, perform a judgment: if the identifier of the data frame... Belongs to a predefined set of target identifiers Then the data field of the data frame The data is then transmitted to the scene state manager for further parsing and processing. If the identifier... Not a set If the data frame is not selected, it is ignored. This method enables effective filtering and acquisition of critical vehicle status signals.

[0056] The display unit is one or more liquid crystal displays used to visualize the image information generated by the main processor. In this embodiment, the display unit specifically refers to the instrument panel display located directly in front of the driver.

[0057] The display unit is physically connected to the main processor's display controller via a standardized digital video interface. In one embodiment, this interface is a low-voltage differential signaling (LVDS) interface or an embedded display port (eDP) interface.

[0058] The display controller receives digital image frame data, which is a pixel matrix, ultimately generated by the display compositor in the software platform. The display controller converts this pixel matrix into timing signals conforming to the digital video interface protocol and drives the display unit to refresh pixels line by line or frame by frame, thereby displaying the image on the screen.

[0059] A frame of image to be displayed It can be defined as:

[0060] ;

[0061] in, For image frames; It is the number of pixels in the horizontal direction of the display unit, i.e., the resolution width; It is the number of pixels in the vertical direction of the display unit, i.e., the resolution height; It is located at pixel coordinates The color value of the pixel at that location. This color value is typically composed of three color components: red (R), green (G), and blue (B), and one transparency (A) component.

[0062] Display controller refresh rate This determines the number of times the display unit updates the image per second. This refresh rate must meet the following conditions to ensure the continuity of dynamic images:

[0063] ;

[0064] in, This is a preset minimum refresh rate threshold, such as 30Hz, to ensure visual smoothness. The main processor's graphics processing power and the display compositor's processing speed must ensure that they can maintain a refresh rate of no less than... The rate at which complete image frames are generated and submitted. To the display controller.

[0065] The software platform runs on the hardware platform and includes: a hypervisor, a secure virtual machine (VM-QNX), an entertainment virtual machine (VM-Android), a scene state manager (SSM), and a display compositor.

[0066] A virtual machine monitor is a type of system software that runs directly on a hardware platform. It belongs to the Type-1 virtual machine monitor and its function is to create and manage secure virtual machines and entertainment virtual machines running on it.

[0067] The virtual machine monitor takes over all physical hardware resources of the main processor, including but not limited to CPU cores, memory address space and input / output (I / O) devices. Through virtualization technology, it divides and encapsulates physical hardware resources into virtual hardware, and then allocates these virtual hardware to each virtual machine.

[0068] The virtual machine monitor utilizes the main processor's hardware virtualization support unit to run at a privilege level higher than that of a regular operating system (such as EL2 in the ARMv8 architecture). Its built-in scheduler is responsible for scheduling the execution of secure and entertainment virtual machines on physical CPU cores and dynamically adjusting the time slice allocation of each virtual machine according to the policies issued by the scene state manager.

[0069] The virtual machine monitor configures the main processor's Memory Management Unit (MMU) to create independent, hardware-protected physical memory address spaces for secure virtual machines and entertainment virtual machines. Any virtual machine attempting to access memory addresses outside its allocated region will be caught by the hardware and generate an exception, which will be handled by the virtual machine monitor, thus ensuring strong memory isolation between virtual machines.

[0070] For input / output devices, the virtual machine monitor manages them using device pass-through or paravirtualization technologies. For example, specific physical devices (such as a standalone CAN controller) can be directly assigned to a secure virtual machine, or controlled communication between the virtual machine and the hardware can be achieved by providing a standardized virtual I / O interface (such as VirtIO).

[0071] The virtual machine monitor is responsible for managing all physical hardware interrupts. It maintains an interrupt routing table to map and distribute a physical interrupt request (IRQ) to a specified virtual machine. This routing process can be represented by the following formula:

[0072] ;

[0073] in, Represents the physical interrupt request number; A unique identifier representing the target virtual machine, for example, Represents a secure virtual machine. Represents an entertainment virtual machine; Represents the interrupt routing function executed by the virtual machine monitor; This represents the virtual interrupt request number that is passed to the target virtual machine after being calculated by the routing function.

[0074] Through the above mechanisms, the virtual machine monitor provides a mutually isolated and resource-controllable operating environment for secure virtual machines and entertainment virtual machines, which is the basis for realizing the method of this invention.

[0075] A secure virtual machine is a standalone virtual machine that runs on top of a virtual machine monitor. Inside it, it runs a real-time operating system (RTOS) that is certified to functional safety standards (such as ISO 26262 ASIL-B), such as the QNX Neutrino real-time operating system.

[0076] The main function of the security virtual machine is to handle all tasks directly related to driving safety, including receiving and parsing vehicle status data through a virtualization interface, and generating and outputting safety-critical graphical information.

[0077] The secure virtual machine receives vehicle status signals from the vehicle bus interface through a virtualized vehicle bus interface provided by a virtual machine monitor. Because it runs a real-time operating system internally, the processing of vehicle status signals has a deterministic upper limit of latency, thus ensuring real-time response to dynamic changes in the vehicle.

[0078] The safety virtual machine switches between at least two graphics rendering modes based on instructions received from the Scene State Manager (SSM). The first mode is full-screen rendering, where the safety virtual machine utilizes its allocated virtual graphics processor (vGPU) resources to render a graphical interface containing complete driving information, such as an instrument panel interface including elements like a speedometer, tachometer, gear indicator, and fault alarm icons. The second mode is component rendering, where the safety virtual machine reduces its graphical output to a predefined widget layer containing only the most essential vehicle status information, such as the gear indicator or charging status icon.

[0079] Secure virtual machine at all times Output of the secure virtual machine's graphics buffer It can be determined by the following function:

[0080] ;

[0081] in, Represents the secure virtual machine at any time Generate and submit the graphics buffer to the secure virtual machine of the display compositor; Represents the secure virtual machine at any time The rendering mode state, which is determined by instructions issued by the scene state manager; An identifier representing full-screen rendering mode; An identifier representing the rendering mode of a component; This represents the graphics buffer data containing complete driving information generated in full-screen rendering mode; This represents a small widget graphics buffer generated in widget rendering mode, containing only core state information. For conditional judgment functions, when hour, for ,when hour, for .

[0082] An entertainment virtual machine is a virtual machine that runs on top of a virtual machine monitor and is independent of a secure virtual machine. It runs a general-purpose operating system, such as Android Automotive OS.

[0083] The function of an entertainment virtual machine is to execute all non-security-critical applications, including video players, web browsers, music players, and game programs. It uses virtualized hardware resources, including virtual CPU, memory, and virtual graphics processor (vGPU), allocated by the virtual machine monitor to perform program calculations and render the graphical interface.

[0084] The entertainment virtual machine has at least two running states controlled by the Scene State Manager (SSM): active state ( ) and inactive state ( When active, the virtual machine monitor allocates sufficient pre-set computing and graphics processing resources to it. When inactive, the entertainment virtual machine is paused or hibernated, and its resource allocation is minimized to reduce its consumption of system resources.

[0085] Running status of the entertainment virtual machine At any moment Commands issued by the scene state manager The decision, and its relationship, can be represented as:

[0086] ;

[0087] in, Representing the entertainment virtual machine at any time The running state, whose value set is { }; The scene state manager represents the time. The set of values ​​for the issued control commands is { }; This represents the state transition function. When received... When the instruction is given, the virtual machine enters... Status; when received When the instruction is given, the virtual machine enters... state.

[0088] If and only if the running state of the entertainment virtual machine for Only then will it generate and submit the entertainment virtual machine's graphics buffer to the display compositor. This graphics buffer contains the user interface of the currently running entertainment application. When its running state is... At this time, it does not produce any graphical output.

[0089] The Scene State Manager is a software module whose function is to determine the appropriate operating mode for the system based on the real-time vehicle status and to issue corresponding control commands. In one embodiment, the Scene State Manager runs as a high-priority process within a secure virtual machine.

[0090] The scenario status manager continuously receives and parses data containing vehicle status signals forwarded by the vehicle bus interface. Specifically, it extracts the gear status value from the data. Vehicle speed values and handbrake status value .

[0091] The scenario state manager has built-in predefined decision logic to map input vehicle state values ​​to system target patterns. The set of values ​​for the target mode of this system is { }, corresponding to security mode and entertainment mode respectively, the decision logic can be defined by the following Boolean expression:

[0092] ;

[0093] ;

[0094] in, Represents the decision logic function; Represents the gear position status value; Represents parking space; Represents vehicle speed; This represents a preset, extremely low vehicle speed threshold (e.g., 0 km / h) to tolerate sensor data fluctuations. This represents the handbrake status value; 1 indicates the handbrake is engaged, and 0 indicates the handbrake is not engaged. It means if and only if , and When all three conditions are met, the decision result is: model; This indicates that the decision outcome is in all other cases. model; This represents the logical AND operator, which means that all conditions connected by this operator must be true for the entire evaluation expression to be true.

[0095] When the scenario state manager determines the system target mode When changes occur, or during system initialization, it generates a set of control instructions and sends them to the virtual machine monitor, security virtual machine, entertainment virtual machine, and display compositor via inter-virtual machine communication mechanisms. These control instructions include:

[0096] Resource allocation instructions sent to the virtual machine monitor are used to adjust the allocation ratio of CPU and other resources to each virtual machine.

[0097] Rendering mode instructions sent to the secure virtual machine to command it to switch between full-screen rendering mode and part rendering mode.

[0098] Running status instructions sent to the entertainment virtual machine are used to command it to enter an active or inactive state.

[0099] Layer composition rule instructions sent to the display compositor define how the final output image will be composed.

[0100] The display compositor is a software module that runs at a privileged level with access to the graphics buffers of the security virtual machine and the entertainment virtual machine. Its function is to combine the graphics buffers generated by one or more virtual machines into a final output image frame according to instructions received from the Scene State Manager (SSM).

[0101] Display the synthesizer at time Receive graphics buffer from the secure virtual machine Graphics buffer from the entertainment virtual machine and layer composition rule instructions from the scene state manager. .

[0102] The display compositor performs pixel-by-pixel layer compositing operations to generate the final output image frame. For each pixel coordinate in the output image frame. Its color value Calculated using the following formula:

[0103] ;

[0104] in, Represents the final output image frame In the middle, the pixel coordinates are The color value of the pixel; This represents the pixel coordinates within the graphics buffer designated as the overlay. The color value of the pixel; This represents the pixel coordinates in the graphics buffer of the overlay layer. The transparency value of the pixel is in the range of [0,1], where 0 represents completely transparent and 1 represents completely opaque; This represents the pixel coordinates within the graphics buffer designated as the base layer. The color value of the pixel.

[0105] Layer compositing rule commands Defined at time Which virtual machine's graphics buffer is designated as the base layer and which as the overlay layer, according to this rule. It can be represented as a pair:

[0106] ;

[0107] in, and These represent the sources of the graphics buffers corresponding to the base layer and the overlay layer, respectively.

[0108] When the system target mode is At that time, the instructions issued by the scene state manager cause and The buffer is empty. At this point, the final output image frame... The content is entirely contained within the graphics buffer of the secure virtual machine. Decide.

[0109] When the system target mode is At that time, the instructions issued by the scene state manager cause and At this point, the final output image frame The result is a composite of the graphics buffer of the security virtual machine (in component rendering mode) overlaid on the graphics buffer of the entertainment virtual machine.

[0110] After completing the compositing calculations for each frame, the display compositor generates the final output image frame. The data is transmitted to the display controller of the display unit for display.

[0111] Figure 1 This is a flowchart of a method for dynamic switching between dual systems in a vehicle dashboard according to an embodiment of the present invention.

[0112] like Figure 1 As shown, when the vehicle's electrical system is activated, for example when an accessory power-on (ACC ON) or ignition switch-on (IG ON) signal is received, the main processor powers on and begins executing the first-stage bootloader stored in non-volatile memory. After completing basic hardware initialization, the bootloader loads the binary image file of the virtual machine monitor from the non-volatile flash memory into the dynamic random access memory and transfers execution control to the virtual machine monitor.

[0113] After gaining control, the virtual machine monitor first takes over all physical hardware resources of the main processor, including control of all CPU cores, the interrupt controller, and the memory management unit (MMU). Subsequently, based on the configuration file pre-stored in non-volatile flash memory, the virtual machine monitor allocates and enables hardware-protected, isolated physical memory regions for itself, the security virtual machine, and the entertainment virtual machine.

[0114] Next, the virtual machine monitor creates and starts the virtual machines one by one according to the preset startup order. In this embodiment, to ensure the fastest availability of safety-critical functions, the security virtual machine is configured to start first. The virtual machine monitor reads the operating system image of the security virtual machine, configures virtual hardware resources such as virtual CPU and virtual interrupt controller for it, sets the program counter of the virtual CPU to the entry point of its operating system, and then places it in the scheduling queue to wait for execution. After the startup initialization of the security virtual machine is completed, the entertainment virtual machine is started in the same way.

[0115] The Scene State Manager (SSM), as a process within the security virtual machine, begins running upon the startup of the security virtual machine. During the initialization phase, because the data from the vehicle bus interface is not yet stable or valid vehicle status signals have not yet been received, the SSM's internal decision-making logic presets the system state to the safest mode in the absence of valid input. Therefore, at the initial moment... Initial decision output Forced to be set as Pattern, i.e. ;

[0116] Based on this initial decision, the scene state manager immediately sends a set of initial state instructions to other relevant modules in the system through the inter-virtual machine communication mechanism. Specifically, it sends an instruction to the security virtual machine itself, requesting it to enter full-screen rendering mode. At the same time, instructions are sent to the entertainment virtual machine, requiring it to remain inactive or enter an inactive state. ); and issue layer composition rule instructions to the display compositor, specifying that it should use only the graphics buffer from the secure virtual machine as the sole display source.

[0117] Therefore, after the system powers on and completes the initialization process, the initial screen displayed on the display unit is a full-function instrument panel containing complete driving information, rendered independently by the safety virtual machine. Although the entertainment virtual machine is running in the background, it is limited in computing resources and its graphics output is completely blocked, so it does not affect the final display, thus ensuring absolute safety and functional determinism after the system starts up.

[0118] Figure 2 This is a schematic diagram of the safe mode operation mechanism of one embodiment of the present invention.

[0119] like Figure 2 As shown, the Scene State Manager (SSM) continuously monitors the vehicle status signal, i.e., the gear position value. Vehicle speed values and handbrake status value Their combination does not satisfy the decision logic function. Entry as defined in Under specific conditions of the mode, the scene state manager will set the system target mode. Continuous decision-making Pattern. The mode covers all dynamic and static vehicle scenarios except for safe parking, including driving, temporary parking, and parking without engaging the handbrake.

[0120] exist In this mode, the scene state manager issues resource allocation instructions to the virtual machine monitor, requesting it to prioritize the operation of secure virtual machines. Based on these instructions, the virtual machine monitor adjusts its internal scheduler policy, allocating the majority of CPU time slices to secure virtual machines. The total time of a CPU core within one scheduling cycle is... Time allocated to the secure virtual machine It can be determined by the following formula:

[0121] ;

[0122] in, Represents the total time of a scheduling cycle; This represents the pre-defined CPU time allocation ratio for the secure virtual machine in safe mode. It is a constant value close to 1, such as 0.9, to ensure the real-time performance and responsiveness of its tasks. This represents the time allocated to the secure virtual machine. The remaining minimal CPU time. It is then allocated to the entertainment virtual machine, solely for maintaining it in a low-power state.

[0123] At the same time, the scene state manager sends instructions to the secure virtual machine to enter and maintain full-screen rendering mode. In full-screen rendering mode, the graphics application within the safety virtual machine utilizes its allocated virtual graphics processor resources to render a graphical interface containing complete driving information and generate the safety virtual machine's graphics buffer. .

[0124] The scene state manager also sends instructions to the entertainment virtual machine to put it into and maintain an inactive state. In the inactive state, the entertainment virtual machine's operating system is suspended by the virtual machine monitor, its internal applications stop running, and it does not perform any graphics rendering operations, thus not submitting any graphics buffers to the display compositor.

[0125] Finally, the Scene State Manager sends layer composition rule instructions to the Display Composer, specifying that it will use the graphics buffer of the Secure Virtual Machine. As the sole base layer, the overlay layer is set to empty. Therefore, the display synthesizer outputs image frames for the final output. The calculation of pixel color values ​​is simplified to direct copying:

[0126] ;

[0127] in, The pixel coordinates in the graphics buffer of the secure virtual machine are The pixel color value.

[0128] Through the coordinated operation of the above mechanisms, in secure mode, the display content of the display unit is generated and controlled entirely by a secure virtual machine, ensuring that the display of all security-critical information is not interfered with in any way, and that the real-time updates and the reliability of the content are guaranteed by the highest level of the system.

[0129] Figure 3 This is a schematic diagram of the operation mechanism of the entertainment mode according to an embodiment of the present invention.

[0130] like Figure 3 As shown, a vehicle status signal continuously monitored by the Scene State Manager (SSM) will be valid if and only if the following three conditions are met simultaneously: gear status value for Gear, vehicle speed value Less than or equal to the preset threshold And the handbrake status value When the state is already activated, the decision logic function The output result is At this point, the scene state manager will switch to the system target mode. The decision was made to switch to entertainment mode, and a new set of control commands was immediately issued.

[0131] In this mode, the scene state manager sends instructions to the virtual machine monitor, requesting it to adjust the resource allocation strategy, prioritizing computing resources for the entertainment virtual machine. Within one scheduling cycle of a CPU core, the time allocated to the entertainment virtual machine... It can be determined by the following formula:

[0132] ;

[0133] in, Represents the total time of a scheduling cycle; This represents the pre-defined CPU time allocation for the entertainment virtual machine in entertainment mode. It's a constant value close to 1, such as 0.9, to ensure the smooth operation of its internal applications. The remaining small amount of CPU time is allocated to the security virtual machine to maintain its kernel state monitoring and component rendering tasks.

[0134] At the same time, the scene state manager sends a command to the security virtual machine to change its rendering mode from full-screen mode. Switch to component rendering mode ( In component rendering mode, the security virtual machine no longer renders the complete instrument panel interface, but only generates the most critical security information (such as gear position). The small-sized graphics widget (identified by the logo), the graphics buffer of the secure virtual machine is In this component graphics buffer, only pixels within the component area have non-zero color and transparency values, while pixels in the remaining areas have a transparency value of 0.

[0135] The scene state manager also sends instructions to the entertainment virtual machine to change its running state from inactive ( Switch to active status ( Upon receiving the instruction, the virtual machine monitor wakes the virtual machine from its suspended state, resuming its internal general-purpose operating system and upper-layer applications (such as video players) to run, and begins rendering its full-screen user interface, generating and submitting the entertainment virtual machine's graphics buffer to the display compositor. .

[0136] Finally, the Scene State Manager sends a new layer composition rule instruction to the Display Composer. This instruction specifies that the graphics buffer of the entertainment virtual machine... As the base layer, and using the graphics buffer of the secure virtual machine (outputting as components at this point) As an overlay layer.

[0137] Therefore, the display synthesizer, according to the alpha mixing formula, overlays the components output by the safety virtual machine onto the full-screen interface of the entertainment virtual machine to generate the final output image frame. Through this mechanism, while ensuring that the vehicle is in an absolutely safe parked state, the main content of the display unit presents rich entertainment information. At the same time, the core safety status components generated by the safety virtual machine are always displayed on the top layer of the screen with the highest priority, ensuring that key information is visible to the driver in any mode.

[0138] Figure 4 This is a schematic diagram of the mode switching triggering and decision-making process according to an embodiment of the present invention.

[0139] like Figure 4 As shown, mode switching is triggered by changes in the vehicle's real-time state. The Scene State Manager (SSM) runs as a fixed, high-priority periodic task within its secure virtual machine. During each decision cycle, it proactively retrieves the latest set of vehicle state signals from the virtualized vehicle bus interface, including gear position values. Vehicle speed values and handbrake status value .

[0140] To prevent frequent and erroneous system mode switching caused by sensor signal jitter at critical points or momentary errors in bus transmission, the scene state manager incorporates a state de-jitter mechanism. A state change is not immediately adopted as a trigger condition, but only if the new combination of vehicle states remains within a preset time window. Or continuous Only after a decision-making cycle is it recognized as an effective and stable state transition.

[0141] In a decision cycle In the process, once a stable state transition confirmed by the anti-shake mechanism occurs, the scene state manager immediately uses this new set of vehicle state values ​​as input to execute the decision logic function. Thus, a new system target pattern can be calculated. The calculation formula is as follows:

[0142] ;

[0143] in, Representatives in the decision-making cycle Calculated potential new target patterns; These represent the decision-making cycle. The gear position, vehicle speed, and handbrake status values ​​have been confirmed by the anti-shake system.

[0144] The scene state manager will calculate the new system target pattern. The pattern executed by the current system in the previous decision cycle A comparison is made, and the mode switching event occurs if and only if the two are not the same. The trigger condition can be expressed by the following formula:

[0145] ;

[0146] in, This represents the mode switching event in decision cycle k, where 1 indicates that the switch is triggered and 0 indicates that it is not triggered. This represents the pattern executed by the current system in the previous decision-making cycle; Represents a conditional judgment, when hour, When it is 1, hour, for .

[0147] once Once determined to be 1, the scene state manager will update its internal state, setting the current system target mode. Set as the new system target mode Based on this, a complete set of control instructions corresponding to the new system target mode is generated. Then, through the inter-virtual machine communication mechanism, these instructions are accurately distributed to the virtual machine monitor, security virtual machine, entertainment virtual machine, and display synthesizer, thereby initiating the mode switching execution process of the entire system.

[0148] After the trigger mode switch event, the Scene State Manager (SSM) generates a structured instruction set containing control information for all relevant modules, based on the newly determined system target mode. This instruction set is used in the decision-making cycle. The generated complete instruction set It can be represented as a quadruple:

[0149] ;

[0150] in, In the decision-making cycle The generated complete instruction set; This is a command sent to the virtual machine monitor, the content of which is a resource allocation policy identifier, and the set of values ​​is { }, which correspond to the resource configuration schemes for safe mode and entertainment mode, respectively; This is a command sent to the secure virtual machine, containing a rendering mode identifier with a value set of { }; This is a command sent to the entertainment virtual machine, and its content is a runtime status identifier with a value set of { }; This is a command sent to the display compositor, containing a layer composition rule identifier, with a value set of { }, which correspond to the layer composition rules for the secure virtual machine and the entertainment virtual machine, respectively.

[0151] Instruction sets are issued through a dedicated inter-virtual machine communication channel pre-established by the virtual machine monitor. In one embodiment, this communication channel includes a fixed physical memory area, i.e., an instruction shared memory area, which all relevant modules (including the virtual machine monitor itself) have read and write access to.

[0152] The process of issuing and receiving instructions is atomic and deterministic. The scene state manager first stores the complete instruction set data structure. The instruction writes to a predetermined address in the shared memory area in a single operation. Upon completion of the write, the scene state manager immediately executes a specific hypercall instruction. This instruction redirects the execution flow from the guest environment to the host environment.

[0153] Upon capturing the hypercall, the virtual machine monitor immediately performs the following operations: First, it reads its own control instructions from the instruction shared memory area and immediately adjusts its internal CPU scheduler parameters and other resource allocation strategies. Second, it injects a virtual interrupt with a predefined interrupt vector number into the entertainment virtual machine to notify it to read the new instructions. Similarly, it also injects a virtual interrupt into the execution environment where the display synthesizer resides.

[0154] The pre-built interrupt service routines within the entertainment virtual machine and the display synthesizer are activated immediately upon receiving a virtual interrupt. Each of them reads the instructions sent to the entertainment virtual machine from a specified offset address in the instruction shared memory area. and instructions sent to the display synthesizer And initiate the corresponding state transition process. This is due to the instructions given to the secure virtual machine. It is generated internally and the instruction is passed through a higher-priority internal message queue or a direct function call, achieving the fastest response.

[0155] When the virtual machine monitor receives instructions sent to it by the Scene State Manager (SSM) via the hypercall mechanism... Immediately afterwards, it executes a series of predefined resource reallocation operations corresponding to the instruction. These operations directly affect the physical hardware resources managed by the virtual machine monitor to adjust the computing power and device access permissions allocated to secure virtual machines and entertainment virtual machines. For the reallocation of central processing unit (CPU) resources, the virtual machine monitor modifies the weight parameters of its internal scheduler. In one embodiment, the CPU time allocation ratio for each virtual machine... It is determined by its scheduling weight The CPU allocation ratio for secure virtual machines and entertainment virtual machines within a scheduling cycle is determined by the following formulas:

[0156] ;

[0157] ;

[0158] in, and These represent the CPU time allocation ratios for the secure virtual machine and the entertainment virtual machine, respectively. and These represent the current scheduling weights of the security virtual machine and the entertainment virtual machine, respectively. When an instruction is received from the virtual machine monitor... for At that time, the virtual machine monitor will Set to the preset high weight value and will Set to the preset low weight value Conversely, when the instruction is... At that time, then Set as ,Will Set as .

[0159] To reallocate graphics processing unit (GPU) resources, the virtual machine monitor issues instructions to its built-in virtual graphics processing unit (vGPU) scheduling module. These instructions cause the virtual machine to adjust its allocation strategy for physical GPU execution time and memory bandwidth. When the system switches to entertainment mode, the entertainment virtual machine's vGPU is granted high priority and the majority of its execution time slices; when the system switches to safe mode, the safe virtual machine's vGPU is given the highest priority to ensure its rendering tasks execute without delay or contention.

[0160] To reallocate access permissions for physical devices, the virtual machine monitor modifies the page table configuration of the Input / Output Memory Management Unit (IOMMU). For example, when switching to entertainment mode, the virtual machine monitor establishes or activates specific IOMMU mappings, directly mapping the device address space of the physical audio controller or a specific USB port to the address space of the entertainment virtual machine, thereby granting it exclusive access. When switching back to safe mode, the virtual machine monitor revokes or invalidates these mappings, cutting off the entertainment virtual machine's access to these physical devices and ensuring that it cannot affect the vehicle's critical functions.

[0161] The compositor displays a message from the Scene State Manager (SSM) that is inconsistent with the current compositing rule. Then, a time-controlled graphical transition process is immediately initiated to achieve a smooth and seamless visual presentation of system mode switching.

[0162] In one embodiment, the switching process from security mode to entertainment mode includes a preset duration of [missing information]. The crossfade-in and fade-out animation. During this transition, the display compositor performs pixel-by-pixel, time-dependent alpha blending calculations for each frame of the output image to be generated. The relative time after the transition begins... The final output pixel color value Determined by the following formula:

[0163] ;

[0164] ;

[0165] in, This means that during the transition, the pixel coordinates in the output image frame are... Pixels in relative time The pixel color value; The pixel color values ​​representing the transition start screen are derived from the graphics buffer in the secure virtual machine's full-screen mode. ; The pixel color value representing the transition target screen is the result of pre-compositing the full-screen screen of the entertainment virtual machine and the component screen of the security virtual machine. This represents a transition factor that changes with relative time, its value smoothly increasing from 0 to 1. In one embodiment, ; Represents the absolute time since the system was powered on; This represents the absolute time at which this transition process began; Represents the preset total transition time; The relative transition time represents the normalization, and its value ranges from [0,1].

[0166] In contrast to the process described above, the switch from entertainment mode to safety mode is designed to be instantaneous, without any transition animation. This is to ensure safety in the event of any changes in conditions that could affect driving safety (such as when the driver engages a clutch). The system can take over and display critical safety information with the highest priority without delay.

[0167] In this scenario, upon receiving the layer compositing rule instruction to switch to safe mode, the display compositor immediately discards all graphics buffer data from the entertainment virtual machine during the next display refresh cycle. The display compositor's compositing logic is then immediately switched to direct copy mode, resulting in the final output image frame. The content is entirely and solely contained within the graphics buffer of the secure virtual machine (which has now switched to full-screen rendering mode). The decision ensured the instantaneous presentation of security information.

[0168] Figure 5 This is a schematic diagram of the system state under normal vehicle driving scenario according to an embodiment of the present invention.

[0169] like Figure 5 As shown, in this embodiment, the vehicle is in motion. Specifically, during a certain decision-making cycle... The vehicle status signal obtained and confirmed by the Scene State Manager (SSM) from the virtualized vehicle bus interface is: gear position status value. for (Forward gear), vehicle speed value The handbrake status value is 60 km / h. 0 (not pulled up).

[0170] The scene state manager uses this set of state signals to influence the decision logic function. The condition expression is evaluated. In the middle, the first sub-condition ( )Right now( The result of the AND operation is false, causing the entire logical AND expression to evaluate to false. Therefore, the function decision logic function... Execute it The branch outputs the system target mode as follows: .

[0171] Because the calculated new target model is consistent with the current state of the system If the mode is the same, the mode switching event is not triggered, and the scene state manager continues to maintain and broadcast the same status. The instruction set corresponding to the mode.

[0172] The virtual machine monitor receives instructions continuously sent to it. (value is) Configure its scheduler weight parameters to prioritize security. The current scheduling weight value of the security virtual machine. Set as a high weight value The current scheduling weight value of the entertainment virtual machine Set to low weight value This ensures that the secure virtual machine receives the majority of CPU execution time.

[0173] The security virtual machine continuously receives instructions sent to it. (value is) This executes its internal full-featured dashboard graphics application. Based on real-time data acquired from the bus, the application renders a complete instrumentation interface within the secure virtual machine's graphics buffer. It includes a dynamic speedometer with an indication value of 60, and a display. It displays all the necessary driving information, including the gear indicator and engine tachometer.

[0174] The entertainment virtual machine relies on continuously received running status instructions. (value is) It remains in a suspended or low-power operating state, and its internal applications do not perform graphical interface rendering, so it does not submit any valid graphics buffer to the display compositor.

[0175] The display synthesizer continuously receives instructions sent to it. (value is) ), the graphics buffer generated by the secure virtual machine As the sole input source, its synthesis operation is simplified to direct data transfer, generating the final output image frame. Content and Completely consistent. Ultimately, the display unit's screen stably displays a complete, real-time digital dashboard with guaranteed functional safety levels, providing the driver with accurate driving information.

[0176] Figure 6 This is a schematic diagram illustrating a scenario of switching from security mode to entertainment mode according to an embodiment of the present invention.

[0177] like Figure 6 As shown, in this embodiment, the vehicle transitions from a driving state to a safe parking state. The driver reduces the vehicle speed to 0 and engages a gear. The vehicle shifts into gear and engages the handbrake. The Scene State Manager (SSM) acquires this series of state changes through the virtualized vehicle bus interface and, after a preset state debounce time window... After confirmation, a new and stable set of vehicle status signals was adopted: gear status value. for Vehicle speed value The value is 0, indicating the handbrake status. The value is 1.

[0178] The scene state manager immediately uses this new set of state signals for the decision logic function. The conditional expression is then evaluated. All three sub-conditions ( (8) (Assuming a threshold) The results of evaluating a small value greater than or equal to 0 (such as 5 km / h) and (1=1) are both true. Therefore, the result of the entire logical AND expression is true, and the decision logic function... The output is .

[0179] Due to the newly calculated target pattern With the system currently in When the mode changes, a mode switching event is triggered. The scene state manager then generates and distributes a corresponding set of events. The instruction set for the mode.

[0180] The virtual machine monitor received a new instruction sent to the virtual machine monitor. (value is) It will immediately adjust its scheduler weight parameters, changing the current scheduling weight of the secure virtual machine. Reduce to low weight value At the same time, the current scheduling weight of the entertainment virtual machine will be adjusted. Upgrade to high weight value This allows the majority of CPU computing resources to be allocated to entertainment virtual machines.

[0181] The security virtual machine receives a new instruction sent to the security virtual machine. (value is) It immediately terminates the rendering task of its full-screen instrument panel and starts rendering only the current gear. The small-sized component graphics are identified, and a component graphic buffer is generated. At the same time, the entertainment virtual machine received new runtime status instructions. (value is) The virtual machine is awakened from its suspended state by the virtual machine monitor and begins rendering its full-screen user interface (e.g., a video playback application), generating the graphics buffer for the entertainment virtual machine. .

[0182] The display synthesizer receives a new instruction sent to the display synthesizer. (value is) This involves initiating a timed crossfade-in / fade-out transition process. During this process, the output pixel color values... The following formula is used to determine the total transition time within the preset range. Internal continuous calculation:

[0183] After a duration of After a smooth transition, the screen content of the display unit is finally and stably presented as a full-screen video playback interface output by the entertainment virtual machine. Furthermore, the security virtual machine generates a gradation level representing the core security status. The components are displayed unambiguously overlaid on the top layer of the screen.

[0184] Figure 7 This is a schematic diagram illustrating a scenario of emergency switching from entertainment mode to security mode according to an embodiment of the present invention.

[0185] like Figure 7 As shown, in this embodiment, the system's initial state is entertainment mode. In this state, the display unit presents a full-screen user interface rendered by the entertainment virtual machine, overlaid with gear levels generated by the security virtual machine. Components. At this time, the driver performs an operation to release the vehicle from the safe parking state, for example, by shifting the transmission gear from... Shift to Gear (forward gear).

[0186] The Scenario State Manager (SSM) acquires this state change via the virtualized vehicle bus interface during its next decision cycle. After confirmation by the state debouncing mechanism, a new set of vehicle state signals is adopted: gear position value. for And vehicle speed value and handbrake status value At this point, they are still 0 and 1 respectively.

[0187] The scene state manager uses this new set of state signals for the decision logic function. Re-evaluate. Because the conditional expression ( The evaluation result of ) is due to ( If the result becomes false, then the entire logical AND expression also becomes false. Therefore, the decision logic function... Execute it The branch outputs the system target mode as follows: .

[0188] Due to the newly calculated target pattern With the system currently in When the mode changes, the mode switching event is triggered immediately. The scene state manager then generates and distributes a corresponding set of events. The instruction set of the mode, including Set as ,Will Set as ,Will Set as and will Set as .

[0189] Upon receiving the instruction, the virtual machine monitor immediately switches the running state of the entertainment virtual machine to suspended and sets the current scheduling weight value of the entertainment virtual machine. Reduce to low weight value At the same time, the current scheduling weight of the security virtual machine will be adjusted. Increase to high weight value Upon receiving the instruction, the secure virtual machine immediately switches from component rendering mode to full-screen rendering mode and begins generating a display reflecting the current vehicle status (e.g., the gear position is shown as...). The graphics buffer of the secure virtual machine. .

[0190] In this emergency exit scenario, the display compositor receives the instruction sent to the display compositor. (value is) After that, a seamless transition is performed. It immediately discards all graphics buffers from the entertainment virtual machine in its internal compositing pipeline and stops performing any layer blending calculations. In the first display refresh cycle that follows, the display compositor directly discards the graphics buffers from the security virtual machine. As the sole display source. The final output image frame. Determined by the following formula:

[0191] ;

[0192] Through this mechanism, the content of the display unit is immediately and completely replaced by a full-featured instrument interface independently generated by a secure virtual machine, ensuring that all information directly related to driving safety can be presented to the driver with the highest priority and without any delay the instant the vehicle is about to move.

Claims

1. A method for dynamic switching between dual systems in a vehicle instrument panel, characterized in that, The dynamic switching method for the dual systems of the vehicle instrument panel is implemented based on a hardware platform, which includes a main processor, a storage unit, a vehicle bus interface, and a display unit. The dynamic switching method for the dual systems of the vehicle instrument panel includes the following steps: S1. Obtain the vehicle status signal that represents the current physical state of the vehicle through the vehicle bus interface; S2. Based on the vehicle status signal, determine the system target mode. The set of values ​​for the system target mode includes safety mode and entertainment mode. S3. When the system target mode is inconsistent with the current system operation mode, a set of control instructions is generated. The control instruction set includes resource allocation instructions, rendering mode instructions, operation status instructions, and layer composition rule instructions. S4. Distribute the control instruction set to the virtual machine monitor, the security virtual machine, the entertainment virtual machine, and the display synthesizer, wherein the virtual machine monitor, the security virtual machine, and the entertainment virtual machine all run on the main processor; S5. The virtual machine monitor adjusts the computing resources allocated to the security virtual machine and the entertainment virtual machine according to the resource allocation instruction. The security virtual machine switches the rendering mode according to the rendering mode instruction, and the entertainment virtual machine switches the running state according to the running state instruction. S6. The display compositer combines the graphics buffers generated by the security virtual machine and the entertainment virtual machine into a final output image frame according to the layer compositing rule instructions, and then delivers it to the display unit for presentation.

2. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 1, characterized in that, In step S2, the specific method for determining the system's target mode is as follows: When the vehicle status signal indicates that the gear status is park, the vehicle speed is less than or equal to a preset vehicle speed threshold, and the handbrake status is engaged, the system target mode is determined to be the entertainment mode. When the vehicle status signal indicates that the gear status value is not park, or the vehicle speed value is greater than the preset vehicle speed threshold, or the handbrake status value is not in the engaged state, the system target mode is determined to be the safety mode.

3. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 1, characterized in that, When the system target mode is the security mode, the switching operation is specifically as follows: The virtual machine monitor allocates primary computing resources to the secure virtual machine; The secure virtual machine enters full-screen rendering mode and generates a graphics buffer containing complete driving information. The entertainment virtual machine enters an inactive state and does not produce any graphics output; The display compositor uses the graphics buffer of the secure virtual machine as the sole display source to generate the final output image frame.

4. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 1, characterized in that, When the system target mode is the entertainment mode, the switching operation is specifically as follows: The virtual machine monitor allocates the primary computing resources to the entertainment virtual machine; The secure virtual machine enters component rendering mode and generates a graphics buffer containing only core vehicle status information. The entertainment virtual machine enters an active state and generates a graphics buffer containing the application's user interface; The display compositor overlays the graphics buffer of the secure virtual machine onto the graphics buffer of the entertainment virtual machine to generate the final output image frame.

5. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 1, characterized in that, Before step S2, the method for dynamic switching between the dual systems of the vehicle instrument panel further includes: The vehicle status signal is subjected to status debouncing processing. Only when the vehicle status signal is maintained for a preset time window is it used to determine the system target mode.

6. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 1, characterized in that, In step S4, the specific method for distributing the control instruction set is as follows: Write the control instruction set into the instruction shared memory area; Executing a hypercall instruction causes the execution flow to trap into the virtual machine monitor; The virtual machine monitor reads the instruction shared memory area and injects a virtual interrupt into the entertainment virtual machine and the display synthesizer. The virtual interrupt is used to trigger the entertainment virtual machine and the display synthesizer to read new instructions.

7. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 1, characterized in that, In step S5, the virtual machine monitor adjusts computing resources in the following way: Modify the weight parameters of the scheduler inside the virtual machine monitor, the weight parameters determining the proportion of CPU time slices obtained by the security virtual machine and the entertainment virtual machine.

8. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 4, characterized in that, The display synthesizer overlays the graphics buffer of the secure virtual machine onto the graphics buffer of the entertainment virtual machine in the following way: Perform pixel-by-pixel alpha blending calculations on the two graphics buffers.

9. The method for dynamic switching between dual systems of an in-vehicle instrument panel according to claim 1, characterized in that, In step S6, when the system target mode switches from the security mode to the entertainment mode, the display synthesizer executes a timed cross-fade-in and fade-out animation to smoothly transition between the starting screen and the target screen. When the system target mode switches from the entertainment mode to the security mode, the display synthesizer performs an instantaneous switch without transition animation, immediately using the graphics buffer of the security virtual machine as the sole display source.

10. A method for dynamic switching between dual systems in a vehicle instrument panel according to claim 1, characterized in that, The dynamic switching method for the dual systems of the vehicle instrument panel is implemented based on a software platform, which includes: A Type-1 virtual machine monitor that runs directly on the aforementioned hardware platform; The security virtual machine and the entertainment virtual machine running on the virtual machine monitor; A scene state manager running inside the secure virtual machine; And the display synthesizer.

Images