Automobile electronic control unit integration method and system

Abstract

The invention provides an automobile electronic control unit integration method and system, and relates to the technical field of automobile electronics, and the method comprises the steps: collecting function demands of each system of an automobile, constructing a function demand database, carrying out the classification, designing a corresponding domain controller, and constructing a layered software architecture in the domain controller; deploying the control algorithm of each function type to a corresponding function core of the domain controller according to the hierarchical software architecture; and dividing the security levels of the functional modules in the domain controller based on the functional core, and performing isolation and communication security monitoring on the functional modules according to different security levels. The operation safety among the functional modules is ensured through an isolation and communication safety monitoring mechanism based on the safety level, so that the automobile electronic control unit can realize centralized management, consistent scheduling and stable and reliable cooperative control under higher system complexity; the problem that an existing distributed electronic control unit architecture lacks a unified management and cooperation mechanism is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of automobile electronics, and particularly relates to an automobile electronic control unit integration method and system. BACKGROUND

[0002] With the continuous improvement of the degree of automobile electrification and intelligence, the power control system, chassis control system, body control system, infotainment system, intelligent driving system and the like in the vehicle interior all rely on electronic control units to cooperate and run. Modern passenger cars and commercial vehicles often integrate a large number of electronic control units, and the communication frequency between different systems is constantly increasing, and the requirements for system real-time performance, data consistency and functional safety are also increasingly stringent. Under this background, the automobile electrical architecture is gradually evolving from the traditional decentralized structure to centralized and regional control structure to meet the development trend of vehicle function complexity.

[0003] In related technical means, a decentralized electronic control unit arrangement method is often used, that is, an independent electronic control unit is configured for each specific function module, and each control unit communicates with each other through a vehicle-mounted bus to realize its own function control and cross-system cooperation. In this technical mode, each electronic control unit has an independent processor, memory and software program, and can complete vehicle body control, state monitoring and part of cross-module information interaction. In this way, the independent operation of each system function can be ensured, the system deployment is flexible, the coupling degree between software and hardware is low, and the traditional vehicle function expansion demand can be better supported.

[0004] Although the independent configuration of electronic control units can realize the autonomous operation of each system function, in the case of continuous increase of vehicle functions and improvement of system interaction frequency, the existing decentralized architecture is difficult to guarantee the coordination of the overall control system, that is, it is difficult to form a unified management and cooperation mechanism among multiple control units in the vehicle interior, thereby leading to difficulty in effectively improving the system consistency and overall operation efficiency. SUMMARY

[0005] In order to overcome the problem of lack of unified management and cooperation mechanism in the existing decentralized electronic control unit architecture, the present application provides an automobile electronic control unit integration method and system.

[0006] In one aspect, the application provides a method for integrating electronic control units of an automobile, comprising: collecting functional requirements of each system of the automobile to build a functional requirement database, classifying electronic control units according to functional types based on the functional requirement database to obtain a functional division result; designing a corresponding domain controller based on the functional division result and building a layered software architecture in the domain controller; deploying control algorithms of each functional type to corresponding functional cores of the domain controller according to the layered software architecture; dividing the security levels of each functional module in the domain controller based on the functional cores, and isolating and monitoring the communication security of each functional module according to different security levels.

[0007] Optionally, the step of collecting functional requirements of each system of the automobile to build a functional requirement database, classifying electronic control units according to functional types based on the functional requirement database to obtain a functional division result, comprises: collecting functional parameters and control signal types of each system of the automobile to build a functional requirement database, classifying electronic control units into a first control unit, a second control unit and a third control unit based on real-time requirements of each system in the functional requirement database, and determining real-time levels according to the first control unit, the second control unit and the third control unit; classifying electronic control units in the first control unit, the second control unit and the third control unit according to control signal types of each system in the functional requirement database, merging electronic control units with similar control objects into the same functional type to obtain control object types; counting total amounts of computing resource requirements of all electronic control units in each functional type, determining the number of processor cores and the storage capacity specifications required by the corresponding functional type according to the total amounts of computing resource requirements to obtain hardware resource configuration parameters; and building a functional division result according to the real-time levels, the control object types and the hardware resource configuration parameters.

[0008] Optionally, the step of determining the hardware resource configuration parameters according to the total amount of computing resource requirements of all electronic control units in each function type includes: extracting the total amount of computing resource requirements of each electronic control unit in each function type from the function requirement database; wherein the total amount of computing resource requirements includes a unit computing power requirement value and a unit storage requirement value; performing cumulative calculation on the unit computing power requirement values of all electronic control units in the same function type to obtain the total computing power requirement of each function type, and performing cumulative calculation on the unit storage requirement values of all electronic control units in the same function type to obtain the total storage requirement of each function type; dividing the total computing power requirement by a preset processor core unit computing power benchmark value and rounding up to obtain the number of processor cores required by each function type; determining program storage capacity and data storage capacity according to the total storage requirement to obtain the storage capacity specification of each function type; and constructing the hardware resource configuration parameters based on the number of processor cores and the storage capacity specification of each function type.

[0009] Optionally, the step of designing a corresponding domain controller based on the function division result and constructing a layered software architecture in the domain controller includes: selecting a multi-core processor chip according to the hardware resource configuration parameters in the function division result; wherein the multi-core processor chip includes one master core and multiple function cores; assigning an operation priority to each function core according to the real-time level in the function division result; configuring a storage module based on the storage capacity specification in the function division result, and configuring a power management module and a communication interface module according to the function division result; designing a corresponding domain controller using the multi-core processor chip, the operation priority, the storage module, the power management module and the communication interface module; and constructing an operating system layer, a middleware layer and an application layer in the domain controller to obtain a layered software architecture.

[0010] Optionally, the step of deploying control algorithms of each function type to the corresponding function core of the domain controller according to the layered software architecture includes: encapsulating control algorithms of each function type as independent software components according to the application layer interface specification of the layered software architecture; and deploying software components belonging to the function types to the corresponding function cores according to the control object type of each function type in the function division result.

[0011] Optionally, the step of dividing the security levels of the function modules in the domain controller based on the function cores and performing isolation and communication security monitoring on the function modules according to different security levels comprises: obtaining a function module list running on each function core, performing security integrity level evaluation on each function module in the function module list to obtain function modules of high security level and low security level; allocating independent memory address spaces for function modules of different security levels and setting memory access permissions through a memory protection unit at a hardware level of the domain controller; creating a secure partition for the function modules of high security level and isolating the function modules of high security level from the function modules of low security level in time and space by using the secure partition; and monitoring data transmission between function cores in real time, blocking a corresponding communication link and sending a security alarm signal to the master core when tampering or unauthorized access of data is detected.

[0012] Optionally, the step of creating a secure partition for the function modules of high security level and isolating the function modules of high security level from the function modules of low security level in time and space by using the secure partition comprises: enabling a virtualization management program at the operating system level, creating an independent virtual execution environment as a secure partition for each function module of high security level through the virtualization management program; setting an independent memory page table for each secure partition, mapping the virtual memory address of the secure partition to a specific region of physical memory through the memory page table, and setting an access control list in the virtualization management program to prohibit the function modules of low security level from accessing the physical memory region corresponding to the secure partition; allocating a fixed time window for each secure partition, and in the time window allocated to a certain secure partition, the virtualization management program gives the processor full control to the current secure partition, and forces suspension of execution of the current secure partition at the end of the time window and switches to the time window of the next function module.

[0013] In another aspect, the examples of the present application also provide an automotive electronic control unit integration system, comprising: a collection module configured to collect function requirements of each system of an automobile to construct a function requirement database, and classify electronic control units according to function types based on the function requirement database to obtain a function division result; a design module configured to design a corresponding domain controller based on the function division result and construct a layered software architecture in the domain controller; a deployment module configured to deploy control algorithms of each function type to corresponding function cores of the domain controller according to the layered software architecture; and a division module configured to divide security levels of function modules in the domain controller based on the function cores and perform isolation and communication security monitoring on the function modules according to different security levels.

[0014] The automobile electronic control unit integration method and system provided by the application have the following technical effects: unified collection and classification of electronic control units are realized based on a function requirement database, domain controller design is driven by function division results, efficient deployment of control algorithms is realized by a layered software architecture, and the running safety between function modules is ensured by a safety level-based isolation and communication safety monitoring mechanism, so that the automobile electronic control unit can realize centralized management, consistent scheduling and stable and reliable collaborative control under higher system complexity, and the problem of lack of unified management and collaborative mechanism in the existing decentralized electronic control unit architecture is overcome. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0016] Figure 1 is a flowchart of the automobile electronic control unit integration method provided by the embodiment of the present application; Figure 2 is a structural schematic block diagram of the automobile electronic control unit integration system provided by the embodiment of the present application. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0018] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or sub-modules does not necessarily have to be limited to those steps or sub-modules clearly listed, but can include other steps or sub-modules not clearly listed or inherent to the process, method, product or device.

[0019] The technical solutions of the present application are further illustrated below in combination with the drawings and through specific embodiments.

[0020] As Figure 1 shown, the present application provides an automobile electronic control unit integration method, which can realize centralized scheduling and collaborative control of electronic control units by uniformly collecting, classifying, integrating and managing the functional requirements of multiple systems of the automobile. Specifically, the following steps are included: Step S1, collecting the functional requirements of each system of the automobile to construct a functional requirement database, and classifying the electronic control units according to the functional requirement database to obtain a functional division result.

[0021] The field contents of the functional requirement database are determined so that the system identification, electronic control unit identification, control object type, control signal type, input / output signal specification, real-time requirement, worst-case execution time estimation, unit computing power requirement value, unit storage requirement value, communication interface type, diagnosis requirement and candidate functional safety level, etc. can be recorded in the database. When collecting the functional requirements, the execution path of the control algorithm can be analyzed by a static time analysis tool to obtain the worst-case execution time estimation, and the processor utilization and computing power requirement can be measured by running example tasks on the target hardware platform to obtain the unit computing power requirement value. After completing the requirement collection, the electronic control units are divided into first control units, second control units or third control units according to the real-time requirement, and the results are written into the functional requirement database. Subsequently, the electronic control units are functionally clustered according to the control object type, control signal type and input / output signal characteristics, and the electronic control units with similar control objects or signal interaction relationships are merged into the same functional type. According to the clustering result, the total computing power requirement and total storage requirement of each functional type are calculated, and finally the functional division result containing the functional type identification, corresponding electronic control unit set, real-time level, control object type, total computing power requirement and total storage requirement, etc. is formed.

[0022] For example, in the power system, the functional requirements of the engine control unit, the energy management control unit and the torque control unit all have high real-time requirements in the functional requirement database, and the physical relationship of their control objects is close, so they will be merged into the power function type and marked in the functional division result as needing high computing power and high storage capacity resource allocation.

[0023] Step S2, designing the corresponding domain controller based on the functional division result, and constructing a layered software architecture in the domain controller.

[0024] According to the requirements of the function division result on computing power, storage, interface bandwidth and real-time level, a suitable multi-core processor chip is selected, and different responsibilities are divided for the master core and the function core in the domain controller, so that the master core undertakes strategy management and fault management, and the function core undertakes specific control tasks of the corresponding function type. Then, according to the real-time level and task density of each function type in the function division result, the priority and core affinity of the function core are set, so that the task corresponding to the first control unit runs on the function core with the highest priority. When constructing the design, the program storage area and data storage area of the domain controller also need to be allocated, the access permission is set and the memory mapping structure is defined, and the power management module and the communication interface module are configured, so as to meet the CAN, CAN-FD, LIN or Ethernet communication requirements of the function type, and the scheduling parameters of the time-sensitive network are configured for the Ethernet according to the demand. Based on the above hardware and resource preparation, a layered software architecture is further constructed inside the domain controller, which includes a driver layer, an operating system layer, a middleware layer and an application layer. The operating system layer needs to support deterministic scheduling or time partitioning, the middleware layer provides cross-function core communication, shared memory management, message queue and communication security monitoring functions, and the application layer is used to load control algorithm software components and call middleware interfaces downward.

[0025] In the domain controller corresponding to the power function type, a multi-core processor with multiple physical cores can be selected, two function cores with higher performance are allocated to the power control task, and the CAN-FD interface related to the power domain is directly connected to the domain controller, so that the high real-time task of the power function type can be executed stably with a fixed period.

[0026] Step S3, according to the layered software architecture, the control algorithm of each function type is deployed to the corresponding function core of the domain controller.

[0027] The control algorithm is packaged as an independent software component, so that each software component contains algorithm execution logic, data input and output interface, state monitoring module, parameter configuration table and version information, and the input and output data structure, message priority, message ID and maximum allowed transmission delay are defined according to the interface specification in the layered software architecture. Then, according to the function division result, the control algorithms of different function types are deployed to their corresponding function cores, and the execution period, priority and storage area of each software component are set, and the shared memory area and message queue mechanism are configured in the middleware layer, so that data exchange between different function types can be realized through shared memory or message queue, and the memory barrier mechanism is used to ensure data consistency. When deploying the algorithm, static analysis and benchmark execution test are also needed to verify the actual execution time and resource occupation of the algorithm component on the target function core, so that the execution period and resource allocation structure can meet the real-time design requirements.

[0028] By encapsulating the traction control algorithm of the power function type as a "power traction component", configured to periodically perform tasks, its input includes vehicle speed and torque demand signals, and the output is the drive actuator control signal; the component is deployed to the power function core, reads the vehicle speed data from the chassis function type through shared memory, and sends the running state to the upper module through the message queue.

[0029] Step S4, based on the security level of each function module in the domain controller is divided according to the function core, and the communication security monitoring of each function module is carried out according to the different security levels.

[0030] According to the candidate security level recorded in the function requirement database and the task characteristics in the function core, each function module is classified according to the function safety standard, and independent memory area, task execution context and access control strategy are allocated to different level modules, so that high level modules can avoid being affected by low level modules. At the same time, in the process of cross module communication, the integrity, timing, source legality and access permission of the message are checked through the communication security monitoring mechanism, and the abnormal communication behavior is blocked or reported if necessary, and the execution state of the function core is continuously monitored during the running, so that the modules with high security level can maintain stable and controllable execution environment in various running scenes.

[0031] As in the power function type, the torque control module related to power is set to the highest security level, its memory area and scheduling context are isolated from other tasks, and at the same time, data exchange is needed through the secure channel with message authentication identification in cross domain communication.

[0032] In this embodiment, the function requirements of each system of the automobile are collected, and a function requirement database is constructed based on the collected function requirements, and then the electronic control unit is classified according to the function type according to the function requirement database to obtain the function division result; after obtaining the function division result, the corresponding domain controller is designed according to the function division result, and a layered software architecture is constructed in the domain controller, so that the domain controller has the ability of layered scheduling and management; then according to the layered software architecture, the control algorithm of each function type is deployed to the function core corresponding to its function type in the domain controller, so that each function core undertakes the control task matched with its function type; finally, the security level of each function module in the domain controller is divided based on each function core, and the function modules are isolated and communication security monitoring is carried out according to different security levels, so that the control task maintains a safe state in the running process, thereby completing the integration process of the automobile electronic control unit.

[0033] By using the above-mentioned integration method of the automobile electronic control unit, the functional requirements of each system of the automobile can be constructed into a functional requirement database in a unified manner, so that the functional type division of the electronic control unit has a clear basis; by designing the domain controller according to the functional division result and constructing a layered software architecture, the management, scheduling and execution path of the control task can be more clear and consistent; by deploying the control algorithm of each functional type to the corresponding functional core of the domain controller, the task conflict between different functional types can be avoided, and the control task execution efficiency can be improved; at the same time, by dividing and implementing the isolation and communication security monitoring of the security level of each functional module based on the functional core, the safety and stability in the overall operation process can be significantly improved, so that the automobile electronic control unit can still maintain coordinated operation and reliability under more complex vehicle functional requirements.

[0034] In another example, step S1 can be preferably as follows: The functional parameters and control signal types of each system of the automobile are collected to construct a functional requirement database, the electronic control units are classified into a first control unit, a second control unit and a third control unit based on the real-time requirements of each system in the functional requirement database, and the real-time level is determined according to the first control unit, the second control unit and the third control unit; wherein the first control unit is an electronic control unit with a real-time requirement within 10 milliseconds, the second control unit is an electronic control unit with a real-time requirement between 10 milliseconds and 100 milliseconds, and the third control unit is an electronic control unit with a real-time requirement above 100 milliseconds.

[0035] The functional parameters and control signal types of each electronic control unit are collected item by item according to a pre-defined functional requirement database field template, which includes but is not limited to: system identification, electronic control unit identification, control object type, control signal type, signal bit width, sampling frequency, maximum allowed delay of command / feedback signal, worst-case execution time (WCET_est) actually measured or estimated, unit computing power requirement value (in DMIPS or MIPS), unit program storage requirement value and unit data storage requirement value (in MB), communication interface type (CAN, CAN-FD, LIN, Ethernet, TSN), power consumption budget, diagnosis and redundancy requirement, and functional safety preliminary level candidate. For the acquisition of WCET_est, a two-step method is adopted: first, a static time analysis tool such as aiT or OTAWA is used to perform static analysis on the control flow graph of the control algorithm to obtain the path-level WCET upper bound; second, a representative workload is run on the target or equivalent processor for benchmarking to obtain the average and peak execution time at runtime, and the static analysis result is compared with the benchmarking result, and the more conservative one is taken as WCET_est. For the unit computing power requirement value, the task execution time measured on the target architecture by SPEC CPU or a self-defined micro-benchmark set can be converted into the MIPS / DMIPS method, and the peak computing power and average computing power are recorded for subsequent accumulation and margin calculation. After completing the field filling, each electronic control unit is classified into a first control unit, a second control unit or a third control unit according to the maximum allowed delay and WCET_est, and the real-time level field is written in the functional requirement database for subsequent processing.

[0036] For example, a brake control unit has a command response requirement of no more than 5 milliseconds, and WCET_est is 1.8 milliseconds after static analysis and benchmarking, so it is marked as real-time level = first control unit in the functional requirement database; an information entertainment related unit has a command response requirement of 300 milliseconds, and WCET_est is 50 milliseconds, so it is marked as real-time level = third control unit in the functional requirement database.

[0037] According to the control signal types of each system in the functional requirement database, the electronic control units in the first control unit, the second control unit and the third control unit are functionally classified, and the electronic control units with similar control objects are merged into the same functional type to obtain the control object type; wherein the electronic control units related to the power system are merged into the power domain, the electronic control units related to the chassis system are merged into the chassis domain, the electronic control units related to the body system are merged into the body domain, and the electronic control units related to the intelligent driving system are merged into the intelligent driving domain.

[0038] A feature vector is constructed for each electronic control unit, including control object semantic encoding (e.g. engine, transmission, steering, braking, etc.), control signal type encoding (analog, PWM, CAN message, Ethernet frame, etc.), real-time level encoding, WCET_est, unit computing power requirement value and unit storage requirement value, and then a rule engine and a hierarchical aggregation algorithm are applied to all feature vectors for function clustering. The rule engine is responsible for identifying explicit business mapping rules (e.g. all units directly controlling driving actuators and with first control unit real-time are necessarily merged into the power or chassis domain), and the hierarchical aggregation algorithm uses hierarchical agglomerative clustering (Hierarchical Agglomerative Clustering) and takes the weighted Euclidean distance of the feature vector as the similarity measure. The weight setting reflects the priority of real-time, control object semantics and communication dependency, to ensure that units with high real-time and communication coupling are preferentially merged into the same function type. After clustering is completed, the clusters are fine-tuned according to the communication dependency analysis results: if there is a large amount of high-frequency / low-delay message interaction between two clusters, they are merged or a high-bandwidth low-delay data channel is marked in the function division result. The function clustering result is written back to the function requirement database and a control object type field is generated.

[0039] For example, if there is a large amount of 0-5 ms CAN-FD message exchange between the engine control unit and the energy management unit in the communication dependency analysis, the clustering algorithm will merge them into the same cluster within the weighted distance threshold, and the rule engine will further confirm that they are merged into the power domain according to the fact that both are actuator controllers and the first control unit is real-time.

[0040] The total amount of computing resources of all electronic control units in each function type is counted, and the number of processor cores and storage capacity required for the corresponding function type are determined according to the total amount of computing resources, to obtain the hardware resource configuration parameters.

[0041] The unit computing power requirement value and the unit storage requirement value of all electronic control units in each function type are extracted from the function requirement database, the unit computing power requirement values of all electronic control units in the same function type are accumulated to obtain the total computing power requirement of the function type, and the unit storage requirement values of all electronic control units in the same function type are accumulated to obtain the total storage requirement of the function type. To map the total computing power requirement to the required number of processor cores, the preset processor core unit computing power benchmark value needs to be determined first, which is based on the single-core continuous computing power (effective computing power considering actual scheduling and context switching overhead) of the target multi-core chip, and the single-core available computing power obtained by benchmark testing is used as the numerical input. The number of processor cores is calculated according to the formula: number of processor cores = round up (total computing power requirement / processor core unit computing power benchmark value), and the initial number of cores obtained is configured redundantly according to the real-time level: when the function type belongs to the first control unit, at least one redundant core is added to the initial number of cores to meet the fault switching and peak load; when the function type belongs to the second control unit, zero or one redundant core is added to the initial number of cores; when the function type belongs to the third control unit, the initial number of cores remains unchanged. For storage capacity, first, the program storage capacity is allocated according to the total storage requirement, and the data storage capacity is allocated according to the total storage requirement, and the allocated program storage capacity and data storage capacity are respectively increased by 20% to 30% of the reserved space to cope with software upgrade and log / data expansion, and finally the storage capacity specifications of each function type are obtained. After determining the number of processor cores and the storage capacity specifications, these parameters are combined with the real-time level of the function type and the control object type to form the hardware resource configuration parameters, which are recorded together in the function division result, and the data interaction relationship and communication bandwidth requirement between the function types are marked in the function division result for use by the domain controller design.

[0042] If the total computing power requirement obtained by accumulating in a certain chassis domain is 18000 DMIPS, and the preset processor core unit computing power benchmark value is 3000 DMIPS / core, then the initial number of processor cores is round up (18000 / 3000) = 6 cores; if the chassis domain is determined to be the first control unit, at least one redundant core is added to the initial number of cores, i.e. the number of processor cores is 7; if the total storage requirement is 512 MB, the program storage can be allocated as 230 MB (about 45%), and the data storage can be allocated as 230 MB (about 45%), and then 25% reserved space is added respectively to obtain the specifications of program storage ≈ 288 MB and data storage ≈ 288 MB.

[0043] The functional division result is constructed according to the real-time level, the control object type, and the hardware resource configuration parameter, wherein the functional division result comprises the real-time level, the control object type, and the hardware resource configuration parameter of each functional type.

[0044] All the above calculations and clustering results are summarized to generate a final functional division result document, which explicitly lists the identification of each functional type, the corresponding electronic control unit set, the real-time level, the control object type, the total computing power requirement, the total storage requirement, the number of processor cores, the program storage and data storage specification, the recommended communication interface type and bandwidth requirement, the external interface mapping table, and the data exchange topology graph between functional types. The functional division result needs to be saved as an independent record in the functional requirement database, and should include version information, generation timestamp, and parameter set for reproducing the division (such as clustering threshold, weighting coefficient, and processor benchmark value). After the functional division result is completed, key functional types should be specially reviewed, including whether the resource margin meets the safety redundancy requirement, whether the communication bandwidth meets the peak interaction requirement, and whether the clustering quality meets the design target. If the review finds that the requirements are not met, the clustering weight or resource benchmark value should be adjusted and the functional division result should be regenerated.

[0045] When the functional division result is annotated with the real-time level = second control unit, the control object type = intelligent driving, the number of processor cores = 4 cores, the program storage = 256 MB, and the data storage = 256 MB in the intelligent driving domain, and a TSN Ethernet channel with a bandwidth of at least 10 Mbps and a delay of less than 5 ms is required between the intelligent driving domain and the power domain in the topology graph.

[0046] Further, the total amount of computing resource requirements of all electronic control units in each functional type is counted, and the number of processor cores and the storage capacity required for the corresponding functional type are determined according to the total amount of computing resource requirements, to obtain the hardware resource configuration parameter. The unit computing power requirement value and the unit storage requirement value of each electronic control unit in each functional type are extracted from the functional requirement database, the unit computing power requirement values of all electronic control units in the same functional type are accumulated to obtain the total computing power requirement of each functional type, and the unit storage requirement values of all electronic control units in the same functional type are accumulated to obtain the total storage requirement of each functional type.

[0047] The extraction and accumulation of the unit computing power requirement value and the unit storage requirement value should clearly use the measurement caliber and unit. The unit computing power requirement value uses peak DMIPS as the accumulation benchmark, and the unit storage requirement value distinguishes program storage and data storage and accumulates separately. After accumulation, the total computing power requirement should be applied with a load factor according to the timing characteristics of the functional type to reflect concurrency and scheduling overhead. The load factor can be taken in the range of 1.1 to 1.4 and adjusted according to the real-time level. The first control unit uses a higher load factor to reflect the preemption and interrupt processing overhead. The total computing power requirement obtained after accumulation and load factor processing is used for subsequent core number calculation. For the total storage requirement, in addition to accumulation, the file system overhead, log writing requirement and firmware upgrade space should also be considered, and 20% to 30% of reserved space should be added. The calculation result of this step is written into the hardware resource configuration parameter field and archived and reviewed as part of the functional division result.

[0048] For example, the unit computing power requirement values of five electronic control units in a certain functional type extracted from the functional requirement database are 2000, 1500, 3000, 1000 and 2500 DMIPS respectively, the total is 10000 DMIPS. If the functional type is the first control unit, the load factor is 1.3, the total computing power requirement is 13000 DMIPS after calculation, and the initial core number is calculated as the integer of (13000 / 3000)=5 cores according to the processor single core benchmark 3000 DMIPS. Then at least one redundant core is added according to the real-time rule, and finally 6 cores are determined.

[0049] According to the preset processor core unit computing power benchmark value, the total computing power requirement is divided by the processor core unit computing power benchmark value and rounded up to obtain the number of processor cores required by each functional type. The initial core number can also be redundantly configured according to the real-time level of the functional type. When the functional type belongs to the first control unit, at least one redundant core is added to the initial core number. When the functional type belongs to the second control unit, zero or one redundant core is added to the initial core number. When the functional type belongs to the third control unit, the initial core number remains unchanged.

[0050] The source and measurement method of the processor core unit computing power benchmark value used in the functional division result should be clearly written. The benchmark value should be obtained by running a standardized microbenchmark on a target chip or a reference chip, and the benchmark test conditions (load type, temperature, frequency) should be noted. After core number calculation, simulation verification should be performed in combination with task scheduling simulation tools (such as using SCHED_TEST or self-developed simulation tools). Simulation verification items include scheduling delay and deadline satisfaction verification under peak load, fault switching and virtualization overhead scenarios. If the simulation fails, the core number or task division strategy should be adjusted.

[0051] For example, if the total computing power requirement is 15000 DMIPS and the processor core unit computing power benchmark value is 3000 DMIPS / core, the initial core number is rounded up (15000 / 3000) = 5 cores; if the function type is determined to be the first control unit, the core number is increased by at least one core as redundancy, and the final core number is 6, and it is confirmed through scheduling simulation that all hard real-time tasks still meet the deadline in the resource failure scenario.

[0052] Determine the program storage capacity and data storage capacity according to the total storage requirement, wherein the program storage capacity is allocated according to 40% to 60% of the total storage requirement, the data storage capacity is allocated according to 40% to 60% of the total storage requirement, and 20% to 30% of reserved space is added to the program storage capacity and the data storage capacity respectively, to obtain the storage capacity specifications of each function type.

[0053] The measurement standards and partitioning strategies of program storage and data storage are determined, the program storage is used to store executable images, static libraries and verification information, and the data storage is used for runtime cache, log and persistent data. The total storage requirement is first split into program storage and data storage according to the selected proportion, and then reserved space for upgrading and logging is reserved for the two parts. After the storage capacity specifications are determined, a memory mapping table needs to be developed and the corresponding physical or logical storage block address interval, access permission and protection strategy (such as read-only / executable bit) of each function module need to be recorded in the function division result. At the end of this step, the storage bandwidth needs to be evaluated to ensure that the storage subsystem will not become a performance bottleneck in the peak access scenario.

[0054] If the total storage requirement is 1024 MB, the program storage and data storage are divided according to 50% / 50%, each being 512 MB, and then 25% reserved space is added respectively, so that the final program storage is 640 MB and the data storage is 640 MB, and independent read-only areas are allocated in the memory mapping table for critical security modules.

[0055] Based on the real-time level, control object type, processor core number and storage capacity specifications of each function type, hardware resource configuration parameters are constructed, and the data interaction relationship and communication bandwidth requirement between each function type are marked in the function division result.

[0056] The calculated processor core number, storage capacity specification and interface demand are summarized as a standardized hardware resource configuration parameter file. The hardware resource configuration parameter file needs to include the recommended multi-core chip model or performance level of each function type, the physical specification of the program and data storage of the master core and function core, the required communication interface type and port number, the communication bandwidth and delay target value, and the description of the power management and temperature constraints. The data interaction relationship diagram should be drawn in the function division result, and the minimum bandwidth and maximum allowable delay of each interaction link are clearly stated, so that the subsequent domain controller design and Ethernet / TSN flow table configuration are used. After completion, the hardware resource configuration parameters are versioned as part of the function division results, and the domain controller selection and software and hardware co-optimization are performed according to the parameters during design review.

[0057] As indicated in the hardware resource configuration parameters of a certain function type, the recommended multi-core chip performance level is "medium-high" level, the master core is 1 core + the function core is 6 cores, the program storage is 512MB, the data storage is 512MB, the external communication requires 2-way CAN-FD and 1-way Ethernet TSN, and the data interaction between adjacent function types requires a minimum bandwidth of 10Mbps and a one-way delay of no more than 5Ms.

[0058] In another example, step S2 can be preferably as follows: According to the hardware resource configuration parameters in the function division result, a multi-core processor chip is selected; wherein the multi-core processor chip includes one master core and a plurality of function cores, and the number of function cores matches the number of processor cores determined in the function division result.

[0059] By reading the processor core number data marked for each function type in the function division result, and converting the data to the core number requirement of the multi-core processor chip, comparing the core number parameters of the existing selectable multi-core processor chips, selecting the multi-core processor chip with core number matching the processor core number and master core frequency not less than 1GHz, function core frequency not less than 400MHz, and when selected, requiring the power consumption index of the chip to meet the maximum power consumption limit required in the function division result, so as to ensure that each function core has the processing capacity to meet the execution of the computing task.

[0060] When the function division result determines that the power domain requires 3 processor cores, the chassis domain requires 2 processor cores, the vehicle body domain requires 1 processor core, and the intelligent driving domain requires 4 processor cores, a multi-core processor chip with 1 master core and 10 function cores can be selected, and the master core is assigned a system management task, and the 10 function cores are one-to-one mapped according to the processor core number of the power domain, the chassis domain, the vehicle body domain and the intelligent driving domain, so that the number of function cores is completely consistent with the number of processor cores.

[0061] According to the real-time level in the function division result, an operation priority is allocated to each function core, a control task of the first control unit is allocated to a high-priority function core, a control task of the second control unit is allocated to a medium-priority function core, and a control task of the third control unit is allocated to a low-priority function core.

[0062] By reading the real-time level of each function type in the function division result, the real-time level is converted into a corresponding priority value, and the smaller the priority value is, the higher the priority is. A priority register rule is set for each function core in the operating system layer, the priority of the function core responsible for the first control unit is set to 1, the priority of the function core responsible for the second control unit is set to 2, and the priority of the function core responsible for the third control unit is set to 3, so as to ensure that a high real-time task has priority to obtain an execution resource.

[0063] When the power domain belongs to the first control unit, the priority of the function core corresponding to the power domain can be set to 1, when the chassis domain belongs to the second control unit, the priority of the function core corresponding to the chassis domain can be set to 2, and when the body domain and the intelligent driving domain belong to the third control unit, the priority of the function core corresponding to the body domain and the intelligent driving domain can be set to 3. The priority scheduler in the operating system layer is used to ensure that a high-priority core has priority to execute when a conflict occurs.

[0064] Based on the storage capacity specification in the function division result, a storage module is configured, the storage module includes a program storage area and a data storage area, an independent storage space is allocated for each function type, and a power management module and a communication interface module are configured according to the function division result. A corresponding domain controller is designed by using a multi-core processor chip, an operation priority, a storage module, a power management module and a communication interface module. The power management module includes multiple power output channels, and the communication interface module includes a CAN bus interface, a LIN bus interface and an Ethernet interface.

[0065] According to the storage capacity specification of each function type in the function division result, independent non-volatile storage and random storage areas are respectively allocated to the program storage area and the data storage area. An extension space of no less than 30% of the total storage requirement is reserved for the first control unit, an extension space of 20% is reserved for the second control unit, and an extension space of 10% is reserved for the third control unit. According to the communication bandwidth requirement in the function division result, a corresponding number of CAN bus interfaces, LIN bus interfaces and Ethernet interfaces are configured for each function type, so that the bandwidth meets the data interaction requirement between the function types. The power management module configures independent power channels according to the power consumption requirement of the function types, so as to realize shunt power supply for each function type.

[0066] When the storage capacity specification of the power domain is 200 MB of program storage area and 300 MB of data storage area, 200 MB of program storage area and 300 MB of data storage area can be allocated to the power domain, and 150 MB of reserved space is additionally added; at the same time, 2 CAN bus interfaces, 1 Ethernet interface and an independent 5V / 3A power supply channel are configured for the power domain to meet the high-bandwidth data interaction and high-power consumption requirements of the power domain, and the above configuration is combined with the multi-core processor chip to build the power domain controller.

[0067] A driving layer, an operating system layer, a middleware layer and an application layer are built in the domain controller to obtain a layered software architecture, the driving layer is used to implement bottom-layer control of hardware resources, the operating system layer is used to implement task scheduling and resource management, the middleware layer is used to implement cross-core communication and data interaction, and the application layer is used to run control algorithms of various functional types.

[0068] The driving layer is built by loading hardware adaptation drivers in the domain controller, a real-time operating system supporting priority scheduling and multi-core management functions is loaded as the operating system layer, a middleware layer supporting shared memory mapping, message queue management and cross-core synchronization mechanisms is built on the basis, and a standardized algorithm calling interface is provided for the application layer above the middleware layer, a complete configuration of the cross-layer structure is realized, and the domain controller can complete the complete workflow of hardware driving, task scheduling, data interaction and algorithm running.

[0069] An RTOS (such as FreeRTOS or AUTOSAR OS) supporting preemption scheduling can be used, CAN drivers, LIN drivers, Ethernet drivers and GPIO drivers are loaded in the driving layer, the shared memory area size is configured to be 64 KB to 256 KB, the maximum depth of the message queue is configured to be 128 messages in the middleware layer, and control algorithm running interfaces for the power domain, the chassis domain, the body domain and the intelligent driving domain are provided in the application layer to ensure that control algorithms of various functional types can run stably.

[0070] In another example, step S3 can be preferably as follows: According to the application layer interface specification of the layered software architecture, control algorithms of various functional types are encapsulated as independent software components, each software component including an algorithm execution module, a data input / output interface and a state monitoring module.

[0071] According to the application layer interface specification in the layered software architecture, a unified input parameter structure, an output parameter structure and an execution function interface are defined for the control algorithm, and the control algorithm is transplanted into the standardized software component framework, so that each software component has an independent algorithm execution module for executing algorithm logic, has an independent data input and output interface for data exchange with the middleware layer, and has a state monitoring module for real-time monitoring of algorithm running state and error code, thereby ensuring the independent running capability of the software component on different function cores.

[0072] For a torque control algorithm of the power domain (such as a PID control algorithm), it can be encapsulated as a "power torque control software component", wherein the algorithm execution module executes the PID calculation logic, the data input and output interface reads the vehicle speed data from the shared memory area and outputs the torque instruction, and the state monitoring module records the PID deviation value in real time and outputs the running state code.

[0073] According to the control object type of each function type in the function division result, the software components belonging to each function type are deployed to the corresponding function core; including deploying the control algorithm belonging to the power domain to the function core responsible for power control, deploying the control algorithm belonging to the chassis domain to the function core responsible for chassis control, deploying the control algorithm belonging to the vehicle body domain to the function core responsible for vehicle body control, and deploying the control algorithm belonging to the intelligent driving domain to the function core responsible for intelligent driving; a shared memory area and a message queue mechanism are established in the middleware layer, data sharing between function cores is realized through the shared memory area, and control instruction transmission between function cores is realized through the message queue mechanism; The task period and execution timing of the control algorithm deployed on each function core are configured, the execution period of the task is set according to the real-time level, the execution period of the control algorithm of the first control unit is set to 1-10 milliseconds, the execution period of the control algorithm of the second control unit is set to 10-100 milliseconds, and the execution period of the control algorithm of the third control unit is set to 100-1000 milliseconds; the control algorithms on each function core are scheduled and managed by the task scheduler of the operating system layer, to ensure that each control algorithm is executed in turn according to the set task period and priority.

[0074] By analyzing the control object type in the function division result, the software component and the corresponding function core are bound, and the shared memory address range, the message queue identifier and the maximum message size are allocated in the middleware layer; the task period is written into the task management table of the operating system layer according to the real-time level, and the execution start time, execution duration and priority level of each control algorithm are specified, periodic scheduling is realized through the multi-core scheduling mechanism of the operating system layer, and it is ensured that tasks do not conflict in execution in a multi-core environment.

[0075] When the power domain belongs to the first control unit, the power domain software component can be deployed to function core 0, the execution period is set to 1 millisecond, the chassis domain software component is deployed to function core 1, the execution period is set to 20 milliseconds, the vehicle body domain software component is deployed to function core 2, the execution period is set to 200 milliseconds, the intelligent driving domain software component is deployed to function core 3, the execution period is set to 800 milliseconds, and a shared memory area A is created in the middleware layer for the power domain and the chassis domain to share vehicle speed data, and a message queue B is created for the intelligent driving domain to send control instructions to the power domain, so as to realize cross-function type collaborative control.

[0076] In another example, step S4 can be preferably as follows: A list of function modules running on each function core is obtained, and each function module in the function module list is evaluated for a safety integrity level according to an automotive functional safety standard, to obtain function modules of different safety levels; wherein the function modules of different safety levels include high safety level function modules and low safety level function modules; the high safety level function modules include ASIL-D level and ASIL-C level, the low safety level function modules include ASIL-B level, ASIL-A level and QM level, ASIL-D level is the highest safety level, and QM level is the lowest safety level.

[0077] By scanning the list of software components deployed on each function core in the domain controller, and combining the risk assessment of the safety function of each software component according to the ISO 26262 standard, including analyzing the influence of functional failure on the overall safety of the vehicle, failure probability and potential hazard level, finally assigning a corresponding ASIL level to each function module, and recording the safety level information of each module in the safety management database, providing a basis for subsequent safety isolation and communication management.

[0078] For example, the power domain torque control software component is ASIL-D level after risk assessment, which is marked as a high safety level function module; the chassis domain steering assist software component is ASIL-C level after evaluation, which also belongs to a high safety level function module; the vehicle body domain light control software component is ASIL-A level after evaluation, which belongs to a low safety level function module; and the intelligent driving domain entertainment information display module is QM level after evaluation, which also belongs to a low safety level function module.

[0079] The memory protection unit is enabled at the hardware level of the domain controller, and independent memory address spaces are allocated to function modules of different safety levels, and the memory access permission is set by the memory protection unit at the hardware level of the domain controller, so that the low safety level function modules are prohibited from accessing the memory address space of the high safety level function modules.

[0080] By configuring the memory protection unit (MPU) in the multi-core processor chip, an independent physical memory area is allocated for each high-security level function module, and a different physical memory area is allocated for the low-security level function module, and an access control register is set to prohibit the function core of the low-security level module from accessing the memory area of the high-security level module, ensuring that the high-security level module is not interfered by the low-security level module during runtime.

[0081] The ASIL-D level torque control module in the power domain is allocated physical memory 0x20000000 to 0x2003FFFF, and the ASIL-A level light control module in the vehicle body domain is allocated physical memory 0x20040000 to 0x2005FFFF, and the access permission is set in the MPU register to prevent the light control module from accessing the memory area of the torque control module.

[0082] A security partition mechanism is established at the operating system layer to create a security partition for the high-security level function module, and the security partition is used to isolate the high-security level function module from the low-security level function module in time and space, ensuring that the high-security level function module is not affected by the failure of the low-security level function module.

[0083] By enabling the security partition function in the real-time operating system, an independent scheduling partition is created for each high-security level function module, an independent task queue and resource access table are configured, the low-security level module is allocated to a different scheduling partition, and the scheduling strategy is strictly executed according to the partition priority in the operating system scheduler, achieving complete isolation of the high-security level module from the low-security level module in time slice and resource access.

[0084] A partition P1 is created for the ASIL-D level function module in the power domain, a partition P2 is created for the ASIL-C level function module in the chassis domain, a partition P3 is created for the ASIL-A level function module in the vehicle body domain, and a partition P4 is created for the entertainment information module QM level, ensuring that P1, P2 and P3, P4 do not compete for resources during operating system scheduling.

[0085] A communication security monitoring module deployed in the middleware layer monitors the data transmission between function cores in real time, performs integrity verification and identity authentication on the transmitted data, and when tampering or unauthorized access is detected, the communication security monitoring module blocks the corresponding communication link and sends a security alarm signal to the master core.

[0086] The communication security monitoring module is deployed in the middleware layer, the CRC32 checking algorithm is used to check the data packet integrity, and the identity authentication mechanism based on AES-128 encryption is used to authenticate the communication parties, when the data packet integrity checking fails or the identity authentication fails, the data link is immediately blocked through the interrupt mechanism, and the safety alarm message is sent to the main control core through the CAN bus, including the function module ID, the fault type and the timestamp information.

[0087] For example, when sending the torque control instruction to the chassis domain in the power domain, the communication security monitoring module performs CRC32 checking on the data packet and verifies the message signature, if the checking fails, the middleware immediately blocks the data channel, and sends an alarm to the main control core: module ID = power domain, fault type = data tampering, time = 12:30:15.

[0088] According to the fault management mechanism preset in the main control core, the health status information of each function core is received, when a fault of a function core is detected, a corresponding fault handling strategy is executed according to the safety level of the fault function core, for the fault of a function core with a high safety level, safety shutdown or switching to a redundant backup is performed, and for the fault of a function core with a low safety level, function degradation or isolation processing is performed.

[0089] The health status register of each function core is periodically polled by the main control core, and the heartbeat signal is collected, when a function core is found to be unresponsive in three consecutive heartbeat periods, the safety level of the function module running in the core is found according to the health status database, and a corresponding processing strategy is executed: for ASIL-D and ASIL-C level function modules, start the redundant backup core and isolate the fault core from power, for ASIL-B, ASIL-A and QM level modules, reduce the function execution frequency or suspend part of the non-critical functions to isolate the fault influence.

[0090] When the chassis domain function core fails, the steering auxiliary software component running in it is detected to be ASIL-C level, the main control core immediately switches to the preconfigured redundant function core and performs initialization loading, and sends the system status log at the same time; when the QM level entertainment module in the intelligent driving domain fails, only the UI refresh function of the module is suspended without affecting the operation of other modules.

[0091] Further, a security partition is created for the function module with a high safety level, and the step of isolating the function module with a high safety level from the function module with a low safety level in time and space by using the security partition can be preferably: A virtualization management program is enabled in the operating system layer, and a separate virtual execution environment is created as a security partition for each function module with a high safety level by the virtualization management program; wherein each security partition is allocated independent virtual processor resources and virtual memory resources.

[0092] By loading the virtualization hypervisor at the operating system layer, an independent virtual machine instance is created for each ASIL-D or ASIL-C function module, each virtual machine instance is bound to a dedicated virtual CPU core and a virtual memory area, an independent interrupt vector table and task queue are configured, complete control and isolation of the virtual execution environment for high safety level modules are realized, and at the same time, it is ensured that interrupts and memories are not shared between virtual machines.

[0093] For example, the ASIL-D level torque control module in the power domain creates a virtual machine VM1 in the virtualization hypervisor, allocates 2 virtual CPU cores and 128 MB of virtual memory; the ASIL-C level steering assist module in the chassis domain creates a virtual machine VM2, allocates 1 virtual CPU core and 64 MB of virtual memory.

[0094] In the virtualization hypervisor, a memory isolation strategy is configured, an independent memory page table is set for each safety partition, the virtual memory address of the safety partition is mapped to a specific area of the physical memory through the memory page table, and an access control list is set in the virtualization hypervisor to prohibit low safety level function modules from accessing the physical memory area corresponding to the safety partition, thereby achieving spatial isolation.

[0095] In the virtualization hypervisor, an independent page table is created for each safety partition, the virtual memory range of the safety partition is mapped to a pre-allocated physical memory block, and a list of allowed module IDs is explicitly allowed in the access control list, and other modules are prohibited from accessing the physical memory block, thereby achieving spatial isolation of the physical memory.

[0096] For example, the VM1 page table maps the virtual address 0x00000000-0x07FFFFFF to the physical memory 0x20000000-0x27FFFFFF, and only allows the power domain module to access; the VM2 page table maps the virtual address 0x00000000-0x03FFFFFF to the physical memory 0x28000000-0x2BFFFFFF, and only allows the chassis domain module to access.

[0097] In the virtualization hypervisor, a time slicing scheduling mechanism is configured, a fixed time window is allocated for each safety partition, and in the time window allocated to a certain safety partition, the virtualization hypervisor transfers complete control of the processor to the current safety partition, and at the end of the time window, the execution of the current safety partition is forcibly suspended, and the time window of the next function module is switched to, thereby ensuring that function modules of different safety levels do not compete for processor resources at the same time, and achieving time isolation.

[0098] The virtualization management program controls the execution of each secure partition through a global clock and a time slice schedule table, each secure partition is allocated a fixed millisecond-level time window, at the end of the time window, the current partition is suspended through a hardware interrupt, the CPU control is switched to the next secure partition, and time slice rotation execution of the multi-function module is realized.

[0099] For example, VM1 is allocated a 5-millisecond time window for execution, and VM2 is allocated a 3-millisecond time window for execution, the virtualization management program rotates the CPU control according to the time slice table, and ensures that VM1 and VM2 cannot use the processor resources at the same time.

[0100] A partition-to-partition communication interface is set in the virtualization management program, the partition-to-partition communication interface adopts a one-way data channel mechanism, only allows a function module of a low security level to send a data request to a secure partition of a function module of a high security level, and when the secure partition of the function module of the high security level sends data to the function module of the low security level, needs to pass data filtering and integrity checking of the virtualization management program; an independent watchdog timer is configured for each secure partition, the watchdog timer periodically monitors the running state of the function module in the secure partition, when it is detected that the function module in the secure partition does not respond within a preset time, the watchdog timer sends a partition failure signal to the virtualization management program, the virtualization management program performs an isolation restart operation of the secure partition without affecting the normal operation of other function modules.

[0101] A one-way data channel between secure partitions is created through the virtualization management program, a communication request sent by a low security level module is delivered to a high security level module after authentication and data integrity checking in the virtualization management program, and data sent by the high security level module must be filtered through the virtualization management program; at the same time, an independent watchdog timer is started for each secure partition, a task heartbeat signal in the partition is checked every set period (such as 10 milliseconds), if no valid heartbeat is detected, an isolation restart operation is triggered, only the secure partition virtual machine instance is restarted, and the normal operation of other partitions is not affected.

[0102] For example, a low security level entertainment module of VM4 sends a data request to an ASIL-D level module of VM1, the virtualization management program allows the delivery after AES-128 encryption verification and CRC32 integrity checking of the request; when VM1 sends data to VM4, the data is first subjected to safety filtering of the virtualization management program, the watchdog timer of VM1 monitors and finds that VM1 does not respond for 10 milliseconds, the virtualization management program only isolates and restarts VM1, and does not affect the normal operation of VM2 chassis domain and VM3 body domain.

[0103] For example, Figure 2As shown, the application also provides an automobile electronic control unit integrated system 10, which comprises a collection module 11, a design module 12, a deployment module 13 and a division module 14, and specifically as follows: The collection module 11 is used for collecting the functional requirements of each system of the automobile to construct a functional requirement database, and classifying the electronic control units according to the functional requirement database to obtain a functional division result.

[0104] The functional requirements and control signal types of each system of the automobile are uniformly collected by the collection module 11 to construct a functional requirement database, and the electronic control units are classified into hard real-time, soft real-time and non-real-time based on the real-time requirement, and the electronic control units are merged into the functional types of power domain, chassis domain, body domain and intelligent driving domain according to the functional object type, so as to form the functional division result.

[0105] The design module 12 is used for designing the corresponding domain controller based on the functional division result, and constructing a layered software architecture in the domain controller.

[0106] The multi-core processor chip is selected based on the functional division result by the design module 12, and the number of functional cores and the operation priority are configured, and the storage module, the communication interface module and the power management module are configured, the domain controller is constructed, and the layered software architecture is established in the domain controller, including the driving layer, the operating system layer, the middleware layer and the application layer, which provides the bottom hardware control, task scheduling, cross-core communication and algorithm execution environment for the control algorithm of each functional type.

[0107] The deployment module 13 is used for deploying the control algorithm of each functional type to the corresponding functional core of the domain controller according to the layered software architecture.

[0108] The control algorithm of each functional type is encapsulated as a software component and deployed to the corresponding functional core according to the functional division result by the deployment module 13, the shared memory area and the message queue are configured to realize the data sharing and instruction transmission between cores, the task cycle and execution time sequence are set according to the real-time level, and the operating system scheduler is used to ensure that the control algorithm is executed according to the priority and cycle.

[0109] The division module 14 is used for dividing the security level of each functional module in the domain controller based on the functional core, and isolating and monitoring the communication security of each functional module according to different security levels.

[0110] The function module list of each function core is obtained by the division module 14, and the safety level of each function module is evaluated in combination with the ISO 26262 safety standard, the function modules with high safety levels and the function modules with low safety levels are strictly isolated in memory, processor time and virtual execution environment, safety partitioning in time and space is realized, a communication safety monitoring module is deployed to perform data integrity checking and identity authentication, and a fault management mechanism of the master core is used to perform redundant switching, function degradation or isolation processing on the function core that fails, so that centralized scheduling, cooperative control and safe and reliable operation among various function types of the whole vehicle electronic control system are realized.

[0111] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of the present application are described. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or can be advantageous.

[0112] Each of the embodiments in the present application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the device, equipment and storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0113] Those of ordinary skill in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or by a program instructing relevant hardware to complete, and the program can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0114] The above is only the preferred embodiment of the present application, and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for integrating an automotive electronic control unit, characterized in that, include: The functional requirements of various systems in the vehicle are collected to build a functional requirements database. Based on the functional requirements database, the electronic control units are classified according to their functional types to obtain the functional classification results. Based on the functional partitioning results, design the corresponding domain controller and build a layered software architecture in the domain controller; Based on the layered software architecture, the control algorithms for each functional type are deployed to the corresponding functional cores of the domain controller; Based on the core functionality, the security levels of each functional module in the domain controller are divided, and each functional module is isolated and its communication security is monitored according to different security levels.

2. The automotive electronic control unit integration method according to claim 1, characterized in that, The steps of collecting functional requirements of various systems in the vehicle to construct a functional requirements database, and classifying electronic control units according to functional type based on the functional requirements database to obtain functional classification results include: The functional parameters and control signal types of various automotive systems are collected to construct a functional requirements database. Based on the real-time requirements of each system in the functional requirements database, the electronic control units are classified into the first control unit, the second control unit, and the third control unit, and the real-time level is determined according to the first control unit, the second control unit, and the third control unit. Based on the control signal types of each system in the functional requirements database, the electronic control units in the first control unit, the second control unit, and the third control unit are functionally classified, and electronic control units with similar control objects are grouped into the same functional type to obtain the control object type. The total computing resource requirements of all electronic control units within each functional type are calculated. Based on the total computing resource requirements, the number of processor cores and storage capacity required for the corresponding functional type are determined to obtain hardware resource configuration parameters. The functional division results are constructed based on the real-time level, the type of controlled object, and the hardware resource configuration parameters.

3. The automotive electronic control unit integration method according to claim 2, characterized in that, The steps of calculating the total computing resource requirements of all electronic control units within each functional type, determining the number of processor cores and storage capacity required for the corresponding functional type based on the total computing resource requirements, and obtaining hardware resource configuration parameters include: Extract the total computing resource requirements of each electronic control unit within each functional type from the functional requirements database; wherein, the total computing resource requirements include the unit computing power requirement and the unit storage requirement. The unit computing power requirement of all electronic control units within the same functional type is accumulated to obtain the total computing power requirement of each functional type. The unit storage requirement of all electronic control units within the same functional type is accumulated to obtain the total storage requirement of each functional type. Based on the preset processor core unit computing power benchmark value, the total computing power requirement is divided by the processor core unit computing power benchmark value and rounded up to obtain the number of processor cores required for each function type. Based on the total storage requirements, the program storage capacity and data storage capacity are determined, and the storage capacity specifications for each functional type are obtained. Hardware resource configuration parameters are constructed based on the number of processor cores and the storage capacity specifications for each functional type.

4. The automotive electronic control unit integration method according to claim 2, characterized in that, The steps of designing the corresponding domain controller based on the functional partitioning results and building a layered software architecture in the domain controller include: A multi-core processor chip is selected based on the hardware resource configuration parameters in the functional partitioning results; wherein, the multi-core processor chip includes a main control core and multiple functional cores; Assign computational priorities to each functional core based on the real-time performance level in the functional division results; Based on the storage capacity specifications in the functional partitioning results, configure the storage module, and configure the power management module and communication interface module according to the functional partitioning results. Design the corresponding domain controller using the multi-core processor chip, the computing priority, the storage module, the power management module, and the communication interface module. An operating system layer, a middleware layer, and an application layer are constructed in the domain controller to obtain a layered software architecture.

5. The automotive electronic control unit integration method according to claim 4, characterized in that, The step of deploying control algorithms for each functional type to the corresponding functional core of the domain controller according to the layered software architecture includes: Based on the application layer interface specification of the layered software architecture, the control algorithms for each functional type are encapsulated into independent software components. Based on the control object type of each function type in the functional division results, the software components belonging to each function type are deployed to the corresponding functional core.

6. The automotive electronic control unit integration method according to claim 4, characterized in that, The steps of classifying the security levels of each functional module in the domain controller based on the functional core, and isolating and monitoring the communication security of each functional module according to different security levels, include: Obtain a list of functional modules running on each functional core, and perform a security integrity level assessment on each functional module in the list to obtain functional modules with high security level and low security level. Independent memory address spaces are allocated to functional modules with different security levels, and memory access permissions are set through the memory protection unit at the hardware level of the domain controller. A security partition is created for the high-security-level functional module, and the security partition is used to isolate the high-security-level functional module from the low-security-level functional module in time and space. The system monitors data transmission between functional cores in real time. When data is detected to be tampered with or accessed without authorization, the system blocks the corresponding communication link and sends a security alarm signal to the main control core.

7. The automotive electronic control unit integration method according to claim 6, characterized in that, The step of creating a security partition for the high-security-level functional module, and using the security partition to isolate the high-security-level functional module from the low-security-level functional module in time and space, includes: A virtualization management program is enabled at the operating system layer, and the virtualization management program creates an independent virtual execution environment as a security partition for each high-security functional module. An independent memory page table is set up for each security partition. The virtual memory address of the security partition is mapped to a specific area of ​​physical memory through the memory page table. An access control list is set in the virtualization management program to prohibit the low-security-level functional modules from accessing the physical memory area corresponding to the security partition. A fixed time window is assigned to each of the security partitions. Within the time window assigned to a certain security partition, the virtualization management program transfers complete control of the processor to the current security partition and forcibly suspends the execution of the current security partition at the end of the time window, switching to the time window of the next functional module.

8. An integrated system for automotive electronic control units, characterized in that, include: The data acquisition module is used to collect the functional requirements of various systems in the vehicle to build a functional requirements database. Based on the functional requirements database, the electronic control units are classified according to their functional types to obtain the functional classification results. The design module is used to design the corresponding domain controller based on the functional partitioning results, and to build a layered software architecture in the domain controller; The deployment module is used to deploy control algorithms of various functional types to the corresponding functional cores of the domain controller according to the layered software architecture. The partitioning module is used to partition the security levels of each functional module in the domain controller based on the functional core, and to isolate and monitor the communication security of each functional module according to different security levels.

Images