Vehicle-mounted multi-virtual machine management system and device, vehicle-mounted multi-instrument system and vehicle

Abstract

The present application relates to a kind of vehicle-mounted multi-virtual machine management system, device, vehicle-mounted multi-instrument system and vehicle.The system of the present application, comprising: control unit, for responding to the ignition switch off signal of vehicle, output offline mode instruction;First virtual machine, for responding to offline mode instruction, to remaining virtual machine in offline sequence output offline instruction, and responding to the offline state of all other virtual, issue offline confirmation signal and enter offline state;Virtual machine monitor, for based on offline confirmation signal, output control unit offline instruction.Virtual machine monitor is completely stripped from vehicle power supply strategy, only as passive execution agent, after each virtual machine is completed offline, MCU is uniformly informed, and the extreme stability of underlying is guaranteed;On the other hand, follow fixed offline sequence, avoid disorder competition to maintain global state consistency;Each virtual machine is independently responsible for itself, eliminates the system-level security risks possibly caused by strategy fluctuation.

Description

Technical Field

[0001] This invention relates to the field of vehicle cockpits, specifically to a management system, device, multi-instrument system, and vehicle for in-vehicle multi-virtual machines. Background Technology

[0002] With the development of automotive intelligence, cockpit domain controllers (SoCs) often employ Hypervisor virtualization technology to run multiple virtual machines (VMs) simultaneously, such as VM0 (instrument / safety-related VMs) and VM1 (infotainment / non-safety-related VMs). Two mainstream power management modes exist in current technology: 1. MCU pass-through mode: After the MCU detects a change in vehicle mode (such as an IGN OFF ignition switch signal), it directly sends a shutdown command to the Hypervisor. The disadvantage of this mode is that the Hypervisor is deeply involved in the vehicle's power strategy, resulting in complex Hypervisor logic, strong coupling with the vehicle model, and difficulty in meeting the isolation requirements of functional safety (ISO 26262). 2. Unordered shutdown mode: Each VM decides its own shutdown timing. This mode may cause safety-critical VMs (such as instrument clusters) to shut down before non-critical VMs, causing display abnormalities or safety hazards, and cannot guarantee the overall system's shutdown consistency. Therefore, a hierarchical power management solution with clear responsibilities and high reliability is urgently needed. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a vehicle-mounted multi-virtual machine management system, device, vehicle-mounted multi-instrument system, and vehicle.

[0004] To achieve the above objectives, the present invention provides a vehicle-mounted multi-virtual machine management system, a device, a vehicle-mounted multi-instrument system, and a vehicle as follows: A vehicle-mounted multi-virtual machine management system, characterized in that it includes: a control unit, a virtual machine monitor, a first virtual machine, and other virtual machines; The control unit is used to output an offline mode command in response to the vehicle's ignition switch off signal; The first virtual machine is used to respond to the offline mode instruction, output offline instructions to the remaining virtual machines in the offline order, and respond to the offline status of all other virtual machines, send offline confirmation signals and enter the offline state. The offline command is used to cause the other virtual machines to sequentially enter the offline state; The virtual machine monitor is used to output a control unit offline command based on the offline confirmation signal, and the control unit offline command is used to put the control unit into an offline state. The first virtual machine and other virtual machines are also used to control at least one vehicle instrument.

[0005] Preferably, the first virtual machine is used to display or control the vehicle's instrument information or safety settings, and the remaining virtual machines are used to display or control the vehicle's audio-visual entertainment functions. The offline order is such that the remaining virtual machines take priority over the first virtual machine.

[0006] Preferably, the other virtual machines are also configured to enter offline mode in response to a offline command and output a offline response signal; If no offline response signal is received from the target virtual machine within a preset time period after the first virtual machine issues the offline command, the offline command is reissued to the target virtual machine. The target virtual machine is one of the remaining virtual machines; If the first virtual machine reissues a shutdown command to the target virtual machine that is greater than a preset threshold, then a shutdown command for the target virtual machine is output. The virtual machine monitor responds to the forced offline command by shutting down the target virtual machine and outputs the shutdown information of the target virtual machine to the control unit.

[0007] Preferably, the remaining virtual machines responding to the offline command further include at least one of pausing multimedia playback, transferring the current application stack in the virtual machine to persistent storage, and turning off the backlight of the virtual machine-controlled display.

[0008] Preferably, the control unit is further configured to output an online mode command to the virtual machine monitor in response to the vehicle's unlock signal; The virtual machine monitor is used to respond to the online mode command by first bringing the first virtual machine online, and then bringing the remaining virtual machines online.

[0009] Preferably, when the first virtual machine is activated, the first virtual machine detects the online status of the other virtual machines through the virtual machine monitor, and outputs the online status of the other virtual machines to the virtual machine monitor. If the virtual machine monitor responds to the online status of the other virtual machines and determines that the target virtual machine among the other virtual machines is offline after a first preset time period, it will bring the target virtual machine back online.

[0010] Preferably, when the first virtual machine is brought online, the status of the other virtual machines is detected; When the first virtual machine detects that the other virtual machines are running, it detects the heartbeats of the other virtual machines; When the first virtual machine detects that it has received a heartbeat from another virtual machine, it determines the current display status of the other virtual machines and displays the content that the other virtual machines need to display. The current display state includes both normal display and black screen display.

[0011] The device for managing multiple instruments in a vehicle is characterized in that the device includes the aforementioned management system for multiple virtual machines in a vehicle.

[0012] A vehicle-mounted multi-instrument system, characterized in that the vehicle-mounted multi-instrument system includes: multiple vehicle-mounted instruments and a management device for the vehicle-mounted multi-instrument system as described above. The vehicle is characterized in that it includes: the aforementioned in-vehicle multi-instrument system.

[0013] The vehicle-mounted multi-virtual machine management system of this invention constructs a highly reliable vehicle power management mechanism: On the one hand, the virtual machine monitor is completely decoupled from the vehicle power policy, acting only as a passive execution agent. After each VM is taken offline, it releases hardware resources and notifies the control unit, thus ensuring the ultimate stability of the underlying layer; On the other hand, the system strictly follows a fixed offline order of "other virtual machines (non-safety critical) first, then the first virtual machine (safety critical)," avoiding disorderly competition to maintain global state consistency; At the same time, each virtual machine can independently be responsible for the resource release of its own peripherals and display status, and the decision-making layer does not interfere with the specific implementation details. This clear delineation of responsibilities makes the main body of each link in the process clear, effectively reducing the risk of misjudgment in the execution of cross-domain instructions, thereby ensuring the accurate closure of the offline process and completely eliminating system-level security risks that may be caused by fluctuations in upper-level policies. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the hibernation process of a vehicle-mounted multi-virtual machine management system according to the present invention. Detailed Implementation

[0015] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0016] A vehicle-mounted multi-virtual machine management system, characterized in that it includes: a control unit, a virtual machine monitor, a first virtual machine, and other virtual machines; The control unit is used to output an offline mode command in response to the vehicle's ignition switch off signal; The first virtual machine is used to respond to the offline mode instruction, output offline instructions to the remaining virtual machines in the offline order, and respond to the offline status of all other virtual machines, send offline confirmation signals and enter the offline state. The offline command is used to cause the other virtual machines to sequentially enter the offline state; The virtual machine monitor is used to output a control unit offline command based on the offline confirmation signal, and the control unit offline command is used to put the control unit into an offline state. The first virtual machine and other virtual machines are also used to control at least one vehicle instrument.

[0017] In some optional embodiments, the first virtual machine is used to display or control the vehicle's instrument information or safety settings, and the remaining virtual machines are used to display or control the vehicle's audio-visual entertainment functions. The offline order is such that the remaining virtual machines take priority over the first virtual machine.

[0018] In some optional embodiments, the other virtual machines are also configured to enter offline mode in response to a offline command and output a offline response signal; If no offline response signal is received from the target virtual machine within a preset time period after the first virtual machine issues the offline command, the offline command is reissued to the target virtual machine. The target virtual machine is one of the remaining virtual machines; If the first virtual machine reissues a shutdown command to the target virtual machine that is greater than a preset threshold, then a shutdown command for the target virtual machine is output. The virtual machine monitor responds to the forced offline command by shutting down the target virtual machine and outputs the shutdown information of the target virtual machine to the control unit.

[0019] In some alternative embodiments, the remaining virtual machines responding to the offline command may further include at least one of pausing multimedia playback, transferring the current application stack in the virtual machine to persistent storage, and turning off the backlight of the virtual machine-controlled display.

[0020] In some optional embodiments, the control unit is also configured to output an online mode command to the virtual machine monitor in response to the vehicle's unlock signal; The virtual machine monitor is used to respond to the online mode command by first bringing the first virtual machine online, and then bringing the remaining virtual machines online.

[0021] In some optional embodiments, when the first virtual machine is activated, the first virtual machine detects the online status of the other virtual machines through the virtual machine monitor and outputs the online status of the other virtual machines to the virtual machine monitor. If the virtual machine monitor responds to the online status of the other virtual machines and determines that the target virtual machine among the other virtual machines is offline after a first preset time period, it will bring the target virtual machine back online.

[0022] In some optional embodiments, when the first virtual machine is brought online, the status of the remaining virtual machines is detected; When the first virtual machine detects that the other virtual machines are running, it detects the heartbeats of the other virtual machines; When the first virtual machine detects that it has received a heartbeat from another virtual machine, it determines the current display status of the other virtual machines and displays the content that the other virtual machines need to display. The current display state includes both normal display and black screen display.

[0023] In the above embodiments, the "offline mode" may include two modes: "sleep mode" and "power off mode". Specifically, when the control unit outputs an offline mode command specifically a "sleep mode" command, the offline sequence is a sleep sequence, the offline command is a sleep command, the offline status is sleep loading, the offline confirmation signal is a sleep confirmation signal, and the offline response signal is a sleep response signal.

[0024] Correspondingly, when the control unit outputs the offline mode command specifically the "power off key mode" command, the offline sequence is specifically the power off sequence, the offline command is specifically the power off command, the offline status is specifically the power off loading, the offline confirmation signal is specifically the power off confirmation signal, and the offline response signal is specifically the power off response signal.

[0025] In some embodiments, "online mode" may include two modes: "wake-up mode" and "power-on mode". Specifically, when the online mode instruction is a "wake-up mode" instruction, the online state is a wake-up state, and the online status is a wake-up status; when the online mode instruction is a "power-on mode" instruction, the online state is a power-on state, and the online status is a power-on status.

[0026] The device for managing multiple instruments in a vehicle includes the aforementioned management system for multiple virtual machines in a vehicle.

[0027] The in-vehicle multi-instrument system includes: multiple in-vehicle instruments and a management device for the in-vehicle multi-instrument system as described above.

[0028] The vehicle includes: the aforementioned management device for implementing multiple onboard instruments.

[0029] The vehicle-mounted multi-virtual machine management system of this invention constructs a highly reliable vehicle power management mechanism: On the one hand, the virtual machine monitor is completely decoupled from the vehicle power policy, acting only as a passive execution agent. After each VM is taken offline, it releases hardware resources and notifies the control unit, thus ensuring the ultimate stability of the underlying layer; On the other hand, the system strictly follows a fixed offline order of "other virtual machines (non-safety critical) first, then the first virtual machine (safety critical)," avoiding disorderly competition to maintain global state consistency; At the same time, each virtual machine can independently be responsible for the resource release of its own peripherals and display status, and the decision-making layer does not interfere with the specific implementation details. This clear delineation of responsibilities makes the main body of each link in the process clear, effectively reducing the risk of misjudgment in the execution of cross-domain instructions, thereby ensuring the accurate closure of the offline process and completely eliminating system-level security risks that may be caused by fluctuations in upper-level policies.

[0030] The above-described in-vehicle multi-virtual machine management system will be described below with reference to embodiments. In some embodiments, the control unit in the in-vehicle multi-virtual machine management system may be an MCU (i.e., a microcontroller unit) and a first virtual machine (i.e., a... Figure 1 VM0 (in some embodiments, it may also be "Power Manager") and other virtual machines (including Figure 1 VM1 in the middle), the virtual machine monitor is Figure 1 Hypervisor in the context of [the system / mechanism].

[0031] In the power-on process of the above system, the MCU detects IGN ON, and the cockpit domain controller (SoC) starts. At this time, the Hypervisor starts, sequentially starting VM0 and VM1. After VM0 starts, the Hypervisor detects the status of VM1. If the Hypervisor cannot detect the startup status of VM1 after VM0 starts, VM1 startup is abnormal. After a preset timeout, VM1 is restarted. When it is confirmed that VM1 has started, the heartbeat of VM1 is detected. If no heartbeat is received from VM1, after a preset timeout, VM1 is restarted. After receiving the heartbeat and confirming that VM1 is working normally, the synchronization mode is sent to VM1. After VM1 receives the mode, it responds to the received mode, completing a normal startup process. If no mode response is received from VM1, after a preset timeout, VM1 is restarted. After restarting VM1, the status of VM1 is detected again. If VM1 is still in an abnormal state after three restarts, VM0 actively shuts down VM1 and notifies the MCU that VM1 is in an abnormal state. When powering down, the shutdown process is initiated.

[0032] In the above system's offline process, the MCU detects that the vehicle has entered the "engine off and locked" state and notifies the PowerManager that the system needs to enter the offline state. The PowerManager makes the decision: the PowerManager running on VM0 notifies VM1 to go offline. After receiving the offline notification, VM1 confirms the ACK to VM0, performs operations such as saving the UI and disconnecting peripherals, and notifies the Hypervisor to suspend VM1 first. After the PowerManager confirms that VM1 is offline normally, VM0 goes offline. VM0 performs a final screen refresh and notifies the Hypervisor to suspend VM0. If VM0 does not receive the offline response from VM1, it repeats the offline notification to VM1 3 times. If it still does not receive the confirmation response from VM1, VM0 shuts down VM1 through the Hypervisor and notifies the MCU that VM1 is currently powered off, and the system goes through the shutdown process. System offline: the Hypervisor confirms that all VMs (i.e., the first virtual machine and the remaining virtual machines) have entered the Suspended state, releases unnecessary hardware resources, and notifies the MCU through GPIO that the system has entered a low-power state. The MCU then cuts off the SoC's main power supply and enters deep sleep.

[0033] In the above system's online process, the MCU detects the unlock signal and goes online with the SoC; the Hypervisor recovers from the offline state; the Hypervisor first restores VM0 to ensure the instrument lights up as quickly as possible; then it restores VM1 to ensure a smooth user experience. After VM0 is brought online, it checks the status of VM1. When it detects that VM1 is running, it starts to detect VM1's heartbeat. Upon receiving VM1's heartbeat, it notifies VM1 of the current display status (normal display screen / black screen display content). This step is the same as the boot process.

[0034] In the shutdown process of the above system, the MCU notifies VM0 to shut down according to the status. In the same offline process, VM0 notifies VM1 to shut down. Upon receiving a response from VM1, it detects that VM1 has completed shutdown and shuts down VM0. If no confirmation response is received from VM1, VM0 shuts down VM1 through the hypervisor and VM0 shuts down.

[0035] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0036] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0037] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0038] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0039] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0040] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0041] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0042] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0043] The vehicle-mounted multi-virtual machine management system of this invention constructs a highly reliable vehicle power management mechanism: On the one hand, the virtual machine monitor is completely decoupled from the vehicle power policy, acting only as a passive execution agent. After each VM is taken offline, it releases hardware resources and notifies the control unit, thus ensuring the ultimate stability of the underlying layer; On the other hand, the system strictly follows a fixed offline order of "other virtual machines (non-safety critical) first, then the first virtual machine (safety critical)," avoiding disorderly competition to maintain global state consistency; At the same time, each virtual machine can independently be responsible for the resource release of its own peripherals and display status, and the decision-making layer does not interfere with the specific implementation details. This clear delineation of responsibilities makes the main body of each link in the process clear, effectively reducing the risk of misjudgment in the execution of cross-domain instructions, thereby ensuring the accurate closure of the offline process and completely eliminating system-level security risks that may be caused by fluctuations in upper-level policies.

[0044] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A vehicle-mounted multi-virtual machine management system, characterized in that, The management system includes: a control unit, a virtual machine monitor, a first virtual machine, and other virtual machines; The control unit is used to output an offline mode command in response to the vehicle's ignition switch off signal; The first virtual machine is used to respond to the offline mode instruction, output offline instructions to the remaining virtual machines in the offline order, and respond to the offline status of all other virtual machines, send offline confirmation signals and enter the offline state. The offline command is used to cause the other virtual machines to sequentially enter the offline state; The virtual machine monitor is used to output a control unit offline command based on the offline confirmation signal, and the control unit offline command is used to put the control unit into an offline state. The first virtual machine and other virtual machines are also used to control at least one vehicle instrument.

2. The vehicle-mounted multi-virtual machine management system according to claim 1, characterized in that, The first virtual machine is used to display or control the vehicle's instrument information or safety settings, while the remaining virtual machines are used to display or control the vehicle's audio-visual entertainment functions. The offline order is such that the remaining virtual machines take priority over the first virtual machine.

3. The vehicle-mounted multi-virtual machine management system according to claim 1, characterized in that, The other virtual machines are also used to enter offline mode in response to a offline command and output a offline response signal; If no offline response signal is received from the target virtual machine within a preset time period after the first virtual machine issues the offline command, the offline command is reissued to the target virtual machine. The target virtual machine is one of the remaining virtual machines; If the first virtual machine reissues a shutdown command to the target virtual machine that is greater than a preset threshold, then a shutdown command for the target virtual machine is output. The virtual machine monitor responds to the forced offline command by shutting down the target virtual machine and outputs the shutdown information of the target virtual machine to the control unit.

4. The vehicle-mounted multi-virtual machine management system according to claim 3, characterized in that, The remaining virtual machines responding to the offline command also include at least one of pausing multimedia playback, transferring the current application stack in the virtual machine to persistent storage, and turning off the backlight of the virtual machine-controlled display.

5. The vehicle-mounted multi-virtual machine management system according to claim 1, characterized in that, The control unit is also configured to output an online mode command to the virtual machine monitor in response to the vehicle's unlock signal; The virtual machine monitor is used to respond to the online mode command by first bringing the first virtual machine online, and then bringing the remaining virtual machines online.

6. The vehicle-mounted multi-virtual machine management system according to claim 5, characterized in that, When the first virtual machine is activated, the first virtual machine detects the online status of the other virtual machines and outputs the online status of the other virtual machines to the virtual machine monitor. If the virtual machine monitor responds to the online status of the other virtual machines and determines that the target virtual machine among the other virtual machines is offline after a first preset time period, it will bring the target virtual machine back online.

7. The vehicle-mounted multi-virtual machine management system according to claim 5, characterized in that, When the first virtual machine is brought online, the status of the remaining virtual machines is checked; When the first virtual machine detects that the other virtual machines are running, it detects the heartbeats of the other virtual machines; When the first virtual machine detects that it has received a heartbeat from another virtual machine, it determines the current display status of the other virtual machines and displays the content that the other virtual machines need to display. The current display state includes both normal display and black screen display.

8. A management device for implementing multiple instruments in a vehicle, characterized in that, The device includes: a vehicle-mounted multi-virtual machine management system as described in any one of claims 1 to 7.

9. A vehicle-mounted multi-instrument system, characterized in that, The in-vehicle multi-instrument system includes: multiple in-vehicle instruments and a management device for the in-vehicle multi-instrument system as described in claim 8.

10. A vehicle, characterized in that, The vehicle includes: an in-vehicle multi-instrument system as described in claim 9.

Images