Auxiliary driving domain controller safe shutdown device and system

Abstract

The application relates to the technical field of vehicles and discloses an auxiliary driving domain controller safety shutdown device and system, which comprises a computing unit, a main communication transceiving unit, at least one secondary communication transceiving unit and a logic gate circuit group; the computing unit is connected with an external power supply unit and the input end of the logic gate circuit group; the input end of the logic gate circuit group is also connected with the external power supply unit; the output end of the logic gate circuit group is connected with the main communication transceiving unit; the secondary communication transceiving unit is connected with the external power supply unit; the application adopts the logic gate circuit group to cooperate with the computing unit to respectively control the shutdown of the main and secondary communication transceiving units; the logic gate circuit group only controls the shutdown of the main communication transceiving unit, and each communication transceiving unit does not need to be configured with an independent gate circuit; while ensuring that each communication transceiving unit can be effectively shut down, the problem of cost increase caused by too many gate circuits used in the shutdown domain controller is solved.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to a safety shutdown device and system for an assisted driving domain controller. Background Technology

[0002] With the rapid development of assisted driving, the safety requirements for automotive domain controllers are becoming increasingly stringent. The shutdown path design of the assisted driving domain controller is a complex system that deeply integrates functional safety concepts, hardware reliability design, and software fault-tolerant architecture. Its core objective is to lay a solid safety foundation for the failure safety of advanced driver assistance functions.

[0003] Existing intelligent assisted driving domain controller shutdown path systems mostly shut down the power supply to electrical equipment, which is not conducive to rapid restart during system testing; or they control the transmission pins of communication equipment, which requires a large number of gate circuits, thereby increasing system costs and reducing product competitiveness. Utility Model Content

[0004] The purpose of this application is to provide an auxiliary driving domain controller safety shutdown device and system, which aims to solve the technical problem that the use of too many gate circuits inside the domain controller increases the cost when shutting down the domain controller.

[0005] To achieve the above objectives, this application proposes a safety shutdown device for an assisted driving domain controller, which includes: a computing unit, a main communication transceiver unit, at least one secondary communication transceiver unit, and a logic gate circuit group. The computing unit is connected to both the external power supply unit and the input terminal of the logic gate circuit group; the input terminal of the logic gate circuit group is also connected to the external power supply unit; the output terminal of the logic gate circuit group is connected to the main communication transceiver unit; the secondary communication transceiver unit is connected to the external power supply unit. The computing unit is used to output a low-level signal to the logic gate circuit group when an external fault signal is detected. The logic gate circuit group is used to output a shutdown signal to the main communication transceiver unit when the low-level signal is received. The main communication transceiver unit is used to disable its own communication function when it receives the shutdown signal; The computing unit is also used to control the external power supply unit to stop supplying power to the secondary communication transceiver unit when an external fault signal is detected.

[0006] In one embodiment, the main communication transceiver unit has a built-in first shutdown circuit; The first shutdown circuit is used to convert the shutdown signal into a low-level signal via a gate circuit when the shutdown signal is received, thereby shutting down the TX pin of the main communication transceiver in the main communication transceiver unit.

[0007] In one embodiment, the first shutdown circuit includes: a first resistor to a sixth resistor, a transistor, and a first OR gate; The first end of the first resistor is connected to the output of the logic gate circuit group, and the second end of the first resistor is connected to the first end of the second resistor; the second end of the second resistor is connected to the first end of the transistor and the first end of the third resistor; the second end of the third resistor is connected to the third end of the transistor and ground; the second end of the transistor is connected to the second end of the fourth resistor and the second end of the first OR gate; the first end of the fourth resistor is connected to the external power supply unit; the first end of the first OR gate is connected to the output of the logic gate circuit group and the first end of the fifth resistor; the second end of the fifth resistor is connected to the first end of the sixth resistor and the TX pin of the main communication transceiver; the second end of the sixth resistor is connected to the output of the first OR gate; the power supply terminal of the first OR gate is connected to the external power supply unit, and the ground terminal of the first OR gate is grounded.

[0008] In one embodiment, the assisted driving domain controller safety shutdown device further includes: a power switch; The first terminal of the power switch is connected to the external power supply unit and the main communication transceiver unit, the second terminal of the power switch is connected to the logic gate circuit group, and the third terminal of the power switch is connected to the secondary communication transceiver unit.

[0009] In one embodiment, the logic gate group includes: a first AND gate, a second AND gate, a NOT gate, and a second OR gate; The two inputs of the first AND gate are respectively connected to the external power supply unit and the computing unit; the output of the first AND gate is connected to the input of the NOT gate; the output of the NOT gate is connected to the input of the second OR gate; and the output of the second OR gate is connected to the main communication transceiver unit. The two input terminals of the second AND gate are respectively connected to the external power supply unit and the computing unit, and the output terminal of the second AND gate is connected to the second terminal of the power switch.

[0010] In one embodiment, the computing unit has a built-in internal monitoring module; The internal monitoring module is used to control the Error Pin of the computing unit to output a low-level signal when the external fault signal is detected.

[0011] In one embodiment, the secondary communication transceiver unit has a built-in second shutdown circuit; the second shutdown circuit is used to shut down the TX pin of the secondary communication transceiver in the secondary communication transceiver unit after receiving a low-level signal converted by the logic gate circuit group.

[0012] In one embodiment, the second shutdown circuit includes: a seventh to an eleventh resistor, a first capacitor, a second capacitor, a first MOSFET, and a second MOSFET; The first end of the seventh resistor is connected to the output of the logic gate circuit group; the second end of the seventh resistor is connected to the first end of the eighth resistor, the second end of the ninth resistor, the first end of the first capacitor, and the gate of the first MOS transistor; the second end of the eighth resistor is grounded; the first end of the ninth resistor is connected to the external power supply unit; the second end of the first capacitor is grounded; the source of the first MOS transistor is grounded, and the drain of the first MOS transistor is connected to the second end of the tenth resistor; the first end of the tenth resistor is connected to the gate of the second MOS transistor, the second end of the eleventh resistor, and the second end of the second capacitor; the first ends of the second capacitor and the eleventh resistor are both connected to the external power supply unit and the source of the second MOS transistor; the drain of the second MOS transistor is connected to the external power supply unit.

[0013] In addition, to achieve the above objectives, this application also proposes an assisted driving domain controller safety shutdown system, which includes the assisted driving domain controller safety shutdown device as described above.

[0014] In one embodiment, the main communication transceiver unit is further configured to wake up the driver assistance domain controller safety shutdown system when an external wake-up signal is received.

[0015] This application proposes a safety shutdown device and system for an assisted driving domain controller. The safety shutdown device includes: a computing unit, a main communication transceiver unit, at least one secondary communication transceiver unit, and a logic gate circuit group; the computing unit is connected to both an external power supply unit and the input terminal of the logic gate circuit group; the input terminal of the logic gate circuit group is also connected to the external power supply unit; the output terminal of the logic gate circuit group is connected to the main communication transceiver unit; the secondary communication transceiver units are connected to the external power supply unit; the computing unit is configured to output a low-level signal to the logic gate circuit group when an external fault signal is detected; the logic gate circuit group is configured to output a shutdown signal to the main communication transceiver unit when the low-level signal is received; the main communication transceiver unit is configured to disable its own communication function when the shutdown signal is received; the computing unit is also configured to control the external power supply unit to stop supplying power to the secondary communication transceiver units when an external fault signal is detected. In the assisted driving domain controller safety shutdown device of this application, when the computing unit detects an external fault signal, it outputs a low-level signal to the logic gate circuit group, which in turn outputs a shutdown signal to disable the communication function of the main communication transceiver unit. Simultaneously, it controls the external power supply unit to stop supplying power to the secondary communication transceiver unit. This device employs a technical approach where the logic gate circuit group, in conjunction with the computing unit, controls the shutdown of the main and secondary communication transceiver units separately. By using the logic gate circuit group to achieve shutdown control only for the main communication transceiver unit, it eliminates the need for separate gate circuits for each communication transceiver unit, thus solving the problem of increased cost due to the excessive use of gate circuits when shutting down the domain controller. Compared with existing technologies, this device reduces the number of gate circuits used while ensuring that each communication transceiver unit can be effectively shut down, thereby lowering the cost of the device. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the module of the first embodiment of the driver assistance domain controller safety shutdown device proposed in this application; Figure 2 This is a first circuit connection diagram of the second embodiment of the driver assistance domain controller safety shutdown device proposed in this application; Figure 3 This is a second circuit connection diagram of the second embodiment of the driver assistance domain controller safety shutdown device proposed in this application; Figure 4 This is a schematic diagram of a module of an embodiment of the driver assistance domain controller safety shutdown system proposed in this application.

[0017] Explanation of icon numbers:

[0018] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0021] It should be noted that all directional indicators (such as up, down, left, right, front, back, etc.) in the embodiments of this application are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicator will also change accordingly.

[0022] Furthermore, the use of terms such as "first" and "second" in this application is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. Additionally, the technical solutions of the various embodiments can be combined with each other, but only on the basis of being achievable by those skilled in the art. When the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed in this application.

[0023] Reference Figure 1 , Figure 1 This is a schematic diagram of the first embodiment of the assisted driving domain controller safety shutdown device proposed in this application. Based on Figure 1 This application presents a first embodiment of the safety shutdown device for the driver assistance domain controller.

[0024] In this embodiment, the assisted driving domain controller safety shutdown device includes: a computing unit 100, a main communication transceiver unit 300, at least one secondary communication transceiver unit 400, and a logic gate circuit group 200; the computing unit 100 is connected to the input terminals of the external power supply unit 500 and the logic gate circuit group 200 respectively; the input terminals of the logic gate circuit group 200 are also connected to the external power supply unit 500; the output terminals of the logic gate circuit group 200 are connected to the main communication transceiver unit 300; and the secondary communication transceiver unit 400 is connected to the external power supply unit 500.

[0025] It should be understood that the computing unit 100, as the control core, is directly connected to the external power supply unit 500 on the one hand, and to the input terminal of the logic gate circuit group 200 on the other hand. The logic gate circuit group 200 adopts a multi-input design. In addition to connecting to the computing unit 100, its input terminal is also directly connected to the external power supply unit 500, while its output terminal is dedicated to the main communication transceiver unit 300. The secondary communication transceiver unit 400 is directly connected to the external power supply unit 500 through a power line, and its power supply status is indirectly controlled by the computing unit 100.

[0026] The computing unit 100 is used to output a low-level signal to the logic gate circuit group 200 when an external fault signal is detected.

[0027] It should be noted that the computing unit 100 continuously monitors the operating status of the assisted driving system. When an external fault signal is detected, it indicates a potential safety hazard, requiring immediate action to ensure safety. Upon detecting an external fault signal, the computing unit 100 quickly outputs a low-level signal to the logic gate circuit group 200. This low-level signal serves as a key signal for triggering subsequent safety shutdown operations, carrying fault information. Simultaneously with detecting the external fault signal, the computing unit 100 also performs power control, controlling the external power supply unit 500 to stop supplying power to the secondary communication transceiver unit 400. This is to further mitigate the potential impact of the fault and prevent safety issues that might arise from the secondary communication transceiver unit 400 continuing to operate in a faulty state.

[0028] The logic gate circuit group 200 is used to output a shutdown signal to the main communication transceiver unit 300 when the low-level signal is received.

[0029] It should be understood that the logic gate group 200 receives low-level signals from the computing unit 100 and signals from the external power supply unit 500. By performing logical operations and processing on these input signals, it determines whether the conditions for outputting a shutdown signal are met. When the logic gate group 200 determines, based on the input signals, that the main communication transceiver unit 300 needs to be shut down, it outputs a shutdown signal to the main communication transceiver unit 300. This shutdown signal is generated after precise logical processing and instructs the main communication transceiver unit 300 to perform a shutdown operation.

[0030] The main communication transceiver unit 300 is used to disable its own communication function when it receives the shutdown signal.

[0031] It should be noted that under normal operating conditions, the main communication transceiver unit 300 is responsible for communicating with external devices to transmit and interact with data, ensuring smooth information flow between the assisted driving system and the outside world. When it receives a shutdown signal from the logic gate circuit group 200, the main communication transceiver unit 300 will immediately shut down its own communication function. This is achieved through internal control circuits and mechanisms, ensuring that the communication connection is quickly severed in case of a fault, preventing fault information from spreading through the communication channel or causing adverse effects on external devices.

[0032] The computing unit 100 is also used to control the external power supply unit 500 to stop supplying power to the secondary communication transceiver unit 400 when an external fault signal is detected.

[0033] It should be understood that the secondary communication transceiver unit 400 also has the ability to communicate with external devices and may undertake specific communication tasks in the driver assistance system, serving as a supplement to or backup communication channel for the primary communication. Since it is directly connected to the external power supply unit 500, its operation is entirely dependent on the power supply status of the external power supply unit 500. When the computing unit 100 controls the external power supply unit 500 to stop supplying power, the secondary communication transceiver unit 400 will be unable to continue operating, thus cooperating with the overall safety shutdown strategy to ensure that the system enters a safe state in the event of a fault.

[0034] This embodiment proposes a safety shutdown device for an assisted driving domain controller. The assisted driving domain controller safety shutdown device includes: a computing unit 100, a main communication transceiver unit 300, at least one secondary communication transceiver unit 400, and a logic gate circuit group 200; the computing unit 100 is connected to an external power supply unit 500 and the input terminal of the logic gate circuit group 200; the input terminal of the logic gate circuit group 200 is also connected to the external power supply unit 500; the output terminal of the logic gate circuit group 200 is connected to the main communication transceiver unit 300; the secondary communication transceiver unit 400 is connected to the external power supply unit 500. The computing unit 100 is configured to output a low-level signal to the logic gate circuit group 200 when an external fault signal is detected; the logic gate circuit group 200 is configured to output a shutdown signal to the main communication transceiver unit 300 when the low-level signal is received; the main communication transceiver unit 300 is configured to disable its own communication function when the shutdown signal is received; the computing unit 100 is also configured to control the external power supply unit 500 to stop supplying power to the secondary communication transceiver unit 400 when an external fault signal is detected. In the safety shutdown device of the assisted driving domain controller of this application, when the computing unit 100 detects an external fault signal, it outputs a low-level signal to the logic gate circuit group 200, which in turn outputs a shutdown signal to shut down the communication function of the main communication transceiver unit 300. Simultaneously, it controls the external power supply unit 500 to stop supplying power to the secondary communication transceiver unit 400. This utilizes the technical means of using the logic gate circuit group 200 in conjunction with the computing unit 100 to separately control the shutdown of the main and secondary communication transceiver units 400. By using the logic gate circuit group 200 to achieve shutdown control only for the main communication transceiver unit 300, it eliminates the need to configure independent gate circuits for each communication transceiver unit, thus solving the problem of increased cost due to the excessive use of gate circuits when shutting down the domain controller. Compared with existing technologies, this reduces the number of gate circuits used while ensuring that each communication transceiver unit can be effectively shut down, thereby reducing the cost of the device.

[0035] Reference Figure 2 and Figure 3 , Figure 2 This is a first circuit connection diagram of the second embodiment of the driver assistance domain controller safety shutdown device proposed in this application. Figure 3 This is a second circuit connection diagram for a second embodiment of the driver assistance domain controller safety shutdown device proposed in this application. Based on the first embodiment of the driver assistance domain controller safety shutdown device described above, a second embodiment of the driver assistance domain controller safety shutdown device of this application is proposed.

[0036] The main communication transceiver unit 300 has a built-in first shutdown circuit; the first shutdown circuit is used to convert the shutdown signal into a low-level signal through a gate circuit when the shutdown signal is received, thereby shutting down the TX pin of the main communication transceiver in the main communication transceiver unit 300.

[0037] It should be understood that when the first shutdown circuit receives the shutdown signal, it inputs it into an internal gate circuit. A gate circuit is an electronic circuit with specific logic functions; here, its role is to perform logical processing and level conversion on the input shutdown signal. After processing by the gate circuit, the shutdown signal is converted into a low-level signal. A low-level signal represents an disabled or off state in digital circuits. This level conversion is to match the control requirements of the TX pin in the main communication transceiver. The converted low-level signal is transmitted to the TX pin of the main communication transceiver. The TX pin is the interface used by the main communication transceiver for data transmission. When it receives a low-level signal, it triggers an internal control mechanism to stop data transmission. The main communication transceiver can no longer send data to external devices, thus achieving the shutdown of the main communication transmission function and achieving the purpose of security isolation.

[0038] It should be noted that the first shutdown circuit includes: first resistors R1 to R6, transistor Q1, and first OR gate OR1; the first end of the first resistor R1 is connected to the output of the logic gate circuit group 200, and the second end of the first resistor R1 is connected to the first end of the second resistor R2; the second end of the second resistor R2 is connected to the first end of the transistor Q1 and the first end of the third resistor R3; the second end of the third resistor R3 is connected to the third end of the transistor Q1 and ground; the second end of the transistor Q1 is connected to the second end of the fourth resistor R4 and the second end of the first OR gate OR1; the first end of the fourth resistor R4 is connected to the external power supply unit 500; the first end of the first OR gate OR1 is connected to the output of the logic gate circuit group 200 and the first end of the fifth resistor R5; the second end of the fifth resistor R5 is connected to the first end of the sixth resistor R6 and the TX pin of the main communication transceiver; the second end of the sixth resistor R6 is connected to the output of the first OR gate OR1; the power supply terminal of the first OR gate OR1 is connected to the external power supply unit 500, and the ground terminal of the first OR gate OR1 is grounded.

[0039] The assisted driving domain controller safety shutdown device further includes: a power switch; the first end of the power switch is connected to the external power supply unit 500 and the main communication transceiver unit 300, the second end of the power switch is connected to the logic gate circuit group 200, and the third end of the power switch is connected to the secondary communication transceiver unit 400.

[0040] It should be understood that the power switch is a PMOS transistor. The first terminal of the power switch connects to the external power supply unit 500 and the main communication transceiver unit 300. The electrical energy output from the external power supply unit 500 first converges at this terminal of the power switch. Under normal circumstances, the main communication transceiver unit 300 obtains a continuous and stable power supply from here to maintain its communication function with external devices, such as receiving and sending important data on vehicle status and environmental perception, ensuring the normal operation of the assisted driving system. The second terminal of the power switch connects to the logic gate circuit group 200, enabling the logic gate circuit group 200 to obtain the necessary power from the power switch. The logic gate circuit group 200 plays a crucial role in signal processing and logical judgment in the entire safety shutdown device; it needs to determine whether to output a shutdown signal based on the received signals. A stable power supply ensures that the logic gate circuit group 200 can accurately and timely execute these logical operations without misjudgment or delay due to power supply problems. The third terminal of the power switch connects to the secondary communication transceiver unit 400, providing power to the secondary communication transceiver unit 400. The secondary communication transceiver unit 400 typically serves as a backup or supplement to the primary communication transceiver unit 300, functioning when the primary communication fails or when additional communication support is required. The power supply to the secondary communication transceiver unit 400 can be easily controlled via a power switch, enabling management of its operational status.

[0041] It should be noted that when the driver assistance system is operating normally and no fault is detected, the power switch is in the ON state. At this time, electrical energy from the external power supply unit 500 is simultaneously supplied to the main communication transceiver unit 300, the logic gate circuit group 200 (via the second terminal), and the secondary communication transceiver unit 400 (via the third terminal) through the first terminal of the power switch. Both the main communication transceiver unit 300 and the secondary communication transceiver unit 400 can operate normally, enabling data interaction with external devices; the logic gate circuit group 200 continuously monitors the system status, awaiting possible fault signal input.

[0042] The logic gate circuit group 200 includes: a first AND gate AND1, a second AND gate AND2, a NOT gate NOT, and a second OR gate OR2.

[0043] It should be understood that the two inputs of the first AND gate AND1 are respectively connected to the external power supply unit 500 and the computing unit 100, the output of the first AND gate AND1 is connected to the input of the NOT gate NOT; the output of the NOT gate NOT is connected to the input of the second OR gate OR2; the output of the second OR gate OR2 is connected to the main communication transceiver unit 300; the two inputs of the second AND gate AND2 are respectively connected to the external power supply unit 500 and the computing unit 100, and the output of the second AND gate AND2 is connected to the second terminal of the power switch.

[0044] The computing unit 100 has a built-in internal monitoring module 600; the internal monitoring module 600 is used to control the Error Pin of the computing unit 100 to output a low-level signal when the external fault signal is detected.

[0045] It should be noted that the internal monitoring module 600 connects to external devices and sensors via a specific interface, continuously receiving status signals from various components. These signals can include various types of information such as voltage, current, frequency, and data integrity. The internal monitoring module 600 analyzes and compares these signals in real time, comparing them against preset normal operating ranges and thresholds. If the received signal exceeds the normal range, or an abnormal pattern occurs (such as data loss, signal interruption, etc.), the internal monitoring module 600 determines that an external fault signal has been detected.

[0046] It should be understood that the external power supply unit 500 has a built-in external monitoring module, which, upon detecting the external fault signal, controls the Error Pin of the external power supply unit 500 to output a low-level signal. The external monitoring module and the internal monitoring module 600 monitor together, and when either detects a fault signal, it will output a low-level signal through its respective Error Pin.

[0047] The secondary communication transceiver unit 400 has a built-in second shutdown circuit; the second shutdown circuit is used to shut down the TX pin of the secondary communication transceiver in the secondary communication transceiver unit 400 after receiving the low-level signal converted by the logic gate circuit group 200.

[0048] It should be understood that the second shutdown circuit is connected to the logic gate group 200 and continuously monitors the signals output by the logic gate group 200. When the logic gate group 200 receives a signal from the computing unit 100 (triggered by a low-level signal output via the Error Pin) or other relevant control signals, it performs logical processing and conversion, and then sends the converted low-level signal to the second shutdown circuit. The second shutdown circuit has a dedicated signal recognition circuit that can accurately identify and judge the received signal. It detects parameters such as the signal's voltage level and duration to determine whether it is a valid shutdown signal. The second shutdown circuit will only trigger the subsequent shutdown operation when the received signal meets the preset shutdown signal characteristics. Once a valid shutdown signal is confirmed, the second shutdown circuit will quickly cut off the power supply or signal path of the secondary communication transceiver's TX pin through its internal switching circuit (such as a transistor switch, relay, etc.). In this way, the secondary communication transceiver cannot send data through the TX pin, thus shutting down the transmission function of the secondary communication transceiver unit 400.

[0049] The second shutdown circuit includes: a seventh resistor R7 to an eleventh resistor R11, a first capacitor C1, a second capacitor C2, a first MOSFET Q2, and a second MOSFET Q3.

[0050] It should be noted that the first end of the seventh resistor R7 is connected to the output terminal of the logic gate circuit group 200, and the second end of the seventh resistor R7 is connected to the first end of the eighth resistor R8, the second end of the ninth resistor R9, the first end of the first capacitor C1, and the gate of the first MOSFET Q2; the second end of the eighth resistor R8 is grounded; the first end of the ninth resistor R9 is connected to the external power supply unit 500; the second end of the first capacitor C1 is grounded; the source of the first MOSFET Q2 is grounded, and the drain of the first MOSFET Q2 is connected to the second end of the tenth resistor R10; the first end of the tenth resistor R10 is connected to the gate of the second MOSFET Q3, the second end of the eleventh resistor R11, and the second end of the second capacitor C2; the first ends of the second capacitor C2 and the eleventh resistor R11 are both connected to the external power supply unit 500 and the source of the second MOSFET Q3; the drain of the second MOSFET Q3 is connected to the external power supply unit 500.

[0051] In this embodiment, after receiving the high-level shutdown signal, the gate circuit in the first shutdown circuit converts it into a low-level signal. This low-level signal is transmitted to the TX pin of the main communication transceiver. Upon detecting the low level, the TX pin immediately stops sending data to external devices, thereby realizing the safety shutdown function and preventing erroneous data from being sent through the communication link and affecting the normal operation of other systems. The coordinated operation of the power switch and the entire safety shutdown device forms a multi-layered safety defense. When the computing unit 100 detects a fault, it can not only control the communication function of the main communication transceiver unit 300 through signals, but also intervene at the power level, providing dual protection for system safety. For example, in the event of a serious fault that may cause the system to lose control, cutting off the power to the secondary communication transceiver unit 400 can prevent it from being maliciously used or sending erroneous commands, ensuring the safety of the vehicle and personnel. The real-time monitoring and rapid response capabilities of the internal monitoring module 600 improve the safety and reliability of the assisted driving domain controller safety shutdown device. It can detect and output a low-level signal in a timely manner at the moment a fault occurs, triggering the safety shutdown operation, preventing the fault from worsening, and reducing potential harm to the vehicle and personnel. For example, if a sensor malfunctions during vehicle operation, the internal monitoring module 600 can quickly detect it and take measures to prevent malfunctions in the driver assistance system caused by incorrect data. The second shutdown circuit can quickly respond to fault signals and promptly shut down the transmission function of the secondary communication transceiver unit 400, effectively preventing the propagation and spread of fault data and reducing the scope and severity of the fault's impact on the system. This improves the safety and stability of the driver assistance domain controller's safety shutdown device, ensuring vehicle safety during operation.

[0052] In addition, this application also proposes an assisted driving domain controller safety shutdown system, referring to... Figure 4 , Figure 4 This is a schematic diagram of a module of an embodiment of the driver assistance domain controller safety shutdown system proposed in this application. The driver assistance domain controller safety shutdown system includes the driver assistance domain controller safety shutdown device as described above.

[0053] Since the assisted driving domain controller safety shutdown system adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be repeated here.

[0054] The main communication transceiver unit 300 is also used to wake up the safety shutdown system of the driver assistance domain controller when it receives an external wake-up signal.

[0055] It should be understood that the main communication transceiver unit 300 is equipped with a dedicated signal receiving circuit capable of recognizing external wake-up signals of specific frequencies, formats, and codes. These signals may originate from the vehicle's central control system, driver-operated triggering devices (such as a one-button start, a specific gesture or voice command recognition module), or other relevant vehicle subsystems. When an external wake-up signal arrives, the signal receiving circuit performs preliminary filtering, amplification, and shaping to ensure signal quality and stability. The pre-processed signal is then transmitted to the decoding module within the main communication transceiver unit 300. The decoding module decodes the signal according to pre-set protocols and rules, extracting the wake-up command and related parameters contained within. Simultaneously, to ensure the signal's legitimacy and security, the decoding module also verifies the signal, such as checking the legitimacy of its source and whether it contains a valid checksum. Only signals that pass verification are considered valid external wake-up signals. Once a valid external wake-up signal is confirmed, the main communication transceiver unit 300 sends wake-up commands to other critical components of the driver assistance domain controller's safety shutdown system through its internal control logic. These commands can be transmitted via specific communication buses (such as CAN bus, LIN bus, etc.) or triggered directly through hardware circuit connections. The wake-up command activates components in the system that are in a low-power sleep state, such as computing unit 100, sensors, power management modules, etc., causing the entire system to switch from sleep mode to normal operating mode.

[0056] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0057] The above are merely preferred embodiments of this application and do not limit the scope of this application. Any equivalent structural or procedural transformations made based on the description and drawings of this application, or direct or indirect applications in other related technical fields, are similarly included within the protection scope of this application.

Claims

1. A safety shutdown device for an assisted driving domain controller, characterized in that, The safety shutdown device of the assisted driving domain controller includes: a computing unit, a main communication transceiver unit, at least one secondary communication transceiver unit, and a logic gate circuit group; The computing unit is connected to both the external power supply unit and the input terminal of the logic gate circuit group; the input terminal of the logic gate circuit group is also connected to the external power supply unit; the output terminal of the logic gate circuit group is connected to the main communication transceiver unit; the secondary communication transceiver unit is connected to the external power supply unit. The computing unit is used to output a low-level signal to the logic gate circuit group when an external fault signal is detected. The logic gate circuit group is used to output a shutdown signal to the main communication transceiver unit when the low-level signal is received. The main communication transceiver unit is used to disable its own communication function when it receives the shutdown signal; The computing unit is also used to control the external power supply unit to stop supplying power to the secondary communication transceiver unit when an external fault signal is detected.

2. The assisted driving domain controller safety shutdown device as described in claim 1, characterized in that, The main communication transceiver unit has a built-in first shutdown circuit; The first shutdown circuit is used to convert the shutdown signal into a low-level signal via a gate circuit when the shutdown signal is received, thereby shutting down the TX pin of the main communication transceiver in the main communication transceiver unit.

3. The assisted driving domain controller safety shutdown device as described in claim 2, characterized in that, The first shutdown circuit includes: a first resistor to a sixth resistor, a transistor, and a first OR gate; The first end of the first resistor is connected to the output of the logic gate circuit group, and the second end of the first resistor is connected to the first end of the second resistor; the second end of the second resistor is connected to the first end of the transistor and the first end of the third resistor; the second end of the third resistor is connected to the third end of the transistor and ground; the second end of the transistor is connected to the second end of the fourth resistor and the second end of the first OR gate; the first end of the fourth resistor is connected to the external power supply unit; the first end of the first OR gate is connected to the output of the logic gate circuit group and the first end of the fifth resistor; the second end of the fifth resistor is connected to the first end of the sixth resistor and the TX pin of the main communication transceiver; the second end of the sixth resistor is connected to the output of the first OR gate; the power supply terminal of the first OR gate is connected to the external power supply unit, and the ground terminal of the first OR gate is grounded.

4. The assisted driving domain controller safety shutdown device as described in claim 1, characterized in that, The assisted driving domain controller safety shutdown device also includes: a power switch; The first terminal of the power switch is connected to the external power supply unit and the main communication transceiver unit, the second terminal of the power switch is connected to the logic gate circuit group, and the third terminal of the power switch is connected to the secondary communication transceiver unit.

5. The assisted driving domain controller safety shutdown device as described in claim 4, characterized in that, The logic gate circuit group includes: a first AND gate, a second AND gate, a NOT gate, and a second OR gate; The two inputs of the first AND gate are respectively connected to the external power supply unit and the computing unit; the output of the first AND gate is connected to the input of the NOT gate; the output of the NOT gate is connected to the input of the second OR gate; and the output of the second OR gate is connected to the main communication transceiver unit. The two input terminals of the second AND gate are respectively connected to the external power supply unit and the computing unit, and the output terminal of the second AND gate is connected to the second terminal of the power switch.

6. The assisted driving domain controller safety shutdown device as described in claim 1, characterized in that, The computing unit has a built-in internal monitoring module; The internal monitoring module is used to control the Error Pin of the computing unit to output a low-level signal when the external fault signal is detected.

7. The assisted driving domain controller safety shutdown device as described in claim 1, characterized in that, The secondary communication transceiver unit has a built-in second shutdown circuit. The second shutdown circuit is used to shut down the TX pin of the secondary communication transceiver in the secondary communication transceiver unit after receiving a low-level signal converted by the logic gate circuit group.

8. The driver assistance domain controller safety shutdown device as described in claim 7, characterized in that, The second shutdown circuit includes: resistors seven to eleven, a first capacitor, a second capacitor, a first MOSFET, and a second MOSFET; The first end of the seventh resistor is connected to the output of the logic gate circuit group; the second end of the seventh resistor is connected to the first end of the eighth resistor, the second end of the ninth resistor, the first end of the first capacitor, and the gate of the first MOS transistor; the second end of the eighth resistor is grounded; the first end of the ninth resistor is connected to the external power supply unit; the second end of the first capacitor is grounded; the source of the first MOS transistor is grounded, and the drain of the first MOS transistor is connected to the second end of the tenth resistor; the first end of the tenth resistor is connected to the gate of the second MOS transistor, the second end of the eleventh resistor, and the second end of the second capacitor; the first ends of the second capacitor and the eleventh resistor are both connected to the external power supply unit and the source of the second MOS transistor; the drain of the second MOS transistor is connected to the external power supply unit.

9. A safety shutdown system for an assisted driving domain controller, characterized in that, The driver assistance domain controller safety shutdown system includes the driver assistance domain controller safety shutdown device as described in any one of claims 1 to 8.

10. The driver assistance domain controller safety shutdown system as described in claim 9, characterized in that, The main communication transceiver unit is also used to wake up the safety shutdown system of the driver assistance domain controller when it receives an external wake-up signal.

Images