Zone oriented control system for vehicle and corresponding control method

Abstract

To provide a zone oriented control system or control architecture for a vehicle and a corresponding control method configured to reduce the complexity, cost and weight of wiring harnesses and components while increasing performance, the flexibility and scalability of vehicle systems.SOLUTION: A control system comprises a plurality of zone controllers 40a, 40b configured to control sensors and / or actuators operating in respective zones of a vehicle. A first zone controller 40a in the zone controllers comprises a respective master control unit 42 coupled to a slave control unit 43 of a second zone controller 40b. The system is configured to send data read / write requests from the first zone controller to the second zone controller. The second zone controller is configured to receive and execute the data read / write requests, by means of the respective slave control unit 43.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a zone-oriented control system or control architecture for a vehicle, and a corresponding control method. [Background technology]

[0002] In the automotive field, a distributed architecture is a type of E / E (electrical / electronic) architecture in which the implemented functions are distributed among a number of interconnected ECUs (electronic control units). In such an architecture, each ECU can process its own data and communicate with other ECUs to implement advanced vehicle functions. Currently, there are many vehicles with a large number of ECUs, and their number is set to increase because in a distributed architecture, there is usually a one-to-one association between vehicle functions and ECUs. Distributed E / E architectures are widely used due to their ease of integration, the physical separation of components from different subsystems, and their repairability.

[0003] However, distributed E / E architectures suffer from scalability issues when used to build complex electrical and electronic systems, such as those required by modern BEV (battery electric vehicle) or PHEV (plug-in hybrid electric vehicle) vehicles. These issues generally include increased cost, complex wiring harnesses, software fragmentation, and security flaws.

[0004] For this reason, various architectures have been proposed, such as domain architecture, zone architecture, and service-oriented architecture. In particular, an Automotive Zone Controller (AZC) is an electronic device that manages and controls various functions and devices within a specific zone of a vehicle, such as the front, rear, left, and rear right or center. Therefore, AZC is part of a new electronic vehicle architecture required for software-defined vehicles, which aims to reduce the complexity, cost, and weight of wiring harnesses and components while improving the performance, flexibility, and scalability of vehicle systems.

[0005] The AZC (Automotive Zone Controller), or simply ZC (Zone Controller), acts as a hub connecting the zone's sensors, actuators, and peripherals to a central processing unit using high-speed interfaces such as Ethernet or CAN-FD. The AZC also manages energy distribution within the area using switches and solid-state relays.

[0006] An example of an automotive E / E zone architecture is shown in FIG. 1. In particular, the illustrated architecture includes multiple zone controller ECUs 40, where multiple automotive ECUs are connected based on proximity criteria. Each zone controller 40 provides multi-domain functions, i.e., functions belonging to different functional areas of the vehicle, such as the body, powertrain, chassis, and lighting, that would be implemented in separate ECUs in a traditional distributed E / E architecture. Conversely, such multi-domain functions are aggregated in each multi-domain zone controller ECU 40. In such an E / E architecture, the zone controller ECUs 40 are coupled to one another by a vehicle network 30, which may be implemented using, for example, automotive Ethernet, CAN, CAN-FD, or the like. As shown, each zone controller 40 can be coupled to sensors 47, actuators 76, or other ECUs 68 based on proximity criteria to reduce cabling. Furthermore, each zone controller 40 is connected via the vehicle network 30 to a central controller 100, whose role is to manage the several zone controllers 40 coupled to the vehicle network 30, and in particular to manage the communication and data exchange between the different components of the E / E architecture. Thus, the central controller 100 acts as a pivotal hub, orchestrating communication between the zone controllers 40 and the various components coupled to the zone controllers 40, such as the sensors 47 and actuators 76 in the E / E zone architecture.

[0007] Zone controllers allow loads such as lights, motors, and actuators, as well as sensors, within a particular zone to communicate directly with each other. This localized communication stream increases efficiency, reduces latency, and improves overall responsiveness. Thus, a zone architecture offers several advantages over traditional vehicle electronic architectures, including reduced complexity, increased performance, and increased flexibility.

[0008] In fact, a zonal architecture reduces the number of wires, connectors, and control units in a vehicle, simplifying production and assembly processes and improving the quality and reliability of vehicle systems. A zonal architecture also enables faster and more secure data transmission and processing in the vehicle, improving the functionality and safety of vehicle systems such as ADAS, infotainment, lighting, and HVAC.

[0009] Additionally, the zonal architecture allows for greater customization of vehicle systems and greater adaptability and scalability to software and hardware changes and updates, allowing software-defined vehicles to be built.

[0010] However, while the zone architecture offers benefits, it also introduces vulnerabilities. The loss of a single zone controller potentially results in the failure of multiple vehicle functions associated with that zone. For example, if a rear zone controller malfunctions, it could affect brake lights, reverse sensors, and other safety features. Despite this, certain functions, such as sensor readings, must continue to operate even when a zone controller fails, because sensors must provide accurate data for critical systems and essential loads such as brake lights must still function.

[0011] Indeed, in such E / E architectures, sensors may be located far from their respective actuators, or vice versa, or sensors and / or actuators may be located far from the respective zone controller ECUs responsible for data processing and decision-making. In this scenario, since multiple sensors, actuators, and ECUs are coupled to one zone controller, the impact of the loss or degradation of one zone controller can be addressed to the operability and safety of vehicle functions. Therefore, the possibility of implementing fallback solutions is key to guaranteeing safety-critical and mission-critical functions.

[0012] As is well known, safety-critical functions, including brakes and airbags, cannot fail due to the malfunction of a single zone controller. Ensuring fail-safe communication and load actuation remains paramount. For this reason, redundancy mechanisms are necessary to mitigate the impact of a failed zone controller. However, introducing redundancy can lead to the reintroduction of long harnesses and cables, partially negating the benefits of the zone architecture. Therefore, it is important to achieve the right balance between harness simplification and redundancy. Indeed, while the zone architecture reduces complexity, excessive redundancy can impair the entire system.

[0013] In summary, while zone architectures represent an advancement in vehicle design, they require careful consideration, especially in the face of the pressing need to optimize the trade-offs mentioned above while maintaining the benefits of simplified harnesses and improved functionality. As vehicles become more interconnected, finding the right balance between efficiency and reliability remains a significant challenge. Summary of the Invention

[0014] An objective of one or more embodiments is to contribute to providing a solution that allows for improved safety for mission-critical applications while preserving the advantages of zone-oriented E / E architectures.

[0015] According to one or more embodiments, the object is achieved through a control system for a vehicle having the features set forth in the following claims. The object is also achieved by a corresponding control method.

[0016] The claims are an integral part of the technical teachings provided with respect to the embodiments.

[0017] The solution described herein is a control system for a vehicle, comprising a vehicle network configured to exchange data with a plurality of zone controllers configured to control respective modules, in particular sensors and / or actuators, operating in respective zones of the vehicle, each zone controller comprising: a microcontroller; - a master control unit, and / or a slave control unit, At least a first zone controller of the plurality of zone controllers includes a control system having a respective master control unit coupled to a slave control unit of a second zone controller of the plurality of zone controllers by a communication link, particularly a serial bus, configured to send instructions, particularly data read / write requests, from the first zone controller to the second zone controller over the communication link, particularly the serial bus, and the second zone controller configured to receive and execute the instructions, particularly data read / write requests, by the respective slave control unit.

[0018] In various embodiments, the control system includes a central controller coupled to a vehicle network, each zone controller coupled to the vehicle network and configured to send and receive data over the vehicle network, and the central controller configured to manage the exchange of data between the zone controllers.

[0019] In various embodiments, the first zone controller is configured to send an instruction to the second zone controller upon detecting that the microcontroller of the second zone controller is malfunctioning.

[0020] In various embodiments, each slave control unit: one or more analog-to-digital converters, and / or one or more digital-to-analog converters, and / or one or more drive circuits.

[0021] In various embodiments, each zone controller is coupled to one or more sensors and / or one or more actuators, one or more analog-to-digital converters read values ​​from the one or more sensors, and one or more digital-to-analog converters send signals to the one or more actuators.

[0022] In various embodiments, the master control unit and the slave control unit each comprise a master transceiver and a slave transceiver, which are coupled to a communication link, in particular a serial bus, and are configured to transmit and receive data over the communication link, in particular the serial bus.

[0023] In various embodiments, the one or more zone controllers are linked to the first zone controller and the second zone controller by an additional serial bus that links each master control unit to a corresponding slave control unit.

[0024] In various embodiments, the first zone controller comprises a plurality, in particular a pair of master control units, each coupled by a respective serial bus to a corresponding slave control unit provided in the second zone controller.

[0025] In various embodiments, the control system further comprises at least a third zone controller having a slave control unit, and the communication link, in particular the serial bus, is split into two branches coupled respectively to the slave control unit of the second zone controller and the slave control unit of the third zone controller.

[0026] In various embodiments, one or more of the plurality of zone controllers comprises a master control unit and a slave control unit.

[0027] The solution described herein also provides a method for controlling modules in a vehicle, comprising a vehicle network exchanging data with a plurality of zone controllers configured to control respective modules, in particular sensors and / or actuators, operating in respective zones of a first vehicle, each zone controller comprising: a microcontroller; - a master control unit, and / or a slave control unit, Refers to a method including: transmitting instructions, particularly data read / write requests, from a first zone controller to a second zone controller in the plurality of zone controllers via a respective master control unit coupled by a serial bus to a slave control unit of a second zone controller in the plurality of zone controllers.

[0028] In various embodiments, upon detecting that the microcontroller of the second zone controller is malfunctioning, the first zone controller sends instructions, particularly data read / write requests, to the second zone controller. [Brief explanation of the drawings]

[0029] Embodiments of the present disclosure will now be described with reference to the accompanying drawings, which are provided purely by way of non-limiting example, in which: [Figure 1] It is explained above. [Figure 2] 1 illustrates multiple zone controllers interconnected via serial IO links according to the solution described herein. [Figure 3] 1 shows two zone controllers interconnected via a serial IO link and connected to a vehicle network according to the solution described herein. [Figure 4] 1 shows two zone controllers interconnected via a serial IO link and connected to a vehicle network according to the solution described herein. [Figure 5]1 shows a master control unit and a slave control unit coupled through a serial bus according to the solution described herein; [Figure 6a-6b] 1 illustrates an exemplary configuration of two pairs of zone controllers interconnected via a serial IO connection, according to the solution described herein. [Figure 7] 1 illustrates an exemplary configuration of three zone controllers interconnected via serial IO connections in accordance with the solution described herein. [Figure 8] 1 illustrates an exemplary configuration of four zone controllers interconnected via serial IO connections in accordance with the solution described herein. [Figure 9] 1 illustrates an exemplary configuration of two zone controllers interconnected via multiple serial IO connections in accordance with the solution described herein. [Figure 10] 1 illustrates an exemplary configuration of three zone controllers interconnected via dual serial IO connections in accordance with the solution described herein. DETAILED DESCRIPTION OF THE INVENTION

[0030] In the following description, numerous specific details are given to provide a thorough understanding of the embodiments. The embodiments may be practiced without one or some of the specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

[0031] Throughout this specification, the term "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. Thus, the appearances of the phrase "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0032] The headings provided herein are for convenience only and do not interpret the scope or meaning of the embodiments.

[0033] As previously mentioned, various embodiments of the present disclosure provide a solution for data sensing and actuation applicable to automotive zone architectures.

[0034] To this end, Figure 2 illustrates an automotive zone control architecture or control system that includes multiple zone controllers, and in particular, four different zone controllers 40: a first zone controller 40a, a second zone controller 40b, a third zone controller 40c, and a fourth zone controller 40d. For example, the four zone controllers 40 may be located in different areas of the vehicle, corresponding to, for example, a front zone controller 40a, a right zone controller 40b, a left zone controller 40c, and a rear zone controller 40d.

[0035] As shown, the front zone controller 40a includes a microcontroller 41 that may be configured to implement several functions that occur in the front zone of the vehicle. For example, the microcontroller 41 may be configured to obtain readings from one or more sensors external to the front zone controller 40a, such as a throttle pedal 48 or a brake pedal 49. To this end, the microcontroller 41 includes an analog-to-digital converter for obtaining values ​​from the sensors.

[0036] As shown, the throttle pedal 48 and the brake pedal 49 may include redundant sensors, labeled 48a and 48b for the throttle pedal and 49a and 49b for the brake pedal, respectively, to ensure fail-safe operability of such mission-critical components. Specifically, each pair of redundant sensors, such as sensors 48a, 48b and sensors 49a, 49b, is connected to a different circuit to ensure fail-safe operability. In the example considered, the primary throttle pedal 48a and the primary brake pedal 49a are coupled to the microcontroller 41 of the front zone controller 40a, while the secondary throttle pedal 48b and the secondary brake pedal 49b are coupled to additional circuitry to provide fail-safe operability, as described below.

[0037] Similarly, rear zone controller 40d includes a microcontroller 41 that can be configured to implement several functions occurring in the rear zone of the vehicle. Specifically, in the example shown in FIG. 2, rear zone controller 40d is configured to activate a plurality of stop lights 79 external to rear zone controller 40d in response to brake pedal 49. As is known per se, in vehicles, stop lights are activated in response to depression of the brake pedal. To this end, in the considered example, rear zone controller 40d includes a high-side driver 78 coupled to microcontroller 41 and stop lights 79. In particular, microcontroller 41 of rear zone controller 40d includes a digital-to-analog converter to provide an analog drive signal to drive circuit 78.

[0038] Thus, in the considered example, each time a user presses the brake pedal 49, the microcontroller 41 provided in the front zone control unit 40a senses the pressure of the brake pedal 49, preferably by means of its integrated analog-to-digital converter, and sends a signal to the microcontroller 41 of the rear zone controller 40d by way of the vehicle network 30, which for convenience is not shown in Figure 2. Upon receiving the signal, the rear zone controller 40d drives the respective microcontroller 41, in particular via its integrated DAC, to drive the high-side driver 78, which then activates the stop lamps 79.

[0039] However, it may occur that one or more microcontrollers fail, thus impairing the functionality of the respective zone controllers. For example, referring to FIG. 2, it may occur that microcontroller 41 in rear zone control unit 40d fails, thus causing malfunctions in the operation of stop lamps 79. In mission-critical applications such as those shown in this embodiment, it is important to provide a fail-safe mechanism that ensures operation of stop lamps 79 even in the event of a failure.

[0040] To this end, the front zone controller 40a comprises a master control unit 42 coupled to a slave control unit 43 provided in the rear zone controller 40d by a communication link embodied by a serial bus 32a, thus being configured to form a serial I / O network.

[0041] Such a serial I / O network can be used when one or more zone controllers, particularly their respective microcontrollers 41, fail and are therefore unable to transmit and / or receive data over the main vehicle network 30. Specifically, a limp home or fail-safe circuit 75 is provided in the rear zone controller 40d so that the limp home circuit 75 can perform actions, such as activation, on behalf of the respective microcontroller 41 when the microcontroller 41 is unavailable due to a failure. Limp home or limp mode refers to defining safe operating parameters for the vehicle when a failure is detected, and in the case of the solution described herein, this refers to using a specific communication link, such as a serial network between the zone controllers, i.e., operating in a fail-safe manner.

[0042] A further analog-to-digital converter ADC 44 is provided in the front zone controller 40a and a further digital-to-analog converter DAC 74 is provided in the rear zone controller 40d to perform operations involving sensors 47, such as the throttle pedal 48 or brake pedal 49, and / or actuators 76, such as stop lamps 79. Thus, the ADC 44 of the front zone controller 40a is coupled to the sensors 47, in particular the secondary sensor of the throttle pedal 48b and the secondary sensor of the brake pedal 49b.

[0043] In particular, in the considered example, limp home circuit 75 is configured to read signals originating from front zone controller 40a and accordingly drive stop lamps 79 via DAC 74 and high-side driver 78. In various embodiments, limp home circuit 75 may be provided external to zone controller 40d. As expected, such a configuration serves as an additional system for performing mission-critical operations, such as activating stop lights 79 in the considered example, thus enhancing safety.

[0044] 2, such a configuration may be provided for some zone controllers, such as right zone controller 40b or left zone controller 40c. In particular, in the illustrated example, right zone controller 40b includes a slave control unit 43 coupled by serial bus 32b to a master control unit 42 provided in rear zone controller 40d, and left zone controller 40c includes a master control unit 42 coupled by serial bus 32c to a slave control unit 43 provided in front zone controller 40a.

[0045] As shown, the master control unit 42 of each zone controller is coupled to a respective microcontroller 41, but the slave control units 43 are preferably not coupled or directly coupled to their respective microcontrollers, i.e., the slave control units 43 may not be coupled to their respective microcontrollers 41, although in embodiments there may be an indirect coupling via a chain of other components or objects.

[0046] Thus, by using such an exemplary configuration, the vehicle's E / E architecture achieves a better degree of safety due to redundancy.

[0047] Indeed, even if the front zone microcontroller 41 fails, the functionality of the front zone controller 40a can still be provided by virtue of the slave control unit 43 configured to receive instructions, particularly data read / write requests, from the master control unit 42 of the left zone controller 40c via serial bus 32c. Similarly, the functionality associated with the right zone controller 40b can still be provided by virtue of the respective slave control unit 43 configured to receive instructions from the master control unit 42 of the rear zone controller 40d via serial bus 32a.

[0048] In general, such a configuration allows for the sharing of peripherals, which may be either sensors 47 or actuators 76, between various zone controllers provided in the vehicle via a dedicated serial bus 32, thus providing a safer architecture tailored for mission-critical applications that can operate independently from the vehicle network 30.

[0049] For simplicity, each coupling of one master control unit 42 to one slave control unit 43 via the serial bus 32 will be referred to hereinafter as an additional serial IO (input / output) link, further indicating that this communication link between the zone controllers implements an additional, in particular redundant, link to sensors or actuators in a redundant system for performing mission-critical operations. A further exemplary embodiment of the solution is shown in Figure 3.

[0050] According to this solution, the first zone controller 40a comprises a microcontroller 41 coupled to a master control unit 42, a slave control unit 43, and a data acquisition circuit 44 coupled to the slave control unit 43. In various embodiments, the data acquisition circuit 44 may be an ADC, such as a flash ADC or a delta-sigma converter.

[0051] Similarly, the second zone controller 40b comprises a microcontroller 41 coupled to the master control unit 42 and the drive circuitry 78, and a slave control unit 43 coupled to a digital-to-analog converter which in turn is coupled to a limp-home or fail-safe circuitry 75.

[0052] As shown, a first zone controller 40a is coupled to a second zone controller 40b via vehicle network 30, which is used when both the first zone controller 40a and the second zone controller 40b are operating normally. Additionally, a first serial bus 32b couples the master control unit 42 of the second zone controller 40b to the slave control unit 43 of the first zone controller 40a.

[0053] Similarly, serial bus 32a couples master control unit 42 of first zone controller 40a to slave control unit 43 of second zone controller 40b. Thus, microcontroller 41 of second zone controller 40b can execute operations directed to peripheral devices coupled to first zone controller 40a even if microcontroller 41 of first zone controller 40a fails.

[0054] Thus, in the configuration shown in FIG. 3, the microcontroller 41 of the first zone controller 40a can perform operations, such as reading data from a sensor or driving an actuator, directed to a peripheral device coupled to the second zone controller 40b, even if the microcontroller 41 of the second zone controller 40b fails.

[0055] As shown, the data acquisition circuitry 44 of the first zone controller 40a is coupled to a plurality of sensors, including a throttle pedal 48, a brake pedal 49, and other sensors 47, while the drive circuitry 78 of the second zone controller 40b is coupled to a plurality of actuators, including a plurality of brake lamps 79 and other general loads 76. In particular, the data acquisition circuitry 44 of the first zone controller 40a is coupled to the secondary sensors of the throttle pedal 48b and the brake pedal 49b, respectively, and the microcontroller 41 of the first zone controller 40a is coupled to the primary sensors of the throttle pedal 48a and the brake pedal 49a.

[0056] In various embodiments, the first zone controller 40a and the second zone controller 40b may be coupled to other zone controllers provided within the vehicle and to the central control unit 100 by a vehicle network 30.

[0057] Thus, in an exemplary scenario in which the microcontroller 41 of the first zone controller 40a is unavailable, the second zone controller 40b can read data from the sensors 47, throttle pedal 48, and brake pedal 49 physically coupled to the first zone controller 40a. Indeed, the microcontroller 41 of the second zone controller 40b can obtain readings from such sensors via the coupled master control unit 42. The master control unit 42 is then coupled by serial bus 32b to the slave control unit 43 of the first zone controller 40a, which is coupled to the analog-to-digital converter 44, which in turn is coupled to the sensor 47, secondary throttle pedal sensor 48b, and secondary brake pedal sensor 49b. Because the microcontroller 41 of the second zone controller 40b can read the sensor data from the first zone controller 40a, the load 76 and stop lamp 79 are driven accordingly by the drive circuit 78 controlled by the microcontroller 41 of the second zone controller 40b. In particular, the microcontroller 41 of the second zone controller 40 b may output an analog drive signal to the drive circuit 78 through a digital-to-analog converter that may be integrated into the microcontroller 41 .

[0058] In a different scenario, if the microcontroller 41 of the second zone controller 40b is unavailable, the first zone controller 40a can drive the load 76 and the stop lamps 79 physically coupled to the second zone controller 40b. Indeed, the microcontroller 41 of the first zone controller 40a can obtain sensor readings from the sensors 47, throttle pedal 48, and brake pedal 49, particularly from the secondary throttle pedal sensor 48b and secondary brake pedal sensor 49b, via the data acquisition circuitry 44, and send drive signals to the coupled master control unit 42, which is coupled to the slave control unit 43 of the second zone controller 40b by the serial bus 32a. The drive signals are therefore received by the failsafe driver 75 coupled to the load 76 and the brake lights 79.

[0059] In summary, the two zone controllers are coupled to each other by a serial bus 32 in addition to the standard vehicle network 30. The serial bus 32a allows a first zone controller 40a to operate loads on a second zone controller 40b based on its own data, and the serial bus 32a is coupled to a master control unit 42 on the first zone controller 40a, which is driven by the microcontroller 41 of the first zone controller 40a, and to a slave control unit 43 on the second zone controller 40b that is functionally dependent on the first zone controller 40a. In the opposite direction, the second zone controller 40b can read sensors on the first zone controller 40a by its own master control unit 42 connected to the slave control unit 43 on the first zone controller 40a by the serial bus 32b, and the slave control unit 43 is functionally dependent from the second zone controller 40b.

[0060] In other words, the slave controllers 43 provided in the second zone controller 40b and coupled to the respective master controllers 42 provided in the first zone controller 40a act as separate parts of the first zone controller 40a, through which the microcontroller 41 of the first zone controller 40a can control other external peripheral devices.

[0061] 4 illustrates an exemplary embodiment of the solution described herein, in which a serial remote IO architecture is used to drive a load 76 and brake lights 79 coupled to a second zone controller 40b based on sensor data received at a first zone controller 40a from a vehicle network 30. As illustrated, the first zone controller 40a exchanges sensor data over the vehicle network 30, receives sensor data 110 originating from other zone controllers provided in the vehicle E / E architecture, and shares sensor data 120 originating from a sensor 47, a throttle pedal 48, or a brake pedal 49 with other controllers coupled to the vehicle network 30. In particular, such sensor data 110 received by the first zone controller 40a may originate from additional zone control units 40 provided within the vehicle or, alternatively, from a central control unit 100.

[0062] The sensor data 110 is then processed by the microcontroller 41, which generates a drive signal. At this point, the drive signal generated by the microcontroller 41 is sent to the master control unit 42, which transmits the drive signal via the serial bus 32 to the slave control unit 43 located in the second zone controller 40b. The slave control unit 43 then forwards the received signal to a digital-to-analog converter 74, which then outputs an analog signal to a failsafe circuit 75, which ultimately drives a load 76 and / or a stop lamp 79 via a driver 78.

[0063] Specifically, as shown in the example, the first zone controller 40a can transmit data, i.e., sensor readings 110, to the second zone controller 40b by using only the serial bus 32, its microcontroller 41, and the respective master controller 42 and slave controller 43, without relying on the vehicle network 30 to exchange data between the first and second zone controllers.

[0064] Thus, in a scenario where the microcontroller 41 of the second zone controller 40b is unavailable, the loads 76, particularly the stop lamps 79, can operate without requiring any intervention from the microcontroller 41 of the second zone controller 40b by virtue of the illustrated serial IO implementation.

[0065] In summary, in such an example, sensor data 120 received from the vehicle network 30 and provided by other zone controllers 40 coupled to the vehicle network 30 is forwarded to the second zone controller 40b by way of a serial bus 32 coupled to the master control unit 42 of the first zone controller 40a and the slave control unit 43 of the second zone controller 40b. Similarly, sensor data 110 is read from sensors 47, throttle pedal 48, and brake pedal 49 and then forwarded via the vehicle network 30 to other zone controllers 40 coupled to the vehicle network 30.

[0066] 5 shows a detailed schematic diagram of the master control unit 42 provided in the first zone controller 40a and the slave control unit 43 provided in the second zone controller 40b. As shown, the master control unit 42 is coupled to the microcontroller 41 of the first zone controller 40a and includes a master transceiver 72. On the other hand, the slave control unit 43 is not coupled to the microcontroller 41 of the second zone controller 40b and similarly includes a slave transceiver 73. As shown in the previous example, the master control unit 42 and the slave control unit 43 are coupled via the serial bus 32. Notably, in such a communication link, the slave transceiver 73 can only send or receive data when the master transceiver 72 sends a corresponding command. Thus, in general, the slave control unit 43 must receive a command or instruction from the master control unit 42 to perform a given operation, such as reading data from a sensor 47 or asserting a drive signal for an actuator 76. Conversely, the master control unit 42 determines, based on requests received from the coupled microcontroller 41, the operations to perform over the serial IO links, particularly the additional serial IO links mentioned above, particularly the connections.

[0067] As shown, in various embodiments, the slave control unit 43 is coupled to one or more ADCs 44 and one or more DACs 74, which may be coupled to multiple sensors 47. In particular, embodiments of the present solution are possible with the ADCs 44 and DACs 74 either provided on the same chip or die of the slave transceiver 73, or with the ADCs 44 and DACs 74 provided in a separate die or package relative to the slave transceiver 73.

[0068] As explained in the previous example, the DAC 74 can be used to drive a load 76 coupled to the slave control unit 43. Indeed, the DAC 74 can be coupled to a fail-safe circuit 75. The fail-safe circuit 75 then receives the analog signal generated by the DAC 74 and sends a drive signal to a drive circuit 78, which drives the load 76 accordingly. In particular, the fail-safe circuit 75 may comprise one or more comparators 77.

[0069] 5, one brake pedal sensor, e.g., 49a, is acquired from the first zone controller 40a, specifically by the microcontroller 41, while the other sensor, e.g., 49b, is lost due to unavailability of the second zone controller 40b. However, the first zone controller 40a can drive a DAC circuit 74 in the second zone controller 40b via the serial IO link 32 to replicate an analog value associated with the brake pedal pressure, which is then used by a failsafe circuit 75 via an analog comparator 77, which then triggers a drive circuit 78 to switch on a load, e.g., a brake lamp 76.

[0070] In various embodiments, the slave control unit 43 further comprises a plurality of input / output ports 60. In particular, the IO ports 60 comprise a power port 62 through which the slave control unit 43 can receive power, and a digital output port 64 through which the slave control unit 43 can generate output digital signals under the control of the corresponding master control unit 42. For example, the power port 62 may be coupled to a power supply rail, and the digital output port 64 may be coupled to a further control unit or a diagnostic device.

[0071] Furthermore, the slave control unit 43 may be provided with other interfaces 66, such as, for example, an SPI interface or an AXI interface.

[0072] In various embodiments, the master control unit 42 and the slave control units 43 may comprise a microcontroller for performing logical operations, or alternatively other logic circuitry, such as combinatorial or sequential digital logic or finite state machines, without a dedicated microcontroller. Thus, the logic circuitry of the master control unit 42 and the slave control units 43 may be coupled to volatile memory, such as static random access memory (SRAM), and non-volatile memory, such as flash memory or EEPROM (Electrically Erasable Programmable Read-Only Memory).

[0073] In summary, this architecture enables safety-critical and mission-critical requirements to be met. A sensor 47, such as a throttle pedal 48 and a brake pedal 49, is provided with two separate redundant sensors, 48a and 48b, and 49 and 49b, respectively. Specifically, each redundant sensor pair is connected to the microcontroller 41 of the zone controller 40 for the zone in which it is provided and to an ADC 44 coupled to a slave control unit 43, so that additional zone controllers 40 can access the values ​​provided by such sensors. For example, pedals 48 and 49 may be associated with a first zone controller 40a, which may be located in the front zone of the vehicle, while the throttle pedal 48 and brake pedal 49 readings may be managed directly by a second zone controller 40b via serial IO, specifically by the slave control unit 43 coupled to the ADC 44. Data acquired by the first and second zone controllers 40a and 40b is then exchanged over the vehicle network 30, allowing all zone controllers to refine the data and make decisions based on all available sensors.

[0074] Without the described configuration including serial IO, loss or degradation of the primary computing power of one zone controller microcontroller 41, such as the microcontroller 41 of the first zone controller 40a, would result in an immediate loss of sensor readings and the ability to refine and drive outputs from the first zone controller 40a. However, thanks to the addition of the serial IO link in this solution, the sensor 47 can still be read independently by the second zone controller 40b, which can also share its readings with other zone controllers 40 over the vehicle network 30. Thus, the remaining zone controllers can control the necessary outputs in this type of scenario.

[0075] Conversely, if the primary computing power is lost in the second zone controller 40b, it is still possible to directly drive the loads directly associated with the second zone controller 40b from the first zone controller 40a via the present serial IO architecture. For example, if one brake pedal sensor 49a is acquired from the first zone controller 40a, specifically by the respective microcontroller 41, and the other sensor 49b is lost due to the second zone controller 40b being unavailable, the first zone controller 40a can drive the DAC circuit 74 of the second zone controller 40b via serial IO to replicate the analog value related to the pressure of the brake pedal 49, which is then processed by the fail-safe circuit 75 using an analog comparator 77 to trigger a driver 78 to activate the stop lamps 79.

[0076] In general, whatever the vehicle topology in which the serial IO method is used, the master control unit 42 is always functionally operating based on instructions, e.g., data read / write requests, received by the microcontroller 41 of its respective zone controller 40, while the slave control units 43 operate completely independently of the zone microcontroller 41 and operate only based on instructions received by the master control unit 42 to which the slave control unit 43 is coupled. Thus, all operations for modules controlled by a zone controller, sensors 47, loads and actuators 76, or any other input peripheral, and which are then specifically coupled to the slave control unit 43, are managed by the respective master control unit 42 coupled thereto. Of course, as shown in FIG. 3, such modules, i.e., sensors 47, loads and actuators 76, or any other input peripheral, controlled by a zone controller, e.g., 40b, are managed by the respective microcontroller 41 when it is operating.

[0077] In view of the above, further embodiments of the present solution are described above regarding different topologies obtainable with serial IO links. Of course, the following exemplary embodiments are discussed to provide a deeper understanding of the solution described herein and are not intended to limit other possible configurations not described herein.

[0078] In the following, the different zone controllers are denoted by the captions 40a, 40b, 40c, and 40d according to the number of zone controllers in one embodiment, but for simplicity, their captions do not change if their internal structure differs, for example, if they include only a master unit, a slave unit, or both; for example, the first zone controller 40a is not denoted by a different caption if it includes only a master unit, a slave unit, or both.

[0079] An exemplary embodiment of the present solution is shown in Figure 6a. In particular, a first zone controller 40a is coupled to a second zone controller 40b via a serial bus 32a. According to the present solution, the first zone controller 40a comprises a microcontroller 41 coupled to a master control unit 42, and the second zone controller 40b comprises a slave control unit 43.

[0080] Specifically, the master control unit 42 of the first zone controller 40a is coupled to the slave control unit 43 of the second zone controller 40b via a serial bus 32a.

[0081] In the embodiment under consideration, the illustrated architecture can be used to enable one-way data exchange between the first zone controller 40a and the second zone controller 40b. That is, the first zone controller 40a can access the controlled modules or peripherals connected to the second zone controller 40b by sending commands to read and write data. However, the reverse is not possible because the second zone controller 40b does not include a master control unit connected to each slave control unit provided within the first zone controller 40a. Therefore, the second control unit 40b cannot generate read or write requests directed to the first zone controller 40a. The second zone controller 40b also includes a microcontroller, but it is not shown in the figure because it is unidirectional and therefore not connected to the serial IO.

[0082] FIG. 6b depicts a first zone controller 40a coupled to a second zone controller 40b via two serial buses 32a and 32b, the first zone controller 40a comprising a microcontroller 41 coupled to a master control unit 42 and a slave control unit 43, and similarly the second zone controller 40b comprising a microcontroller 41 coupled to the master control unit 42 and the slave control unit 43.

[0083] The master control unit 42 of the first zone controller 40a is coupled to the slave control unit 43 of the second zone controller 40b via serial bus 32a, and the master control unit 42 of the second zone controller 40b is coupled to the slave control unit 43 of the first zone controller 40a via serial bus 32b.

[0084] Conversely, the first zone controller 40a and the second zone controller 40b can exchange data bidirectionally; in effect, the first zone controller 40a has a master control unit 42 coupled to each slave control unit 43 provided within the second control unit 40b, and similarly, the second control unit 40b has a master control unit 42 coupled to each slave control unit 43 provided within the first control unit 40a. Thus, in such a configuration, the first zone controller 40a can access peripherals coupled to the second zone controller 40b, and the second zone controller 40b can access peripherals coupled to the first zone controller 40a. Naturally, having the first zone controller 40a and the second zone controller 40d coupled in both directions increases system robustness and reduces wiring harness complexity.

[0085] In summary, in the example of FIG. 6a, the first zone controller 40a can access the peripherals of the second zone controller 40b, but the second zone controller 40b cannot access the peripherals of the first zone controller 40a, whereas in FIG. 6b, the first zone controller 40a can access the peripherals of the second zone controller 40b, and the second zone controller 40b can access the peripherals of the first zone controller 40a.

[0086] In FIG. 7 a further exemplary embodiment of the solution is shown.

[0087] In particular, the illustrated configuration includes a first zone controller 40a, a second zone controller 40b, and a third zone controller 40c. As illustrated, the first zone controller 40a is coupled to the second zone controller 40b via serial bus 32a and to the third zone controller 40c via serial bus 32b, respectively. The second zone controller 40b is also connected to the third zone controller 40c via serial bus 32c.

[0088] According to this solution, the first, second and third zone controllers 40a, 40b and 40c comprise respective microcontrollers 41 coupled to respective master control units 42. The zone controllers 40a, 40b and 40c also comprise respective slave control units 43.

[0089] In the considered embodiment, the illustrated architecture can be employed to enable one-way exchange of data between zone controllers. Indeed, the first zone controller 40a can access the resources of the second zone controller 40b by reading and / or writing data, and the second zone controller 40b can access the resources of the third zone controller 40c. Finally, the third zone controller 40c can access the resources of the first zone controller 40a.

[0090] In particular, while the above relationships are valid, none of the three zone controllers considered in this example can be coupled to other adjacent zone controllers by serial IO, i.e., the first zone controller 40a cannot access the resources of the third zone controller 40c, the second zone controller 40b cannot access the resources of the first zone controller 40a, and the third zone controller 40c cannot access the resources of the second zone controller 40b. In other words, in this example, the zone controllers are coupled to each other in a manner similar to a ring network topology, and therefore each zone controller can access only one adjacent zone controller.

[0091] FIG. 8 illustrates a similar ring configuration including four zone controllers coupled to a ring network. As previously described, cascading, or (daisy) chained, redundant serial IO links form the ring network. In particular, a first zone controller 40a is coupled to a second zone controller 40b via serial bus 32a and to a fourth zone controller 40d via serial bus 32b. In turn, the second zone controller 40b is coupled to a third zone controller 40c via serial bus 32c, and the third zone controller 40c is coupled to a fourth zone controller 40d via serial bus 32d.

[0092] Specifically, the master control unit 42 of the first zone controller 40a is coupled to the slave control unit 43 of the second zone controller 40b, the master control unit 42 of the second zone controller 40b is coupled to the slave control unit 43 of the third zone controller 40c, the master control unit 42 of the third zone controller 40c is coupled to the slave control unit 43 of the fourth zone controller 40d, and the master control unit 42 of the fourth zone controller 40d is coupled to the slave control unit 43 of the first zone controller 40a.

[0093] As mentioned above, in this example, the zone controllers are interconnected via redundant serial IO connections or links to form a ring network. Again, data exchange can only occur in one direction due to the fact that each zone controller has only one master control unit 42 and one slave control unit 43. In fact, each zone controller 40 can only access one adjacent zone controller. Specifically, the first zone controller 40a can only access the resources of the second zone controller 40b, which can only access the resources of the third zone controller 40c, which can only access the resources of the fourth zone controller 40d, and finally, the fourth zone controller 40d can only access the resources of the first zone controller 40a. Therefore, exchanging data in the opposite direction—for example, from the first zone controller 40a to the fourth zone controller 40d—is not possible in the illustrated configuration. For example, bidirectional communication can be achieved by implementing a similar network topology, providing each zone controller with two master control units 42 and two slave control units 43, with one master control unit 42 coupled to its next adjacent slave control unit 43, e.g., coupling the first zone controller 40a to the second zone controller 40b, and the other master control unit 42 coupled to its previous adjacent slave control unit 43, e.g., coupling the first zone controller 40a to the fourth zone controller 40d.

[0094] A further embodiment of the present solution is shown in Figure 9, featuring a unidirectional link between a first zone controller 40a and a second zone controller 40b. As shown, the first zone controller 40a is coupled to the second zone controller 40b by two serial buses 32a and 32b, which couple the master control units 42a and 42b of the first zone controller 40a to respective slave control units 43a and 43b of the second zone controller 40b.

[0095] In particular, the two master control units 42a and 42b are coupled to the microcontroller 41 of the first zone controller 40a and are configured to receive instructions from the microcontroller 41. The slave control units 43a and 43b provided in the second zone controller 40b may be coupled to the same peripherals, i.e., the sensors 47 and / or actuators 76, or may be coupled to different peripherals of the second zone controller 40b. Because the serial IO links have the same direction, data read or write requests can only be generated by the first zone controller 40a towards the second zone controller 40b, while the reverse is not possible in the illustrated configuration.

[0096] Of course, if desired, for example for bandwidth reasons, there may be more than two master units in the first zone controller, and correspondingly more than two slave units.

[0097] The configuration shown can be employed to achieve higher bandwidth thanks to dual serial IO links being added to the vehicle network to meet final design requirements, or alternatively to provide even more secure linking by sending the same data twice over the serial IO links. Of course, these enhancements also come with the drawback of a more complex cable harness, but this is still simpler than the corresponding wiring harness in a traditional distributed E / E architecture.

[0098] To achieve increased bandwidth in the considered configuration, both the master control unit 42 and the slave control unit 43 include buffers coupled to data segmentation circuits for segmenting and reassembling data transmitted and received over the serial buses 32a and 32b.

[0099] Conversely, to achieve greater security by configuring buses 32a and 32b as redundant communication channels, master control unit 42 and slave control unit 43 shall include error detection circuitry configured, for example, to check whether two or more symbols received from buses 32a and 32b, respectively, are different, and if so, to drop the symbols and request retransmission from master control unit 42.

[0100] FIG. 10 shows an exemplary embodiment of the present solution featuring a first zone controller 40a coupled by a dual serial bus 32 to a second zone controller 40b and a third zone controller 40c.

[0101] As shown, the first zone controller 40a includes a microcontroller 41 coupled to a master control unit 42. The master control unit 42 is coupled to a slave control unit 43 provided in a second zone controller 40b and a slave control unit 43 provided in a third zone controller 40c. In particular, the coupling between the master control unit 42 and the two slave control units 43 is achieved via a serial bus 32, which is split into two branches: a first branch 32x is received by the second zone controller 40b, and a second branch 32y is received by the third zone controller 40c. As a result, both slave control units 43 receive the same data transmitted from the first zone controller 40a via branches 32x and 32y.

[0102] To precisely address the requested zone controller, the master control unit 42 can include an address identifying the desired slave control unit 43 in the data read / write request.

[0103] For example, if the microcontrollers 41 of both the second and third zone controllers 40b and 40c malfunction and become inoperable, the first zone controller 40a can still access the resources of the other two zone controllers through the dual serial IO links. Specifically, whenever the first zone controller 40a requests access to a resource linked to the second zone controller 40b, the master control unit 42 should include an address in the data read / write request indicating that the second zone controller 40b is the intended recipient of the data read / write request. Similarly, to access a resource linked to the third zone controller 40c, the data read / write request generated by the master control unit 42 should include an address indicating that the third zone controller 40c is the intended recipient of the request.

[0104] Therefore, the slave control units 43 of both the second and third zone controllers 40b and 40c are configured to verify whether a received data read / write request is directed to the respective zone controller. If the received data read / write request is directed to the respective zone controller 40, the slave control unit 43 continues to execute the request. On the other hand, if the slave control unit 43 receives a data read / write request directed to another zone controller, the slave control unit 43 discards the request.

[0105] The operations of adding an address to a data read / write request and verifying whether a received data read / write request is directed to a zone of interest controller may be performed by logic circuitry provided within the master control unit 42 and the slave control unit 43, respectively. For example, such operations may be performed by a microcontroller provided in both the master control unit 42 and the slave control unit 43, or by registers coupled to a programmable logic device, look-up table, or finite state machine. Of course, the addressing techniques described herein allow for many more slave control units 43 to be coupled to a single master control unit 42 by employing appropriately sized clocks, symbol durations, and symbol rates.

[0106] 6 to 10, it is apparent that each zone controller 40 may include a master control unit 42 and a slave control unit 43 in addition to a microcontroller 41. However, in an embodiment, one or more zone controllers 40 may include either a master control unit 42 or a slave control unit 43 in addition to a microcontroller 41.

[0107] The solution therefore relates to a control system for a vehicle comprising a vehicle network 30 configured to exchange data with a plurality of zone controllers, e.g. 40a and 40b, configured to control respective modules operating in respective zones of the vehicle, in particular sensors 47 and / or actuators 76. In particular, each zone controller 40 comprises a microcontroller 41, a master control unit 42 and / or a slave control unit 43.

[0108] In particular, in the considered solution, at least a first zone controller 40a of the plurality of zone controllers, for example 40a and 40b, comprises a respective master control unit 42 coupled to a slave control unit 43 of a second zone controller 40b of the plurality of zone controllers 40a, 40b by a communication link, in particular a serial bus 32, and is configured to send instructions, in particular data read / write requests, from the first zone controller 40a to the second zone controller 40b over the communication link, in particular the serial bus 32, and the second zone controller 40b is configured to receive and execute the instructions, such as data read / write requests, by means of the respective slave control unit 43.

[0109] Therefore, based on the above explanation, the advantages of the solution described therein are clear.

[0110] In particular, the described solution allows for further reduction in the complexity of the wiring harness by using this type of architecture, with the trade-off of reducing the available bandwidth. Thus, for example, if a designer requires a lighter wiring harness due to some technical constraints, the designer may decide to use a solution with two or more slave control units, e.g., 43, coupled to one master control unit, e.g., 42, as shown in Figure 10. Conversely, if the designer requires increased bandwidth, the designer may decide to adopt a solution with two or more master control units 42 and two or more slave control units 43 for each zone controller, as shown in Figure 9.

[0111] Naturally, without prejudice to the principles of the present solution, the details of construction and embodiments can be widely varied from those described and illustrated herein purely by way of example, without departing from the scope of the present solution, which is defined by the appended claims.

Claims

1. A control system for a vehicle, comprising a vehicle network (30) configured to exchange data with a plurality of zone controllers (40 a, 40 b) configured to control respective modules, in particular sensors (47) and / or actuators (76) operating in respective zones of the vehicle, each zone controller (40) a microcontroller (41), a master control unit (42), and / or a slave control unit (43), a master control unit (42) coupled to a slave control unit (43) of a second zone controller (40b) of the plurality of zone controllers (40a, 40b) by a communication link, in particular a serial bus (32); the master control unit (42) is configured to transmit instructions, in particular data read / write requests, from the first zone controller (40a) to the second zone controller (40b) over the communication link, in particular the serial bus (32); and the second zone controller (40b) is configured to receive and execute the instructions, in particular the data read / write requests, by the respective slave control unit (43).

2. 2. The control system of claim 1, comprising a central controller (100) coupled to the vehicle network (30), each zone controller (40) coupled to the vehicle network (30) and configured to send and receive data via the vehicle network (30), the central controller (100) configured to manage the exchange of data between the zone controllers (40).

3. 3. The control system of claim 2, wherein the first zone controller (40a) is configured to send a command to the second zone controller (40b) upon detecting that the microcontroller (41) of the second zone controller (40b) is malfunctioning.

4. Each slave control unit (43) one or more analog-to-digital converters (44), and / or one or more digital-to-analog converters (74), and / or - one or more drive circuits (78).

5. 5. The control system of claim 4, wherein each zone controller (40) is coupled to one or more sensors (47) and / or one or more actuators (76), and the one or more analog-to-digital converters (44) read values ​​from the one or more sensors (47) and the one or more digital-to-analog converters (74) send signals to the one or more actuators (76).

6. 2. The control system of claim 1, wherein the master control unit (42) and the slave control unit (43) comprise a master transceiver (72) and a slave transceiver (73), respectively, the master transceiver (72) and the slave transceiver (73) being coupled to the communication link, in particular a serial bus (32), and configured to transmit and receive data via the communication link, in particular the serial bus (32).

7. 7. The control system of claim 1, wherein one or more zone controllers (40) are linked to the first zone controller (40a) and the second zone controller (40b) by a further serial bus (32) linking each master control unit (42) to a corresponding slave control unit (43).

8. 7. A control system according to any one of claims 1 to 6, wherein the first zone controller (40a) comprises a plurality, in particular a pair of master control units (42a, 42b), each coupled by a respective serial bus (32a, 32b) to a corresponding slave control unit (43a, 43b) provided in the second zone controller (40b).

9. 8. A control system according to claim 1, further comprising at least a third zone controller (40c) having a slave control unit (43), wherein the communication link, in particular the serial bus (32), is divided into two branches (32x, 32y) coupled respectively to the slave control unit (43) of the second zone controller (40b) and to the slave control unit (43) of the third zone controller (40c).

10. 8. The control system of claim 1, wherein one or more of the plurality of zone controllers (40a) comprises a master control unit (42) and a slave control unit (43).

11. 11. The control system according to claim 1, wherein, upon malfunction of the microcontroller (41) of the second zone controller (40b), the at least first zone controller (40a) in the plurality of zone controllers (40a, 40b) is configured to execute the transmission command, in particular a data read / write request, from the first zone controller (40a) to the second zone controller (40b).

12. 1. A method for controlling modules in a vehicle, comprising a vehicle network (30) exchanging data with a plurality of zone controllers (40a, 40b) configured to control respective modules, in particular sensors and / or actuators, operating in respective zones of the vehicle, wherein each zone controller (40) a microcontroller (41), a master control unit (42), and / or a slave control unit (43), transmitting instructions, particularly data read / write requests, from the first zone controller (40a) to a second zone controller (40b) in the plurality of zone controllers (40a, 40b) via a respective master control unit (42) coupled by a serial bus (32) to a slave control unit (43) of a second zone controller (40b) in the plurality of zone controllers (40a, 40b).

13. 13. The method of claim 12, further comprising linking one or more zone controllers (40) to the first zone controller (40a) and the second zone controller (40b) by a further serial bus (32), in particular linking each master control unit (42) to a corresponding slave control unit (43).

14. 14. The method according to claim 12 or 13, comprising coupling the first zone controller (40a) by a plurality, in particular a pair of master control units (42a, 42b), to corresponding slave control units (43a, 43b) provided in the second zone controller (40b), in particular by respective serial buses (32a, 32b).

15. 15. The method according to any one of claims 12 to 14, further comprising providing at least a third zone controller (40c) having a slave control unit (43), and providing the communication link, in particular a serial bus (32), being split into two branches (32x, 32y) coupled respectively to the slave control unit (43) of the second zone controller (40b) and to the slave control unit (43) of the third zone controller (40c).

16. 16. The method of any one of claims 12 to 15, comprising providing one or more zone controllers (40a) of the plurality with a master control unit (42) and a slave control unit (43).

17. 16. The method according to any one of claims 12 to 15, wherein the sending command, in particular a data read / write request, from the first zone controller (40a) to the second zone controller (40b) is executed upon detecting that the microcontroller (41) of the second zone controller (40b) is malfunctioning.

Images