Safe redundant start-stop system and method for onboard controller, chip, and intelligent vehicle

Abstract

The present application relates to a safe redundant start-stop system and method for an onboard controller, a chip, and an intelligent vehicle. The system comprises a daemon component, a process management component, a state management component, and a health management component; the daemon component is used for starting and monitoring the process management component; the process management component is used for starting and monitoring the state management component, the health management component and each controller application; the health management component is used for receiving process activity information of the state management component and each controller application, and generating a start-stop message on the basis of an object where an anomaly occurs; the state management component is used for generating a start-stop message on the basis of an application exit message received from the process management component; and the process management component restarts the controller applications in the start-stop message and / or the state management component. By means of functional grouping and hierarchical structuring, the working conditions of various controller applications are addressed, and the start and stop of the controller applications are safely and efficiently managed, thereby ensuring safe running of vehicles.

Description

Vehicle controller safety redundant start-stop system, method, chip and smart car

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on January 22, 2024, with application number 202410099586.5 and invention name “On-board controller safety redundant start-stop system, method, chip and smart car”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of intelligent vehicle technology, and in particular to a vehicle-mounted controller safety redundant start-stop system, method, chip and intelligent vehicle. Background Art

[0003] As vehicles become increasingly intelligent, the types and number of embedded controllers onboard become more complex, and the requirements for safe operation of these controllers are becoming increasingly stringent. During vehicle use, efficient management of the start and stop of onboard controllers is required in various situations to ensure safe operation.

[0004] Currently, the application software of in-vehicle controllers (referred to as controller applications) is directly managed by the SOC (System on Chip). This increases the complexity of the SoC, potentially leading to more failure points and making maintenance difficult. Furthermore, when a controller application fails, the SoC struggles to promptly start and stop the controller application. In other words, current in-vehicle controller systems struggle to safely and efficiently manage the start and stop of controller applications, impacting the safe operation of the vehicle.

[0005] Summary of the Invention

[0006] One of the purposes of this application is to provide a vehicle-mounted controller safety redundant start-stop system to solve the problem in the existing technology that it is difficult to safely and efficiently manage the start and stop of controller applications, which affects the safe operation of the vehicle; the second purpose is to provide a vehicle-mounted controller safety redundant start-stop method; the third purpose is to provide a chip; and the fourth purpose is to provide a smart car.

[0007] In order to achieve the above objectives, the technical solutions adopted in this application are as follows:

[0008] A vehicle-mounted controller safety redundant start-stop system, the system comprising:

[0009] Guardian component, process management component, state management component and health management component;

[0010] The daemon component is used to start and monitor the process management component, and restart the process management component when the process management component finishes running;

[0011] The process management component is used to start and monitor the state management component, the health management component and each controller application, and restart the component that has finished running when any of the state management component and the health management component ends running; when the controller application ends running, an application exit message is generated according to the controller application that has finished running, and the application exit message is sent to the state management component; and in response to a received start / stop message, the controller application and / or the state management component in the start / stop message is restarted;

[0012] The health management component is used to receive process activity information of the state management component and each controller application, and when it is determined according to the process activity information that any object of the state management component and the controller application is abnormal, generate the start / stop message according to the abnormal object, and send the start / stop message to the process management component;

[0013] The state management component is used to generate the start / stop message according to the application exit message received from the process management component, and send the start / stop message to the process management component; and also periodically send process activity information of its own process to the health management component.

[0014] According to the above technical means, the start and stop of controller applications are managed by dividing them into functional groups and hierarchical methods, which can efficiently manage the start and stop of controller applications in various situations, realize safe redundant start and stop of controller applications, and ensure the safe operation of the vehicle.

[0015] Optionally, the health management component also monitors the guard component and obtains the resource status of the controller system. When the guard component is abnormal and / or the controller system is determined to be abnormal based on the resource status, a signal is sent to the watchdog software to restart the controller system.

[0016] According to the above technical means, it is possible to handle controller system anomalies and guardian component operation anomalies, thereby achieving safe operation of the domain controller.

[0017] Optionally, when the process management component receives the start / stop message sent by the state management component, it restarts the controller application in the start / stop message; when the process management component receives the start / stop message sent by the health management component, it restarts the controller application and / or the state management component in the start / stop message.

[0018] According to the above technical means, by using the state management component and the health management component to handle different working conditions and objects, the processing efficiency and system reliability can be improved.

[0019] Optionally, the status management component includes a counting unit, which is used to accumulate the number of restarts when the status management component is restarted by the process management component and determines that the status management component is restarted after an abnormal exit based on the startup parameters of the status management component. When the number of restarts exceeds a preset threshold, a signal is sent to the watchdog software to restart the controller system.

[0020] According to the above technical means, by setting startup parameters to prevent the state management component from restarting repeatedly in a short period of time, it is possible to handle the working condition where the state management component fails to restart, thereby improving the reliability of the system.

[0021] Optionally, the process management component includes a monitoring recovery unit, which is used to send the current status of each controller application monitored by the restarted component to the restarted component when any component of the health management component and the status management component is restarted to restore the restarted component's monitoring of the controller application.

[0022] According to the above technical means, by restoring the current state of the monitored controller application, it is possible to avoid the need to restart the monitored controller application due to restarting the health management component or the state management component, thereby improving restart efficiency.

[0023] Optionally, the process management component includes a tool chain unit, and the tool chain unit is used to read the SOA tool chain configuration when starting the controller application, obtain startup logic information, and start the controller application according to the startup logic information.

[0024] According to the above technical means, the startup logic of the controller application is managed through the SOA tool chain configuration, which can more conveniently manage the startup process of the controller application.

[0025] Optionally, both the state management component and the health management component include a tool chain unit, which is used to read the SOA tool chain configuration, obtain operation logic information, and generate the start and stop message based on the controller application that ends operation or is abnormal and the operation logic information.

[0026] According to the above technical means, by adopting the tool chain unit to read the SOA tool chain configuration, the start and stop logic of the controller application that has ended operation or is abnormal can be configured, and management is more efficient and convenient.

[0027] Optionally, the state management component and the health management component also include an application combination unit, which is used to obtain a combination of controller applications based on the controller application that has ended operation or is abnormal and the operation logic information, and generate the start-stop message based on the combination.

[0028] According to the above technical means, by identifying the functional group or associated controller applications to which the controller application that has ended operation or is abnormal belongs, logical operations can be performed on the entire combination of controller applications to improve the security of the domain controller.

[0029] A vehicle controller safety redundant start-stop method, comprising:

[0030] Pre-building a first-level functional component, a second-level functional component, and a third-level functional component, wherein the first-level functional component is used to start and monitor the second-level functional component, the second-level functional component is used to start and monitor the third-level functional component and each controller application, and the third-level functional component is used to receive process activity information or application exit messages of each controller application;

[0031] Start the first-level functional components as a daemon process;

[0032] When the first-level functional component monitors that the second-level functional component has finished running, restarting the second-level functional component using the first-level functional component;

[0033] When the second-level functional component monitors that the third-level functional component has finished running, the second-level functional component is used to restart the third-level functional component; when the second-level functional component monitors that the controller application has finished running, an application exit message is generated according to the controller application that has finished running, and the application exit message is sent to the third-level functional component; when the second-level functional component receives a start-stop message sent by the third-level functional component, the second-level functional component is used to restart the controller application in the start-stop message;

[0034] When the third-level functional component determines that the controller application is abnormal based on the process activity information, it generates the start-stop message based on the abnormal controller application or generates the start-stop message based on the application exit message, and sends the start-stop message to the second-level functional component.

[0035] Optionally, the third-level functional component includes a state management component and a health management component, the state management component is used to receive the application exit message sent by the second-level functional component, and the health management component is used to receive process activity information of each controller application.

[0036] According to the above technical means, by using state management components and health management components to handle different working conditions, processing efficiency and system reliability can be improved.

[0037] Optionally, the health management component also receives process activity information of the state management component, and when it is determined that the state management component is abnormal based on the process activity information of the state management component, generates the start / stop message and sends it to the second-level functional component.

[0038] According to the above technical means, by using the health management component to monitor whether the state management component is abnormal, the state management component can be restarted in time when it is abnormal, thereby improving the reliability of the system.

[0039] A chip stores a vehicle controller safety redundancy start-stop program, which, when executed by a processor, implements any one of the steps of the vehicle controller safety redundancy start-stop method.

[0040] A smart car includes a memory, a processor, and an on-board controller safety redundant start-stop program stored in the memory and executable on the processor. When the on-board controller safety redundant start-stop program is executed by the processor, any one of the steps of the above-mentioned on-board controller safety redundant start-stop method is implemented.

[0041] The beneficial effects of this application are: instead of restarting the controller system when the controller application is abnormal or exits, the operating conditions of various controller applications are solved by dividing them into functional groups and hierarchical methods, and the start and stop of controller applications are managed safely and efficiently to ensure the safe operation of the vehicle; and, combined with SOA service, the system can quickly iterate and quickly adapt to various embedded controllers of the entire vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] FIG1 is a functional architecture diagram of a vehicle controller safety redundant start-stop system according to an embodiment of the present application;

[0043] FIG2 is an interaction sequence diagram of the state management component of an embodiment of the present application;

[0044] FIG3 is an interaction sequence diagram of the health management component according to an embodiment of the present application;

[0045] FIG4 is a schematic diagram of a smart car according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will describe the embodiments of the present application with reference to the accompanying drawings and optional embodiments. Those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be understood that the optional embodiments are only for the purpose of illustrating the present application and are not intended to limit the scope of protection of the present application.

[0047] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application. Therefore, the illustrations only show components related to the present application and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0048] Vehicle embedded controllers (also known as onboard controllers) primarily consist of a microcontroller (MCU) and a system-on-chip (SOC). The SOC runs an operating system such as Linux or QNX (the controller system) and application software (the controller application). The controller application manages and controls various vehicle functions and systems, such as engine control, vehicle stability control, braking system control, air conditioning system control, and entertainment system control.

[0049] In the context of software-defined vehicles, vehicles are becoming increasingly intelligent, placing ever-higher demands on the safe operation of embedded controllers throughout the vehicle. Efficiently managing the controllers' start and stop functions in various situations during vehicle operation has become a crucial challenge.

[0050] In response to the current problem of difficulty in safely and efficiently managing the start and stop of controller applications, this application manages the start and stop of controller applications by building multiple components by functional groups and levels. It can efficiently manage the start and stop of controller applications in various situations, and realize safe and redundant start and stop of controller applications.

[0051] The vehicle-mounted controller safety redundant start-stop system of the present application can be deployed on the vehicle's domain controller (such as the cockpit domain controller, entertainment domain controller, power domain controller, etc.) to achieve safe redundant start-stop of the controller applications on the domain controller, or it can be deployed on the central domain controller (such as the ECU) to achieve safe redundant start-stop of the controller applications of the entire vehicle.

[0052] The vehicle controller safety redundant start-stop system of the embodiment of the present application runs on an embedded domain controller, which is composed of a single-chip microcomputer MCU and multiple SOCs. The MCU is responsible for the power management of the entire embedded domain controller. Each chip on the domain controller generates corresponding interface code through SOA service according to its own needs, and is integrated into each controller application and deployed and run. It should be noted that it is not limited to domain controllers with only one MCU and one or more SOCs, but can also be used for domain controllers with multiple MCUs and multiple SOCs.

[0053] Specifically, as shown in FIG1 , the above system includes: a guard component SWC_RUN, a process management component SWC_EM, a state management component SWC_SM, and a health management component SWC_PHM.

[0054] The daemon component is the functional component that is called immediately after the vehicle controller is started. The daemon component can be a module or a code snippet. For example, if the vehicle controller is running a system such as Linux or QNX, the daemon component is managed and run by systemd (a system and service manager responsible for starting, stopping, and managing daemon processes); if the vehicle controller is a real-time operating system such as a single-chip microcomputer (MCU), UCOS, or RTOS, the daemon component is a task component (a code snippet in a while(true) loop) that is initialized after the vehicle controller is powered on. When the daemon component is started, it starts and monitors the process management component SWC_EM. During the monitoring process, if it detects that the process management component SWC_EM has exited normally or abnormally for unknown reasons, it is responsible for quickly restarting the process management component SWC_EM in milliseconds.

[0055] The process management component is a functional component that manages the start, stop, sleep, and restart operations of controller applications and controller application combinations on the vehicle controller. After the process management component is started, it starts and monitors the state management component SWC_SM, the health management component SWC_PHM, and each controller application by creating subprocesses and subtasks. During the monitoring process, when the state management component SWC_SM or the health management component SWC_PHM exits normally or abnormally and ends its operation, it is responsible for quickly restarting the state management component or health management component that ended its operation in milliseconds;

[0056] Since controller applications may be associated with each other, for example, the voice recognition application is associated with the door lock switch application, which can achieve voice locking. When a controller application ends its operation, simply restarting the controller application may cause other controller applications associated with the controller application to malfunction, affecting the safe operation of the vehicle. Therefore, when it is monitored that a controller application has ended its operation, the controller application that has ended its operation is packaged as an application exit message. For example, the process name and process PID of the controller application that has ended its operation are packaged as an application exit message, and then the application exit message is sent to the state management component. The state management component then determines other controller applications associated with the controller application based on the association between the controller applications, and then restarts the controller application and other controller applications associated with the controller application through the process management component.

[0057] In this embodiment, the process management component also includes a toolchain unit. When starting a controller application, the toolchain unit reads the SOA (Service-Oriented Architecture) toolchain configuration and obtains startup logic information. The startup logic information is used to determine the startup parameters and startup sequence of the controller application. The controller application is started according to the startup logic information. Specifically, the process management component first starts the state management component SWC_SM and the health management component SWC_PHM. After the state management component and the health management component are running normally, the controller applications (APP1, AAP2, ..., APPn) are started and monitored based on the dependencies configured in the SOA toolchain and the functional group relationships of the applications before and after startup.

[0058] When the controller application starts, the code for the controller application to report its startup, exit and other status can also be generated according to the SOA tool chain configuration, so that the controller application can "report" the running status to the process management component as soon as it starts. If the process management component does not receive the running status of the controller application within the time specified by the SOA tool chain configuration, then according to the SOA tool chain configuration regulations, restart the controller application (exit first and then restart) or do not restart, or if it still does not receive the status after restarting again, restart it several times (the number of times is configurable) and other logical requirements to execute the startup of the controller application.

[0059] When the controller application is running, it can also call the interface to "report" its corresponding running status to the process management component as needed, such as: start, exit, sleep, upgrade, restart, custom status, etc.

[0060] Among them, the state management component is a functional component that performs logical management of the controller application state. After the state management component is started, when it receives an application exit message from the process management component, it obtains the controller application that has terminated according to the application exit message, and then searches for the application function group to which the controller application that has terminated belongs or obtains other controller applications associated with the controller application that has terminated according to the pre-configured association rules between controller applications. Then, the controller application that has terminated and the other associated controller applications are packaged into a start-stop message, and the start-stop message is sent to the process management component. After receiving the start-stop message, the process management component reads the controller application that needs to be restarted from the start-stop message and performs a restart operation.

[0061] In this embodiment, to enable flexible configuration and management of controller applications, the SOA toolchain configuration includes operational logic for controller applications that experience exceptions, such as the number of restart attempts and restart parameters. Accordingly, the state management component also includes a toolchain unit. This toolchain unit can read this information from the SOA toolchain configuration, obtain logic information, package this logic information with the terminated controller application, and generate start / stop information, enabling the process management component SWC_EM to execute operations according to the logic of the SOA toolchain configuration.

[0062] In one example, the operation logic of the application combination (the associated controller application or the functional group to which the controller application belongs) can also be set in the SOA tool chain configuration. The state management component also includes an application combination unit. The application combination unit can read this information in the SOA tool chain configuration and obtain the controller application combination based on the controller application that has ended operation. For the controller applications in the application combination, the operation status of these controller applications can also be detected. It is determined whether these controller applications need to be logically operated based on the SOA tool chain configuration. If necessary, the logic information is obtained based on the SOA tool chain configuration, and the controller applications that need to be operated and the logic information and the controller applications that have ended operation are packaged together as start and stop information and sent to the process management component. Therefore, the state management component SWC_SM not only manages the logical operation of a single controller application, but also manages the logical operation of the controller application combination. According to the operation status of each controller application itself in a certain situation and the unified state of the application combination, the process management component can perform start and stop operations according to the logic of the SOA tool chain configuration.

[0063] In one example, when the process management component restarts the state management component, a new abnormal startup parameter of the state management component is added. When the state management component determines that it is a restart after an abnormal exit based on the abnormal startup parameter, the number of restarts is recorded to avoid repeated restarts. For example, when the number of restarts exceeds a preset threshold, a signal is sent to the watchdog software to restart the controller system. Specifically, the "command" to restart the SOC system is sent to the MCU in combination with hardware communication methods such as SPI, GPIO, and UART. For example, the MCU is allowed to identify whether the state of the SOC is abnormal by checking whether the range of signal inversion is normal. If the SOC is abnormal, the interface is called to notify the MCU. In addition to identifying the software "watchdog" of the SOC on the domain controller, the MCU of the domain controller also identifies the software and hardware "watchdog" of its own MCU to restart the MCU itself and the entire domain controller.

[0064] In one example, after identifying an abnormal restart of the state management component using abnormal startup parameters during the restart, the state management component obtains the controller applications monitored by the controller application. The process association component then synchronizes the status of these controller applications at the time of the restart with the state management component, allowing the state management component to resume monitoring of these controller applications. This avoids the need to exit and then restart these monitored controller applications due to the restart of the state management component.

[0065] Among them, the health management component is a functional component that collects, arbitrates, and monitors the process operation data of the controller application. Specifically, the various operating conditions of the controller application of each embedded controller and domain-level embedded controller on the vehicle during its life cycle include not only normal exit and abnormal exit, but also abnormalities such as "stuck" and "stuck" (the process task has not exited at this time) caused by abnormal operation logic of the controller application software itself or other reasons. Therefore, after the health management component is started, it receives the "heartbeat" and health information sent by each controller application. The "heartbeat" and health information are collectively referred to as process activity information. The above health information is used to represent the running status information of the process, and the specific content is not limited, such as the running time information of the process, the execution logic information of the function in the process, and custom information. When a controller application is determined to be abnormal based on the process activity information, the abnormal controller application is packaged as a start-stop message and sent to the process management component. After receiving the start-stop message, the process management component restarts the controller application in the start-stop message.

[0066] After setting the operation logic for controller applications that have experienced an exception in the SOA toolchain configuration, in one example, the health management component also includes a toolchain unit. The toolchain unit can read the operation logic of the controller applications in the SOA toolchain configuration, obtain the logic information, package this logic information with the controller application that has experienced an exception, and generate start and stop information. This enables the process management component SWC_EM to perform operations according to the logic configured in the SOA toolchain. For example, operations such as restart, shutdown, background operation, and upgrade can be performed.

[0067] In one example, exception logic for controller applications is configured within the SOA toolchain configuration, making the determination of controller application anomalies configurable and facilitating the management of these rules. Upon receiving process activity information, the exception logic is used to determine whether a controller application is anomaly. This logic information is packaged with the controller application identified as an anomaly to generate a start / stop message. Upon receiving the start / stop message, the process management component restarts the controller application identified in the start / stop message.

[0068] In one example, after setting the operation logic of the application combination in the SOA tool chain configuration, the health management component also includes an application combination unit. The application combination unit can read this information in the SOA tool chain configuration, obtain the controller application combination based on the abnormal controller application, and for the controller applications in the application combination, it can also detect the running status of these controller applications, and determine whether these controller applications need to be logically operated based on the SOA tool chain configuration. If necessary, the logic information is obtained based on the SOA tool chain configuration, and the controller applications that need to be operated and the logic information, as well as the controller applications that have ended operation, are packaged together as start-stop information and sent to the process management component. Therefore, similar to the state management component, the health management component SWC_PHM not only manages the logical operations of a single controller application, but also manages the logical operations of the controller application combination. It can perform start-stop operations according to the logic of the SOA tool chain configuration based on the running status of each controller application itself in a certain situation and the unified status of the application combination.

[0069] In this embodiment, the guard component is a first-level functional component, the process management component is a second-level functional component, the first-level functional component is used to start and monitor the second-level functional component, and the state management component and health management component are third-level functional components, which are started and monitored by the second-level functional component. The state management component is used to manage the operating logic when the controller application ends its operation, and the health management component is used to determine the operating logic based on the controller application process activity information. By dividing the start and stop management of the controller application into functional groups and hierarchical methods, it is possible to efficiently manage the abnormal conditions of the controller application in various situations. Moreover, when the controller application exits abnormally, it can be restarted in time, realizing the redundancy function of the controller application and ensuring the safe operation of the vehicle.

[0070] This embodiment utilizes distributed communication methods such as SOME / IP and DDS to implement SOA-based services for each controller application, generating a unified interface. This allows for configurable business logic for adapting to the safe and redundant startup and shutdown of each embedded controller throughout the vehicle, including the "heartbeat," health information, judgment, shutdown, and restart logic of the monitored controller application. This allows for rapid iteration to support the deployment and operation of each embedded controller throughout the vehicle, and rapid adaptation to other vehicle models.

[0071] The process management component SWC_EM, state management component SWC_SM, and health management component SWC_PHM, which implement redundant startup and shutdown, can also experience abnormal exits or "stuck" or "stuck" (process tasks not exiting) due to platform communication anomalies. Therefore, to improve the operational safety of the controller, this embodiment also handles abnormalities in functional components at each level to enhance system reliability.

[0072] Specifically, to ensure the safe operation of the process management component SWC_EM, if the process management component exits abnormally, the guardian component will restart the process management component in milliseconds, ensuring that the process management component is always online. If the process management component is restarted, the state management component SWC_SM, the health management component SWC_PHM, and other monitored controller applications will be shut down and restarted. To address situations where the process management component is "stuck" or "stuck" due to system resource conditions, the health management component is used to monitor the process management component. If the process management component is abnormal or fails to operate normally after multiple restarts in a short period of time, a signal is sent to the watchdog software to restart the controller system.

[0073] A health management component is also used to monitor the guardian component and obtain the resource status of the controller system running the process management component. When the guardian component is abnormal and / or the controller system is determined to be abnormal based on the resource status (such as the CPU is 100% for a long time, the disk, IO and other indicators are abnormal), a signal is sent to the watchdog software to restart the controller system.

[0074] To ensure the safe operation of the state management component SWC_SM, as shown in Figure 2, when the process management component detects an abnormal exit of the state management component, it saves the current state of each controller application monitored by the state management component. After the state management component restarts, it sends the current state of each controller application to the state management component to resume monitoring of the controller application. This avoids the need to exit and restart the monitored controller application due to the state management component's own restart. The state management component also notifies the health management component of its own status. To prevent the state management component from becoming "stuck" or "stuck," the state management component periodically sends process activity messages (including "heartbeat" and health information) about its own process to the health management component. If the health management component detects an abnormal heartbeat packet from the state management component and determines that the state management component is in a "stuck" or "stuck" state based on the logic and health information configured in the SOA toolchain, it generates a start / stop message and sends it to the process management component, prompting the process management component to restart the state management component.

[0075] In order to ensure the safe operation of the health management component, as shown in Figure 3, when the process management component monitors that the health management component has exited abnormally, the process management component immediately restarts the health management component and saves the current status of each controller application monitored by the health management component. After the health management component is started, the current status of each controller application is sent to the health management component to restore the health management component's monitoring of the controller application, avoiding the need to exit and then restart the monitored controller application due to the restart of the health management component itself.

[0076] In one example, when the health management component and the process management component are abnormal, the controller system is restarted by calling the hardware "watchdog" of the controller hardware and the software "open dog" of the controller system.

[0077] To sum up, this embodiment does not require restarting the controller system when the controller application is abnormal or exits. Instead, it solves various working conditions (normal exit, abnormal exit, stuck, OTA upgrade, etc.) one by one through functional groups and hierarchical methods. Combined with SOA service, it can quickly iterate and support the deployment and operation of various embedded controllers in the whole vehicle, such as only one single-chip MCU plus one SOC domain controller, and the deployment and operation of multiple single-chip MCUs plus multiple SOC domain controllers. If the abnormality of the whole vehicle is across chips and domain controllers, it can also be solved by dividing the chips and domain controllers.

[0078] Based on the vehicle controller safety redundant start-stop system, this application also provides a vehicle controller safety redundant start-stop method. First, the first-level functional component, the second-level functional component, and the third-level functional component are pre-built. Then, the first-level functional component is started as a daemon process. After the first-level functional component is started, the second-level functional component is started and monitored. After the second-level functional component is started, the third-level functional component and each controller application are started and monitored. The third-level functional component is used to receive process activity information or application exit messages from each controller application.

[0079] When the first-level functional component monitors that the second-level functional component has finished running, the first-level functional component is used to restart the second-level functional component;

[0080] When the second-level functional component monitors that the third-level functional component has finished running, the second-level functional component is used to restart the third-level functional component; when the second-level functional component monitors that the controller application has finished running, an application exit message is generated according to the controller application that has finished running, and the application exit message is sent to the third-level functional component; when the second-level functional component receives a start / stop message sent by the third-level functional component, the second-level functional component is used to restart the controller application in the start / stop message;

[0081] When the third-level functional component determines that the controller application is abnormal based on the process activity information, it generates a start-stop message based on the abnormal controller application or generates a start-stop message based on the application exit message, and sends the start-stop message to the second-level functional component.

[0082] In this embodiment, the first-level functional component is the guard component SWC_RUN, and the second-level functional component is the process management component SWC_EM. The third-level functional components are the state management component SWC_SM and the health management component SWC_PHM. Application components with redundant mechanisms that meet functional safety requirements are pre-developed. These components include SWC_watchdog, SWC_RUN, SWC_EM, SWC_SM, SWC_PHM, etc. SWC_watchdog is a functional service component that starts, stops, and restarts the vehicle's embedded control chip hardware platforms and platform systems. It is also known as a hardware "watchdog" or software "doorkeeper."

[0083] The state management component receives application exit messages from the second-tier functional components, and the health management component receives process activity information from each controller application and the state management component itself. If the state management component is determined to be abnormal based on the process activity information of the state management component process, the health management component generates a start / stop message and sends it to the second-tier functional component to restart the state management component. If the state management component is determined to be abnormal based on the process activity information of the controller application, the health management component generates a start / stop message and sends it to the second-tier functional component to restart the controller application.

[0084] Specifically, in this embodiment, the specific functions of the above-mentioned vehicle controller safety redundant start-stop method can refer to the corresponding description in the above-mentioned vehicle controller safety redundant start-stop system, and will not be repeated here.

[0085] Based on the above embodiment, the present application also provides a smart car. As shown in Figure 4, the above smart car includes a processor and a memory connected via a system bus. The processor of the smart car is used to provide computing and control capabilities. The memory of the smart car includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a vehicle controller safety redundancy start-stop program. The internal memory provides an environment for the operation of the operating system and the vehicle controller safety redundancy start-stop program in the non-volatile storage medium. When the vehicle controller safety redundancy start-stop program is executed by the processor, the steps of any of the above-mentioned vehicle controller safety redundancy start-stop methods are implemented.

[0086] An embodiment of the present application also provides a chip, for example: an SOC chip, on which a vehicle controller safety redundancy start-stop program is stored. When the vehicle controller safety redundancy start-stop program is executed by a processor, the steps of any one of the vehicle controller safety redundancy start-stop methods provided in an embodiment of the present application are implemented.

[0087] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0088] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0089] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing a custom logical function or process step, and the scope of optional embodiments of the present application includes additional implementations in which functions may be performed in a sequence other than as shown or discussed, including in a substantially simultaneous manner or in a reverse order depending on the functions involved, which should be understood by a person skilled in the art to which the embodiments of the present application pertain.

[0090] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program can be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing it in other suitable ways as necessary, and then storing it in a computer memory.

[0091] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0092] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0093] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0094] The above embodiments are only preferred embodiments for fully illustrating the present application, and the protection scope of the present application is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art based on the present application are within the protection scope of the present application.

Claims

1. Vehicle-mounted controller safety redundant start-stop system, characterized in that, The system includes: a daemon component, a process management component, a status management component, and a health management component; The daemon component is used to start and monitor the process management component, and when the process management component ends its operation, restart the process management component; The process management component is used to start and monitor the status management component, the health management component, and each controller application. When any one of the status management component and the health management component ends its operation, restart the component that has ended its operation; when a controller application ends its operation, generate an application exit message according to the controller application that has ended its operation, and send the application exit message to the status management component; it also responds to the received start / stop message and restarts the controller application and / or the status management component in the start / stop message; The health management component is used to receive the process activity information of the status management component and each controller application. When it is determined according to the process activity information that any one of the status management component and the controller application is abnormal, generate the start / stop message according to the abnormal object, and send the start / stop message to the process management component; The status management component is used to generate the start / stop message according to the application exit message received from the process management component, and send the start / stop message to the process management component; it also regularly sends the process activity information of its own process to the health management component.

2. The vehicle-mounted controller safety redundant start-stop system according to claim 1, wherein The health management component also monitors the daemon component and obtains the resource status of the controller system. When the daemon component is abnormal and / or it is determined that the controller system is abnormal according to the resource status, send a signal to the watchdog software to restart the controller system.

3. The vehicle-mounted controller safety redundancy start-stop system according to claim 1, wherein When the process management component receives the start / stop message sent by the status management component, restart the controller application in the start / stop message; when the process management component receives the start / stop message sent by the health management component, restart the controller application and / or the status management component in the start / stop message.

4. The vehicle-mounted controller safety redundancy start-stop system according to claim 1, characterized in that, The status management component includes a counting unit. The counting unit is used to, when the status management component is restarted by the process management component, accumulate the restart times when it is determined according to the start parameters of the status management component that the status management component is restarted after an abnormal exit. When the restart times exceed a preset threshold, send a signal to the watchdog software to restart the controller system.

5. The vehicle-mounted controller safety redundant start-stop system according to claim 1, characterized in that, The process management component includes a monitoring and recovery unit. The monitoring and recovery unit is used to, when restarting any one of the health management component and the status management component, send the current status of each controller application monitored by the restarted component to the restarted component to restore the monitoring of the controller application by the restarted component.

6. The in-vehicle controller safety redundant start-stop system according to claim 1, characterized in that, The process management component includes a tool chain unit. The tool chain unit is used to, when starting a controller application, read the SOA tool chain configuration, obtain the start logic information, and start the controller application according to the start logic information.

7. The in-vehicle controller safety redundant start-stop system according to claim 1, characterized in that, Both the state management component and the health management component include a tool chain unit, which is used to read the SOA tool chain configuration, obtain the operation logic information, and generate the start / stop message according to the controller application that has ended operation or is abnormal and the operation logic information.

8. The vehicle-mounted controller safety redundant start-stop system according to claim 7, characterized in that, The state management component and the health management component further include an application combination unit, which is used to obtain the combination of controller applications according to the controller application that has ended operation or is abnormal and the operation logic information, and generate the start / stop message according to the combination.

9. The method for safe redundant start and stop of a vehicle-mounted controller, characterized in that, Comprising: Pre-construct a first-level function component, a second-level function component, and a third-level function component. The first-level function component is used to start and monitor the second-level function component. The second-level function component is used to start and monitor the third-level function component and each controller application. The third-level function component is used to receive the process activity information or application exit message of each controller application. Start the first-level function component in the form of a daemon process. When the first-level function component monitors that the second-level function component has ended operation, use the first-level function component to restart the second-level function component. When the second-level function component monitors that the third-level function component has ended operation, use the second-level function component to restart the third-level function component. When the second-level function component monitors that the controller application has ended operation, generate an application exit message according to the ended controller application, and send the application exit message to the third-level function component. When the second-level function component receives the start / stop message sent by the third-level function component, use the second-level function component to restart the controller application in the start / stop message. When the third-level function component determines that the controller application is abnormal according to the process activity information, generate the start / stop message according to the abnormal controller application or generate the start / stop message according to the application exit message, and send the start / stop message to the second-level function component.

10. The on-vehicle controller safety redundancy start-stop method according to claim 9, characterized in that, The third-level function component includes a state management component and a health management component. The state management component is used to receive the application exit message sent by the second-level function component. The health management component is used to receive the process activity information of each controller application.

11. The vehicle-mounted controller safety redundancy start-stop method according to claim 10, wherein, The health management component also receives the process activity information of the state management component. When it determines that the state management component is abnormal according to the process activity information of the state management component, it generates the start / stop message and sends it to the second-level function component.

12. Chip, characterized in that, The vehicle-mounted controller security redundancy start / stop program is stored on the chip. When the vehicle-mounted controller security redundancy start / stop program is executed by a processor, the steps of the vehicle-mounted controller security redundancy start / stop method according to any one of claims 9-11 are implemented.

13. An intelligent vehicle, characterized in that, The intelligent vehicle includes a memory, a processor, and an in-vehicle controller safety redundant start-stop program stored on the memory and executable on the processor. When the in-vehicle controller safety redundant start-stop program is executed by the processor, it implements the steps of the in-vehicle controller safety redundant start-stop method according to any one of claims 9-11.

Images