Vehicle interface device and vehicle

Abstract

A vehicle interface device (100), suitable for being connected between an autonomous driving system platform (200) and a vehicle platform (300), and comprising: a substrate (10); first and second vehicle interface modules (11, 12), which are independently arranged on the substrate (10), wherein each of the vehicle interface modules (11, 12) comprises a main control unit (110, 120) and a power supply unit (111, 122), a hard-wired signal transmission unit (115, 125) and an external transceiver unit (116, 126) which are connected to the corresponding main control unit (110, 120), the main control unit (110) of the first vehicle interface module communicates with the main control unit (120) of the second vehicle interface module, signal pins of the hard-wired signal transmission unit (115) of the first vehicle interface module (11) is electrically connected to corresponding signal pins of the hard-wired signal transmission unit (125) of the second vehicle interface module (12), and the external transceiver units (116, 126) are connected to the autonomous driving system platform (200) and the vehicle platform (300); and an Ethernet switch unit (13) connected between the main control unit (110) of the first vehicle interface module (11) and the main control unit (120) of the second vehicle interface module (12), and connected to the autonomous driving system platform (200) and the vehicle platform (300). The vehicle interface device (100) can ensure the security and reliability of a system. Further provided is a vehicle.

Description

Vehicle interface device and vehicle

[0001] This application claims priority to Chinese Patent Application No. 202411535237.X, filed on October 30, 2024, entitled "Vehicle Interface Device and Vehicle", the entire contents of which are incorporated herein by reference. Technical Field

[0002] The embodiments of this disclosure generally relate to the field of autonomous vehicles, and more specifically, to a vehicle interface device and a vehicle including the vehicle interface device. Background Technology

[0003] In Level 3 and above autonomous vehicle applications, ensuring system safety and reliability is paramount. One conventional approach uses two controllers to achieve hardware or functional redundancy. However, using two controllers results in low integration, large space requirements, and high costs when deployed in the vehicle. Another conventional approach implements partial redundancy within a single controller, degrading operation in case of main control system failure, using a lower-performance control chip to monitor system operation. In this case, system anomalies only result in functional degradation, preventing the continuation of dynamic autonomous driving tasks. Summary of the Invention

[0004] The purpose of this disclosure is to provide a vehicle interface device and a vehicle including the vehicle interface device to at least partially solve the above-mentioned problems and other potential problems.

[0005] In a first aspect of this disclosure, a vehicle interface device is provided, suitable for connection between an autonomous driving system platform and a vehicle platform. The vehicle interface device includes: a base plate; a first vehicle interface module and a second vehicle interface module, independently arranged on the base plate, wherein each vehicle interface module includes a main control unit and a power supply unit, a hard-wired signal transmission unit, and an external transceiver unit connected to the corresponding main control unit; the main control unit of the first vehicle interface module communicates with the main control unit of the second vehicle interface module; signal pins of the hard-wired signal transmission unit of the first vehicle interface module are electrically connected to corresponding signal pins of the hard-wired signal transmission unit of the second vehicle interface module; the external transceiver unit is connected to the autonomous driving system platform and the vehicle platform; and an Ethernet switch unit is connected between the main control units of the first and second vehicle interface modules and connected to the autonomous driving system platform and the vehicle platform.

[0006] In some embodiments, when the first vehicle interface module is functioning normally, the external transceiver unit of the first vehicle interface module receives and transmits external communication data, and the main control unit of the first vehicle interface module receives and transmits external communication data via an Ethernet switch unit. The external transceiver unit of the second vehicle interface module receives external communication data but does not transmit it, and the main control unit of the second vehicle interface module receives and transmits external communication data via an Ethernet switch unit. Furthermore, when the first vehicle interface module is malfunctioning and the second vehicle interface module is functioning normally, the external transceiver unit of the second vehicle interface module receives and transmits external communication data, and the main control unit of the second vehicle interface module receives and transmits external communication data via an Ethernet switch unit. The external transceiver unit of the first vehicle interface module receives and transmits external communication data, and the main control unit of the first vehicle interface module receives and transmits external communication data via an Ethernet switch unit.

[0007] In some embodiments, the power supply unit includes: a reverse connection protection circuit, the input of which is connected to a corresponding power supply, the reverse connection protection circuit being turned on when the power supply polarity is correct and turned off when the power supply polarity is reversed; and a power management integrated circuit, the input of which is connected to the reverse connection protection circuit and the output of which is connected to a corresponding main control unit.

[0008] In some embodiments, the reverse connection protection circuit in the first vehicle interface module is connected to the first dual power supply, and the reverse connection protection circuit in the second vehicle interface module is connected to the second dual power supply, which is independent of the first dual power supply.

[0009] In some embodiments, the hardwired signal transmission unit includes an input pin and an output pin. The input pin of the hardwired signal transmission unit in the first vehicle interface module is electrically connected to the input pin of the hardwired signal transmission unit in the second vehicle interface module, and the output pin of the hardwired signal transmission unit in the first vehicle interface module is electrically connected to the output pin of the hardwired signal transmission unit in the second vehicle interface module.

[0010] In some embodiments, anti-backlash circuits are provided at the output pins of the hard-wired signal transmission units in the first vehicle interface module and the second vehicle interface module. The anti-backlash circuits are configured to prevent the output signal of one hard-wired signal transmission unit from being fed back into the other hard-wired signal transmission unit.

[0011] In some embodiments, the output pins include functional safety-related pins and non-functional safety-related pins. When the first vehicle interface module is functioning normally, the input pins of the hard-wired signal transmission units in both the first and second vehicle interface modules receive input signals, the functional safety-related pins of the hard-wired signal transmission units in both modules output functional safety control signals, the non-functional safety-related pins of the hard-wired signal transmission units in the first and second vehicle interface modules output signals, and the non-functional safety-related pins of the hard-wired signal transmission units in the second vehicle interface module do not output signals. Conversely, when the first vehicle interface module is malfunctioning and the second vehicle interface module is functioning normally, the input pins of the hard-wired signal transmission units in both modules receive input signals, the functional safety-related pins of the hard-wired signal transmission units in both modules output functional safety control signals, the non-functional safety-related pins of the hard-wired signal transmission units in the second vehicle interface module output signals, and the non-functional safety-related pins of the hard-wired signal transmission units in the first vehicle interface module do not output signals.

[0012] In some embodiments, functional safety-related pins include analog KL15 signal output pins, and non-functional safety-related pins include at least one of PWM output pins and LED indicator pins.

[0013] In some embodiments, each vehicle interface module further includes an A / D input unit connected to the main control unit to transmit A / D sampled data to the main control unit.

[0014] In some embodiments, each vehicle interface module further includes an inter-module transceiver, wherein the inter-module transceiver of the first vehicle interface module is connected to the inter-module transceiver of the second vehicle interface module to exchange data between the main control unit of the first vehicle interface module and the main control unit of the second vehicle interface module.

[0015] In some embodiments, the master control unit of the first vehicle interface module is also connected to the master control unit of the second vehicle interface module via an inter-module communication line. The master control units of the first and second vehicle interface modules are configured to monitor each other's heartbeat signals via the inter-module communication line. The heartbeat signals reflect whether the corresponding vehicle interface modules are normal, and the second vehicle interface module takes over the interface function of the vehicle interface device when it detects that the first vehicle interface module is abnormal or receives a takeover request from the master control unit of the first vehicle interface module.

[0016] In some embodiments, when the interface function of the vehicle interface device is transferred from the first vehicle interface module to the second vehicle interface module, the master control unit of the first vehicle interface module sends the check value in the message transmitted by its external transceiver unit to the master control unit of the second vehicle interface module.

[0017] In a second aspect of this disclosure, a vehicle is provided, comprising: an autonomous driving system platform; a vehicle platform; and a vehicle interface device of the first aspect of this disclosure, connected between the autonomous driving system platform and the vehicle platform.

[0018] It should be understood that the content described in this section is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0019] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0020] Figure 1 shows a schematic diagram of an example environment in which embodiments of the present disclosure can be implemented;

[0021] Figure 2 shows a circuit diagram of a vehicle interface device according to some embodiments of the present disclosure.

[0022] Explanation of reference numerals in the attached drawings: 100 Vehicle interface device; 200 Autonomous driving system platform; 300 Vehicle platform; 10 Baseboard; 11 First vehicle interface module; 12 Second vehicle interface module; 13 Ethernet switch unit; 110, 120 Main control unit; 111, 121 Power supply unit; 1111, 1211 Reverse connection protection circuit; 1112, 1212 Power management integrated circuit; 1120, 1220 Inter-module communication line; 1121, 1221 Inter-module transceiver; 113, 123 Storage unit; 114, 124 Encryption unit; 115, 125 Hard-wired signal transmission unit; 1151, 1251 PWM output unit; 1152, 1252 I / O unit; 1153, 1253 HSD output unit; 1154, 1254 Anti-recoil circuit; 116, 126 External transceiver units; 117, 127 A / D input units. Detailed Implementation

[0023] Preferred embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0024] The term "comprising" and its variations as used herein signify open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "at least partially based on". The terms "one example embodiment" and "one embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc., may refer to different or the same objects.

[0025] As briefly mentioned above, in autonomous vehicles, using two hardware components for redundancy results in low integration, large space requirements, and high costs. On the other hand, implementing partial redundancy in a single controller can only achieve degraded operation and cannot continue to perform dynamic driving tasks for autonomous driving.

[0026] The embodiments of this disclosure propose a redundancy scheme for vehicle interface devices in autonomous vehicles. In this scheme, two sets of identical hardware resources are arranged on the same PCB board, improving integration. The two sets of hardware resources are redundant to each other, achieving redundancy of all hardware and communication functions. Even if one system malfunctions, it will not trigger functional degradation.

[0027] Figure 1 illustrates a schematic diagram of an example environment in which embodiments of the present disclosure can be implemented. In this example environment, a vehicle is shown including a vehicle interface device 100, an autonomous driving system platform 200, and a vehicle platform 300, with the vehicle interface device 100 connected between the autonomous driving system platform 200 and the vehicle platform 300. The vehicle described herein can be a vehicle with an engine, an electric vehicle, or a hybrid vehicle. Embodiments of the present disclosure do not limit the type of vehicle.

[0028] The autonomous driving system platform 200 is a device that senses the vehicle's surrounding environment, generates a driving plan based on the sensing results, and issues commands to the vehicle platform 300 via the vehicle interface device 100 according to the plan. The autonomous driving system platform 200 may be developed by a different manufacturer or supplier than the manufacturer or supplier of the vehicle platform 300. The autonomous driving system platform 200 may include an autonomous driving electronic control unit (ECU) and the necessary sensor set.

[0029] The vehicle platform 300 may include a vehicle control ECU, a braking system, a steering system, a steering angle sensor, and a vehicle speed sensor. It should be understood that the vehicle platform 300 may also include any other suitable components, and the embodiments disclosed herein are not limiting in this regard.

[0030] The vehicle interface device 100 is connected between the autonomous driving system platform 200 and the vehicle platform 300, enabling communication and function control between the autonomous driving system platform 200 and the vehicle platform 300. An example structure of the vehicle interface device 100 will now be described with reference to Figure 2.

[0031] As shown in Figure 1, the vehicle interface device 100 described herein generally includes a base plate 10, a first vehicle interface module 11, a second vehicle interface module 12, and an Ethernet switch unit 13.

[0032] The substrate 10 may be a printed circuit board (PCB) or any other suitable type of substrate for carrying other components of the vehicle interface device 100. In some embodiments, the vehicle interface device 100 may also include a housing for encapsulating the substrate 10 and the components it carries.

[0033] As shown in Figure 2, the first vehicle interface module 11 and the second vehicle interface module 12 are independently arranged on the base plate 10. The first vehicle interface module 11 and the second vehicle interface module 12 are independent hardware systems and can have essentially the same hardware resources. The two vehicle interface modules are redundant, achieving redundancy in all hardware and communication functions. The first vehicle interface module 11 can also be referred to as vehicle interface module VIM_A in this document, and the second vehicle interface module 12 can also be referred to as vehicle interface module VIM_B.

[0034] As shown in Figure 2, the first vehicle interface module 11 may include a main control unit 110 and a power supply unit 111, a hardwired signal transmission unit 115, and an external transceiver unit 116 connected to the main control unit 110. The second vehicle interface module 12 may include a main control unit 120 and a power supply unit 121, a hardwired signal transmission unit 125, and an external transceiver unit 126 connected to the main control unit 120. The main control unit 110 of the first vehicle interface module 11 communicates with the main control unit 120 of the second vehicle interface module 12. The main control units 110 and 120 may be microcontroller units (MCUs) or any other suitable type of processing unit. The signal pins of the hardwired signal transmission unit 115 of the first vehicle interface module 11 are electrically connected to the corresponding signal pins of the hardwired signal transmission unit 125 of the second vehicle interface module 12, which will be described in detail below. The hardwired signal transmission units 115 and 125 are responsible for the input and output of hardwired signals. The external transceiver units 116 and 126 are connected to the autonomous driving system platform 200 and the vehicle platform 300. External transceiver units 116 and 126 are responsible for sending and receiving messages. As an example, external transceiver units 116 and 126 may include multiple CAN FD transceivers responsible for sending and receiving CAN messages. CAN FD is an extension of the CAN bus protocol, providing higher data transmission rates and larger data frame lengths compared to the traditional CAN bus.

[0035] As shown in Figure 2, the Ethernet switch unit 13 is connected between the main control unit 110 of the first vehicle interface module 11 and the main control unit 120 of the second vehicle interface module 12, and is also connected to the autonomous driving system platform 200 and the vehicle platform 300. The Ethernet switch unit 13 can be responsible for transmitting signals that are not related to vehicle safety, such as window control signals and air conditioning control signals.

[0036] In some embodiments, as shown in FIG2, the power supply unit 111 includes a reverse connection protection circuit 1111 and a power management integrated circuit (PMIC) 1112. The input of the reverse connection protection circuit 1111 can be connected to a corresponding power supply. The output of the reverse connection protection circuit 1111 is connected to the input of the power management integrated circuit 1112. The reverse connection protection circuit 1111 conducts when the power supply polarity is correct and disconnects when the power supply polarity is reversed, to prevent damage to components in the first vehicle interface module 11 when the power supply polarity is reversed. The reverse connection protection circuit 1111 can include any suitable transistor, such as a diode, MOSFET, etc. The input of the power management integrated circuit 1112 is connected to the output of the reverse connection protection circuit 1111, and the output of the power management integrated circuit 1112 is connected to the main control unit 110. The power management integrated circuit 1112 provides power management functions for the first vehicle interface module 11, converting the received power into the required voltage and current levels and providing it to the main control unit 110.

[0037] In one embodiment, as shown in Figure 2, the input terminal of the reverse connection protection circuit 1111 can be connected to a first dual power supply (not shown) via two sets of power supply pins KL30 and KL31. The first dual power supply includes two different power supplies, each of which includes a positive terminal and ground. With this arrangement, when a power supply circuit has a fault such as an open circuit or a short circuit, the power input of the first vehicle interface module 11 can still be guaranteed.

[0038] In some embodiments, as shown in FIG2, the power supply unit 121 includes a reverse connection protection circuit 1211 and a power management integrated circuit (PMIC) 1212. The input of the reverse connection protection circuit 1211 can be connected to a corresponding power supply. The output of the reverse connection protection circuit 1211 is connected to the input of the power management integrated circuit 1212. The reverse connection protection circuit 1211 conducts when the power supply polarity is correct and disconnects when the power supply polarity is reversed, to prevent damage to components in the second vehicle interface module 12 when the power supply polarity is reversed. The reverse connection protection circuit 1211 may include any suitable transistor, such as a diode, MOSFET, etc. The input of the power management integrated circuit 1212 is connected to the output of the reverse connection protection circuit 1211, and the output of the power management integrated circuit 1212 is connected to the main control unit 120. The power management integrated circuit 1212 provides power management functions for the second vehicle interface module 12, converting received power into the required voltage and current levels and providing it to the main control unit 120.

[0039] In one embodiment, as shown in Figure 2, the input terminal of the reverse connection protection circuit 1211 is also connected to a second dual power supply (not shown) via two sets of power supply pins KL30 and KL31. The second dual power supply includes two different power supplies, each including a positive terminal and ground. The second dual power supply is independent of the first dual power supply. With this arrangement, even if one power supply circuit has an open circuit, short circuit, or other fault, the power input to the second vehicle interface module 12 can still be guaranteed. Furthermore, the independence of the second dual power supply from the first dual power supply ensures that the power supply to the first vehicle interface module 11 and the second vehicle interface module 12 will not affect each other; if the power supply to one vehicle interface module fails, the other vehicle interface module can still be powered normally.

[0040] As mentioned above, the signal pins of the hard-wired signal transmission unit 115 of the first vehicle interface module 11 are electrically connected to the corresponding signal pins of the hard-wired signal transmission unit 125 of the second vehicle interface module 12. This will be described in detail below with reference to Figure 2.

[0041] In some embodiments, as shown in FIG2, the signal pins of each of the hardwired signal transmission units 115 and 125 include input pins and output pins. As an example, the input pins may include button signal pins Button1 and Button2, and a KL15 signal input pin KL15 IN; the output pins may include pulse width modulation (PWM) output pins PWM OUT1, PWM OUT2, and PWM OUT3, LED indicator pins LED OUT, LED OUT2, and LED OUT3, and an analog KL15 signal output pin KL15OUT. The input pins of the hardwired signal transmission unit 115 are electrically connected to the input pins of the hardwired signal transmission unit 125 via traces on the substrate 10. The output pins of the hardwired signal transmission unit 115 are electrically connected to the output pins of the hardwired signal transmission unit 125 via traces on the substrate 10. For example, the button signal pin Button1 of the hardwired signal transmission unit 115 is connected to the button signal pin Button1 of the hardwired signal transmission unit 125. The button signal pin Button2 of the hard-wired signal transmission unit 115 is connected to the button signal pin Button2 of the hard-wired signal transmission unit 125. The KL15 signal input pin KL15 IN of the hard-wired signal transmission unit 115 is connected to the KL15 signal input pin KL15 IN of the hard-wired signal transmission unit 125. The PWM output pins PWM OUT1, PWM OUT2, and PWM OUT3 of the hard-wired signal transmission unit 115 are connected to the PWM output pins PWM OUT1, PWM OUT2, and PWM OUT3 of the hard-wired signal transmission unit 125, respectively. The indicator light pins LED OUT, LED OUT2, and LED OUT3 of the hard-wired signal transmission unit 115 are connected to the indicator light pins LED OUT, LED OUT2, and LED OUT3 of the hard-wired signal transmission unit 125, respectively. The analog KL15 signal output pin KL15 OUT of the hard-wired signal transmission unit 115 is connected to the analog KL15 signal output pin KL15 OUT of the hard-wired signal transmission unit 125.

[0042] In some embodiments, each output pin in the hard-wired signal transmission units 115 and 125 includes functional safety-related pins and non-functional safety-related pins. Functional safety-related pins are used to output signals related to the vehicle's functional safety. For example, functional safety-related pins include output pin KL15 OUT, used to output an analog KL15 signal, which needs to meet the functional safety requirement of "avoiding unexpected power-off of the autonomous driving system." Non-functional safety-related pins are used to output signals unrelated to the vehicle's functional safety. Non-functional safety-related pins include, for example, indicator light pins LED OUT, LED OUT2, and LED OUT3, used to output indicator light control signals. Non-functional safety-related pins may also include PWM output pins PWM OUT1, PWM OUT2, and PWM OUT3.

[0043] In some embodiments, as shown in FIG2, an anti-backlash circuit 1154 is provided at the output pin of the hard-wired signal transmission unit 115. An anti-backlash circuit 1254 is provided at the output pin of the hard-wired signal transmission unit 125. The anti-backlash circuit 1154 is configured to prevent the output signal of the hard-wired signal transmission unit 125 from flowing back into the hard-wired signal transmission unit 115. The anti-backlash circuit 1254 is configured to prevent the output signal of the hard-wired signal transmission unit 115 from flowing back into the hard-wired signal transmission unit 125. In one embodiment, each of the anti-backlash circuits 1154 and 1254 may include a diode, which allows unidirectional signal transmission, thereby preventing signal backflow.

[0044] In some embodiments, as shown in FIG2, the hard-wired signal transmission unit 115 includes a PWM output unit 1151, and the hard-wired signal transmission unit 125 includes a PWM output unit 1251. The output pins PWM OUT1, PWM OUT2, and PWM OUT3 of the PWM output unit 1151 are electrically connected to the output pins PWM OUT1, PWM OUT2, and PWM OUT3 of the PWM output unit 1251 via traces on the substrate 10, respectively. Diodes are respectively provided at the output pins PWM OUT1, PWM OUT2, and PWM OUT3 of the PWM output unit 1151 as anti-backlash circuits 1154 as described above. Diodes are also provided at the output pins PWM OUT1, PWM OUT2, and PWM OUT3 of the PWM output unit 1152 as anti-backlash circuits 1254 as described above.

[0045] In some embodiments, as shown in FIG2, the hard-wired signal transmission unit 115 further includes an input / output (I / O) unit 1152, and the hard-wired signal transmission unit 125 further includes an I / O unit 1252. The input pins Button1, Button2, and KL15 IN of the I / O unit 1152 are electrically connected to the input pins Button1, Button2, and KL15 IN of the I / O unit 1252 via traces on the substrate 10, respectively. The output pin LED OUT of the I / O unit 1152 is electrically connected to the output pin LED OUT of the I / O unit 1252 via traces on the substrate 10. An anti-backlash circuit 1154 is provided at the output pin LED OUT of the I / O unit 1152. An anti-backlash circuit 1254 is provided at the output pin LED OUT of the I / O unit 1252.

[0046] In some embodiments, as shown in FIG2, the hard-wired signal transmission unit 115 further includes a high-side drive (HSD) output unit 1153, and the hard-wired signal transmission unit 125 further includes a high-side drive output unit 1253. The output pins LED OUT2, LED OUT3, and KL15 OUT of the high-side drive output unit 1153 are electrically connected to the output pins LED OUT2, LED OUT3, and KL15 OUT of the high-side drive output unit 1253 via traces on the substrate 10. Diodes are provided at the output pins LED OUT2, LED OUT3, and KL15 OUT of the high-side drive output unit 1153 as an anti-recoil circuit 1154 as described above. Diodes are also provided at the output pins LED OUT2, LED OUT3, and KL15 OUT of the high-side drive output unit 1253 as an anti-recoil circuit 1254 as described above. The output pins of both the high-side drive output units 1153 and 1253 include functional safety-related pins and non-functional safety-related pins.

[0047] In some embodiments, as shown in FIG2, the first vehicle interface module 11 further includes an A / D input unit 117, and the second vehicle interface module 12 further includes an analog-to-digital (A / D) input unit 127. The A / D input unit 117 is connected to the main control unit 110 to transmit A / D sampled data to the main control unit 110. The A / D input unit 127 is connected to the main control unit 120 to transmit A / D sampled data to the main control unit 120.

[0048] In some embodiments, as shown in FIG2, the first vehicle interface module 11 further includes an inter-module transceiver 1121, and the second vehicle interface module 12 further includes an inter-module transceiver 1221. The inter-module transceiver 1121 is connected to the inter-module transceiver 1221 to exchange data between the master control unit 110 of the first vehicle interface module 11 and the master control unit 120 of the second vehicle interface module 12. The inter-module transceivers 1121 and 1221 may include CAN FD transceivers.

[0049] In some embodiments, as shown in FIG2, the main control unit 110 of the first vehicle interface module 11 is also connected to the main control unit 120 of the second vehicle interface module 12 via an inter-module communication line 1120. The main control unit 110 of the first vehicle interface module 11 and the main control unit 120 of the second vehicle interface module 12 are configured to monitor each other's heartbeat signals via the inter-module communication line 1120. The heartbeat signals reflect whether the corresponding vehicle interface modules are functioning correctly. As an example, the inter-module communication line 1120 may be connected to the general purpose input / output (GPIO) interfaces of the main control units 110 and 120.

[0050] In some embodiments, the first vehicle interface module 11 further includes a storage unit 113, and the second vehicle interface module 12 further includes a storage unit 123. Storage units 113 and 123 may include volatile memory (e.g., registers, cache, random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. As an example, as shown in FIG2, storage units 113 and 123 may include low-power double data rate 4 (LPDDR4), an embedded multimedia card (eMMC), NOR flash memory, and EEPROM.

[0051] In one embodiment, as shown in FIG2, the first vehicle interface module 11 further includes an encryption unit 114, and the second vehicle interface module 12 further includes an encryption unit 124. The encryption unit 124 is responsible for protecting data security, strengthening key management, and improving system security.

[0052] Since both the first vehicle interface module 11 and the second vehicle interface module 12 have independent main control units, storage units, and peripheral hardware, their operation can be guaranteed to be independent. The two interface modules can achieve heartbeat monitoring, interrupt triggering, and data exchange through GPIO interfaces, Ethernet interfaces, CAN interfaces, etc.

[0053] When the vehicle interface device 100 is working, the first vehicle interface module 11 and the second vehicle interface module 12 operate simultaneously. The first vehicle interface module 11 acts as the main module, receiving external input and outputting the calculation results. The second vehicle interface module 12 acts as a redundant module, receiving external input but essentially not outputting anything. Next, an example switching logic for the external communication interface of the vehicle interface device 100 will be described.

[0054] When both modules are functioning normally, the external transceiver unit 116 and Ethernet interface of the first vehicle interface module 11 receive external communication data and transmit communication data outwards. The external transceiver unit 126 and Ethernet interface of the second vehicle interface module 12 only receive external communication data and control the transceiver and other components not to transmit data outwards. When the second vehicle interface module 12 malfunctions, the communication logic is unaffected and remains the same as when both modules are functioning normally. When the first vehicle interface module 11 malfunctions, it only receives external communication data and does not transmit data outwards. The second vehicle interface module 12 receives external communication data, enables the transceiver's transmission function, and transmits data outwards. Simultaneously, it copies the checksum value from the monitored communication packets to its internal memory to ensure that the signal verification is normal.

[0055] When a hard-wired signal is input via hard-wired signal transmission units 115 and 125, both modules can receive the signal input simultaneously, regardless of whether they are both operating normally.

[0056] When both modules are functioning normally, or when the first vehicle interface module 11 is functioning normally and the second vehicle interface module 12 is malfunctioning, only the non-functional safety-related pins of the first vehicle interface module 11 output to the outside, while the non-functional safety-related pins of the second vehicle interface module 12 do not output to the outside. When the first vehicle interface module 11 malfunctions and the second vehicle interface module 12 is functioning normally, the first vehicle interface module 11 will actively or passively disconnect the corresponding non-functional safety-related pins from output, and then the second vehicle interface module 12 will enable the corresponding non-functional safety-related pins to output to the outside. During the switching between the first vehicle interface module 11 and the second vehicle interface module 12, there will be a short period of disconnection (e.g., milliseconds), but this will not affect the safety of the autonomous driving system.

[0057] When both modules are operating normally, the corresponding functional safety-related pins of both modules will output external signals. If either module malfunctions, the malfunctioning module will cut off its I / O output, but this will not cause the functional safety-related pins to disconnect. Therefore, the external controller receiving this signal will not experience unexpected power-down due to a fault switch within the vehicle interface module.

[0058] In some embodiments, when the first vehicle interface module 11 is functioning normally, the external transceiver unit 116 of the first vehicle interface module 11 receives external communication data and transmits communication data to the outside, the main control unit 110 of the first vehicle interface module 11 receives external communication data and transmits communication data to the outside via the Ethernet switch unit 13, the external transceiver unit 126 of the second vehicle interface module 12 receives external communication data but does not transmit communication data to the outside, and the main control unit 120 of the second vehicle interface module 12 receives external communication data but does not transmit communication data to the outside via the Ethernet switch unit 13.

[0059] In some embodiments, when the first vehicle interface module 11 is malfunctioning and the second vehicle interface module 12 is functioning normally, the external transceiver unit 126 of the second vehicle interface module 12 receives external communication data and transmits communication data to the outside, the main control unit 120 of the second vehicle interface module 12 receives external communication data and transmits communication data to the outside via the Ethernet switch unit 13, the external transceiver unit 116 of the first vehicle interface module 11 receives external communication data but does not transmit communication data to the outside, and the main control unit 110 of the first vehicle interface module 11 receives external communication data but does not transmit communication data to the outside via the Ethernet switch unit 13.

[0060] In some embodiments, when the first vehicle interface module 11 is functioning normally, the input pins of both the hardwired signal transmission units 115 and 125 receive input signals, the functional safety-related pins of both the hardwired signal transmission units 115 and 125 output functional safety control signals, the non-functional safety-related pins of the hardwired signal transmission unit 115 output signals, and the non-functional safety-related pins of the hardwired signal transmission unit 125 do not output signals.

[0061] In some embodiments, when the first vehicle interface module 11 is malfunctioning and the second vehicle interface module 12 is functioning normally, the input pins of both hardwired signal transmission units 115 and 125 receive input signals, the functional safety-related pins of both hardwired signal transmission units 115 and 125 output functional safety control signals, the non-functional safety-related pins of hardwired signal transmission unit 125 output signals, and the non-functional safety-related pins of hardwired signal transmission unit 115 do not output signals.

[0062] In some embodiments, when the first vehicle interface module 11 is functioning normally, the PWM output unit 1151 outputs a PWM signal, while the PWM output unit 1251 does not output a PWM signal. When the first vehicle interface module 11 is malfunctioning and the second vehicle interface module 12 is functioning normally, the PWM output unit 1251 outputs a PWM signal, while the PWM output unit 1151 does not output a PWM signal.

[0063] In some embodiments, when the first vehicle interface module 11 is functioning normally, the input pins of I / O units 1152 and 1252 both receive input signals, the output pin of I / O unit 1152 outputs signals, and the output pin of I / O unit 1252 does not output signals.

[0064] In some embodiments, when the first vehicle interface module 11 is malfunctioning and the second vehicle interface module 12 is functioning normally, the input pins of I / O units 1152 and 1252 both receive input signals, the output pin of I / O unit 1252 outputs signals, and the output pin of I / O unit 1152 does not output signals.

[0065] In some embodiments, when the first vehicle interface module 11 is functioning normally, the functional safety-related pins of the high-side drive output units 1153 and 1253 both output functional safety control signals, the non-functional safety-related pins of the high-side drive output unit 1153 output signals, and the non-functional safety-related pins of the high-side drive output unit 1253 do not output signals.

[0066] In some embodiments, when the first vehicle interface module 11 is malfunctioning and the second vehicle interface module 12 is functioning normally, the functional safety-related pins of the high-side drive output units 1153 and 1253 both output functional safety control signals, the non-functional safety-related pins of the high-side drive output unit 1253 output signals, and the non-functional safety-related pins of the high-side drive output unit 1153 do not output signals.

[0067] In some embodiments, the second vehicle interface module 12 takes over the interface functions of the vehicle interface device 100, namely the input / output functions of external signals / data, as described above, when it detects an abnormality in the first vehicle interface module 11 or receives a takeover request from the main control unit 110 of the first vehicle interface module 11. For example, the two interface modules may monitor each other's heartbeat signals. When the second vehicle interface module 12 detects an abnormality in the heartbeat signal of the first vehicle interface module 11, it will actively initiate a takeover request. After the first vehicle interface module 11 responds, it will disconnect its external output, and the second vehicle interface module 12 will then take over all the functions of the vehicle interface module.

[0068] In some embodiments, when the interface function of the vehicle interface device 100 is transferred from the first vehicle interface module 11 to the second vehicle interface module 12, the main control unit 110 of the first vehicle interface module 11 sends the check value in the message transmitted by its external transceiver unit 116 to the main control unit 120 of the second vehicle interface module 12, so that the message transmitted by the external transceiver unit 116 of the second vehicle interface module 12 continues to accumulate based on the check value without interruption.

[0069] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, and are not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A vehicle interface device, adapted to connect between an autonomous driving system platform and a vehicle platform, the vehicle interface device comprising: substrate; A first vehicle interface module and a second vehicle interface module are independently arranged on the substrate. Each vehicle interface module includes a main control unit and a power supply unit, a hard-wired signal transmission unit, and an external transceiver unit connected to the corresponding main control unit. The main control unit of the first vehicle interface module communicates with the main control unit of the second vehicle interface module. The signal pins of the hard-wired signal transmission unit of the first vehicle interface module are electrically connected to the corresponding signal pins of the hard-wired signal transmission unit of the second vehicle interface module. The external transceiver unit is connected to the autonomous driving system platform and the vehicle platform. An Ethernet switch unit is connected between the main control unit of the first vehicle interface module and the main control unit of the second vehicle interface module, and is also connected to the autonomous driving system platform and the vehicle platform.

2. The vehicle interface device according to claim 1, wherein, under normal conditions of the first vehicle interface module, the external transceiver unit of the first vehicle interface module receives external communication data and transmits communication data externally, the main control unit of the first vehicle interface module receives external communication data and transmits communication data externally via the Ethernet switch unit, the external transceiver unit of the second vehicle interface module receives external communication data but does not transmit communication data externally, and the main control unit of the second vehicle interface module receives external communication data but does not transmit communication data externally via the Ethernet switch unit, and In the case where the first vehicle interface module malfunctions and the second vehicle interface module functions normally, the external transceiver unit of the second vehicle interface module receives and transmits external communication data, and the main control unit of the second vehicle interface module receives and transmits external communication data via the Ethernet switch unit. The external transceiver unit of the first vehicle interface module receives external communication data but does not transmit it, and the main control unit of the first vehicle interface module receives and transmits external communication data via the Ethernet switch unit but does not transmit it.

3. The vehicle interface device according to claim 1, wherein the power supply unit comprises: A reverse connection protection circuit, the input of which is used to connect to the corresponding power supply, the reverse connection protection circuit being turned on when the power supply polarity is correct and being turned off when the power supply polarity is reversed; as well as The power management integrated circuit has its input terminal connected to the reverse connection protection circuit and its output terminal connected to the corresponding main control unit.

4. The vehicle interface device according to claim 3, wherein the reverse connection protection circuit in the first vehicle interface module is connected to the first dual power supply, and the reverse connection protection circuit in the second vehicle interface module is connected to the second dual power supply, the second dual power supply being independent of the first dual power supply.

5. The vehicle interface device according to claim 1, wherein the hard-wired signal transmission unit includes an input pin and an output pin, the input pin of the hard-wired signal transmission unit in the first vehicle interface module is electrically connected to the input pin of the hard-wired signal transmission unit in the second vehicle interface module, and the output pin of the hard-wired signal transmission unit in the first vehicle interface module is electrically connected to the output pin of the hard-wired signal transmission unit in the second vehicle interface module.

6. The vehicle interface device according to claim 5, wherein an anti-backlash circuit is provided at the output pin of the hard-wired signal transmission unit in the first vehicle interface module and the second vehicle interface module, and the anti-backlash circuit is configured to prevent the output signal of one hard-wired signal transmission unit from flowing back into the other hard-wired signal transmission unit.

7. The vehicle interface device according to claim 5, wherein the output pins include functional safety-related pins and non-functional safety-related pins. When the first vehicle interface module is functioning normally, the input pins of the hard-wired signal transmission units in both the first and second vehicle interface modules receive input signals. The function safety-related pins of the hard-wired signal transmission units in both modules output function safety control signals. The non-function safety-related pins of the hard-wired signal transmission units in the first and second vehicle interface modules output signals, while the non-function safety-related pins of the hard-wired signal transmission units in the second vehicle interface module do not output signals. When the first vehicle interface module malfunctions and the second vehicle interface module functions normally, the input pins of the hardwired signal transmission units in both the first and second vehicle interface modules receive input signals, the function safety-related pins of the hardwired signal transmission units in both modules output function safety control signals, the non-function safety-related pins of the hardwired signal transmission units in the second vehicle interface module output signals, and the non-function safety-related pins of the hardwired signal transmission units in the first vehicle interface module do not output signals.

8. The vehicle interface device according to claim 7, wherein the functional safety-related pins include an analog KL15 signal output pin, and the non-functional safety-related pins include at least one of a PWM output pin and an LED indicator pin.

9. The vehicle interface device according to claim 1, wherein each vehicle interface module further includes an A / D input unit connected to the main control unit to transmit A / D sampled data to the main control unit.

10. The vehicle interface device according to claim 1, wherein each vehicle interface module further includes an inter-module transceiver, the inter-module transceiver of the first vehicle interface module being connected to the inter-module transceiver of the second vehicle interface module to exchange data between the main control unit of the first vehicle interface module and the main control unit of the second vehicle interface module.

11. The vehicle interface device according to claim 1, wherein the main control unit of the first vehicle interface module is further connected to the main control unit of the second vehicle interface module via an inter-module communication line, and the main control units of the first vehicle interface module and the second vehicle interface module are configured to monitor each other's heartbeat signals via the inter-module communication line, the heartbeat signals reflecting whether the corresponding vehicle interface modules are functioning normally. The second vehicle interface module takes over the interface function of the vehicle interface device when it detects an abnormality in the first vehicle interface module or receives a takeover request from the main control unit of the first vehicle interface module.

12. The vehicle interface device according to claim 11, wherein when the interface function of the vehicle interface device is transferred from the first vehicle interface module to the second vehicle interface module, the main control unit of the first vehicle interface module sends the checksum in the message transmitted by its external transceiver unit to the main control unit of the second vehicle interface module.

13. A vehicle comprising: Autonomous driving system platform; Vehicle platform; as well as The vehicle interface device according to any one of claims 1 to 12 is connected between the autonomous driving system platform and the vehicle platform.

Images