Vehicle ECU Architecture for Mixed ASIL Signal Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vehicle systems face challenges in managing software with varying safety levels, leading to potential performance mismatches and inefficiencies due to the mixing of software with different safety degrees, which can result in excessive performance when lower safety software is executed.
Innovation Solution
A vehicle system is designed with multiple devices and controllers, each having a predetermined safety standard, utilizing a central controller and relay unit to manage input and output signals through single-level controllers, ensuring appropriate confirmation processing and signal distribution based on safety standards, thereby integrating and controlling devices with varying safety integrity levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple pieces of software with different safety degrees are mixed in the same vehicle control device, then reusability of software is improved, but performance mismatch occurs causing excessive performance when lower safety software is executed
Solution Approach 1:
The vehicle control device is divided into multiple control units, each dedicated to a specific safety level (ASIL A, ASIL B, ASIL C, ASIL D). This segmentation allows software to be executed in appropriately matched hardware environments, preventing performance mismatch while maintaining software reusability across different safety levels.
Solution Approach 2:
A relay unit is introduced as an intermediary component to manage communication and data sharing between control units of different safety levels. This mediator enables software reusability across safety levels while maintaining proper isolation and preventing performance mismatch by controlling access patterns.
2Quantity of substance
If multiple pieces of software with different safety degrees are mixed in the same vehicle control device, then resource sharing is improved, but system complexity increases due to safety standard matching requirements
Solution Approach 1:
The system is segmented into dedicated control units for each safety level, which simplifies resource sharing management. Each control unit can share resources within its safety level without complex matching requirements, while the relay unit handles inter-level resource coordination.
Solution Approach 2:
The relay unit serves multiple functions: it acts as an intermediary for communication, manages data sharing between different safety levels, and coordinates resource allocation. This universal component reduces overall system complexity by centralizing safety level coordination.
3Device complexity
If a single controller executes all safety levels, then device count is reduced, but confirmation processing accuracy decreases due to mixed safety standards
Solution Approach 1:
Confirmation processing is segmented and distributed to control units dedicated to specific safety levels. Each control unit performs confirmation processing appropriate to its safety level, ensuring accuracy while the relay unit coordinates between units to maintain overall system reliability.
Data Source
AI summary
A safety standard of a predetermined level is set for a function to be implemented in each of devices. A central ECU includes ASIL ECUs to, in which each of the ASIL ECUS to is allocated for each level of the safety standard and is able to execute, on the device, confirmation processing according to the allocated level. A network branch unit distributes and transmits each of input signals from the devices, the input signals being respectively transmitted from zone ECUs, to a corresponding one of the ASIL ECUS each having the level allocated thereto and corresponding to the function of the device, and distributes and transmits each of output signals from the ASIL ECUs, the output signals being respectively transmitted from the ASIL ECUs, to a corresponding one of the zone ECUs each having transmitted the input signal from the device subjected to the confirmation processing.