CN112224200A

CN112224200A - Controller of vehicle equipment control system and function safety control method

Info

Publication number: CN112224200A
Application number: CN201910573374.5A
Authority: CN
Inventors: 王玉珏
Original assignee: Vitesco Technologies Holding China Co Ltd
Current assignee: Vitesco Technologies Holding China Co Ltd
Priority date: 2019-06-28
Filing date: 2019-06-28
Publication date: 2021-01-15

Abstract

The present disclosure proposes a controller for a vehicle equipment control system, a vehicle equipment control system having the controller, and a method for functional safety control of the controller. The controller has a function control unit configured to monitor a first parameter of the vehicle and to control a device of the vehicle in response to the first parameter; and a functional safety unit configured to monitor a second parameter of the vehicle satisfying a functional safety level, determine a fault causing passenger safety injury based on the second parameter, and output a first enable signal controlling the vehicle to enter a safe state in response to the fault causing passenger safety injury. The controller, the vehicle equipment control system and the method can ensure the personal safety requirements of passengers specified by the ISO26262 standard, and can not influence the existing control program of the vehicle equipment control system as far as possible, thereby obviously reducing the complexity of system development.

Description

Controller of vehicle equipment control system and function safety control method

Technical Field

The present disclosure relates to the field of automotive electronics, and in particular to a controller for a vehicle equipment control system, a vehicle equipment control system having the controller, and a method for functional safety control of the controller.

Background

In developing control software for an electronic controller of a vehicle control system, many complex functional safety measures and/or requirements must be implemented in order to meet the stringent requirements of the road vehicle functional safety ISO26262 standard for personal safety injuries to passengers.

Since the automatic Transmission of a motor vehicle has functional Control requirements for different performances, types and technologies, the Transmission Control Unit (TCU) must be modified and designed in a special way based on the functional Control of the existing Transmission to match various mechanical mechanisms in different transmissions. This large number of functional control requirements is complicatedly interleaved with functional safety requirements, which presents a significant challenge to the design of control software for TCUs.

Accordingly, there is a need for improvement in the functional safety control of a controller of a vehicle equipment control system, such as a vehicle transmission control system.

Disclosure of Invention

The present disclosure is directed to a controller for a vehicle equipment control system, a vehicle equipment control system having the same, and a method for functional safety control of the same, so as to significantly reduce the complexity of system development in the functional safety control modification process of the vehicle equipment control system, and meet the requirements of road vehicle functional safety standards.

According to an aspect of the present disclosure, there is provided a controller for a vehicle equipment control system, the controller including:

a function control unit configured to monitor a first parameter of the vehicle and to control a device of the vehicle in response to the first parameter;

a functional safety unit configured to monitor a second parameter of the vehicle that satisfies a functional safety level, determine a fault that causes occupant safety injury based on the second parameter, and output a first enable signal that controls the vehicle to enter a safe state in response to the fault that causes occupant safety injury.

According to one embodiment, the functional safety unit comprises:

a safety target monitoring subunit configured to determine a first fault caused by a device failure of the vehicle among the faults causing passenger safety injury based on an input satisfying a functional safety level, and output the first enable signal in response to the first fault;

a controller integrity monitoring subunit configured to provide an operating environment satisfying a functional safety level and the input to the safety target monitoring subunit based on the monitored second parameter, and determine a second fault caused by failure of the operating environment among the faults causing passenger safety injury and output the first enable signal in response to the second fault.

According to another aspect of the present disclosure, there is provided a vehicle device control system including: a controller as described above; a first driver for driving an actuator of a device of the vehicle; an external monitoring unit for monitoring a failure of the functional safety unit and outputting a second enable signal when the failure is detected; and a functional safety driver for driving an actuator of a device of the vehicle to bring the vehicle into a safe state.

According to yet another aspect of the present disclosure, there is provided a method for functional safety control of a controller of a vehicle equipment control system, comprising: monitoring a first parameter of the vehicle and controlling a device of the vehicle in response to the first parameter; monitoring a second parameter of the vehicle that meets a functional safety level; determining a fault causing a passenger safety injury based on the second parameter; and outputting a first enable signal for controlling the vehicle to enter a safe state in response to the fault causing the passenger to be safely injured.

According to yet another aspect of the present disclosure, a computer-readable storage medium is proposed, on which a computer program is stored, the computer program comprising executable instructions which, when executed by a processor, implement the method as described above.

According to yet another aspect of the present disclosure, an electronic device is provided, which includes a processor; and a memory for storing executable instructions of the processor; wherein the processor is arranged to execute the executable instructions to implement the method as described above.

By adopting the controller, the vehicle equipment control system and the function safety control method of the controller, based on the function safety system architecture applicable to the vehicle equipment control system, the concept of fault safety is unified for different characteristics of function safety levels in the vehicle equipment control system, the vehicle function safety target is realized on the premise of meeting the road vehicle function safety ISO26262 standard, the personal safety requirements of passengers are ensured, the existing control program of the vehicle equipment control system is not influenced as much as possible, and the system development complexity is remarkably reduced.

Drawings

The above and other features and advantages of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.

FIG. 1 is a schematic block diagram for a vehicle equipment control system according to one embodiment of the present disclosure;

FIG. 2 is a schematic flow chart diagram of a method for functional safety control of a controller of a vehicle equipment control system according to one embodiment of the present disclosure;

FIG. 3 is a schematic flow chart of sub-steps of a method for functional safety control of a controller of the vehicle equipment control system shown in FIG. 2; and

fig. 4 is a schematic block diagram of an electronic device according to one embodiment of the present disclosure.

Detailed Description

Exemplary embodiments will now be described more fully with reference to the accompanying drawings. The exemplary embodiments, however, may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. In the drawings, the size of some of the elements may be exaggerated or distorted for clarity. The same reference numerals denote the same or similar structures in the drawings, and thus detailed descriptions thereof will be omitted.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the subject matter of the present disclosure can be practiced without one or more of the specific details, or with other methods, components, etc. In other instances, well-known structures, methods, or operations are not shown or described in detail to avoid obscuring aspects of the disclosure.

First, contents related to standards related to vehicle safety in the present disclosure will be described. The road vehicle function safety standard ISO26262 is derived from the standard IEC 61508, belongs to the international standard suitable for mass production passenger cars, and the latest version was published in 2018. The ISO26262 standard is mainly located in components such as electrical devices, electronic equipment, programmable electronic devices, and the like, which are specially used in the automotive field, and aims to improve the international standard of functional safety of automotive electronics and electrical products. The ISO26262 standard is only for safety-related vehicle electrical and electronic systems, including motors, electronics, and software components, and is not generally applicable to non-electrical and electronic systems (e.g., mechanical, hydraulic, etc.).

ASIL (automatic Safety Integrity Level) is a Safety requirement Level determined by the ISO26262 standard for a vehicle system or a component of a vehicle system, for example for a control system of a vehicle device and a controller thereof, depending on the degree of Safety risk. ASIL is classified into functional safety requirement levels that increase in order from a to D, for example, a high level B functional safety requirement is more stringent than a low level a functional safety requirement, and a vehicle control program developed according to the level B functional safety requirement may be applied to a level a required vehicle system, but not vice versa. ASIL requires that each relevant part of the vehicle control system that meets the grade requirement has a corresponding or higher grade requirement. However, a combination of a certain number of components and data required at a low level may meet the criteria required at a high level. For example, a combination of multiple control components or data that meet the functional safety requirements of level B may meet the functional safety requirements of level C.

In the process of modifying and upgrading the existing vehicle component control system in compliance with the ISO26262 standard, the modification of the existing software of the control system is very labor intensive. Taking a TCU as an example of a controller of a power transmission system of a vehicle, a transmission of an automobile has different performance, type and technical functional requirements, and an existing TCU functional control scheme has a complex and mature control flow. Corresponding monitoring, diagnostic and response processing steps for vehicle component failures also exist in these TCU functional control schemes, but do not necessarily meet the functional safety requirements of the ISO26262 standard. If the existing TCU function control program is modified and upgraded, the number of control logic and data parameters to be considered is very large, and there is a possibility that the performance of the mature power transmission process is affected during the modification process, and even a new program defect (such as the program BUG) is generated. Therefore, it is one of the main concerns of the present application how to modify the existing control program as little as possible while meeting the basic requirements of the road vehicle functional safety standard ISO 26262.

Those skilled in the art will appreciate that the modifications to the TCU of the power transmission system described in the present disclosure are merely exemplary for more clearly illustrating the concepts of the present disclosure and its advantages, and are not intended to limit the application scenarios of the present disclosure. Any vehicle equipment control system and its controller (e.g., ECU) that uses a controller control device in a vehicle system, such as a brake control system, a lighting control system, an air conditioning control system and its corresponding controller (ECU) of a vehicle, etc., is an application scenario of the present disclosure. In the exemplary embodiments of the present disclosure, the present disclosure is mainly applied to a low-voltage control system, but the inventive concept of the present disclosure may also be applied to modification of functional safety requirements of other equipment control systems of a vehicle, where applicable.

In an embodiment of the present disclosure, a "Fail-Safe (Fail-Safe)" concept is presented. "fail-safe" applies to the controller TCU of various different types of power transmission systems. In functional safety control, if a fault is detected that may cause personal safety injury to an occupant (e.g., a worst case fault condition), the TCU or an external monitoring unit located outside the TCU in the vehicle equipment control system can send an actuator control command to the equipment to close the associated actuator that caused the functional safety fault/failure or can avoid or eliminate the functional safety fault/failure condition, causing the vehicle to enter a vehicle safety state. This "fail-safe" concept is based on the following basic settings: closing the corresponding actuator can enable the device corresponding to the vehicle device control system such as a power transmission system (transmission) to enter a safe mechanical state of the vehicle within a fixed fault-tolerant time interval, and the safe mechanical state can be considered that the vehicle meets the safety definition specified by the ISO26262 standard in any driving scene. For example, the TCU may disengage the driveline mechanism of the transmission to completely disconnect the power output of the vehicle engine or motor from the drive shaft, allowing the vehicle to coast to a stop in the event of a functional safety failure of the power transmission system.

Based on the concepts and settings described above, a functional safety system architecture for a vehicle equipment control system and its controller is presented. It should be noted that when the controller TCU identifies or determines a device fault or failure that violates a functional safety objective while monitoring the operational state of the device, the controller TCU responsively shuts down the corresponding actuator. If the vehicle equipment can enable the vehicle to enter a safe state due to the fact that the actuator is turned off, for example, personal safety injury to passengers does not exist any more, the functional safety system architecture can be applied to simplify the modification of the functional safety requirement of the existing vehicle functional control system. However, if the actuator is turned off, which causes the vehicle to enter a dangerous state, the functional safety architecture cannot be used to simplify the functional safety requirements of the existing vehicle functional control system.

An exemplary structure of a vehicle device control system and a controller thereof according to an embodiment of the present disclosure will be described in detail below with reference to fig. 1.

The vehicle equipment control system 10 includes a controller 100, an input 200, a power supply 300, a power supply monitoring unit 310, an external monitoring unit 400, a driver 111, a functional safety driver 500, and an actuator 600. The solid lines in the figures represent electrical connections, such as voltages or currents, or mechanical (direct or indirect) connections, and the dashed lines represent signal and data communication connections.

The controller 100 includes a function control unit 110 and a function safety unit 120. The functional safety unit 120 includes a safety objective monitoring subunit 121 and a controller integrity monitoring subunit 122. The functional safety system architecture based on the present disclosure is divided into three layers in the controller 100, which are a basic functional layer BFL formed by the functional control unit 110, a functional safety target monitoring layer SGM formed by the safety target monitoring subunit, and a functional safety integrity monitoring layer FSI formed by the controller integrity monitoring subunit 122. The control software of each layer may be designed and configured relatively independently and with data and state interaction with each other.

The function control unit 110 of the base functional layer BFL corresponds to the control unit of the controller 100 which is not modified with respect to the ISO26262 standard. The function control requirements of the function control unit 110 of the existing vehicle function control system are determined by the function requirements of the equipment, for example, depending on the structure, type and technical function index of the transmission of the vehicle power transmission system.

The function control unit 110 is used to monitor various parameters received by the controller 100 from the inputs 200 and to control the devices of the vehicle in response to the parameters. The parameters of the input 200 may come from the detection signals of various sensors of the vehicle or from the CAN bus. The parameters of the input 200 may be electrical measurement data such as voltage or current, physical measurement data such as position, pressure or flow, processed data or program code or control instructions. The parameters received from the input 200 may also be indicative data, such as the operational status or fault identification of various devices or subsystems of the vehicle.

The function control unit 110 monitors the vehicle state indicated by the received parameter and performs further processing according to the parameter, determines a deviation between the parameter and a predetermined value, or performs corresponding control in response to the corresponding parameter. For example, if a fault or deviation in the equipment of the vehicle is determined based on the parameters, the location or source of the fault may be determined and a corresponding command or response may be output to control the actuator driver 111 to eliminate the fault or deviation, or a fault indication or warning may be output. The functional control unit 110 of the basic functional layer BFL is primarily intended to ensure the proper operation of the vehicle equipment, and also includes fault detection and response to ensure vehicle safety. The purpose of the fault monitoring and response of the function control unit 110 is to preferentially ensure that the vehicle equipment is functioning properly. The monitoring and response of the functional control unit 110 to faults is generally based on qualitative analysis and therefore its response speed is relatively fast. According to an embodiment of the present disclosure, the function control unit 110 may also perform a degraded mode operation in response to a monitored equipment failure or malfunction.

The actuator driver 111, as a general actuation path, may transmit the state of one or more actuators or actuator groups 600 to the function control unit 110 through an actuator interface, and receive an output or control instruction of the corresponding actuator 600 controlling the vehicle device from the function control unit 110.

Although the control function in the basic functional layer BFL can also monitor faults, the functional safety target requirements of the road vehicle functional safety ISO26262 are generally not met. The functional safety unit 120 is used to improve the control functions of the controller 100, with functional safety target requirements dictated by ISO26262, primarily for equipment failures or failures that may lead to personal safety injuries of the passengers of the vehicle. ASIL divides the functional security requirements into progressively higher security levels from level a to D.

The functional safety unit 120 is configured to monitor a parameter satisfying a functional safety level specified by ASIL among the parameters received from the input 200, and determine a malfunction or failure of an apparatus that does not satisfy a functional safety target of the ISO26262 standard, that is, a malfunction or failure of an apparatus that may cause safety injury to passengers, based on the parameter of the high functional safety level, and output an enable signal C120 capable of controlling the vehicle to enter a safe state in response to the malfunction or failure.

The parameters provided by input 200 to controller 100 may not meet the safety levels specified by ASIL, and therefore the parameters may need to be modified or adjusted to achieve the safety levels corresponding to ISO26262 standards. For example, when the vehicle equipment control system 10 needs to satisfy the ASIL D safety level in the ISO26262 standard, the input data from the sensors and the CAN bus may be parameters of the C safety level, and the parameters need to be adjusted. Such as, but not limited to, improving sampling accuracy of input parameters, number of samples, number and confidence of input sources, redundancy check level, etc. According to an embodiment of the present disclosure, the input data of a plurality of low security levels may be integrated into the input data of a higher security level, and the original data definition and the value of the input 200 are updated to obtain parameters conforming to the ASIL security level.

The safety target monitoring subunit 121 is configured to determine a fault caused by a vehicle equipment fault or failure, among faults or failures that may cause safety injuries to passengers, based on the above-described parameters satisfying the safety level of the ASIL function, and output the enable signal C120 to drive the functional safety driver 500 in response to the fault caused by the equipment fault or failure. The functional safety driver 500 then controls (e.g., shuts down) one or more corresponding actuators or groups of actuators 600 of the vehicle to bring the vehicle into a safe state. The enable signal C120 is a fault/failure indication or control command for the functional safety of the vehicle equipment, and may for example take the form of a logical value (true or false, i.e. 1 or 0) for the purpose of logical processing.

The safety target monitoring subunit 121 in the functional safety target monitoring layer SGM is configured to monitor whether a functional safety target of the vehicle device violates a functional safety target specified by the ISO26262 standard. The functional safety objective may be in the form of, for example, a threshold indicator or an objective function. All safety logic operation mechanisms aiming at the functional safety target are implemented in the safety target monitoring subunit 121, and the logic operation mechanisms generally consist of two parts, namely fault/failure detection and fault/failure response. The safety target monitoring subunit 121 receives input data satisfying the ASIL function safety level from the controller integrity monitoring subunit 122, performs a logical operation on the input data, and compares the result of the operation with the function safety target. The functional safety objective monitoring layer SGM differs from the basic functional layer BFL in the detection of device faults/failures in that the safety objective monitoring subunit 121 needs to quantitatively analyze the possibility of faults/failures covering the functional safety objectives, i.e. to take into account the effect of various faults on the functional safety objectives. When the operation result does not meet the requirements of the functional safety target, the vehicle equipment is determined to have faults or failures caused by the faults or failures of the vehicle equipment, which can cause safety injury of passengers, namely the vehicle indicated by the input data is determined to have the indication of the faults/failures which can affect the personal safety of the vehicle and the passengers. The decision whether or not to fulfil (i.e. violate) a functional safety objective is not only based on the logical operation or decision result of certain input data, but also takes into account other input data that may be relevant to the detected fault/failure, ultimately giving an indication whether or not the current state of the vehicle is functionally safe.

The fault/failure response is typically a fault indication or warning for functional safety, outputting a command or flag, such as a true value, that enables the microcontroller, such as the enable signal C120 described above. In contrast to the functional control unit 110 at the basic functional layer BFL, the safety target monitoring subunit 121 at the functional safety target monitoring layer SGM prioritizes the response to a fault/failure to meet functional safety requirements, i.e. to eliminate personal safety injuries of vehicle occupants, while the function of the vehicle is normally placed in a secondary position. The safety objective monitoring subunit 121 will use some systematic strategy to ensure the reliability of the failure detection, and then use an independent path that meets the functional safety requirements specified by ASIL to control the vehicle to enter a safe state, i.e., to drive the actuators 600 of the vehicle devices by controlling the functional safety drivers 500 instead of the drivers 111.

Since the SGM performs quantitative logical operations, the failure detection and operation speed may be lower than that of the BFL, which is the basic functional layer. For example, when the safety target monitoring subunit 121 has not determined a failure based on the input data, the function control unit 110 has determined a failure of the vehicle device and controls the driver 111 to cause the actuator 600 to adjust the state of the corresponding device or component so that the failure has been eliminated. According to an embodiment of the present disclosure, the safety target monitoring subunit 121 may also perform data interaction with the function control unit 110 before determining the fault, and determine a fault caused by a vehicle equipment failure among the faults causing the passenger safety injury with reference to the output of the function control unit 110.

The functional safety objective monitoring layer SGM ensures that the correct fault/failure detection result can be logically calculated based on the correct input data, and the controller integrity monitoring subunit 122 of the functional safety integrity monitoring layer FSI is configured to provide the operating environment satisfying the functional safety level and the input data satisfying the functional safety level specified above to the safety objective monitoring subunit 121 based on the monitored parameters satisfying the functional safety level specified by ASIL. In addition, the controller integrity monitoring subunit 122 also determines a failure caused by the operating environment failure among the failures that cause the passenger safety injury, and outputs the above-described enable signal C120 to the functional safety driver 500 in response to the failure caused by the operating environment failure/failure.

The controller integrity monitoring subunit 122 of the functional safety integrity monitoring layer FSI is provided for the purpose of ensuring the integrity of the functional safety of the monitoring controller 100. The functional safety target monitoring layer SGM is used to correctly logically calculate the detection result of the fault/failure, and the functional safety integrity monitoring layer FSI ensures that the functional safety target monitoring layer SGM performs logical calculation based on correct input data and a correct data processing environment. According to an embodiment of the present disclosure, the controller integrity monitoring subunit 122 does not monitor the correctness of the logical calculation process of the functional safety target monitoring layer SGM. Thus, the two

subunits

121 and 122 of the functional safety objective monitoring layer SGM and the functional safety integrity monitoring layer FSI, respectively, are focused on failures of passenger safety injuries due to different failures/failures and operate in parallel to independently trigger an indication of a functional safety failure/failure and output the enable signal C120.

The controller integrity monitoring subunit 122 ensures that the input data and environmental integrity includes, but is not limited to: parameters received from the input 200 that satisfy the ASIL-specified functional security level (i.e., input data of the functional security monitoring subunit 121) are ensured, a safe operation mechanism of the microprocessor uC of the controller 100 is ensured, storage reliability of control software is ensured, operation reliability of monitoring control program flow, reliable interaction of an external monitoring unit, power monitoring, and the like are ensured. The controller integrity monitoring subunit 122 is concerned with all faults that may cause the safety target monitoring subunit 121 of the functional safety target monitoring layer SGM to fail to operate properly. When there is a failure/failure of input data and operational environment integrity, for example, a parameter received from the input 200 that should satisfy the functional safety level specified by ASIL does not satisfy the corresponding functional safety level (resulting in incorrect input data), a safety failure of the processor of the controller 100 (resulting in incorrect operation of the logic operation of the control program), a failure of the memory of the controller 100 (resulting in incorrect data read or written, and incorrect logic operation due to an operational memory error such as RAM), a program operation failure of the controller 100 (program BUG), a failure of the external monitoring unit 400 of the vehicle equipment control system 10 (resulting in a failure of the controller 100 itself), and a failure of the power supply 300 of the controller 100 (resulting in power supply fluctuation to burn out the controller 100, the controller 100 being inoperable or unreliable), the controller integrity monitoring subunit 122 determines that there is a fault caused by the input data and the operating environment integrity failure and triggers the output of the enable signal C120.

Since the safety target monitoring subunit 121 at the functional safety target monitoring layer SGM and the controller integrity monitoring subunit 122 at the functional safety integrity monitoring layer FSI are more interested in functional safety targets of the vehicle than the functional control unit 110 at the base functional layer BFL, the fault response priorities of the

subunits

121 and 122 are generally higher than the functional control unit 110. For example, when the power transmission system of the vehicle is malfunctioning, the response of the functional control unit 110 may be to disable the actuators of the mechanical or hydraulic components to eliminate the malfunction, and the response of the functional safety control unit 120 may be to shut down the transmission to cut off the power transmission system to ensure that the vehicle enters a safe state. That is, the functional safety control unit 120, upon identifying a fault/failure violating the functional safety objective, may shut off the driving of the actuator 600 rather than merely shutting off a portion of the actuator 600 or driving a portion of the actuator 600 to eliminate the equipment fault.

The power supply 300 is used to provide operating power to the controller 100. The power supply monitoring unit 310 monitors a power supply state of the power supply 300, such as a power supply voltage and current. When the power supply of the power supply 300 fluctuates, for example, the power supply voltage has a high voltage, a low voltage, or a voltage fluctuation exceeding a rated operation threshold, the power supply monitoring unit 310 detects the abnormal change and determines that the power supply 300 has a fault/failure that may cause the controller 100 to be damaged or fail to operate normally, and outputs the enable signal C310 to the functional safety driver 500 as a fault response. The enable signal C310 may take the same definition and form as the enable signal C120 above.

According to embodiments of the present disclosure, the controller integrity monitoring subunit 122 may also monitor the power input of the power supply 300 as one of the parameters that meets the functional safety level specified by ASIL. This redundant fault monitoring of the power supply 300 is performed at both the functional safety unit 120 and the power supply monitoring unit 310, and the reliability of the functional safety monitoring can be improved. According to one embodiment, the monitoring of the power input of the power supply 300 may also be done in the safety target detection subunit 121.

The external monitoring unit 400 is used to monitor the controller 100 for a failure/malfunction of the functional safety unit 120. According to an embodiment of the present disclosure, since the controller integrity monitoring subunit 122 in the functional safety unit 120 is used to ensure the integrity of the functional safety of the monitoring controller 100, such as including the correctness of the input data and the operating environment, the external monitoring unit 400 is mainly used to monitor the failure/malfunction of the integrity monitoring subunit 122 of the controller 10. The external monitoring unit 400 may take the form of a watchdog, for example, and verify the reliability of the data and program execution environment of the functional security object monitoring layer SGM and the functional security integrity monitoring layer FSI in the functional security unit 120 through interactive communication with the integrity monitoring subunit 122. Such as, but not limited to, encryption/decryption verification of data, correct and valid responses during mutual interrogation, response time to interrogation, etc. When the external monitoring unit 400 determines that the integrity monitoring subunit 122 has a failure caused by a failure of the operating environment, the enable signal C400 is output to the functional safety driver 500. Enable signal C400 may take on a similar definition and format as enable signal C120.

The monitoring between the external monitoring unit 400 and the integrity monitoring subunit 122 is bidirectional. The integrity monitoring subunit 122 may also determine whether the external monitoring unit 400 has a fault through interaction with the external monitoring unit 400, for example, to determine whether the watchdog has failed. If it is determined that there is a malfunction of the external monitoring unit 400, the integrity monitoring subunit 122 may also determine that there is a malfunction of the vehicle device control system 10 that may lead to passenger safety injury, i.e., that the external monitoring unit 400 is also considered part of the integrity operating environment. In response to the fault/failure, the integrity monitoring subunit 122 may output an enable signal C120 to the functional safety driver 5000. The external monitoring unit 400 and the integrity monitoring subunit 122 are used as a redundant monitoring means for the integrity of the operating environment, so that the monitoring reliability of the functional safety fault causing the safety injury of the passenger can be effectively ensured.

The functional safety driver 500 is configured to receive at least one of the enable signal C120 output by the functional safety unit 120, the enable signal C310 output by the power monitoring unit 310, and the enable signal C400 output by the external monitoring unit 400, and determine whether it is necessary to output a driving signal to the actuator or the group of actuators 600 or to turn off the actuator 600 based on internal logic.

The functional safety driver 500 includes a logic unit 510 and a switching unit 520. The logic unit 510 is used to calculate a control signal of the output switching unit 520 based on the enable signals C120, C310, and C400. According to an embodiment of the present disclosure, the logic unit 510 outputs a control signal that turns on the switching unit 520 to drive or turn off the actuator 600 when any one of the three enable signals indicates that there is a fault/failure that may cause a safety injury to passengers. When any of the enable signals indicates that there is no malfunction/failure causing safety injury to passengers, the logic unit 510 outputs a control signal for closing the switching unit 520, and does not output a driving signal for bringing the vehicle into a safe state to the actuator 600. The logic unit 510 may take the form of a simple logic unit of a nor gate or a more complex logic unit, for example.

The actuator 600 may include one or more actuators or actuator groups for actuating respective elements of the vehicle device or turning off the respective device to bring the vehicle into a safe state based on a driving or turning off signal received from the driver 111 or the functional safety driver 500. The actuator 600 may be, for example, a piston, a valve, a gear, a lever, an electrical or mechanical switch, etc.

Fig. 2 then shows the schematic steps of a method for functional safety control of a controller of a vehicle equipment control system according to one embodiment of the present disclosure.

At the start of the program, the function control unit 110 of the controller 100 detects a parameter of the vehicle and controls the devices of the vehicle in response to the parameter in step S100. What step S100 actually completes is the basic control function that the controller 100 completes before introducing the road vehicle function safety ISO26262 standard.

Simultaneously with step S100, the controller integrity monitoring subunit 122 of the functional safety unit 120 monitors the parameter of the vehicle that satisfies the functional safety level specified by ASIL in step S200, and supplies the parameter that satisfies the functional safety level to the safety target monitoring subunit 121.

Next, the safety target monitoring subunit 121 of the functional safety unit 120 and the controller integrity monitoring subunit 122 together determine whether the vehicle has a malfunction/failure that causes a safety injury to the passenger based on the parameter that satisfies the functional safety level in step S300. Step S100 runs in parallel with steps S200 to S400. According to an embodiment of the present disclosure, it is possible that step S100 completes monitoring and responsively completing control of the device for a malfunction of the vehicle device already prior to step S300, such that the malfunction causing the safety injury to the passenger is no longer present. Therefore, the safety target detecting sub-unit 121 may determine in step S300 that the vehicle has a malfunction/failure causing safety injury to passengers in conjunction with the vehicle parameters and states output from the function control unit 110 in step S100.

After determining that there is a fault/failure causing passenger safety injury, the functional safety unit 120 outputs an enable signal controlling the vehicle to enter a safe state in response to the fault causing passenger safety injury in step S400.

Flow branches S100 and branches S200-S400 of fig. 2 may be executed in a loop to continuously monitor the vehicle equipment for faults. When the vehicle is shut down, the process ends.

Fig. 3 illustrates a detailed process of step S300 in fig. 2.

In step S310, the controller integrity monitoring subunit 122 of the functional safety unit 120 provides the security target monitoring subunit 121 with an operating environment that satisfies the functional safety level and an input that satisfies the functional safety level based on the monitored parameter that satisfies the functional safety level.

Subsequently in step S320, the safety target monitoring subunit 121 determines a malfunction caused by a device failure of the vehicle among the malfunctions causing passenger safety injuries, based on the input provided in step S310, and outputs an enable signal in response to the malfunction.

In step S330, which is executed independently in parallel with step S320, the controller integrity monitoring subunit 122 then determines a failure caused by the failure of the operating environment among the failures that cause the passenger safety injury and outputs the enable signal in response to the failure.

After at least one of steps S320 and S330 is completed, step S400 in fig. 2 is continued, and an enable signal is output to the functional safety driver 500, for example, as shown in fig. 1, to drive or turn off the actuator to bring the vehicle into a safe state.

The specific steps of the functional safety control method of the control unit 100 of the vehicle equipment control system 10 are described above. When the vehicle equipment control system 10 is operating, it is also possible to add, after step S400 shown in fig. 2, an enable signal that is monitored for a failure by the power supply monitoring unit 310 and output in response thereto and an enable signal that is monitored for a failure by the external monitoring unit 400 and output in response thereto, determine that the vehicle has a failure that causes safe injury to passengers through logical operation by the functional safety drive unit 500, and send a drive or shut-off signal to the actuator in response to bring the vehicle into a safe state.

Through the controller for the vehicle equipment control system, the vehicle equipment control system with the controller and the method for controlling the function safety of the controller, a 'failure-safety' concept is provided, based on a function safety system framework suitable for the vehicle equipment control system, the failure safety concept is unified for different characteristics of function safety levels in the vehicle equipment control system, the vehicle function safety target is realized on the premise of meeting the road vehicle function safety ISO26262 standard, the personal safety requirements of passengers are guaranteed, the existing control program of the vehicle equipment control system is not influenced as much as possible, and the system development complexity is obviously reduced.

It should be noted that although in the above detailed description several modules or units are mentioned for the vehicle device control system and its controller, such a division is not mandatory. Indeed, the features and functionality of two or more modules or units described above may be embodied in one module or unit, according to embodiments of the present disclosure. Conversely, the features and functions of one module or unit described above may be further divided into embodiments by a plurality of modules or units. The components shown as modules or units may or may not be physical units, i.e. may be located in one place or may also be distributed over a plurality of network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. One of ordinary skill in the art can understand and implement it without inventive effort.

In an exemplary embodiment of the disclosure, there is also provided a computer readable storage medium, on which a computer program is stored, the program comprising executable instructions which, when executed by a processor for example, may implement the steps of the method for functional safety control of a controller of a vehicle equipment control system as described in any one of the above embodiments. In some possible implementations, various aspects of the disclosure may also be implemented in the form of a program product comprising program code for causing a terminal device to perform the steps according to various exemplary embodiments of the disclosure described in this specification for a method for functional safety control of a controller of a vehicle equipment control system, when the program product is run on the terminal device.

A program product for implementing the above method according to an embodiment of the present disclosure may employ a portable compact disc read only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto, and in this document, a readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

The computer readable storage medium may include a propagated data signal with readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A readable storage medium may also be any readable medium that is not a readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out operations for the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).

In an exemplary embodiment of the present disclosure, there is also provided an electronic device, which may include a processor, and a memory for storing executable instructions of the processor. Wherein the processor is configured to perform the steps of the method for functional safety control of a controller of a vehicle equipment control system in any of the above embodiments via execution of the executable instructions.

As will be appreciated by one skilled in the art, aspects of the present disclosure may be embodied as a system, method or program product. Accordingly, various aspects of the present disclosure may be embodied in the form of: an entirely hardware embodiment, an entirely software embodiment (including firmware, microcode, etc.) or an embodiment combining hardware and software aspects that may all generally be referred to herein as a "circuit," module "or" system.

An electronic device 700 according to this embodiment of the disclosure is described below with reference to fig. 4. The electronic device 700 shown in fig. 4 is only an example and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.

As shown in fig. 4, the electronic device 700 is embodied in the form of a general purpose computing device. The components of the electronic device 700 may include, but are not limited to: at least one processing unit 710, at least one memory unit 720, a bus 730 that connects the various system components (including the memory unit 720 and the processing unit 710), a display unit 740, and the like.

Wherein the memory unit stores program code executable by the processing unit 710 to cause the processing unit 710 to perform steps according to various exemplary embodiments of the present disclosure described in the methods for functional safety control of a controller of a vehicle equipment control system of the present specification. For example, the processing unit 710 may perform the steps as shown in fig. 2 and 3.

The memory unit 720 may include readable media in the form of volatile memory units, such as a random access memory unit (RAM)7201 and/or a cache memory unit 7202, and may further include a read only memory unit (ROM) 7203.

The memory unit 720 may also include a program/utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may comprise an implementation of a network environment.

Bus 730 may be any representation of one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

The electronic device 700 may also communicate with one or more external devices 800 (e.g., keyboard, pointing device, bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic device 700, and/or with any devices (e.g., router, modem, etc.) that enable the electronic device 700 to communicate with one or more other computing devices. Such communication may occur via an input/output (I/O) interface 750. Also, the electronic device 700 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network such as the internet) via the network adapter 760. The network adapter 760 may communicate with other modules of the electronic device 700 via the bus 730. It should be appreciated that although not shown in the figures, other hardware and/or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to cause a computing device (which may be a personal computer, a server, or a network device, etc.) to execute the method for controlling the functional safety of the controller of the vehicle device control system according to the embodiments of the present disclosure.

Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.

Claims

1. A controller for a vehicle equipment control system, the controller comprising:

2. The controller of claim 1, wherein the functional safety unit comprises:

3. The controller according to claim 2, wherein determining the first fault caused by a device failure of the vehicle among the faults causing passenger safety injury based on the input satisfying a functional safety level comprises:

performing a logical operation on the input;

comparing the result of the operation to a functional safety objective to determine the first fault.

4. The controller according to claim 2, wherein determining the second failure caused by the operating environment failure among the failures causing passenger safety injury comprises:

determining the second fault based on any one of:

the second parameter does not satisfy the functional security level:

a safety failure of a processor of the controller;

a failure of a memory of the controller;

a program run failure of the controller;

a failure of an external monitoring unit of the vehicle equipment control system; and

a failure of a power supply of the controller.

5. The controller of claim 2, wherein the safety objective monitoring subunit is further configured to determine the first fault based on an input satisfying a functional safety level and an output of the functional control unit.

6. The controller of any one of claims 1-5, wherein the functional safety objective is based on the ISO26262 standard.

7. The controller of any one of claims 1 to 5, wherein the functional security level is defined by an Automotive Safety Integrity Level (ASIL).

8. The controller according to any one of claims 1 to 5, wherein the vehicle equipment control system is a power transmission system of the vehicle, and the controller is a transmission control unit.

9. A vehicle equipment control system comprising:

the controller of any one of claims 1 to 8;

a first driver for driving an actuator of a device of the vehicle;

an external monitoring unit for monitoring a failure of the functional safety unit and outputting a second enable signal when the failure is detected; and

a functional safety driver for driving an actuator of a device of the vehicle to bring the vehicle into a safe state.

10. The vehicle equipment control system according to claim 9,

the function control unit controls the device of the vehicle through the first driver.

11. The vehicle equipment control system according to claim 9,

the functional safety driver controls the vehicle to enter a safe state based on at least one of the first enable signal output by the functional safety unit and the second enable signal output by the external monitoring unit.

12. The vehicle equipment control system according to claim 9, characterized by further comprising:

a power supply for supplying power to the controller; and

the power supply monitoring unit is used for monitoring the fault of the power supply and outputting a third enabling signal when the fault is detected;

wherein the functional safety driver controls the vehicle to enter a safe state based on at least one of the first enable signal output by the functional safety unit, the second enable signal output by the external monitoring unit, and the third enable signal output by the power monitoring unit.

13. A method for functional safety control of a controller of a vehicle equipment control system, comprising:

monitoring a first parameter of the vehicle and controlling a device of the vehicle in response to the first parameter;

monitoring a second parameter of the vehicle that meets a functional safety level;

determining a fault causing a passenger safety injury based on the second parameter; and

outputting a first enable signal that controls the vehicle to enter a safe state in response to the fault causing the occupant safety injury.

14. The method of claim 13, wherein determining a fault that causes a passenger safety injury based on the second parameter further comprises:

providing an operating environment that satisfies a functional security level and an input that satisfies a functional security level based on the monitored second parameter;

determining a first fault caused by a device failure of the vehicle among the faults causing passenger safety injury based on the input, and outputting the first enable signal in response to the first fault; and

determining a second fault caused by the failure of the operating environment among the faults causing passenger safety injury and outputting the first enable signal in response to the second fault.

15. A computer-readable storage medium, on which a computer program is stored, the computer program comprising executable instructions that, when executed by a processor, carry out the method of any one of claims 1 to 8.

16. An electronic device, comprising:

a processor; and

a memory for storing executable instructions of the processor;

wherein the processor is arranged to execute the executable instructions to implement the method of any one of claims 1 to 8.