CN116279537A

CN116279537A - Control system and vehicle

Info

Publication number: CN116279537A
Application number: CN202310127871.9A
Authority: CN
Inventors: 卡伊·谢德; 罗杰·卡拉姆; 翟要; 霍尔格·尚茨
Original assignee: Yupao Robotics Usa
Current assignee: Yupao Robotics Usa
Priority date: 2023-02-09
Filing date: 2023-02-09
Publication date: 2023-06-23

Abstract

The specification provides a control system and a vehicle, wherein each ECU in the control system comprises a first data I/O interface, a second data I/O interface, a first performance chip, a second performance chip and a router, the router is respectively in communication connection with the first data I/O interface, the second data I/O interface, the first performance chip and the second performance chip, the operation mode of the router comprises a first model and a second mode, the router is communicated with the first performance chip and the second performance chip in the first mode, and the router is communicated with the first performance chip and the first data I/O interface in the second mode, and is communicated with the second performance chip and the second data I/O interface in the second mode. The control system can flexibly meet various different control requirements by controlling the operation mode of the router, so that the control system has higher expandability.

Description

Control system and vehicle

Technical Field

The present disclosure relates to the field of control technologies, and in particular, to a control system and a vehicle.

Background

Currently, electronic control units (Electronic Control Unit, ECU) are widely used in vehicles because they can be used to control the execution components in the vehicle. Illustratively, a variety of sensors are mounted in the vehicle that are capable of collecting data related to the operation of the vehicle. For example, the sensors can collect data on braking, shifting, speed, acceleration, etc. during vehicle operation. The ECU can acquire data acquired by at least part of the sensors and process the data to obtain control instructions. Thereafter, the ECU transmits a control instruction to the execution unit to realize control of the vehicle. Another example, in addition to pure sensor readings, is that the ECU may be applied to assist, automatic, autonomous driving. This may require the ECU to perform functions of reading sensors, sensor fusion, scene perception, path planning, and actuator control.

In the related art, control requirements (e.g., required computing performance) corresponding to different execution units in a vehicle are different. When designing the vehicle, a technician is required to respectively perform software and hardware design based on the control requirement corresponding to each execution component, so as to obtain the ECU corresponding to the execution component. However, after the ECU is designed, its corresponding calculation performance is fixed, and it is difficult to expand its calculation performance. This makes the control system less scalable.

Therefore, there is a need in the control art to provide a control system with high scalability.

Disclosure of Invention

The specification provides a control system with higher expandability and a vehicle.

In a first aspect, the present description provides a control system comprising: at least one electronic control unit ECU, wherein each ECU includes: a first data I/O interface and a second data I/O interface, a first performance chip and a second performance chip, and a router; the router is respectively in communication connection with the first data I/O interface, the second data I/O interface, the first performance chip and the second performance chip, wherein an operation mode of the router comprises a first mode and a second mode, in the first mode, the router is communicated with the first performance chip and the second performance chip, and in the second mode, the router is communicated with the first performance chip and the first data I/O interface and is communicated with the second performance chip and the second data I/O interface.

In some embodiments, the router comprises: a first routing component, a second routing component, and at least one security chip; the first routing component is respectively in communication connection with the first performance chip and the first data I/O interface; the second routing component is respectively in communication connection with the second performance chip, the second data I/O interface and the first routing component; the at least one security chip is communicatively coupled to the first routing component and the second routing component and configured to: in the first mode, the first routing component and the second routing component are controlled to be communicated with the first performance chip and the second performance chip, and in the second mode, the first routing component is controlled to be communicated with the first performance chip and the first data I/O interface, and the second routing component is controlled to be communicated with the second performance chip and the second data I/O interface.

In some embodiments, the at least one security chip comprises: a first security chip and a second security chip; the first security chip is respectively in communication connection with the first performance chip and the first routing component; and the second security chip is respectively in communication connection with the second performance chip and the second routing component.

In some embodiments, the control system further comprises: a first power source configured to power the first data I/O interface, the first performance chip, the first routing component, and the first security chip of each of the at least one ECU, and a second power source configured to power the second data I/O interface, the second performance chip, the second routing component, and the second security chip of each of the at least one ECU.

In some embodiments, the first performance chip generates first control data at runtime and the second performance chip generates second control data at runtime; and the at least one security chip is in communication connection with the first performance chip and the second performance chip, and at least one of the first control data and the second control data is verified during operation.

In some embodiments, each ECU further comprises: the PCB is provided with two performance chip interfaces, wherein the first data I/O interface and the second data I/O interface are arranged on the PCB, and the first performance chip and the second performance chip are respectively arranged on the two performance chip interfaces.

In some embodiments, the communication connection between the components in each ECU is a unified bus connection.

In some embodiments, the communication connection between the components in each ECU is based on the high speed serial computer expansion bus standard PCIe protocol.

In some embodiments, the at least one ECU comprises M ECUs connected in a preset topology, the M being an integer greater than 1; and the first data I/O interface of each ECU in the M ECUs is in communication connection with the first data I/O interface or the second data I/O interface of the ECU adjacent to the preset topological structure, so that the preset topological structure is in annular connection.

In some embodiments, the communication connection between the components in each ECU is based on a first communication protocol; the communication connection between the data I/O interfaces of the different ECUs is based on a second communication protocol; and the first communication protocol is the same as the second communication protocol.

In some embodiments, the at least one ECU comprises M ECUs, M being an integer greater than 1; and, the control system further comprises a switching circuit communicatively connected to the first data I/O interface and the second data I/O interface, respectively, of each of the M ECUs such that the M ECUs form a star connection.

In some embodiments, the switching circuit comprises: a first switch communicatively coupled to the first data I/O interface of each of the M ECUs, respectively, and a second switch communicatively coupled to the first switch and to the second data I/O interface of each of the M ECUs, respectively.

In a second aspect, the present specification also provides a vehicle comprising: an execution component and a control system; wherein the control system comprises at least one electronic control unit ECU configured to send control data to the execution means, wherein each ECU comprises: a first data I/O interface, a second data I/O interface, a first performance chip, a second performance chip, and a router; the router is respectively in communication connection with the first data I/O interface, the second data I/O interface, the first performance chip and the second performance chip, wherein an operation mode of the router comprises a first mode and a second mode, in the first mode, the router is communicated with the first performance chip and the second performance chip, and in the second mode, the router is communicated with the first performance chip and the first data I/O interface and is communicated with the second performance chip and the second data I/O interface.

In some embodiments, the router comprises: a first routing component, a second routing component, and at least one security chip; the first routing component is respectively in communication connection with the first performance chip and the first data I/O interface; the second routing component is respectively in communication connection with the second performance chip, the second data I/O interface and the first routing component; and, the at least one security chip communicatively coupled to the first routing component and the second routing component, configured to: in the first mode, the first routing component and the second routing component are controlled to be communicated with the first performance chip and the second performance chip, and in the second mode, the first routing component is controlled to be communicated with the first performance chip and the first data I/O interface, and the second routing component is controlled to be communicated with the second performance chip and the second data I/O interface.

In some embodiments, the at least one ECU comprises M ECUs connected in a preset topology, the M being an integer greater than 1; and the first data I/O interface of each ECU in the M ECUs is in communication connection with the second data I/O interface of the ECU adjacent to the preset topological structure, so that the preset topological structure is in annular connection.

According to the technical scheme, each ECU comprises a first data I/O interface, a second data I/O interface, a first performance chip, a second performance chip and a router, wherein the router is respectively in communication connection with the first data I/O interface, the second data I/O interface, the first performance chip and the second performance chip, the operation mode of the router comprises a first model and a second mode, the router is communicated with the first performance chip and the second performance chip in the first mode, and the router is communicated with the first performance chip and the first data I/O interface in the second mode and is communicated with the second performance chip and the second data I/O interface in the second mode. Based on the scheme, the operation mode of the router can be controlled, so that the ECU can flexibly meet various different control requirements, for example, the router can be controlled to work in a first mode to realize the control requirements by using the calculation performance of a single ECU, and for example, the router can also be controlled to work in a second mode to realize the control requirements by combining the calculation performance of a plurality of ECUs. Therefore, the control system provided by the application has higher expandability.

Other functions of the control system and the vehicle provided in the present specification will be partially set forth in the following description. The inventive aspects of the control systems and vehicles provided herein may be fully explained by the practice or use of the methods, devices, and combinations described in the following detailed examples.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present description, the drawings that are needed in the description of the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present description, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 shows a schematic structural view of a vehicle provided according to an embodiment of the present specification;

fig. 2 shows a schematic structural diagram of an ECU provided according to an embodiment of the present specification;

fig. 3 shows a schematic diagram of a data path of a single ECU in a first mode provided according to an embodiment of the present specification;

fig. 4 shows a schematic diagram of a data path of a single ECU in a second mode provided according to an embodiment of the present specification;

FIG. 5A shows a schematic diagram of a ring-shaped data path formed by 2 ECUs provided in accordance with an embodiment of the present description;

FIG. 5B shows a schematic diagram of a 4 ECU formed annular data path provided in accordance with an embodiment of the present disclosure;

FIG. 6 shows a schematic diagram of a control system powered by two power sources provided in accordance with an embodiment of the present disclosure;

fig. 7A shows a schematic diagram of forming a star connection between a plurality of ECUs provided in accordance with an embodiment of the present specification;

fig. 7B shows another schematic diagram of forming a star connection between a plurality of ECUs provided in accordance with an embodiment of the present specification;

FIG. 8 shows a schematic diagram of a PCB provided in accordance with an embodiment of the present description and generating different control systems based on the PCB; and

fig. 9 shows a schematic structural diagram of a Soc provided according to an embodiment of the present specification.

Detailed Description

The following description is presented to enable one of ordinary skill in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the disclosure. Thus, the present description is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the claims.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting. For example, as used herein, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. The terms "comprises," "comprising," "includes," and/or "including," when used in this specification, are taken to specify the presence of stated integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

These and other features of the present specification, as well as the operation and function of the related elements of structure, as well as the combination of parts and economies of manufacture, may be significantly improved upon in view of the following description. All of which form a part of this specification, reference is made to the accompanying drawings. It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the description. It should also be understood that the drawings are not drawn to scale.

The flowcharts used in this specification illustrate operations implemented by systems according to some embodiments in this specification. It should be clearly understood that the operations of the flow diagrams may be implemented out of order. Rather, operations may be performed in reverse order or concurrently. Further, one or more other operations may be added to the flowchart. One or more operations may be removed from the flowchart.

The use of prefix words such as "first", "second", etc. in this specification is merely for convenience in distinguishing and describing different things that fall under the same name class, and does not restrict the order or number of things. For example, the "first information" and the "second information" are merely information of different contents or purposes, and have no time-sequence relationship or priority relationship, and the first information may be one information or a plurality of information, and the second information may also be one information or a plurality of information.

In the present specification, "at least one" means one or more, and "a plurality" means two or more. "and/or", describes an association relationship of an association object, and indicates that there may be three relationships, for example, a and/or B, and may indicate: a alone, a and B together, and B alone, wherein a, B may be singular or plural. The character "/" generally indicates that the context-dependent object is an "or" relationship. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b, or c may represent: a, a; b; c, performing operation; a and b; a and c; b and c; or a and b and c. Wherein a, b and c can be single or multiple.

In the present application, the connection may be a direct connection or an indirect connection. For example, the connection between A and B may be a direct connection between A and B or a connection between A and B via C.

Fig. 1 shows a schematic structural diagram of a vehicle 10 provided according to an embodiment of the present specification. The vehicle 10 may be an autonomous vehicle or a non-autonomous vehicle. When the vehicle 10 is an autonomous vehicle, the automatic driving level of the vehicle 10 may be any one of the following levels: auxiliary driving level, semi-automatic driving level, and full-automatic driving level. As shown in fig. 1, the vehicle 10 may include an implement 100, a sensing system 110, and a control system 200.

The execution unit 100 is a unit of the vehicle 10 that can receive control data and control the vehicle 10 based on the control data. For example, the implement 100 may include, but is not limited to, components in the vehicle 10 such as the engine, transmission, chassis, throttle, engine, brake system, and steering system (including steering of tires and/or operation of steering lights) drive the implement. The implement assembly 100 may also include other components in the vehicle 10.

The sensing system 110 includes a plurality of sensors. The plurality of sensors may include various internal and external sensors that provide data to the vehicle 10. Such as shown in fig. 1, the plurality of sensors may include vehicle component sensors and environmental sensors. The vehicle component sensors are coupled to the implement components 100 of the vehicle 10 and can detect the operating conditions and parameters of various components of the implement components 100.

The environmental sensors allow the vehicle to understand and potentially respond to its environment in order to assist the vehicle 10 in navigation, path planning, and safeguarding passengers and persons or property in the surrounding environment. The environmental sensors may also be used to identify, track and predict the movement of objects, such as pedestrians and other vehicles. The environmental sensor may include a position sensor and an external object sensor.

The position sensor may comprise a GPS receiver, accelerometer and/or gyroscope, the receiver. The position sensor may sense and/or determine a plurality of geographic locations and orientations of the vehicle 10. For example, the latitude, longitude, and altitude of the vehicle are determined.

The external object sensor may detect objects external to the vehicle, such as other vehicles, obstacles in the road, traffic signals, signs, trees, etc. The external object sensor may include a laser sensor, radar, camera, sonar, and/or other detection device.

The control system 200 is communicatively coupled to the execution unit 100 and the sensing system 110. Upon receiving the information sensed by the sensing system 110, the control system 200 may process information and/or data related to vehicle driving (e.g., autopilot) and send control data to the execution unit 100 to perform one or more of the functions described in this disclosure.

It should be noted that the number of the execution units 100 included in the vehicle 10 may be one or more. When the number of the execution units 100 included in the vehicle 10 is plural, each execution unit 100 may correspond to one control system 200. For example, the vehicle 10 may include: the system comprises an engine, a transmission, a chassis, a control system corresponding to the engine, a control system corresponding to the transmission and a control system corresponding to the chassis.

With continued reference to fig. 1, control system 200 may include at least one ECU 300. The number of ECUs 300 included in control system 200 may be one or plural, for example, 2, 3, 4, or more, and the present application is not limited thereto. In fig. 1, an ECU is illustrated as an example. In some embodiments, in the case where vehicle 10 includes a plurality of execution units 100, one ECU 300 may be included in control system 200 corresponding to some execution units 100, and a plurality of ECUs 300 may be included in control system 200 corresponding to other execution units 100.

Fig. 2 shows a schematic configuration diagram of an ECU 300 provided according to the embodiments of the present specification. As shown in fig. 2, ECU 300 may include at least: two first data Input/Output (I/O) interfaces, two performance chips (performance chips), and a router (route selector) 350. For example, the performance chip may be performance SOC (performance SOC). For convenience of description, two first data I/O interfaces are hereinafter described as a first data I/O interface 310 and a second data I/O interface 320, respectively, and two performance chips are hereinafter described as a first performance chip 330 and a second performance chip 340, respectively. It should be appreciated that first data I/O interface 310 and second data I/O interface may be interchanged and first performance chip 330 and second performance chip 340 may be interchanged in the same ECU 300.

First data I/O interface 310 and second data I/O interface 320 are used for data transfer between different ECUs 300. In some embodiments, where control system 200 includes multiple ECUs 300, first data I/O interface 310 and second data I/O interface 320 may each be communicatively coupled to data I/O interfaces of other ECUs configured to receive data from, or output data to, the other ECUs.

In some embodiments, the first data I/O interface and the second data I/O interface may each be a line driver (LineDriver) based interface. For example, the first data I/O interface and the second data I/O interface may employ a Retimer chip to equalize and enhance the control data.

The first performance chip 330 and the second performance chip 340 are chips having a certain computational performance. In some embodiments, both the first performance chip 330 and the second performance chip 340 are configured to generate control data, i.e., the first performance chip 330 generates first control data at run-time; the second performance chip 340 generates second control data at run-time. For example, the control data may be obtained by collecting data from at least some of the sensors in the vehicle by the performance chip (the first performance chip 330 or the second performance chip 340) and performing calculation processing on the data. For another example, the control data may be obtained by receiving, by the performance chip (the first performance chip 330 or the second performance chip 340), the previous control data from the other performance chip, and performing calculation processing on the previous control data. The other performance chips may be other performance chips in the same ECU or other performance chips in different ECUs. For another example, the control data may be acquired by a performance chip (the first performance chip 330 or the second performance chip 340) from at least some of the sensors in the vehicle and the previous control data received from other ECU, and the data acquired by the sensors and the previous control data are calculated.

ECU 300 achieves expansion of computational performance by including two performance chips, as compared to including only 1 performance chip. This design improves the computational performance of a single ECU.

In some embodiments, control data generated by first performance chip 330 and second performance chip 340 in the same ECU 300 are the same. In this case, the first performance chip 330 and the second performance chip 340 implement the same control function, being a redundant backup relationship. The redundant backup performance chip is arranged in the control system, so that the safety of the control function provided by the control system can be improved, and the control system is suitable for scenes with higher safety of the control function.

In some embodiments, the control data generated by first performance chip 330 and second performance chip 340 are different. In this case, the first performance chip 330 and the second performance chip 340 implement different control functions. The control requirement of the execution component is realized through the cooperative work of the first performance chip 330 and the second performance chip 340, and the method can be suitable for a scene with complex control requirement of the execution component.

With continued reference to FIG. 2, the router 350 is communicatively coupled to the first data I/O interface 310, the second data I/O interface 320, the first performance chip 330, and the second performance chip 340, respectively. The modes of operation of the selector 350 include a first mode and a second mode. Depending on the mode of operation, the router 350 may controllably form different data paths between the first performance chip 330, the second performance chip 340, the first data I/O interface 310, and the second data I/O interface 320, respectively.

In the first mode, the router 350 communicates the first performance chip 330 with the second performance chip 340. In this way, data may be transferred between the first performance chip 330 and the second performance chip 340. For example, control data generated by the first performance chip 330 may be transferred to the second performance chip 340, or control data generated by the second performance chip 340 may be transferred to the first performance chip 330.

In the second mode, the router 350 communicates the first performance chip 330 with the first data I/O interface 310 and communicates the second performance chip 340 with the second data I/O interface 320. In this way, data may be transferred between the first performance chip 330 and the first data I/O interface 310. For example, control data generated by the first performance chip 330 may be transferred to the first data I/O interface 310, and further transferred to other ECUs through the first data I/O interface 310; alternatively, the first data I/O interface may receive control data from other ECUs, which in turn are passed to the first performance chip 330 via the first data I/O interface. Data may be transferred between the second performance chip 340 and the second data I/O interface 320. For example, control data generated by the second performance chip 340 may be transferred to the second data I/O interface 320, and further transferred to other ECUs through the second data I/O interface 320; alternatively, the second data I/O interface 320 may receive control data from other ECUs, which in turn are passed to the second performance chip 340 via the second data I/O interface 320.

It should be appreciated that since the operation mode of the router 350 includes a first mode in which the router 350 is capable of communicating the first performance chip 330 and the second performance chip 340 and a second mode in which the router 350 is capable of communicating the first performance chip 330 with the first data I/O interface 310 and communicating the second performance chip 340 with the second data I/O interface 320, the ECU can flexibly meet a variety of different control requirements by controlling the operation mode of the router 350. For example, in a scenario where the control requirements of the execution unit are relatively simple, the selector 350 may be controlled to operate in the first mode, thereby achieving the control requirements of the execution unit using the computational capabilities of the single ECU. For another example, in a scenario where the control requirements of the execution unit are complex, the router 350 may be controlled to operate in the second mode, so that the control requirements of the execution unit can be implemented in conjunction with the computing performance of the multiple ECUs. Therefore, the calculation performance of the control system provided by the application has higher expandability.

With continued reference to fig. 1, in some embodiments, the router 350 may include a first routing component 351, a second routing component 352, and at least one security chip (safetychip). In some embodiments, the security chip may be security SOC (safetysystemon chip)

Wherein the first routing component 351 may be communicatively coupled to the first performance chip 330 and the first data I/O interface 310, respectively. The second routing component 352 may be communicatively coupled with the first routing component 351, the second performance chip 340, and the second data I/O interface 320, respectively. The at least one security chip may be communicatively coupled to the first routing component 351 and the second routing component 352. In the first mode, the at least one security chip may communicate the first performance chip 330 with the second performance chip 340 by controlling states of the first routing part 351 and the second routing part 352. In the second mode, the at least one security chip may communicate the first performance chip 330 with the first data I/O interface by controlling the state of the first routing part 351, and may communicate the second performance chip 340 with the second data I/O interface by controlling the state of the second routing part 352. That is, the at least one security chip may implement a routing function by controlling the first routing part 351 and the second routing part 352.

In some embodiments, the first routing component 351 and the second routing component 352 may employ Multiplexers (Multiplexers). A multiplexer is a device that can implement a single pole double throw like function. For example, the multiplexer may include a static contact, a first dynamic contact, a second dynamic contact, and a communication. The first end of the communicating member is connected with the static contact, and the second end of the communicating member can be selectively connected with the first dynamic contact or the second dynamic contact. An exemplary connection is as follows: the static contacts of the first routing element 351 are connected to the first performance chip 330, the static contacts of the second routing element 352 are connected to the second performance chip 340, the first dynamic contacts of the first routing element 351 are connected to the first data I/O interface 310, the first dynamic contacts of the second routing element 352 are connected to the second data I/O interface 320, and the second dynamic contacts of the first routing element 351 are connected to the second dynamic contacts of the second routing element 351.

In the first mode, the at least one security chip may control the second end of the communication in the first routing member 351 to be connected to the second dynamic contact and control the communication in the second routing member 352 to be connected to the second dynamic contact such that a data path is formed between the first performance chip 330, the static contact of the first routing member 351, the second dynamic contact of the second routing member 352, the static contact of the second routing member 352, and the second performance chip 340.

In the second mode, the at least one security chip may control the second ends of the communication members in the first routing member 351 to be connected to the first dynamic contact such that a data path is formed between the first performance chip 330, the static contact of the first routing member 351, the first dynamic contact of the first routing member 352, and the first data I/O interface 310. The at least one security chip may also control the connection of the communication in the second routing component 352 to the first dynamic contact such that a data path is formed between the second performance chip 340, the static contact of the second routing component 352, the first dynamic contact of the second routing component 352, and the second data I/O interface 320.

In some embodiments, with continued reference to fig. 2, the at least one security chip includes a first security chip 353 and a second security chip 354. The first security chip 353 is communicatively coupled to the first routing component 351 and the second security chip 354 is communicatively coupled to the second routing component 352. In the first mode, the first security chip 353 controls the state of the first routing part 351, and the second security chip 354 controls the state of the second routing part 352 to communicate the first performance chip 330 with the second performance chip 340. In the second mode, the first security chip 353 controls the state of the first routing part 351 to communicate the first performance chip 330 with the first data I/O interface 310; the second security chip 354 controls the state of the second routing component 352 to communicate the second performance chip 340 with the second data I/O interface 320.

In some embodiments, the at least one security chip is further configured to perform a verification process on control data generated by the performance chip (at least one of the first performance chip 330 and the second performance chip 340). In some embodiments, with continued reference to FIG. 2, the first secure chip 353 is also communicatively coupled to the first performance chip 330, the second secure chip 354 is also communicatively coupled to the second performance chip 340, and the first secure chip 353 and the second secure chip 354 are also communicatively coupled.

In the following, a specific application scenario is taken as an example, and the control system 200 and the data transmission manner in the control system 200 are illustrated in conjunction with fig. 3 to 7.

In some exemplary application scenarios, the control requirements of the execution components in the vehicle 10 are relatively simple, and the control requirements of the execution components can be completed by a single ECU 300. In this case, the control system 200 corresponding to the execution means may include 1 ECU 300, and the structure of the ECU 300 is shown in fig. 2. The router 350 in this ECU 300 operates in the first mode. As an example, fig. 3 shows a schematic diagram of a data path of a single ECU in a first mode provided according to an embodiment of the present specification. As shown in fig. 3, in the first mode, since the router 350 in the ECU 300 communicates the first performance chip 330 and the second performance chip 340, a circular data path may be formed between the first performance chip 330, the second performance chip 340, the second security chip 354 and the first security chip 353 in the ECU 300. The different chips may have previously been data transferred based on a circular data path.

Based on the ring-shaped data path shown in fig. 3, control data can be transferred from one of the chips to any one of the other 3 chips. The security chip may perform the verification process on the control data generated by the performance chip in a variety of ways. For example, the first security chip 353 is configured to perform a verification process on the control data generated by the first performance chip 330, and the second security chip 354 is configured to perform a verification process on the control data generated by the second performance chip 340. For another example, the first security chip 353 is configured to perform a verification process on the control data generated by the second performance chip 340, and the second security chip 354 is configured to perform a verification process on the control data generated by the first performance chip 330. Of course, other manners may be used, and this application is not limited thereto. Based on the annular data path, communication conflict does not occur when control data is transmitted, so that the jitter of a control system is low and the throughput is high.

Based on the annular data path shown in fig. 3, the control system 200 may control the execution units in the following manners. For example, the first performance chip 330 generates first control data and passes the first control data along the ring data path to the first security chip 353. The first security chip 353 performs authentication processing on the first control data. In the case where the verification result is that the preset security condition is satisfied, the first security chip 353 or the first performance chip 330 transmits the first control data to the execution part. For another example, the second performance chip 340 generates second control data and passes the second control data along the ring data path to the second security chip 354. The second security chip 354 performs authentication processing on the second control data. In the case where the verification result is that the preset security condition is satisfied, the second security chip 354 or the second performance chip 340 transmits the second control data to the execution part. For another example, the first performance chip 330 generates first control data and passes the first control data along a ring data path to the first security chip 353. The first security chip 353 performs authentication processing on the first control data. In case that the verification result is that the preset security condition is satisfied, the first performance chip 330 transfers the first control data to the second performance chip 340 along the ring-shaped data path. The second performance chip 340 generates second control data based on the first control data and passes the second control data along the ring data path to the second security chip 354. The second security chip 354 performs authentication processing on the second control data. In the case that the verification result is that the preset security condition is satisfied, the second security chip 354 or the second performance chip 340 transmits the second control data to the execution part.

In some exemplary application scenarios, the control requirements corresponding to the execution components in the vehicle 10 are complex, and the control requirements of the execution components may not be satisfied by the single ECU 300. In this case, the control system 200 corresponding to the execution means may include a plurality of ECUs 300, so that control of the execution means is achieved by cooperative work among the plurality of ECUs 300. Wherein the structure of each ECU 300 is shown in fig. 2. The router 350 in each ECU 300 operates in the second mode. As an example, fig. 4 shows a schematic diagram of a data path of a single ECU in the second mode provided according to the embodiments of the present specification. As shown in fig. 4, in the second mode, since the router 350 in each ECU 300 communicates with the first performance chip 330 and the first data I/O interface 310 and communicates with the second performance chip 340 and the second data I/O interface 320, one data path is formed between the first data I/O interface 310, the first performance chip 330, the second performance chip 340, the second security chip 354, the first security chip 353 and the second data I/O interface 320 in each ECU 300. Data transfer between different chips may be based on the data path.

In some embodiments, where control system 200 includes M ECUs, M is an integer greater than 1, based on the data paths formed in the single ECU shown in fig. 4. The M ECUs are connected in a preset topological structure. In some embodiments, the predetermined topology is a ring connection. In such a connection, the first data I/O interface of each ECU of the M ECUs is communicatively connected to the first data I/O interface or the second data I/O interface of a topologically adjacent ECU, so that the performance chips of the M ECUs form a ring connection. The "the performance chips of the M ECUs form a ring connection" means that, among the performance chips included in the M ECUs, the two performance chips are communicatively connected to form one ring data path. The amphoteric performance chips may be directly connected or indirectly connected, which is not limited herein.

As one example, assume that m=2. The control system 200 includes 2 ECUs, ECU-1 and ECU-2, respectively. The connection relationship between the data I/O interfaces of the 2 ECUs may be as follows: the first data I/O interface of the ECU-1 is in communication connection with the second data I/O interface of the ECU-2, and the first data I/O interface of the ECU-2 is in communication connection with the second data I/O interface of the ECU-1. In this way, the performance chips of 2 ECUs are made to form a ring connection. Fig. 5A shows a schematic diagram of a ring-shaped data path formed by 2 ECUs provided according to an embodiment of the present specification. Note that, in fig. 5A, the connection relationship between the data I/O interfaces in the 2 ECUs is omitted. As shown in fig. 5A, the first safety chip 353 in the ECU-1, the first performance chip 330 in the ECU-1, the second performance chip 340 in the ECU-2, the second safety chip 354 in the ECU-2, the first safety chip 353 in the ECU-2, the first performance chip 330 in the ECU-2, the second performance chip 340 in the ECU-1, the second safety chip 354 in the ECU-1, and the first safety chip 353 in the ECU-1 are sequentially communicated, forming a ring-shaped data path between the respective chips of the 2 ECUs. It should be understood that the data transfer manner based on the ring data path shown in fig. 5A is similar to the data transfer manner based on the ring data path shown in fig. 3, and will not be described here.

As one example, assume that m=4. The control system 200 includes 4 ECUs, namely ECU-1, ECU-2, ECU-3, and ECU-4. The connection relationship between the data I/O interfaces of the 4 ECUs may be as follows: the first data I/O interface of ECU-1 may be communicatively coupled to the second data I/O interface of ECU-2, the first data I/O interface of ECU-2 may be communicatively coupled to the second data I/O interface of ECU-3, the first data I/O interface of ECU-3 may be communicatively coupled to the second data I/O interface of ECU-4, and the first data I/O interface of ECU-4 may be communicatively coupled to the second data I/O interface of ECU-1. In this way, the performance chips of the 4 ECUs are made to form a ring connection.

Fig. 5B shows a schematic diagram of a ring-shaped data path formed by 4 ECUs provided according to an embodiment of the present specification. Note that, in fig. 5B, the connection relationship between the data I/O interfaces in the 4 ECUs is omitted. As shown in FIG. 5B, the first performance chip 353 in ECU-1, the first performance chip 330 in ECU-1, the second performance chip 340 in ECU-2, the second performance chip 354 in ECU-2, the first performance chip 353 in ECU-2, the first performance chip 330 in ECU-2, the second performance chip 340 in ECU-3, the second performance chip 354 in ECU-3, the first performance chip 353 in ECU-3, the first performance chip 330 in ECU-3, the second performance chip 340 in ECU-4, the second performance chip 354 in ECU-4, the first performance chip 353 in ECU-4, the second performance chip 340 in ECU-1, the second security chip 354 in ECU-1, the first security chip 353 in ECU-1 are in communication in sequence, forming an annular data path between the respective chips of the 4 ECUs. It should be understood that the data transfer manner based on the ring data path shown in fig. 5B is similar to the data transfer manner based on the ring data path shown in fig. 3, and will not be described here.

It should be understood that the data paths formed between the plurality of ECUs shown in fig. 5A and 5B described above are only some possible examples, and other forms of data paths may be formed, which are not limited in this application. In the control system shown in fig. 5A and 5B, the data I/O interfaces of different ECUs are connected to each other, so that the calculation performance of the control system can be extended by increasing the number of ECUs in the control system.

In some embodiments, the control system may further include a first power source and a second power source. The first power supply and the second power supply are two mutually independent power supply systems, the two power supply systems are not mutually influenced, and the first power supply and the second power supply are both configured to provide electric energy for the ECU in the control system. Fig. 6 shows a schematic diagram of a control system powered by two power sources provided in accordance with an embodiment of the present description. Taking the control system as an example comprising two ECUs, the control system may comprise a first power source and a second power source in addition to the ECU-1 and the ECU-2 (the first power source and the second power source are not explicitly shown in FIG. 6). Wherein the first data I/O interface 310, the first performance chip 330, the first routing part 351, and the first security chip 353 of each ECU in the control system are all connected to a first power supply. That is, the first power supply is configured to supply power to the first data I/O interface 310, the first performance chip 330, the first routing part 351, and the first security chip 353 of each ECU in the control system. The second data I/O interface 320, the second performance chip 340, the second routing component 352, and the second security chip 354 of each ECU in the control system are all connected to a second power supply. That is, the second power supply is configured to supply power to the second data I/O interface 320, the second performance chip 340, the second routing component 352, and the second security chip 354 of each ECU in the control system.

In the control system shown in fig. 6, since a part of the components on the ECU is supplied with power by the first power source and another part of the components is supplied with power by the second power source, when the first power source fails, the components connected to the first power source on the ECU cannot function normally, and the components connected to the second power source are not affected. Similarly, when the second power source fails, the components of the ECU connected to the second power source cannot function properly, and the components connected to the first power source are not affected. Thus, the control system can improve the reliability of a single ECU by adopting two independent power supplies to supply power to different components of the ECU.

In the control system shown in fig. 6, for the whole control system, when the first power supply and the second power supply work normally, the control system may form a ring-shaped data path as shown in fig. 5A, and a data transfer process based on the ring-shaped data path may be referred to the related description above, which is not repeated herein. When one of the power supplies fails, only a portion of the segments in the ring data path will be rendered inoperable, without causing paralysis of the entire ring data path. For example, referring to fig. 6, assuming a failure of the second power supply, the components (i.e., the second data I/O interface 320, the second performance chip 340, the second routing part 352, and the second security chip 354 of the ECU-1, and the second data I/O interface 320, the second performance chip 340, the second routing part 352, and the second security chip 354 of the ECU-2) connected to the second power supply stop operating, and the components (i.e., the first data I/O interface 310, the first performance chip 330, the first routing part 351, and the first security chip 353 of the ECU-1, and the first data I/O interface 310, the first performance chip 330, the first routing part 351, and the first security chip 353) connected to the first power supply may also operate normally. In this case, the ring-shaped data path may be degraded into a linear data path, i.e., a linear data path that is transferred bi-directionally is formed between the first safety chip 353 of the ECU-1, the first performance chip 330 of the ECU-2, and the first safety chip 353 of the ECU-2. For example, the manner of data transfer from ECU-1 to ECU-2 may be as follows: in ECU-1, data may be transferred by first security chip 353 to first performance chip 330, via first routing component 351 to first data I/O interface 310. The data is then transferred to the first data I/O interface 310 of ECU-2 via the first data I/O interface 310 of ECU-1. In the ECU-2, the data is transferred to the first performance chip 353 via the first routing part 351, and further may be transferred to the first security chip 353. For another example, the manner of data transfer from ECU-2 to ECU-1 may be as follows: in ECU-2, data may be transferred by first security chip 353 to first performance chip 330, via first routing component 351 to first data I/O interface 310. The data is then transferred to the first data I/O interface 310 of ECU-1 via the first data I/O interface 310 of ECU-2. In the ECU-1, data is transferred to the first performance chip 353 via the first routing part 351, and further may be transferred to the first security chip 353. Therefore, the control system supplies power to different components by adopting two independent power supplies, and only a part of data transmission paths of the control system can be influenced under the condition of one power supply failure, and the situation that all the data transmission paths cannot work is avoided, so that the reliability of the whole control system can be improved.

In some embodiments, where control system 200 includes M ECUs, M is an integer greater than 1, based on the data paths formed in the single ECU shown in fig. 4. The M ECUs are connected in a preset topological structure. In some embodiments, the predetermined topology is a star connection. In such a connection, the control system 200 may also include a switching circuit 400. The first data I/O interface 310 and the second data I/O interface 320 of each of the M ECUs are connected with the switching circuit 400 such that the M ECUs form a star connection. For example, the switching circuit 400 may include a plurality of interfaces, and the different interfaces have a predetermined connection relationship therebetween. By connecting the first data I/O interface and the second data I/O interface of each ECU with different interfaces in the switching circuit 400, respectively, a data path can be formed between the different ECUs. That is, the connection between the performance chips in different ECUs can be achieved by the switching circuit 400.

As an example, fig. 7A shows a schematic diagram of forming a star connection between a plurality of ECUs provided according to an embodiment of the present specification. As shown in fig. 7A, control system 200 includes 3 ECUs 300 and switching circuit 400, wherein 3 ECUs 300 are ECU-1, ECU-2, and ECU-3, respectively. The first data I/O interface of ECU-1, the second data I/O interface of ECU-1, the first data I/O interface of ECU-2, the second data I/O interface of ECU-2, the first data I/O interface of ECU-3, and the second data I/O interface of ECU-3 are connected to the switching circuit 400, respectively. Thus, 3 ECUs form a star connection centered on the switching circuit 400. The connection relationship between the interfaces in the switching circuit 400 may be set according to the control requirements of the execution units to form a specific data path between the 3 ECUs, thereby satisfying the control requirements of the execution units. For example, assuming that the connection relationship between the interfaces in the switching circuit 400 is shown by a broken line in fig. 7A, one annular data path can be formed between 3 ECUs by means of the switching circuit 400. It should be noted that, by means of the switching circuit 400, a linear or other various forms of data paths may be formed between a plurality of ECUs, and the annular data path is only one possible example, which is not limited in this application.

Fig. 7B shows another schematic diagram of forming a star connection between a plurality of ECUs provided according to an embodiment of the present specification. Fig. 7B differs from fig. 7A in that the switching circuit 400 may include a first switch 401 and a second switch 402. The first switch 401 and the second switch 402 are in communication connection, and can exchange data therebetween. The first switch 401 is respectively communicatively connected to a first data I/O interface of each ECU in the control system, and the second switch 402 is respectively communicatively connected to a second data I/O interface of each ECU in the control system. In this way, the chips of different ECUs in the control system can be interconnected by the first exchanger 401 and the second exchanger 402.

It should be understood that in the control system shown in fig. 7B, the chips of different ECUs may exchange data through the first exchanger 401, may exchange data through the second exchanger 402, and may exchange data through both the first exchanger 401 and the second exchanger 402. For example, data may be transferred from the first security chip 353, the first performance chip 330 of the ECU-1 to the first performance chip 330, the first security chip 353 of the ECU-3 via the first switch 401. For another example, data may be transmitted from the

second security chip

354, 340 of the ECU-3 to the

second performance chip

340, 354 of the ECU-1 via the second switch 402. For another example, data may be transferred from the first secure chip 353, the first performance chip 330 of the ECU-1 to the second performance chip 340, the second secure chip 354 of the ECU-2 via the first switch 401 and the second switch 402. For another example, data may be transferred from the first secure chip 353, the first performance chip 330 of the ECU-2 to the second performance chip 340, the second secure chip 354 of the ECU-3 via the first switch 401 and the second switch 402. In some embodiments, a ring-shaped data path may also be formed between the chips of different ECUs via the first switch 401 and the second switch 402. For example, the annular data path formed between ECU-1 and ECU-3 may pass through: first security chip 353 of ECU-1, first performance chip 330 of ECU-1, first switch 401, first performance chip 330 of ECU-3, first security chip 353 of ECU-3, second security chip 354 of ECU-3, second performance chip 340 of ECU-3, second switch 402, second performance chip 340 of ECU-1, second security chip 353 of ECU-1. Therefore, the control system can form a plurality of data paths in different forms between a plurality of ECUs by the aid of the first switching circuit 401 and the second switching circuit 402, so that the data transmission mode in the control system is more flexible, and control requirements of different application scenes can be met conveniently.

In the control system shown in fig. 7B, when one of the first switch 401 and the second switch 402 fails, data exchange can be performed between the chips of each ECU through the other switch. For example, assuming that the first switch 401 fails, data transmission between the chips of ECU-1 and ECU-3 may be through the second switch 402. For example, assuming that the first performance chip 330 of ECU-1 needs to transmit data to the first performance chip 330 of ECU-3, the following data paths may be sequentially transferred: data is transmitted in the ECU-1 sequentially through the first performance chip 330, the first security chip 353, the second security chip 354, and the second performance chip 340, and then is transmitted to the ECU-3 through the second switch 402, and the data sequentially passes through the second performance chip 340, the second security chip 354, and the first security chip 353 in the ECU-3, and finally reaches the first performance chip 330. Therefore, the control system realizes redundant backup of the data exchange function by arranging the first exchanger 401 and the second exchanger 402, and under the condition that one exchanger fails, different ECUs in the control system can exchange data through the other exchanger, so that the overall operation of the control system is not influenced, and the reliability of the control system is improved.

Fig. 7A and 7B illustrate star connections formed by 3 ECUs 300 provided in the present application. In some embodiments, the ECU 300 provided in the present application may also form a star connection with other types of ECUs (e.g., ECUs designed in the related art) through the switching circuit 400, which is not exemplified.

In the control system shown in fig. 7A and 7B, the data I/O interfaces of different ECUs are connected to each other through a switching circuit, so that the calculation performance of the control system can be extended by increasing the number of ECUs in the control system.

In some embodiments, the communication connection between the components inside ECU 300 may be a Unified Bus (Unified Bus) connection. Taking ECU 300 shown in fig. 2 as an example, a communication connection between first performance chip 330 and first security chip 353, a communication connection between second performance chip 340 and second security chip 354, a communication connection between first security chip 353 and second security chip 354, a communication connection between first performance chip 330 and first routing component 351, a communication connection between second performance chip 340 and second routing component 352, a communication connection between first routing component 351 and first data I/O interface 310, and a communication connection between second routing component 352 and second data I/O interface 320 are all unified bus connections. Thus, the ECU 300 has high performance in terms of bandwidth, delay, jitter, and the like inside.

In some embodiments, the communication connections between the components within ECU 300 are based on a first communication protocol. For example, the first communication protocol may be: a high speed serial computer expansion bus standard (Peripheral Component Interconnect Express, PCIe) protocol or a modified PCIe protocol, wherein the modified PCIe protocol may be a standard PCIe protocol that makes changes/modifications at one, some, or more levels of the PCIe hierarchy. For another example, the first communication protocol may also be other protocols, such as the cache coherence interconnect standard (Cache Coherent Interconnect for Accelerators) protocol, the Injedax bus (NVLink) protocol, and the like.

In some embodiments, the communication connection between the data I/O interfaces of the different ECUs may be a unified bus connection. For example, in the example shown in FIG. 5A, the communication connection between the first data I/O interface 310 of ECU-1 and the second data I/O interface 320 of ECU-2, and the communication connection between the second data I/O interface 320 of ECU-1 and the first data I/O interface 310 of ECU-2 are all unified bus connections. For another example, in the example shown in FIG. 5B, the communication connection between the first data I/O interface 310 of ECU-1 and the second data I/O interface 320 of ECU-2, the communication connection between the first data I/O interface 310 of ECU-2 and the second data I/O interface 320 of ECU-3, the communication connection between the first data I/O interface 310 of ECU-3 and the second data I/O interface 320 of ECU-4, and the communication connection between the first data I/O interface 310 of ECU-4 and the second data I/O interface 320 of ECU-1 are all unified bus connections. For another example, in the example shown in FIG. 7A, the communication connection between the first data I/O interface 310 of ECU-1 and the switch circuit 400, the communication connection between the second data I/O interface 320 of ECU-1 and the switch circuit 400, the communication connection between the first data I/O interface 310 of ECU-2 and the switch circuit 400, the communication connection between the second data I/O interface 320 of ECU-2 and the switch circuit 400, the communication connection between the first data I/O interface 310 of ECU-3 and the switch circuit 400, and the communication connection between the second data I/O interface 320 of ECU-3 and the switch circuit 400 are all unified bus connections. Thus, different ECUs have higher performance in terms of bandwidth, delay, jitter and the like.

In some embodiments, the communication connection between the data I/O interfaces of the different ECUs is based on a second communication protocol. The second communication protocol is identical to the first communication protocol. For example, the first communication protocol and the second communication protocol are PCIe protocols, or the first communication protocol and the second communication protocol are other protocols. Because the second communication protocol is the same as the first communication protocol, the communication mode between different ECUs is the same as the communication mode inside each ECU, and seamless expansion between different ECUs is realized. In addition, the reusability of the software driver and the middleware codes is improved due to the fact that the same communication mode is adopted between the inside of the ECU and the ECU.

Fig. 2 to 7B described above illustrate a case where the number of security chips included in the router 350 is 2. In some embodiments, the number of security chips that the router 350 includes may also be 1. For illustration, the security chip included in the router 350 is referred to as a third security chip. The third security chip is communicatively coupled to the first routing component 351 and the second routing component 352, respectively. In the first mode, the third security chip controls states of the first routing part 351 and the second routing part 352 to communicate the first performance chip 330 with the second performance chip 340. This results in a circular data path between the third security chip, the first performance chip 330, and the second performance chip 340. In the second mode, the third security chip controls the state of the first routing part 351 to communicate the first performance chip 330 with the first data I/O interface 310, and controls the state of the second routing part 352 to communicate the second performance chip 340 with the second data I/O interface 320. Thus, a data path is formed among the first data I/O interface 310, the first performance chip 330, the third security chip, the second performance chip 340, and the second data I/O interface 320. It should be understood that the data paths formed in this case, and the expansion manner between the plurality of ECUs are similar to those of fig. 3 to 7B, and are not described here in detail.

With continued reference to fig. 2, in some embodiments, each ECU 300 may further include: a printed circuit board (Printed Circuit Board, PCB) 360. The first data I/O interface 310 and the second data I/O interface 320 are disposed on the PCB 360. Two performance chip interfaces (not shown in fig. 2) are also provided on the PCB, and the first performance chip 330 and the second performance chip 340 are respectively provided on the two performance chip interfaces. In some embodiments, at least one secure chip interface (not shown in fig. 2) is also provided on the PCB, and the secure chip included in the router 350 is also provided on the secure chip interface. For example, two secure chip interfaces are provided on the PCB, and the first secure chip 353 and the second secure chip 354 are respectively provided on the two secure chip interfaces. In some embodiments, the first routing member 351 and the second routing member 352 are also disposed on the PCB. In some embodiments, a bus between components in ECU 300 is also provided on the PCB.

Thus, by using the PCB, different control systems can be flexibly constructed by arranging different numbers of performance chips and/or safety chips on the chip interfaces of the PCB. An example is illustrated below in connection with fig. 8. Fig. 8 shows a schematic diagram of a PCB provided according to an embodiment of the present description and generating different control systems based on the PCB. In which (a) in fig. 8 is exemplified by a schematic view of a PCB without any chip. As shown in fig. 8 (a), two performance chip interfaces 361 and two security chip interfaces 362 are provided on the PCB 360. Fig. 8 (b), (c), (d), and (e) are schematic diagrams of a single ECU control system obtained by providing different numbers of chips on the PCB in (a). In fig. 8, (b), (c), (d) and (e) are only examples of the performance chip and the security chip, and other components (e.g., data I/O interface and routing means) are omitted.

In some embodiments, it is assumed that the control requirement of a certain execution unit is relatively simple, only one performance chip is needed to obtain the control data corresponding to the execution unit, and the control data does not need to be subjected to verification processing of a security chip. In this case, the first performance chip 330 may be disposed on one of the performance chip interfaces 361 of the PCB, to obtain a control system corresponding to the execution component. For example, the control system is as shown in (b) of fig. 8.

In some embodiments, it is assumed that the control requirement of a certain execution component is relatively simple, only one performance chip is required to obtain the control data corresponding to the execution component, and the control data is required to be subjected to verification processing of a security chip. In this case, the first performance chip 330 may be disposed on one of the performance chip interfaces 361 of the PCB, and the first security chip 353 may be disposed on one of the security chip interfaces 362, to obtain a control system corresponding to the execution component. For example, the control system is as shown in (c) of fig. 8.

In some embodiments, assuming that the control requirement of an execution unit is complex, two performance chips are required to obtain the control data corresponding to the execution unit, and the control data is required to be subjected to verification processing of a security chip. In this case, the first performance chip 330 and the second performance chip 340 may be respectively disposed on the two performance chip interfaces 361 of the PCB, and the first security chip 353 may be disposed on one of the security chip interfaces 362, so as to obtain a control system corresponding to the execution component. For example, the control system is as shown in (d) of fig. 8. In some embodiments, a first security chip 353 and a second security chip 354 may also be respectively disposed on the two security chip interfaces 362, resulting in a control system for the execution unit. For example, the control system is as shown in (e) of fig. 8.

It should be understood that (b) to (e) in fig. 8 are exemplified by a control system including a single ECU. In some embodiments, given that the control requirements of a certain execution unit are more complex, three or more performance chips are required to obtain the control data corresponding to the execution unit. In this case, a plurality of ECUs as shown in fig. 8 (c) or (d) may be combined to obtain a control system corresponding to the execution unit. It should be understood that, for a specific combination of multiple ECUs, reference may be made to the description of the relevant portions above, and the resulting control system is similar to that of fig. 5A, 5B, 7A or 7B, and will not be described here.

Based on fig. 8, the present application can be flexibly extended to obtain a plurality of control systems with different computing performances based on the same PCB hardware base. Specifically, based on the above-described PCB hardware foundation, by adjusting the number of chips provided inside the PCB, four forms of control systems as in (b), (c), (d), and (e) in fig. 8 can be obtained. Further, by adjusting the number of PCBs, a control system as shown in fig. 5A, 5B, 7A, or 7B may be obtained. Therefore, the control system provided by the application has higher expandability both in the ECU and among the ECUs. In addition, various control systems are realized based on the same PCB hardware base, so that the PCB has higher reusability, is convenient for large-scale mass production, and can also reduce development cost.

In some embodiments, first performance Chip 330, second performance Chip 340, first security Chip 353, and second security Chip 354 in ECU 300 may each be a System on Chip (SoC), which may also be referred to as a System on Chip. The structure of the SoC will be described with reference to fig. 9.

Fig. 9 shows a schematic structural diagram of an SoC provided according to an embodiment of the present specification. The SoC may be used as the first performance chip 330, the second performance chip 340, the first security chip 353, or the second security chip 354. As shown in fig. 9, the SoC500 may include at least one storage medium 510 and at least one processor 520. In some embodiments, soC500 may also include a communication port 530 and an internal communication bus 540. Meanwhile, the SoC500 may further include an I/O component 550.

Internal communication bus 540 may connect the various system components including storage media 510, processor 520, I/O components 550, and communication ports 530.

I/O component 550 supports input/output between SoC500 and other chips.

The communication port 530 is used for data communication between the SoC500 and the outside world. The communication port 530 may be a wired communication port or a wireless communication port.

The storage medium 510 may include a data storage device. The data storage device may be a non-transitory storage medium or a transitory storage medium. For example, the data storage device may include one or more of a magnetic disk 511, a Read Only Memory (ROM) 512, or a Random Access Memory (RAM) 513. The storage medium 510 further includes at least one set of instructions stored in the data storage device. The instruction set is computer program code that may include programs, routines, objects, components, data structures, procedures, modules, etc. for generating control data or that may include programs, routines, objects, components, data structures, procedures, modules, etc. for performing a verification process on control data.

The at least one processor 520 may be communicatively coupled with the at least one storage medium 510 and the communication port 530 via an internal communication bus 540. The at least one processor 520 is configured to execute the at least one instruction set described above. When the SoC500 is running, the at least one processor 520 reads the at least one instruction set and performs a method of generating control data or a method of performing a verification process on the control data according to an instruction of the at least one instruction set. Processor 520 may be in the form of one or more processors, in some embodiments processor 520 may include one or more hardware processors, such as microcontrollers, microprocessors, reduced Instruction Set Computers (RISC), application Specific Integrated Circuits (ASICs), application specific instruction set processors (ASIPs), central Processing Units (CPUs), general purpose graphics processing units (GPGPGPUs), physical Processing Units (PPUs), microcontroller units, digital Signal Processors (DSPs), field Programmable Gate Arrays (FPGAs), advanced RISC Machines (ARM), programmable Logic Devices (PLDs), any circuit or processor capable of executing one or more functions, or the like, or any combination thereof. For illustrative purposes only, only one processor 520 is depicted in Soc500 in this description. However, it should be noted that the SoC500 may also include multiple processors in this specification, and thus, the methods/steps of generating control data or verifying control data disclosed in this specification may be performed by one processor or may be performed jointly by multiple processors as described in this specification.

The foregoing describes specific embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

In view of the foregoing, it will be evident to a person skilled in the art that the foregoing detailed disclosure may be presented by way of example only and may not be limiting. Although not explicitly described herein, those skilled in the art will appreciate that the present description is intended to encompass various adaptations, improvements, and modifications of the embodiments. Such alterations, improvements, and modifications are intended to be proposed by this specification, and are intended to be within the spirit and scope of the exemplary embodiments of this specification.

Furthermore, certain terms in the present description have been used to describe embodiments of the present description. For example, "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the present description. Thus, it is emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various portions of this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined as suitable in one or more embodiments of the invention.

It should be appreciated that in the foregoing description of embodiments of the present specification, various features have been combined in a single embodiment, the accompanying drawings, or description thereof for the purpose of simplifying the specification in order to assist in understanding one feature. However, this is not to say that a combination of these features is necessary, and it is entirely possible for a person skilled in the art to label some of the devices as separate embodiments to understand them upon reading this description. That is, embodiments in this specification may also be understood as an integration of multiple secondary embodiments. While each secondary embodiment is satisfied by less than all of the features of a single foregoing disclosed embodiment.

Each patent, patent application, publication of patent application, and other materials, such as articles, books, specifications, publications, documents, articles, etc., cited herein are hereby incorporated by reference. All matters are to be interpreted in a generic and descriptive sense only and not for purposes of limitation, except for any prosecution file history associated therewith, any and all matters not inconsistent or conflicting with this document or any and all matters not complaint file histories which might have a limiting effect on the broadest scope of the claims. Now or later in association with this document. For example, if there is any inconsistency or conflict between the description, definition, and/or use of terms associated with any of the incorporated materials, the terms in the present document shall prevail.

Finally, it is to be understood that the embodiments of the application disclosed herein are illustrative of the principles of the embodiments of the present specification. Other modified embodiments are also within the scope of this specification. Accordingly, the embodiments disclosed herein are by way of example only and not limitation. Those skilled in the art can adopt alternative arrangements to implement the application in the specification based on the embodiments in the specification. Therefore, the embodiments of the present specification are not limited to the embodiments precisely described in the application.

Claims

1. A control system comprising at least one electronic control unit ECU, wherein each ECU comprises:

a first data I/O interface and a second data I/O interface;

a first performance chip and a second performance chip; and

a router in communication with the first data I/O interface, the second data I/O interface, the first performance chip, and the second performance chip, respectively, wherein the operation mode of the router comprises a first mode and a second mode,

in the first mode, the router communicates the first performance chip with the second performance chip, and

in the second mode, the router communicates the first performance chip with the first data I/O interface and communicates the second performance chip with the second data I/O interface.

2. The control system of claim 1, wherein the router comprises:

the first routing component is respectively in communication connection with the first performance chip and the first data I/O interface;

the second routing component is respectively in communication connection with the second performance chip, the second data I/O interface and the first routing component; and

at least one security chip communicatively coupled to the first routing component and the second routing component and configured to:

in the first mode, controlling the first routing component and the second routing component to communicate the first performance chip with the second performance chip, and

and in the second mode, controlling the first routing component to communicate the first performance chip with the first data I/O interface, and controlling the second routing component to communicate the second performance chip with the second data I/O interface.

3. The control system of claim 2, wherein the at least one security chip comprises:

the first security chip is respectively in communication connection with the first performance chip and the first routing component; and

and the second security chip is respectively in communication connection with the second performance chip and the second routing component.

4. A control system according to claim 3, wherein the control system further comprises:

a first power supply configured to supply power to the first data I/O interface, the first performance chip, the first routing component, and the first security chip of each of the at least one ECU; and

a second power supply configured to supply power to the second data I/O interface, the second performance chip, the second routing component, and the second security chip of each of the at least one ECU.

5. The control system of claim 2, wherein the first performance chip generates first control data at run-time and the second performance chip generates second control data at run-time; and

the at least one security chip is in communication connection with the first performance chip and the second performance chip, and at least one of the first control data and the second control data is verified during operation.

6. The control system according to claim 1, wherein each ECU further comprises: a Printed Circuit Board (PCB) provided with two performance chip interfaces,

Wherein the first data I/O interface and the second data I/O interface are disposed on the PCB, and the first performance chip and the second performance chip are disposed on the two performance chip interfaces, respectively.

7. The control system of claim 1, wherein the communication connection between the components in each ECU is a unified bus connection.

8. The control system of claim 7, wherein the communication connection between the components in each ECU is based on a high speed serial computer expansion bus standard PCIe protocol.

9. The control system of claim 1, wherein the at least one ECU comprises M ECUs connected in a preset topology, the M being an integer greater than 1; and

the first data I/O interface of each ECU of the M ECUs is communicatively connected to the first data I/O interface or the second data I/O interface of the ECU adjacent to the preset topology, so that the preset topology is connected in a ring shape.

10. The control system of claim 9, wherein the control system is configured to control the control system,

the communication connection between the components in each ECU is based on a first communication protocol;

the communication connection between the data I/O interfaces of the different ECUs is based on a second communication protocol; and

The first communication protocol is the same as the second communication protocol.

11. The control system of claim 1, wherein the at least one ECU comprises M ECUs, the M being an integer greater than 1; and

the control system further includes a switching circuit communicatively connected to the first data I/O interface and the second data I/O interface, respectively, of each of the M ECUs such that the M ECUs form a star connection.

12. The control system of claim 11, wherein the switching circuit comprises:

a first switch communicatively connected to the first data I/O interface of each of the M ECUs, respectively; and

and a second switch communicatively connected to the first switch and communicatively connected to the second data I/O interface of each of the M ECUs, respectively.

13. A vehicle, characterized by comprising:

an execution part; and

a control system comprising at least one electronic control unit ECU configured to send control data to the execution means, wherein each ECU comprises:

a first data I/O interface and a second data I/O interface;

a first performance chip and a second performance chip; and

14. The vehicle of claim 13, wherein the router comprises:

15. The vehicle of claim 14, characterized in that the at least one security chip comprises:

16. The vehicle of claim 15, wherein the control system further comprises:

17. The vehicle of claim 14, wherein the first performance chip generates first control data at run-time and the second performance chip generates second control data at run-time; and

18. The vehicle of claim 13, wherein each ECU further comprises: a Printed Circuit Board (PCB) provided with two performance chip interfaces,

19. The vehicle of claim 13, wherein the communication connection between the components in each ECU is a unified bus connection.

20. The vehicle of claim 19, wherein the communication connection between the components in each ECU is based on a high speed serial computer expansion bus standard PCIe protocol.

21. The vehicle of claim 13, wherein the at least one ECU comprises M ECUs connected in a preset topology, M being an integer greater than 1; and

22. The vehicle of claim 21, wherein the vehicle is a vehicle,

23. The vehicle of claim 13, wherein the at least one ECU comprises M ECUs, the M being an integer greater than 1; and

the control system further includes:

and a switching circuit which is respectively in communication connection with the first data I/O interface and the second data I/O interface of each ECU in the M ECUs, so that the M ECUs form a star connection.

24. The vehicle of claim 23, wherein the switching circuit comprises: