基于ISO 26262的车身域控制器开发  

Development of automotive body domain controller based on ISO 26262

作　　者：邵广亚 冯雪 张维 田松 张博 林海峰[2] SHAO Guangya;FENG Xue;ZHANG Wei;TIAN Song;ZHANG Bo;LIN Haifeng(Xuzhou XCMG Automobile Manufacturing Company Limited,Xuzhou 221000,China;College of Information Science and Technology,Nanjing Forestry University,Nanjing 210003,China)

机构地区：[1]徐州徐工汽车制造有限公司,徐州221000 [2]南京林业大学信息科学技术学院,南京210003

出　　处：《北京信息科技大学学报（自然科学版）》2024年第1期69-75,共7页Journal of Beijing Information Science and Technology University

基　　金：江苏省重点研发计划项目(BE2021716)。

摘　　要：使用单个微控制单元(microcontroller unit,MCU)的车身域控制器由于缺少外部芯片监控主控MCU的工作情况,缺少对多点故障失效的诊断覆盖,影响潜在失效率。此外,单MCU由于芯片引脚不足,使用复选芯片后大幅增加了单点故障失效率,因而很难达到功能安全等级B的要求。为满足功能安全的要求,设计了一种基于国产车规芯片AC78406的双MCU架构的车身域控制器。该控制器设计方案可消除多路复选芯片的硬件随机失效率,同时增加对MCU失效的诊断覆盖,从而提高功能安全等级。Body domain controllers using single microcontroller unit(MCU)lack diagnostic coverage for multi-point fault failures due to the lack of an external chip to monitor the operation of the master MCU,affecting the potential failure rate.In addition,the single MCU can hardly meet the requirements of functional safety level B due to the lack of chip pins,and the use of multiplexing chip dramatically increases the single-point fault failure rate.To meet the functional safety requirements,body domain controller with dual-MCU architecture based on the domestic automotive-gauge chip AC78406 was designed,which eliminated the hardware random failure rate of the multiplexing chip,and increased the diagnostic coverage of the MCU failures,thus improving the functional safety level.

关 键 词：域控制器 功能安全标准 硬件在环 

分 类 号：TP271[自动化与计算机技术—检测技术与自动化装置]