--Collect the "Automotive Driving Automation Classification" (GB/T 40429-2021)--
As vehicles become more electronic, electronic control units (ECUs) take over the entire car. From anti-lock braking system, four-wheel drive system, electronically controlled automatic transmission, active suspension system, airbag system, gradually extended to body safety, network, entertainment, sensing control system, etc. With the continuous improvement of the richness and complexity of automotive electronic functions, the number of automotive ECUs is increasing year by year, and the number of ECUs in some high-end models has exceeded 100.
The explosive growth of automotive electronics software has brought great challenges to the automotive electrical and electronic architecture. How to ensure data processing and network security optimization in more and more complex lines has become a problem, with one or several "brains" to control the whole car ECU and sensors is gradually becoming the future of automotive electrical and electronic architecture, domain-based domain controller Unit integration architecture is the best solution at present.
The so-called "domain" is to divide the automotive electronic system into several functional blocks according to the function, and the system architecture inside each function block is built by the domain controller as the leader, and replaces the previous distributed ECU architecture with a multi-core central computer with a high computing power. At present, the "domain" of the domain controller generally refers to the functional domain, which can be divided into five main domains: powertrain, chassis control, body control, entertainment system (cockpit domain), and ADAS according to the most typical classification method. In each domain, the domain controller is equivalent to a high-performance ECU that handles the function control and forwarding within the domain, which requires the controller itself to have powerful processing power and ultra-high real-time performance, as well as a large number of communication peripherals. System interconnection within each domain can still use the CAN and FlexRay communication buses, which are commonly used today. Communication between different domains requires Ethernet with higher transmission performance as the backbone network to undertake the task of information exchange.
The development of domain controllers, on the one hand, is due to the development needs of vehicle-mounted electronics, which can greatly optimize the vehicle electronic and electrical circuits. Using a domain architecture also separates sensing from processing, and sensors and ECUs are no longer one-to-one relationships and are easier to manage. In addition, proper integration can be done to reduce the number of ECUs. The scalability of the platform will also be better. With the centralization of ECUs, vehicle communication harnesses have also been greatly reduced, and the decline in vehicle parts costs is also evident. With the evolution of the vehicle's electrical and electronic architecture in the future, domain controllers will become more and more powerful. The demands on electronic design will also become higher and higher. This article will then discuss the advantages and applications of automotive domain controllers.
Reasons to use the domain controller integration schema
There are several reasons for the use of a domain controller integrated architecture instead of the previous multi-ECU decentralized architecture:
The number of functions in the car is gradually increasing and complicating
The current electronic architecture of automobiles integrates one or more functional features in each individual control unit. This not only increases the number of control units and distributed software functions, but also complicates the communication connections between the units. When cars need to add new features, the solution in the past has tended to be to add an additional ECU module and electrical wiring harness responsible for the corresponding functions. Nowadays, with the increasing degree of electronicity of cars, especially the increase of automatic driving, active safety and other functions, the number of ECUs in the car has increased rapidly, and the number of ECUs in a car will reach an average of 50-70, and the number of ECUs in some more complex luxury cars has already exceeded 100. The 2005 BMW 7 Series was already equipped with 65 ECUs. By 2010, the number of ECUs used on the Audi A8 exceeded 100. With so many ECUs staggered, not only does it lead to a very complex harness design, but also a very mixed logic control. The method of adding new features to cars by increasing the number of ECUs is no longer sustainable.
The need for high-speed data processing and complex software algorithms in the cars of the future
Domain controller technology is an irresistible trend in the development of future automobiles, and it is also the hardware basis for future automobiles to adapt to various technological trends. As the demand for complex functions such as safety and entertainment is increasing at an unprecedented rate, the cars of the future must have higher data processing and computing capabilities. Many OEMs claim to make cars "smartphones on wheels" in the future. When the car gradually develops towards a large mobile intelligent terminal, it must be made that the car is like a smart phone, constantly upgrading, through more computing power and better software algorithms to meet the new features and new functions required.
The traditional ECU distributed architecture can no longer support the needs of automobiles for high-speed data exchange and complex software algorithms, and there is not enough computing power to meet the growing requirements of computing data, and in-vehicle networks cannot support high-speed data transmission requirements. Compared with mobile phones, tablets and other devices, the use cycle of the car is much longer, as the major car companies launch more and more rich and diverse functions of the car, buyers often hope that the car they buy can have the same upgrade ability as the smart phone, rather than as in the past, the function and characteristics of the car remain basically unchanged throughout the life cycle of the car. All features and functions in ECU-based decentralized electronic architecture cars must be designed and implemented before the vehicle is launched, and consumer demand for rapid updates of car functions will not be met in the future.
Under the general trend of "software-defined cars", smart cars rely more on hardcore high-configuration hardware and powerful soft power software to meet the soft and hard combination parts required by a smart car. Over The Air Technology, which is all the rage today, is a remote upgrade to automotive hardware and software capabilities, and OTA updates can be used to provide new car features, optimize automotive software systems, patch bugs in automotive features, and improve the overall driving experience. OTAs have the ability to reduce recall costs, quickly respond to safety needs, and improve user experience, which has become an inevitable choice in the future era of intelligent vehicles
To achieve all of these goals, we need higher computing power, embedded memory capacity, and connectivity bandwidth, and only cars using domain controller architectures can meet the required hardware requirements.
Reduction in the cost of in-vehicle SOCs
Under the influence of Moore's Law in the electronics industry, the price of high-performance automotive SOC chips will further decline with technological progress and large-scale mass production. With the advancement of automotive intelligence, NVIDIA, Qualcomm, MTK and other mobile phone chip players have also begun to enter the automotive market, the cost of automotive SOCs has been falling sharply in recent years, getting closer and closer to the price of traditional MCUs, which is also one of the reasons why automakers use domain controllers with integrated functions.
Advantages of using a domain controller integration architecture
Compared to traditional ECU distributed architectures, domain controller architectures have the following key advantages:
Lightweight, high efficiency
Under the traditional ECU architecture, each additional new feature brings the corresponding ECU and wiring harness, resulting in an intricate wiring harness becoming the second heaviest component in the car after the engine. This design idea does not conform to the lightweight rules in car design and reduces the energy efficiency and mileage of the car. With a domain controller and an integrated ECU, the vehicle can remove multiple microcontrollers, power supplies, housings and copper wires, greatly simplifying the automotive electronic structure, achieving integration and manufacturing automation, reducing the weight of electronic components, and improving driving efficiency. Taking the automotive cockpit domain controller as an example, by integrating to replace the traditional dashboard, infotainment system and HUD display, the quality of the entire system can be reduced by more than 30%.
Cost reduction
Adding an additional ECU module to the new function is not sustainable, and the dedicated MCU, memory, power supply, PCB and other electronic components corresponding to the new ECU module will greatly increase the cost of manufacturing. As the price of in-vehicle SOC chips with powerful computing power continues to fall, in the case of an integrated cockpit solution, each vehicle could save at least about $70. With the explosion of mass production and shipments of domain controllers, the production cost of automobiles will be further reduced.
Data latency
Smart cars are often loaded with multiple sensors for sensing the external environment, and for safety reasons, vehicles need to be able to accept and process large amounts of data from their own sensors, other vehicles outside or infrastructure (V2X) in a timely manner, all of which must be able to be processed at real-time or very near real-time speeds in order to ensure the safety of the driving process.
Real-time processing of large amounts of data to ensure low data latency requires high-performance computing power and high-bandwidth network communication. Data only needs to be processed once in a domain controller with high-performance computing power and can be shared among different cores. In the architecture using a large number of ECU modules, data needs to be transmitted in different networks multiple times, and multiple operations are carried out, and the traditional ECU architecture will lead to low computational efficiency, high data latency, can not guarantee the rapid response ability of the car in the face of various emergencies, and the security is not high enough.
Upgradeability
With the continuous development of automobiles from mechanical products to digital electronic products, the level of software has become the core competitiveness of automobiles. Ten years ago, a car contained only about 10 million lines of software code. Today, a car has about 100 million lines of software code. In the future, the amount of software code for self-driving cars will reach 300 million to 500 million lines. The amount of code in automotive software is increasing exponentially, and due to the accumulation of code, security vulnerabilities need to be patched in a timely manner. Functional maintenance and complex software upgrades for cars will become even more important. Compared with the traditional distributed ECU architecture, the scalable computing power of domain controllers, more flexible vehicle OTA and the increase in the proportion of software make automakers have the ability to provide users with a continuously iterative and upgraded functional experience. In other words, car companies can upgrade the functions of the car simply by updating the software algorithm without adding additional ECUs.
The Internet of Everything
Due to the high-performance computing power and high-bandwidth communication of domain controllers, drivers can connect to their surrounding external environment through digital platforms and 5G networks. V2X technology will allow vehicles to communicate with other vehicles and road infrastructure to obtain environmental information. All of this data must be communicated and processed in real time, which requires high-bandwidth communication and high-performance in-vehicle computing power. It's clear that traditional discrete MCUs struggle to support high-speed communication and computing power.
Automotive domain controller design
Many technologies in the IT industry and consumer electronics can be migrated to the smart cars of the future. The in-vehicle SOC used in the future car, embedded operating systems, virtual machine monitors and OTA upgrade technologies are mature and widely used in consumer electronics and other fields. Automotive electronics frameworks can learn from other electronics.
However, due to the high safety requirements of automobiles, automotive electronic design needs to meet strict safety standards and standard requirements. The requirements for security, stability, and durability make automotive domain controllers designed with extremely high quality and reliability. Ensuring the safety and stability of the car will become a key factor to consider when designing the electronic and electrical architecture of the car.
The basic architecture of the future car
Basic architecture
The automotive electronic architecture of the future is rapidly evolving. Safety features and autonomous driving functions require better computing power and higher bandwidth communication capabilities. In order to make the car more connected and infotainment, the car will be transformed into a distributed IT system that can communicate with the cloud to update the software remotely, while updating digital map information and traffic conditions in real time.
The diagram above illustrates the future of automotive electrical and electronic architectures that require the ability to interact between different components and different functional modules, and the ability to manage and control a growing number of functions and complex software algorithms. In addition, the framework should be well scalable to cope with the increased demand and expectations for automotive capabilities over time. OTA should also be one of the necessary features of the architecture.
The updatability and upgradeability of automotive electronic architectures allows OEMs to control the upgrade process of the vehicle even after the vehicle is sold. The separation of software and hardware makes the software functions of the car independent of the hardware, which greatly improves the scalability of the system functions and the convenience of updating.
Framework attributes
SOA (Service-oriented Architecture) Service-Oriented Framework: The SOA approach has been widely used in IT and consumer electronics. SOA provides a large number of abstract interfaces for automotive electronic systems. Its packaging can be designed and tested using agile development methods to reduce the complexity of increasing system functionality and make it easier for software groups to be reused across different vehicles.
Central gateway server
All communication information is processed using a central information server and proxy server, isolating the local control domain from the outside environment to ensure the security and confidentiality of the system. The system is divided into physical layer, information layer, service layer, so that the system has good scalability, while making the system used in different types of vehicles when the change is small, the portability is higher.
In the future automotive electrical and electronic architecture, the central gateway will serve as an information bridge, exchange information and isolate the domain controllers and peripheral communication sources in the vehicle, such as mobile networks, Bluetooth, WiFi, Ethernet, etc., and it will also serve as the car's central diagnostic interface for system vulnerability diagnosis. Domain controllers can be used as gateways between a central gateway and local smart sensors, actuators, and ECUs to compile and pass information between Ethernet and CAN or LIN.
The central gateway will assume primary responsibility for maintaining network security. The central gateway validates messages from legitimate sources and protects authentication from spoofing, limits network traffic to a predefined normal range, and restricts the communication of anomalous or excessive messages to avoid compromising the vehicle's functionality. It also needs to block unapproved illegal messages and warn of invalid attempts. This can greatly improve the network security of the entire vehicle and significantly reduce the load on the security functions of the on-board domain controller.
In-vehicle and back-end architectures
In the future, there will be more and more interaction between automotive in-vehicle systems and cloud back-end architectures. Both can be connected via WIFI or high-bandwidth 5G networks. In the context of the need for safety and autonomous driving functions, vehicles need to have the ability to interact with external information, such as surrounding vehicles, next-generation infrastructure, weather, road information, and real-time, high-precision maps. Because the car's software algorithm and basic hardware computing power will be limited to a certain extent, with the increase of data volume, the difficulty of making real-time analysis and decisions on changing scenarios and driving conditions will gradually increase, so in the future, cars will increasingly need to interact with high-processing power backends (such as cloud servers) to obtain relevant information and data in driving scenarios.
Automotive functional safety
The so-called "functional safety" is a general term for technology that avoids intolerable functional risks through safety functions and safety measures. The "function" of Function Safety refers to the role played by the safety device monitoring the controlled object and controller. Usually we use the computer as a safety device, and if the controller fails, the computer shuts down the controlled object and warns the user of the danger. This safety effect implemented by the safety device is called "functional safety". Functional safety can be said to be a safety measure designed through the use of safety devices such as computers.
Car driving is related to the safety of passengers, and safety is also the first meaning of car design guidelines. Each industry has corresponding technical standards that constrain the minimum performance of a product. The ISO26262 standard adopted by the automotive industry is derived from iec61508, the basic standard for functional safety of electronic, electrical and programmable devices, which is mainly positioned in the automotive industry for specific electrical devices, electronic equipment, programmable electronic devices and other components specifically used in the automotive field, aiming to improve the functional safety of automotive electronics and electrical products. The ISO 26262 standard is a functional safety standard for automotive electrical and electronic systems, using ASIL to specify the safety requirements of the acceptable level of residency risk that the corresponding device must meet, involving the entire safety life cycle of the automotive electrical and electronic system and its management process, the ultimate purpose of which is to ensure "safety" and avoid unreasonable risks caused by the failure of the automotive electrical and electronic system.
With the increasing use of data connections and in-vehicle communications, vehicles are becoming more vulnerable to malicious cyberattacks. The threat risk points in intelligent connected vehicles may be: malicious attackers can use the CAN bus broadcast mechanism to carry out packet eavesdropping, forgery and data replay. It can hijack the access mechanism of ECU device manufacturers, reverse crack the source code, and extract, tamper with, and analyze the firmware code in the chip.
Due to the development trend of vehicle electrification, intelligence and networking, the special multi-scenario use state and the status quo of the whole life cycle of research and development, production, use, maintenance and scrapping, compared with the traditional information security system, the information security research direction of intelligent networked vehicles needs to be solved: how to carry out highly reliable intrusion detection and protection to prevent the direct control of the vehicle control unit from causing losses in life and property; how to ensure the information security of the complex communication environment and improve the protection ability of the vehicle. This will be the focus of future automotive functional safety research.
Consumer demand for automotive safety features and software features is growing at an unprecedented rate. This trend has led to the shift of automotive electrical and electronic architectures from distributed electronic controller units (ECUs) to more integrated domain controllers. Cars are also increasingly demanding computing power and storage power. The electrical and electronic framework represented by domain controllers can provide faster, safer and more reliable data processing and energy distribution capabilities. Future automotive platforms with domain controllers can easily take advantage of the latest technologies such as cloud computing, the internet, big data, and OTA upgrades. Powerful multi-core processing capabilities, dedicated in-vehicle embedded operating systems, innovative electrical and electronic architectures, and high-bandwidth communication capabilities are essential elements of the future domain controller architecture car.
With the advent of domain controllers, the intelligent evolution of automobiles is becoming more and more rapid. With the process of centralization of the automotive electronic architecture shown in Figure 2, the ideal state of the future is that the car can have a vehicle computing platform - the central brain. The central domain controller may become the form of a computer, and the core difficulty will come from the car's operating system, which needs to connect with the software applications of the upper layer and the hardware resources of the bottom layer at the same time. Because the car's cockpit domain, intelligent driving domain, power domain, body domain and other major "domains" have inconsistent requirements for the operating system. For example, the cockpit system has high requirements for the color processing and rendering of the screen, while the intelligent driving function has particularly high safety requirements for the system. At present, there is no chip or an embedded hardware platform, which has both high computing power to support rich image processing, high performance, high storage, and a very rich IO interface.
From the domain controller to the central brain
In addition to the challenges at the hardware level, the software industry chain of the automotive industry is also facing the possibility of reconstruction. Software capabilities have increasingly become the core competitiveness of players in the industry chain. The centralized control of software capabilities by the main and machine factories may bring about the reconstruction of the relationship between the industrial chain. The beginning of any industry change is always accompanied by conflicts of interest and the breaking of rules, and this is also the case in this change triggered by the demise of the ECU. The emergence of domain controllers is just a midfield battle. It is certain that the transformation of the "central brain" form of the automobile, as well as the competition for the right to speak in the era of intelligent automobiles behind it, will make various players in the automotive industry chain go forward and follow, and the automotive industry will definitely undergo earth-shaking changes in the next decade.
References
[ 1 ] LI Wei,YU Xiaoyong,KUANG Xiaojun. A Brief Analysis of Automotive Electronic Architecture Development and Typical Domain Controllers[J]. Times Auto, 2021(16): 163-164.
LI W, YU X Y, KUANG X J. Analysis of automotive electronics architecture development and typical domain controllers [J]. Auto Time，2021（16）：163-164.
[ 2 ] LIU Jiaxi,DING Feng. Domain Controller Platform for Future Automotive Electrical and Electronic Architecture[J]. China Integrated Circuits, 2019, 9(28): 82-87
LIU J X, DING F. Domain controller platform for future automotive electrical and electronic architectures. [J]. China Integrated Circuit，2019，9（28）：82-87.
[ 3 ] D. Wang and S. Ganesan, "Automotive Domain Controller," 2020 International Conference on Computing and Information Technology (ICCIT-1441), 2020, pp. 1-5, doi: 10.1109/ICCIT-144147971.2020.9213824.
[ 4 ] S. Brunner, J. Roder, M. Kucera and T. Waas, "Automotive E/E-architecture enhancements by usage of ethernet TSN," 2017 13th Workshop on Intelligent Solutions in Embedded Systems (WISES), 2017, pp. 9-13, doi: 10.1109/WISES.2017.7986925.
[ 5 ] G. Xie, Y. Li, Y. Han, Y. Xie, G. Zeng and R. Li, "Recent Advances and Future Trends for Automotive Functional Safety Design Methodologies," in IEEE Transactions on Industrial Informatics, vol. 16, no. 9, pp. 5629-5642, Sept. 2020, doi: 10.1109/TII.2020.2978889.
Reprinted from the automotive ECU development, Zhihu, the views in the text are only for sharing and exchange, does not represent the position of this public account, such as copyright and other issues, please inform, we will deal with it in a timely manner.
-- END --