Bidirectional power supply monitoring management system and method of high-safety controller

Abstract

The invention relates to the field of controller power supply monitoring and management, and provides a bidirectional power supply monitoring and management system and method of a high-safety controller. A power switch control unit; the voltage isolation area module is used for providing voltage conversion and current overload protection and ensuring stable and safe power supply for electric appliances; the power supply low-voltage detector and the power supply low-voltage buffer are used for providing buffer voltage during power supply switching so as to realize smooth switching; the power management safety monitoring unit is used for monitoring power supply and cutting off power supply to protect the system when a power distribution fault occurs; and the central control unit is used for managing the operation and health state of the controller. The power supply design disclosed by the invention adopts a multi-redundancy design, when a fault is detected, the system can be automatically switched to a backup system, the continuity of power supply and control functions is ensured, manual intervention is not needed, and key functions can still operate normally even if a main system has a fault.

Description

Technical Field

[0001] The invention relates to the field of controller power monitoring management, in particular to a bidirectional power monitoring management system and method for a high-security controller, and a bidirectional power switching method for a high-security controller. Background Art

[0002] ZCU (Zonal Control Unit) is a concept used to improve the design and management of electrical systems, mainly used in the aerospace and automotive fields. Based on the principles of modularization and integration, it divides the electrical system into different spatial areas or "zones", each of which is controlled by a ZCU. This approach divides the system into smaller, more manageable parts, thereby simplifying the design and maintenance of the electrical system. The use of ZCU effectively improves the efficiency of system management. Each ZCU is responsible for monitoring and controlling all electrical functions in a designated area, including sensor data collection, executing control commands, and monitoring system health. This approach not only reduces the complexity and weight of the wiring harness, but also improves the reliability and maintainability of the system.

[0003] The prior art has the following problems: Single point of failure: Existing ZCU or high-security controller power supply designs have multiple single points of failure, which may affect the safety of the entire system when failures occur, thereby reducing the safety of the entire system.

[0004] Fault detection and response time: Existing systems have certain delays in detecting faults and taking appropriate measures to keep the system operating safely, which limits their ability to achieve higher safety levels.

[0005] Insufficient redundancy design: To ensure that the backup system can take over control when the primary system fails, a high degree of redundancy design is required. However, existing technologies may have shortcomings in this regard and cannot fully guarantee the safe and stable operation of the system. Summary of the invention

[0006] In view of the problems existing in the above-mentioned prior art, the present invention provides a bidirectional power supply monitoring management system and method for a high-security controller, as well as a bidirectional power supply switching method for a high-security controller, which can ensure the safe and stable operation of the system.

[0007] The present invention discloses a bidirectional power supply monitoring and management system of a high-security controller, comprising: Several independent power supply devices, capable of supplying power independently; A power switch control unit, the power supply device is connected to the power switch control unit; The voltage isolation zone module is connected to the power switch control unit to provide voltage conversion and current overload protection to ensure stable and safe power supply to electrical appliances; A power low voltage detector and a power low voltage buffer, wherein the power low voltage detector is connected to the power switch control unit, and the power low voltage buffer is respectively connected to the power low voltage detector and the voltage isolation zone module, and is used to provide a buffer voltage when switching power supply to achieve smooth switching; A power management safety monitoring unit that monitors the power supply and cuts off the power supply to protect the system in the event of a power distribution failure; The central control unit is connected to the voltage isolation zone module, the power management safety monitoring unit, the power low voltage detector, and the power switch control unit, and is responsible for managing the operation and health status of the controller.

[0008] Furthermore, the power management safety monitoring unit includes: a PMIC master power management safety monitoring chip and a PMIC slave power management safety monitoring chip, which are respectively arranged inside and outside the voltage isolation area module; Furthermore, the voltage isolation area module also includes: a current overload protector, a boost converter, a high-side switch, a low-voltage converter, a safety switch, and an isolation area voltage converter.

[0009] Furthermore, the system also includes: a Buck step-down circuit, wherein the Buck step-down circuit is connected to the voltage isolation area module, and the central control unit is communicatively connected to the Buck step-down circuit.

[0010] The present invention also discloses a bidirectional power supply monitoring and management method of a high-security controller, comprising: S1: The power supply device is turned on, and the power switch control unit receives the wake-up signal and starts; S2: Determine whether the voltage of the power supply device is within a preset range, and if so, turn on the power switch control unit; S3: The power low voltage detection unit monitors the voltage in real time. When it is detected that the access voltage is less than the preset value, it will provide feedback to the power management safety monitoring unit, start the power low voltage buffer to provide power support for the controller, and start other power supply devices to provide stable power supply for the controller; S4: If each power management safety monitoring unit is still not powered on within a certain period of time after the power is turned on, or the voltage does not reach the specified level, the power switch management chip is turned off, the wake-up fails, the problem is recorded, and the next wake-up signal is waited for; S5: The power management safety monitoring unit performs a power-on self-test. If the self-test passes, the power management safety monitoring chip controls and keeps the power switch control unit in an activated and on state. S6: The central control unit performs a power-on self-test. If the self-test passes and the corresponding startup conditions are met, the central control unit starts and operates under the mutual monitoring and safety mechanism of the central control unit and the power management safety monitoring chip that meets the ASIL-D safety requirements.

[0011] Furthermore, the step S2 comprises: Determine whether the voltage of the power supply device is between 4.5V and 29V. If so, turn on the power switch control unit; if not, keep the power supply disconnected and wait for the next activation cycle to make another determination; The step S3 comprises: The power supply low voltage detection unit monitors the voltage in real time. When it detects that the access voltage is less than 6V, it will provide feedback to the power management safety monitoring unit, start the power supply low voltage buffer to provide 20ms of power support for the controller, and start other power supply devices to provide stable power supply for the controller; The step S4 comprises: If each power management safety monitoring unit is still not powered within 20ms after the power is turned on, or the voltage is not between 9V and 16V, the power switch management chip is turned off, the wake-up fails, the problem is recorded, and the next wake-up signal is waited; The step S5 comprises: The power management safety monitoring unit performs a self-test at power on. If the self-test fails, the power on is interrupted, the controller wake-up expires, and the controller is shut down and waits for the next wake-up. If the self-test passes, the keep alive channel is turned on, and the power management safety monitoring unit controls and keeps the power switch control unit in an activated on state until the power management safety monitoring unit cancels the Keep Alive high potential output. The step S6 comprises: The safety switch of the power management safety monitoring unit is turned on, and the SoC processor performs a power-on self-test; If the self-test fails, the SoC processor will restart the power management safety monitoring unit, close the Keep Alive channel, power off the controller, and wait for the next wake-up; If the self-test passes and the corresponding startup conditions are met, the SoC processor starts and runs under the mutual monitoring and safety mechanism of the SoC processor and the power management safety monitoring unit that meet the ASIL-D safety requirements.

[0012] The present invention also discloses a bidirectional power switching method of a high-security controller, the method comprising: The bidirectional power supply monitoring and management method based on the above-mentioned high-security controller continuously monitors the voltage of the power supply device; State 1: If the voltage of the main power supply device is within the voltage overload protection start range and lasts for more than a certain period of time, the voltage overload protection is turned on, the main power supply device is turned off and switched to the standby power supply device; State 2: If the voltage of the main power supply device is within the voltage overload warning range, only the overvoltage alarm is triggered; State three: If the voltage of the main power supply device is within the normal voltage range, it is determined that the controller system is in the normal voltage area; State 4: If the voltage of the main power supply device is within the low voltage warning range, the system alarm voltage is too low; and when the voltage of the main power supply device is lower than the low voltage protection value, the main power supply device is immediately turned off and the backup power supply device is started to achieve low voltage protection; State 5: If the voltage of the main power supply device is within the low voltage protection range, the power switch control unit disconnects the main power supply device and maintains the power reverse connection protection state; State six: If the voltage of the main power supply device returns to exceed the low voltage protection range, the main power supply device is turned on and the standby power supply device is turned off to save power.

[0013] The state 1 specifically includes: If the voltage of the main power supply device is within the range of greater than or equal to 28V and less than 40V for more than 1 minute, the voltage overload protection is turned on, the main power supply device is turned off and switched to the backup power supply device; The second state specifically includes: If the voltage of the main power supply device is less than 28V and greater than 16V, only the overvoltage alarm will be triggered and the power supply will be maintained for at least 1 hour; The state three specifically includes: If the voltage of the main power supply device is within the range of less than or equal to 16V and greater than or equal to 9V, it is determined that the controller system is in the normal voltage area; The fourth state specifically includes: If the voltage of the main power supply device is less than 9V and greater than or equal to 6V, the system alarm voltage is too low and the power supply is maintained for at least 1 hour. And if the voltage of the main power supply device is lower than 7V, the main power supply device is immediately turned off and the backup power supply device is started to achieve low voltage protection; The state five specifically includes: If the voltage of the main power supply device is lower than 6V, the power switch control unit disconnects the main power supply device and maintains the power reverse connection protection state; The state six specifically includes: If the voltage of the main power supply device returns to greater than 6V, the power switch control unit turns on the main power supply device, ending the state of the power reverse connection protection; If the voltage of the main power supply device returns to be greater than or equal to 7V, the main power supply device is turned on and the standby power supply device is turned off to save power.

[0014] The present invention has at least the following beneficial effects: Enhanced redundancy design: The power supply design disclosed in the present invention adopts multiple redundancy design, including redundant power supplies, control units and communication paths, as well as redundancy of power supply monitoring. This ensures that even if the main system fails, key functions can still operate normally.

[0015] Real-time fault detection and isolation: The present invention adopts independent heterogeneous fault detection algorithms, which can identify and isolate faults within milliseconds or even microseconds, prevent them from spreading to other system parts, and maintain the security of the overall system.

[0016] Intelligent backup switching mechanism: When a critical system failure is detected, the present invention can automatically and seamlessly switch to the backup system to ensure the continuity of power supply and control functions without human intervention.

[0017] Other beneficial effects of the present invention will be described in detail in the specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 The invention discloses a safety power supply circuit diagram of a bidirectional power supply monitoring and management system of a high-safety controller.

[0020] Figure 2 It is a schematic diagram of the management mechanism of stepped voltage monitoring and power distribution disclosed in the present invention.

[0021] Figure 3 The invention discloses a flow chart of a bidirectional power supply monitoring and management method for a high-security controller.

[0022] Figure 4 It is a schematic diagram of the power supply voltage management principle disclosed by the present invention.

[0023] Figure 5 It is a schematic diagram of the setting of the ASIL-D level safety motor mechanism and the stepped voltage and current monitoring disclosed in the present invention. DETAILED DESCRIPTION

[0024] To make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described in detail below. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other implementation methods obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0025] Embodiment 1

[0026] This embodiment discloses a bidirectional power supply monitoring and management system for a high-security controller, see Figure 1 , wherein the dotted lines in the connection lines represent the connection relationship of control / monitoring / activation / communication, and the solid lines represent the power supply connection relationship. The system includes: (1) Voltage isolation area module, mainly including: PMIC main power management safety monitoring chip, safety switch, isolation area voltage converter, boost converter, low voltage converter, current overload protector, transformer switch, etc., used to isolate internal and external voltages and different voltage areas to ensure that ASIL (D) level devices obtain stable voltage and real-time monitoring.

[0027] (2) The central control chip (SoC processor) is responsible for managing the operation and health status of the controller, monitoring the output voltage of the KL30 power supply and each level of voltage converter through the ADC interface, and taking emergency measures to deal with abnormal situations in a timely manner.

[0028] (3) The power supply low-voltage buffer and low-voltage detector are used to provide a system buffer voltage of at least 20ms to ensure that the system maintains normal operation before the power supply is connected to the second power supply to deal with sudden power failure.

[0029] (4) Two independent power supply units (power supply 1 and power supply 2), each of which is an independent power supply source. For example, in a battery electric vehicle, one power supply comes from the high-voltage battery through a DCDC voltage converter, and the other comes from a small battery.

[0030] (5) Power switch control unit, which is equipped with power supply voltage overvoltage, reverse connection protection and voltage and current filters to provide hardware physical protection. This switch has the function of being woken up by Ethernet or CAN_FD and can be activated by the traditional KL15 power-on signal.

[0031] (6) Two power management safety monitoring chips, including the PMIC main power pipeline safety monitoring chip in the voltage isolation area module and the PMIC slave power pipeline safety monitoring chip outside the voltage isolation area module. These two power management safety monitoring chips are responsible for monitoring the power supply to key components such as the SoC processor to ensure that the power supply requirements of ASIL (D) are met, and monitor the health of the hardware and software of the SoC processor. In the event of a power distribution failure or short circuit, the power management safety monitoring chip will cut off the power supply to protect the system. The power management safety monitoring chip is not only responsible for power supply voltage-related monitoring, but also monitors the operation of the hardware and software systems of the SoC processor, and is responsible for isolating errors generated by hardware and errors derived from software failures.

[0032] Compared with other existing power supply systems, the present invention has the following advantages: First, a current monitoring function is added to the main power supply control system, which is specifically implemented by a power management safety monitoring chip. Second, a backup power supply is added (see Figure 1 The third is to add a low voltage detection mechanism and power-off buffer (see Figure 1 The power supply low voltage detection and power supply low voltage buffer in the power supply are used to ensure that the system can still survive the possible unexpected low voltage that may cause system failure during power failure and power replacement.

[0033] In addition, the present invention also provides a redundant power management safety monitoring chip, that is, a PMIC power pipeline safety monitoring chip, which provides reliable control of the power supply and system health monitoring when inevitable hardware failures occur. These functions can not only issue an early warning and enter a protection state before the controller is overloaded with current, but also perform thermal protection in advance when the continuous current is too large. In this way, the system can provide sufficient early warning time to deal with high temperature failures that may cause safety problems. And avoid the disadvantages of a single power supply or two-way and one-way power supply mode, when one power supply fails, the system cannot continue to supply power stably or cannot determine where the problem lies. Therefore, the invention improves the safety and reliability of the ZCU or controller through the above structure.

[0034] Embodiment 2

[0035] See also Figure 2 This embodiment discloses a voltage monitoring and power distribution management solution, including an internal power supply system and an external power supply system monitoring mechanism designed specifically for ZCU or high-security controllers. The functions and features of this embodiment are as follows: (1) The power management safety monitoring unit that can meet the safety integrity of ASIL (D) is specifically composed of two power management safety monitoring chips. The key to the application of ASIL (D) level power management safety monitoring chips in vehicle-mounted devices is to ensure that the power system can maintain a high degree of reliability and safety even in extreme or unforeseen circumstances. It monitors the power supply of the internal SoC processor and other peripheral devices, and can independently provide stable power supply of ASIL (B) level; it can also monitor thermal management and health management within the system. It can control the switching of all power devices through GPIO and set thresholds. It has the following characteristics: a) High fault tolerance: The two ASIL (D) level power management safety monitoring chips have redundant circuits and self-detection functions, which can continue to operate normally when a single fault occurs; b) Advanced diagnostic functions: These power management safety monitoring chips have advanced self-diagnosis functions, which can monitor the status of the power system in real time and quickly identify any potential faults, thereby preventing faults from occurring, and isolating faults from causing safety hazards with millisecond-level reactions before the faults cause functional errors; c) Strict voltage and current monitoring: Ensure that the system can remain within a safe operating range even under extreme operating conditions such as temperature changes or voltage fluctuations; d) Low power design: The power management safety monitoring chip not only has the characteristics of a high safety level, but also optimizes power consumption, which helps to improve the energy efficiency of the entire vehicle; e) High temperature and electromagnetic compatibility: Meet the automotive industry's strict requirements for high temperature tolerance and electromagnetic compatibility (EMC) to ensure reliability in various environments; f) The two power management safety monitoring chips and the SoC processor form a triangular safety mechanism that supervises and guarantees each other through I 2 C and reset and watchdogs mechanisms ensure that the system safety reaches a stable ASIL (D) safety integrity.

[0036] (2) Areas that meet the requirements of step-by-step power supply safety monitoring: ASIL(B)+ASIL(B)=ASIL(D). Provide heterogeneous and multi-layer safety monitoring and fault isolation systems. Figure 2 As shown in the circle, the power supply circuit specified in the present invention includes a monitoring and power supply protection system from a power supply device to a boost converter to a high-side switch and then to an electronic fuse, and the electronic fuse is used to connect electrical appliances.

[0037] (3) Low voltage detection and power failure buffer module (such as capacitors and small batteries). It ensures that the SoC processor is reported within 10µs after the voltage is detected to be too low, starts power supply 2 and the power low voltage buffer to power the system, and shuts down non-safety-related power supplies to keep the ZCU or controller running for the longest time to record faults, in order to cope with unforeseen power failures, and can ensure that the backup power supply 2 can smoothly switch power supply. It is charged when the system is powered on, and discharges to maintain the system operation for 20ms or longer when the system detects power failure (low voltage).

[0038] (4) Power switch management module with low-power wake-up function, such as Figure 1 The power switch control unit and power supply device shown in the figure have the following characteristics and advantages: a) Low quiescent current: when waiting for the wake-up signal, the power switch management chip will have very low quiescent current consumption to reduce the energy consumption of the whole vehicle when in standby mode; b) Communication interface compatibility: supports receiving wake-up signals through common vehicle communication interfaces (such as CAN, Ethernet), and is easy to integrate into the existing vehicle network; c) High reliability: designed for automotive applications, it can withstand various interferences in the vehicle electrical system, complex climate and electrical properties (low voltage, overvoltage, voltage instability, etc.) to ensure stable operation; d) Intelligent management function: in addition to the wake-up function, it also includes overvoltage, undervoltage protection, temperature monitoring and other intelligent management functions to improve the safety and reliability of the system.

[0039] (5) The computing area voltage isolation module, which is mainly composed of a low-voltage converter, a current overload protector, etc., is mainly used to provide voltage conversion and overcurrent protection functions in electronic systems, while ensuring the stability and safety of power supply for MCUs and GPUs. The design concept of this device comes from the need to protect sensitive components in electronic systems, especially in applications that may be damaged by voltage instability. It usually has the following characteristics: a) Voltage conversion function: Through a low-voltage or boost converter, the input voltage can be converted into a stable low voltage or high voltage suitable for electronic devices and microprocessors; b) Current overload protection: The current overload protector of the voltage isolation module can immediately cut off the current when the current reaches a level that may damage the circuit, protecting the electronic equipment from damage caused by overcurrent. This protection measure is crucial to extending the service life of the equipment and preventing sudden failures; c) Voltage isolation: The voltage isolation module has the ability to isolate voltage and can isolate the direct electrical connection between input and output. Voltage isolation helps protect processors and memories that rely on precise and stable voltages. The risk of overvoltage and overcurrent in other areas may cause serious calculation errors and safety failures; it also reduces the impact of voltage and electromagnetic noise in the high-voltage area on the safety performance of the system.

[0040] Embodiment 3

[0041] This embodiment discloses the process of starting the circuit and protecting the circuit, and has a unique power supply connection and startup logic process. Figure 3 As shown, the specific process includes: (1) Power 1 and power 2 are turned on, and the communication hardware with wake-up function in the power switch control unit receives the wake-up signal. In this embodiment, the TCAN1462Q1 chip is selected, which has a standby function and consumes very low power less than 1μA in sleep mode.

[0042] (2) The power switch control unit is allowed to be turned on within the specified access voltage range, connected to power supply 1, and power the PMIC main power management safety monitoring chip; if the power supply is greater than 29V (passenger car, 40V for heavy trucks) or less than 4.5V, the power supply remains disconnected and a judgment is made in the next activation cycle.

[0043] (3) The power switch control unit is turned on, and the power low voltage detection unit located outside the voltage isolation area monitors the voltage in real time. If the input voltage is less than 6V, the power low voltage detection unit will feed back the information to the power management safety monitoring unit and start the power low voltage buffer to provide the power support required by the controller for 20ms for possible sudden power outages, and turn on power supply 2 to provide stable power for the controller.

[0044] (4) If the power management safety monitoring chip is still not powered on or detects the specified voltage (9v≤V≤16v) within 20ms after the power is turned on, the power switch control unit is turned off, the wake-up fails, the problem is recorded, and the next wake-up signal is waited for.

[0045] (5) If the power supply voltage is normal and within the specified voltage range (9v≤V≤16v), the power management safety monitoring chip is powered on and automatically starts self-testing. If the power management safety monitoring chip fails the self-test, the power-on is interrupted, the controller wake-up expires, and the computer is shut down and waits for the next wake-up. If the self-test passes, the keep alive channel is turned on, and the power management safety monitoring chip controls and keeps the power switch control unit in an activated on state until the power management safety monitoring chip cancels the Keep Alive high potential output (for example, processing the shutdown).

[0046] (6) If no safety-related faults are detected, the power management safety monitoring chip turns on the safety switch and the SoC processor is powered on. The SoC processor self-test is started.

[0047] (7) If the self-test fails, the SoC processor will restart the power management safety monitoring chip, the Keep Alive channel will also be closed, the controller will be powered off, and wait for the next wake-up.

[0048] (8) If the self-test passes and the SoC processor meets the startup conditions, the SoC processor starts, the controller system starts, and runs under the mutual monitoring and safety mechanism of the SoC processor and the power management safety monitoring chip that meet the ASIL-D safety requirements until the controller is shut down.

[0049] Embodiment 4

[0050] The technical solution disclosed in this embodiment serves as an integrated intelligent power management system, which can monitor the status of each power supply in real time and automatically switch to the backup power supply when a fault is detected, thereby reducing system downtime.

[0051] Figure 4 The working state diagram of the power supply voltage. The state diagram describes the state change process of the controller with the state machine setting. The influence of the power supply voltage on the controller state is summarized in the present invention as follows (the power supply 2 is always kept in the normal voltage range. If it is outside the normal voltage range, the advanced automatic driving mode is not turned on): (1) Voltage overload protection start range: When the system rated voltage is 12V, if the voltage of power supply 1 is equal to or greater than 28V and less than 40V for more than 1 minute, the controller system will start voltage overload protection, that is, the system will turn off power supply 1 and turn on power supply 2.

[0052] (2) If the voltage of power supply 1 drops from 28 V to above 16 V, the system will only trigger the high voltage alarm and full load operation (autopilot) is not recommended, but the system is guaranteed to maintain operation at this voltage for at least 1 hour.

[0053] (3) When the voltage is less than or equal to 16V and greater than or equal to 9V, the controller system is in the normal voltage range. The full function of the system running in this voltage range is the safest setting.

[0054] (4) When the voltage is less than 9V and greater than or equal to 6V, the system alarm voltage is too low. It is not recommended to use functions such as automatic driving at full load under this voltage. The system is guaranteed to work for 1 hour under this condition. If the voltage is lower than 7V, the system immediately turns off the power supply and starts the power supply, that is, the low voltage protection function is realized.

[0055] (5) If the voltage is lower than 6V, the power switch management chip disconnects power supply 1 and keeps the power reverse protection status.

[0056] (6) If the voltage returns to 7V or higher, power supply 1 is turned on and power supply 2 is turned off to save power.

[0057] Embodiment 5

[0058] Regarding the power supply design of ASIL (D), the controller usually uses two sets of ASIL (B) voltage monitoring to meet the safety rule of ASIL (B) + ASIL (B) = ASIL (D). However, for some devices with stringent safety requirements and ASIL (D) functions, if a power supply fails, the power supply requiring ASIL (D) only obtains the power supply that meets the safety monitoring of ASIL (B). For the safety system that still needs to continue to work, it is regarded as a safety degradation, which is not conducive to the automatic operation of L3 and above after a fault occurs. It still needs to maintain a relatively long period of automatic operation. The present invention proposes a solution with an intelligent power management ZCU or a high-safety controller to provide redundant ASIL (D) power supply for electrical appliances requiring ASIL (D).

[0059] like Figure 5 As shown, for the ZCU area space optimization controller, the present invention uses step-by-step voltage and current monitoring. Even if each monitoring point can only meet ASIL (B), it can still achieve safety monitoring of non-ASIL (D) level for the relevant power supply section. In addition, it can realize ASIL (B) safety power supply for several sections as needed, and QM-level power supply for electrical appliances without functional safety requirements as needed. Both safety and economy are taken into consideration.

[0060] In the figure, area I: the voltage of the electronic switch and boost converter II is monitored by the power monitoring safety chip, and the current and voltage inside the power supply are also monitored, and the status (Power Good power stability-threshold and state machine implanted in electronic devices) is fed back in real time. Such bidirectional monitoring ensures that the output of the electronic switch and the regulator can reach the safety level of ASIL (B). The high-side switch II behind it is connected to the electronic fuse II for realizing the power supply of ASIL (B). The main advantage of the high-side switch is that it can ensure the safety of the system because it can prevent the load end from short-circuiting due to accidental grounding. The working state, output voltage and current of the high-side switch are monitored by the central processing chip (SoC processor). If the output voltage and current are outside the specified working range, the central processing chip will record the current data and shut down and reset the switch. The power management safety monitoring dual chip (PMIC main power management safety monitoring chip and PMIC slave power management safety monitoring chip) provides ASIL (B) level safety monitoring. The output of area I is monitored by ASIL (D) level safety, which complies with the safety rules mentioned above.

[0061] Area II in the figure: The voltage of the electronic switch / boost regulator is monitored by the power monitoring safety chip, which also monitors the internal current and voltage of the power supply and provides real-time feedback (Power Good) status. This two-way monitoring ensures that the output of the electronic switch and regulator can reach the safety level of ASIL (B). The Buck step-down circuit QM level (see Figure 1 Buck step-down circuit in the circuit), and finally region II is responsible for outputting a stable low voltage that is monitored relative to the stable power supply.

[0062] Area III in the figure: It has the same connected voltage stabilization monitoring circuit as area I, ensuring the output of ASIL (D). In this embodiment, it and the output of area I form a pure ASIL (D) redundant output, which can ensure the supply of power that meets the ASIL (D) safety conditions required by the demanding safety system in actual complex situations.

[0063] Area IV in the figure: The electronic switch / boost regulator here has no external monitoring and provides QM level overvoltage protection. Electronic fuse 4 provides QM level current overload protection.

[0064] The above is the monitoring and protection design of external power transmission of the invention. Although the power supply obtained by ZCU is only QM level, it still has redundant power supply, power failure buffer and sensitive backup power supply connection mechanism, which maximizes the reliability of internal and external power supply and achieves the safety integrity of ASIL (D) level; internal power supply monitoring prevents the computing equipment from not working properly or even working incorrectly due to changes in power supply voltage and current.

[0065] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A bidirectional power supply monitoring and management system for a high-security controller, characterized in that: include: Several independent power supply devices, capable of supplying power independently; A power switch control unit, the power supply device is connected to the power switch control unit; The voltage isolation zone module is connected to the power switch control unit to provide voltage conversion and current overload protection to ensure stable and safe power supply to electrical appliances; A power low voltage detector and a power low voltage buffer, wherein the power low voltage detector is connected to the power switch control unit, and the power low voltage buffer is respectively connected to the power low voltage detector and the voltage isolation zone module, and is used to provide a buffer voltage when switching power supply to achieve smooth switching; A power management safety monitoring unit that monitors the power supply and cuts off the power supply to protect the system in the event of a power distribution failure; The central control unit is connected to the voltage isolation zone module, the power management safety monitoring unit, the power low voltage detector, and the power switch control unit, and is responsible for managing the operation and health status of the controller.

2. The bidirectional power supply monitoring and management system of the high-security controller according to claim 1, characterized in that: The power management safety monitoring unit comprises: a PMIC master power management safety monitoring chip and a PMIC slave power management safety monitoring chip which are respectively arranged inside and outside the voltage isolation area module.

3. The bidirectional power supply monitoring and management system of the high-security controller according to claim 2 is characterized in that: The voltage isolation area module also includes: a current overload protector, a boost converter, a high-side switch, a low-voltage converter, a safety switch, and an isolation area voltage converter.

4. The bidirectional power supply monitoring and management system of the high-security controller according to claim 3 is characterized in that: The system also includes: a Buck step-down circuit, wherein the Buck step-down circuit is connected to the voltage isolation area module, and the central control unit is communicatively connected to the Buck step-down circuit.

5. A bidirectional power supply monitoring and management method for a high-security controller, characterized in that: include: S1: The power supply device is turned on, and the power switch control unit receives the wake-up signal and starts; S2: Determine whether the voltage of the power supply device is within a preset range, and if so, turn on the power switch control unit; S3: The power low voltage detection unit monitors the voltage in real time. When it is detected that the access voltage is less than the preset value, it will provide feedback to the power management safety monitoring unit, start the power low voltage buffer to provide power support for the controller, and start other power supply devices to provide stable power supply for the controller; S4: If each power management safety monitoring unit is still not powered on within a certain period of time after the power is turned on, or the voltage does not reach the specified level, the power switch management chip is turned off, the wake-up fails, the problem is recorded, and the next wake-up signal is waited for; S5: The power management safety monitoring unit performs a power-on self-test. If the self-test passes, the power management safety monitoring chip controls and keeps the power switch control unit in an activated and on state. S6: The central control unit performs a power-on self-test. If the self-test passes and the corresponding startup conditions are met, the central control unit starts and operates under the mutual monitoring and safety mechanism of the central control unit and the power management safety monitoring chip that meets the ASIL-D safety requirements.

6. The bidirectional power supply monitoring and management method of a high-security controller according to claim 5, characterized in that: The step S2 comprises: Determine whether the voltage of the power supply device is between 4.5V and 29V. If so, turn on the power switch control unit; if not, keep the power supply disconnected and wait for the next activation cycle to make another determination; The step S3 comprises: The power supply low voltage detection unit monitors the voltage in real time. When it detects that the access voltage is less than 6V, it will provide feedback to the power management safety monitoring unit, start the power supply low voltage buffer to provide 20ms of power support for the controller, and start other power supply devices to provide stable power supply for the controller; The step S4 comprises: If each power management safety monitoring unit is still not powered within 20ms after the power is turned on, or the voltage is not between 9V and 16V, the power switch management chip is turned off, the wake-up fails, the problem is recorded, and the next wake-up signal is waited; The step S5 comprises: The power management safety monitoring unit performs a self-test at power on. If the self-test fails, the power on is interrupted, the controller wake-up expires, and the controller is shut down and waits for the next wake-up. If the self-test passes, the keep alive channel is turned on, and the power management safety monitoring unit controls and keeps the power switch control unit in an activated on state until the power management safety monitoring unit cancels the Keep Alive high potential output. The step S6 comprises: The safety switch of the power management safety monitoring unit is turned on, and the SoC processor performs a power-on self-test; If the self-test fails, the SoC processor will restart the power management safety monitoring unit, close the Keep Alive channel, power off the controller, and wait for the next wake-up; If the self-test passes and the corresponding startup conditions are met, the SoC processor starts and runs under the mutual monitoring and safety mechanism of the SoC processor and the power management safety monitoring unit that meet the ASIL-D safety requirements.

7. A bidirectional power switching method for a high-security controller, characterized in that: The method includes: The bidirectional power supply monitoring and management method based on the high-security controller of claim 5 or 6 continuously monitors the voltage of the power supply device; State 1: If the voltage of the main power supply device is within the voltage overload protection start range and lasts for more than a certain period of time, the voltage overload protection is turned on, the main power supply device is turned off and switched to the standby power supply device; State 2: If the voltage of the main power supply device is within the voltage overload warning range, only the overvoltage alarm is triggered; State three: If the voltage of the main power supply device is within the normal voltage range, it is determined that the controller system is in the normal voltage area; State 4: If the voltage of the main power supply device is within the low voltage warning range, the system alarm voltage is too low; and when the voltage of the main power supply device is lower than the low voltage protection value, the main power supply device is immediately turned off and the backup power supply device is started to achieve low voltage protection; State 5: If the voltage of the main power supply device is within the low voltage protection range, the power switch control unit disconnects the main power supply device and maintains the power reverse connection protection state; State six: If the voltage of the main power supply device returns to exceed the low voltage protection range, the main power supply device is turned on and the standby power supply device is turned off to save power.

8. The bidirectional power switching method of the high-security controller according to claim 7, characterized in that: When the system rated voltage is 12V: The state 1 specifically includes: If the voltage of the main power supply device is within the range of greater than or equal to 28V and less than 40V for more than 1 minute, the voltage overload protection is turned on, the main power supply device is turned off and switched to the backup power supply device; The second state specifically includes: If the voltage of the main power supply device is less than 28V and greater than 16V, only the overvoltage alarm will be triggered and the power supply will be maintained for at least 1 hour; The state three specifically includes: If the voltage of the main power supply device is within the range of less than or equal to 16V and greater than or equal to 9V, it is determined that the controller system is in the normal voltage area; The fourth state specifically includes: If the voltage of the main power supply device is less than 9V and greater than or equal to 6V, the system alarm voltage is too low and the power supply is maintained for at least 1 hour; and if the voltage of the main power supply device is lower than 7V, the main power supply device is immediately turned off and the backup power supply device is started to achieve low voltage protection; The state five specifically includes: If the voltage of the main power supply device is lower than 6V, the power switch control unit disconnects the main power supply device and maintains the power reverse connection protection state; The state six specifically includes: If the voltage of the main power supply device returns to greater than 6V, the power switch control unit turns on the main power supply device, ending the state of the power reverse connection protection; If the voltage of the main power supply device returns to be greater than or equal to 7V, the main power supply device is turned on and the standby power supply device is turned off to save power.

Images