Dual-redundancy power supply management system and method

Abstract

The invention relates to the technical field of vehicles, in particular to a dual-redundancy power supply management system and method, and the system comprises an intelligent power distribution unit which is integrated with a first-stage power distribution circuit and a second-stage power distribution circuit; a plurality of MOS (Metal Oxide Semiconductor) tubes are arranged in the primary power distribution circuit and are used for executing corresponding switching operations according to different power failure modes; the secondary power supply distribution circuit comprises a plurality of high-side driving units and is used for providing controlled power supply output for a load, and the high-side driving units have the functions of current detection, temperature detection and fault protection; and the control unit is used for controlling the on-off states of the MOS tube and the high-side driving unit and realizing feedback and remote control of fault information through a bus. Therefore, the problems of low integration level, limited functions, insufficient safety, difficulty in meeting high-order intelligent driving requirements and the like of a vehicle power supply management scheme in related technologies are solved.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to a dual-redundant power management system and method. Background Technology

[0002] With the development of vehicle electrification and intelligent driving, electronic and electrical architecture technology is constantly being updated, and vehicle electrical systems have undergone tremendous changes. More and more advanced technologies are being applied to the whole vehicle, such as alcohol interlock, remote control, digital keys and advanced autonomous driving. These advanced technologies will inevitably bring greater electricity demand.

[0003] In related technologies, vehicle power management basically adopts the power management scheme of main power switch, fuse and relay. The power management of electrical appliances is achieved by controlling the relay to open or close through different controllers. However, there are many technical limitations: (1) Low integration and large size. A large number of discrete components occupy valuable vehicle body space, which is not conducive to the lightweight design of the whole vehicle and the later functional expansion. (2) Relays and fuses are mechanical or one-time protection components with slow response speed. For example, at 1.35 times the rated current, the fuse blowing time is as long as 120 to 1800 seconds, which cannot achieve fast overcurrent protection and poses a safety hazard. (3) Lack of intelligent control capability. It is difficult to support complex power management logic, real-time status monitoring, fault diagnosis and remote control functions, and cannot meet the power management requirements of intelligent connected vehicles for programmable, configurable and networkable power management. (4) Lack of effective redundant power supply path and fault isolation means may lead to the failure of the whole vehicle power or key safety system, which seriously affects driving safety. Summary of the Invention

[0004] This application provides a dual-redundant power management system and method to solve the problems of low integration, limited functionality, insufficient safety, and difficulty in meeting the needs of high-level intelligent driving in related technologies.

[0005] The first aspect of this application provides a dual-redundant power management system, comprising the following steps: an intelligent power distribution unit, wherein the intelligent power distribution module integrates a primary power distribution circuit and a secondary power distribution circuit, wherein the primary power distribution circuit includes a first power supply, a second power supply, and a redundancy switching circuit; wherein the first power supply includes a main battery and a DC-DC converter, and the second power supply includes an auxiliary battery and a DC-DC converter, and the first power supply and the second power supply are redundant inputs to each other; the primary power distribution circuit is provided with multiple MOSFETs for performing corresponding switching operations according to different power failure modes; the secondary power distribution circuit includes multiple high-side drive units for providing controlled power output to the load, and the high-side drive units have current detection, temperature detection, and fault protection functions; and a control unit for controlling the on / off states of the MOSFETs and the high-side drive units, and realizing fault information feedback and remote control through a bus.

[0006] Optionally, the MOSFET includes a first MOSFET, a second MOSFET, a third MOSFET, and a fourth MOSFET, wherein the source of the first MOSFET is connected to the positive terminal of the main battery, and the drain is connected to the input terminal of the secondary power distribution circuit; the sources of the second and third MOSFETs are connected to the output terminals of the DC-DC converter, and the drains are connected to the input terminals of the secondary power distribution circuit; the source of the fourth MOSFET is connected to the positive terminal of the auxiliary battery, and the drain is connected to the input terminal of the secondary power distribution circuit.

[0007] Optionally, the first input port of the primary power distribution circuit is electrically connected to the main battery, the second input port is electrically connected to the auxiliary battery, and the third input port is electrically connected to the DC-DC converter.

[0008] Optionally, the input terminals of the high-side drive units are electrically connected to the power nodes of the first-level power distribution circuit, and the output terminals of the plurality of high-side drive units are used to supply power to a plurality of external loads.

[0009] Optionally, in the secondary power distribution circuit, for at least one safety-class load, two high-side drive units are provided. The input terminals of the two high-side drive units are respectively connected to the first-level power circuit and the second-level power circuit, and the output terminals are respectively used to connect to different power supply pins of the safety-class load, forming a redundant power supply channel.

[0010] Optionally, the control unit further includes a main controller and a secondary controller, wherein the main controller and the secondary controller are electrically connected via a serial communication interface; the secondary controller is used to take over control of the MOS transistor and the high-side drive unit when the main controller fails.

[0011] A third aspect of this application provides a dual-redundant power management method, which is applied to the dual-redundant power management system described in the above embodiments. The method includes the following steps: acquiring the status parameters of the main battery, auxiliary battery, and DC-DC converter; determining whether a fault has occurred in the power system and identifying the fault type based on the status parameters; and controlling the combination of switching on and off of the corresponding MOS transistor switches in the dual-redundant power management system according to the fault type to isolate the faulty power supply and switch to the redundant power path.

[0012] Optionally, isolating the faulty power supply and switching to a redundant power path includes: when a fault is detected in the DC-DC converter, controlling the second and third MOSFETs to turn off, at which point the main battery and auxiliary battery jointly supply power to the load; when a fault is detected in the main battery, controlling the first MOSFET to turn off, at which point the DC-DC converter and auxiliary battery jointly supply power to the load; when a fault is detected in the auxiliary battery, controlling the fourth MOSFET to turn off, at which point the DC-DC converter and main battery jointly supply power to the load; when a fault is detected in both the main battery and the DC-DC converter, controlling the first, second, and third MOSFETs to turn off, so that the auxiliary battery supplies power to the load; when a fault is detected in both the auxiliary battery and the DC-DC converter, controlling the second, third, and fourth MOSFETs to turn off, so that the main battery supplies power to the load; when a fault is detected in both the main battery and the auxiliary battery, controlling the first and fourth MOSFETs to turn off, so that the DC-DC converter supplies power to the load.

[0013] Optionally, it further includes: identifying the electrical state of the output channel in the secondary power distribution circuit; determining the fault type based on the electrical state of the output channel, the fault type including open circuit fault, overcurrent fault, overtemperature fault and short circuit fault; and performing corresponding isolation or protection actions based on the fault type.

[0014] Optionally, the step of performing corresponding isolation or protection actions according to the fault type includes: when an open circuit fault is determined, the high-side drive unit feeds back the fault information to the control unit, and the control unit reports it to the vehicle via the CAN bus; when a steady-state overcurrent fault is determined, the control unit controls the high-side drive unit to cut off the output after a target duration; when an overtemperature fault is determined, the high-side drive unit automatically shuts off the output and automatically restarts after the temperature returns to normal; when a short circuit fault is determined, the hardware protection circuit of the high-side drive unit immediately cuts off the output.

[0015] Therefore, this application has at least the following beneficial effects: The intelligent power distribution unit in this embodiment achieves highly reliable and intelligent power management by integrating primary and secondary power distribution circuits. The primary power distribution circuit uses a first power source consisting of a main battery and a DC-DC converter, and a second power source consisting of an auxiliary battery and a DC-DC converter. These two power sources are redundant, and a redundant switching circuit composed of multiple MOSFETs dynamically switches the power supply path according to different power failure modes, ensuring continuous power supply even when any power link fails, significantly improving the continuity and safety of power supply. The secondary power distribution circuit employs current detection, temperature detection, and rapid fault protection (such as overcurrent protection). The high-side drive unit, capable of withstanding short circuits, over-temperature, etc., enables precise control and comprehensive protection of the load, with a response time in the microsecond range, far superior to traditional fuses. The control unit uniformly regulates the on / off state of all MOSFETs and high-side drive units, supports remote control, fault diagnosis, and CAN bus communication, and can activate a backup control path in case of main controller failure. Combined with OTA programmability, the system achieves controllability, diagnostics, configuration, and upgradeability, effectively solving the problems of large size, slow response, lack of redundancy, and low level of intelligence of traditional relay + fuse solutions. It is suitable for application scenarios with stringent requirements for power safety and reliability, such as high-level intelligent driving.

[0016] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0017] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a dual-redundant power management system provided according to an embodiment of this application; Figure 2 This is an example diagram of a power distribution scheme provided according to an embodiment of this application; Figure 3 This is a flowchart illustrating the dual-redundant power management method provided according to an embodiment of this application. Detailed Implementation

[0018] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0019] The current power switch, fuse, and relay solution has the following disadvantages: 1) Low integration: Fuse + relay occupy a large space, making it inconvenient to add new functions later; 2) Large size: After integrating new functions, the size is large, the required maintenance space is increased, and the overall vehicle layout is more difficult; 3) Limited scope of application: With the development of intelligent driving technology, major car manufacturers are paying more and more attention to functional safety and expected functional safety, and the fuse + relay method cannot meet the requirements; 4) Limited functions: The relay fuse solution is difficult to implement complex electrical architecture and control logic, and cannot meet the needs of modern cars for intelligence and connectivity; 5) Long protection time: At 1.35 times the rated current, the fusing time is 120s-1800s, which is relatively long.

[0020] This application provides a dual-redundant power management system with intelligent power distribution, which can isolate faulty modules in the event of a fault. It can also realize highly integrated, platform-based, intelligent and expandable power distribution modules SJB (Smart Junction Box). This module has controllable, network-connected, diagnostic, programmable and configurable functions, and meets functional safety requirements.

[0021] The dual-redundant power management system and method of this application are described below with reference to the accompanying drawings.

[0022] Specifically, the dual-redundant power management system proposed in this application embodiment.

[0023] Figure 1 This is a block diagram of a dual-redundant power management system according to an embodiment of this application.

[0024] like Figure 1 As shown, the dual-redundant power management system 10 includes an intelligent power distribution unit 100 and a control unit 200.

[0025] The intelligent power distribution unit 100 integrates a primary power distribution circuit and a secondary power distribution circuit. The primary power distribution circuit includes a first power supply, a second power supply, and a redundancy switching circuit. The first power supply includes a main battery and a DC-DC converter, and the second power supply includes an auxiliary battery and a DC-DC converter. The first and second power supplies are redundant inputs to each other. The primary power distribution circuit has multiple MOSFETs to perform corresponding switching operations according to different power failure modes. The secondary power distribution circuit includes multiple high-side drive units to provide controlled power output to the load. The high-side drive units have current detection, temperature detection, and fault protection functions. The control unit 200 is used to control the on / off state of the MOSFETs and high-side drive units, and realizes fault information feedback and remote control through the bus.

[0026] It is understood that the embodiments of this application can achieve rapid and automatic switching and fault isolation under various power failure modes by setting two redundant power inputs in the primary power distribution circuit and using multiple MOSFETs to form a redundant switching circuit, which significantly improves the continuity and reliability of the vehicle power supply. At the same time, the secondary power distribution circuit adopts multiple high-side drive units with current and temperature detection and multiple fault protection functions to provide intelligent and refined controlled power output to the load, and combined with the control unit to realize comprehensive status monitoring, fault diagnosis and information reporting, ultimately achieving the goal of high integration, high functional safety level and intelligent power management.

[0027] In this embodiment, the MOSFET includes a first MOSFET, a second MOSFET, a third MOSFET, and a fourth MOSFET. The source of the first MOSFET is connected to the positive terminal of the main battery, and the drain is connected to the input terminal of the secondary power distribution circuit. The sources of the second and third MOSFETs are connected to the output terminal of the DC-DC converter, and the drains are connected to the input terminal of the secondary power distribution circuit. The source of the fourth MOSFET is connected to the positive terminal of the auxiliary battery, and the drain is connected to the input terminal of the secondary power distribution circuit.

[0028] It is understood that the embodiments of this application construct a highly flexible and reliable redundant switching architecture by configuring the first to fourth MOSFETs and precisely setting their connection relationships: the first and fourth MOSFETs directly control the connection of the main battery and the auxiliary battery, respectively, while the second and third MOSFETs control the connection of the DC-DC converter, respectively. This layout enables the control unit to accurately achieve rapid isolation and seamless switching of power supply paths under various power failure modes by independently or in combination turning off specific MOSFETs, thereby ensuring that when any single path (battery or DC-DC) fails, the redundant path can quickly take over the power supply, greatly improving the power continuity and vehicle functional safety level of the system when facing single or compound failures.

[0029] In this embodiment, the first input port of the primary power distribution circuit is electrically connected to the main battery, the second input port is electrically connected to the auxiliary battery, and the third input port is electrically connected to the DC-DC converter.

[0030] It is understood that the embodiments of this application can physically separate the three key power sources—the main battery, auxiliary battery, and DC-DC converter—by setting three independent input ports and directly connect them to the primary power distribution circuit. This constructs a truly independent and non-interfering dual-battery and DC-DC redundant power supply architecture from the source. This layout ensures that if any battery or DC-DC converter fails, it can be precisely isolated from the circuit through internal control logic (such as operating a MOSFET), while the remaining normal power supply units continue to provide power. This achieves flexible and rapid reconfiguration of the power supply path and strict isolation of faults, laying a solid hardware foundation for meeting the high reliability and functional safety requirements of advanced intelligent driving power systems.

[0031] In this embodiment, the input terminals of the high-side drive units are electrically connected to the power nodes of the first-level power distribution circuit, and the output terminals of the multiple high-side drive units are used to supply power to multiple external loads.

[0032] It is understood that the embodiments of this application can achieve centralized management and distributed output control of redundant power supplies by connecting the input terminals of multiple high-side drive units to a unified power node of the primary power distribution circuit. This architecture ensures that each high-side drive unit can obtain power from the high-reliability power node that has undergone redundancy processing, and independently and accurately supply power to its corresponding external load. Thus, on the basis of inheriting system-level power supply redundancy and high reliability, it further realizes independent intelligent control, real-time status monitoring and rapid fault protection for each load circuit, significantly improving system integration, power distribution flexibility and load-level management refinement.

[0033] In this embodiment of the application, in the secondary power distribution circuit, two high-side drive units are provided for at least one safety-class load. The input terminals of the two high-side drive units are respectively connected to the first-level power circuit and the second-level power circuit, and the output terminals are respectively used to connect to different power supply pins of the safety-class load, thus forming a redundant power supply channel.

[0034] It is understood that the embodiments of this application can construct a complete redundant power supply channel from the common power supply bus to the load end by configuring two parallel high-side drive units for safety-type loads: the two drive units share a high-reliability power supply from the front stage, but are controlled independently and connected to different power supply pins of the load respectively; this design ensures that when a single high-side drive unit experiences any open circuit, overcurrent, or control failure, the other unit can still independently and continuously supply power to the safety-type load, thereby achieving redundant backup of the power supply path at the load end, greatly improving the power supply continuity and system functional safety level of safety-type loads (such as braking systems EBS) under single-point failure conditions, and directly supporting the high reliability requirements of advanced intelligent driving for key actuators.

[0035] In this embodiment, the control unit further includes a main controller and a secondary controller, wherein the main controller and the secondary controller are electrically connected through a serial communication interface; the secondary controller is used to take over control of the MOSFET and the high-side drive unit when the main controller fails.

[0036] It is understood that the embodiments of this application can construct a hardware redundancy architecture for the control layer by setting up a main controller and a secondary controller and establishing a coordination and monitoring link between them through a serial communication interface. The secondary controller continuously monitors the status of the main controller. When the failure of the main controller is detected, it can seamlessly take over the control of the MOSFET and high-side drive unit, thereby effectively avoiding the paralysis of the entire power management system due to the failure of a single control unit. This greatly improves the fault tolerance and operational reliability of the system, ensures the functional safety of the vehicle power management at the core controller level, and meets the stringent requirements of high availability and safety integrity of the control system for advanced intelligent driving systems.

[0037] The dual-redundant power management system proposed in this application integrates primary and secondary power distribution circuits to achieve highly reliable and intelligent power management. The primary power distribution circuit uses a first power source consisting of a main battery and a DC-DC converter, and a second power source consisting of an auxiliary battery and a DC-DC converter. The two are redundant with each other, and the power supply path is dynamically switched according to different power failure modes through a redundant switching circuit composed of multiple MOSFETs, ensuring that the system can still provide power when any power link fails, significantly improving the continuity and safety of power supply. The secondary power distribution circuit uses a high-side drive unit with current detection, temperature detection, and fast fault protection (such as overcurrent, short circuit, overtemperature, etc.) to achieve precise control and comprehensive protection of the load. The response time is in the microsecond range, which is far superior to traditional fuses. The control unit uniformly controls the on / off state of all MOSFETs and high-side drive units, supports remote control, fault diagnosis, and CAN bus communication, and can activate the backup control path when the main controller fails. Combined with OTA programmable capability, the system is controllable, diagnosable, configurable, and upgradeable.

[0038] Figure 3 This is a flowchart illustrating a dual-redundant power management method provided in an embodiment of this application.

[0039] like Figure 3 As shown, this dual-redundant power management method is applied to a dual-redundant power management system, wherein the method includes the following steps: In step S101, the status parameters of the main battery, auxiliary battery, and DC-DC converter are obtained.

[0040] It is understood that the embodiments of this application can provide the control unit with real-time perception capability of the power input status of the entire link by acquiring and monitoring key status parameters (such as voltage, current, temperature and operating status) of the main battery, auxiliary battery and DC-DC converter in real time; this status monitoring mechanism is the core foundation for realizing intelligent power distribution and high reliability redundancy management, enabling the system to make intelligent decisions based on accurate power health status.

[0041] In step S102, based on the status parameters, it is determined whether a fault has occurred in the power system and the fault type is identified.

[0042] It is understood that the embodiments of this application can construct a systematic power fault diagnosis and classification capability by analyzing the acquired status parameters of the main battery, auxiliary battery, and DC-DC converter in real time. Based on preset voltage thresholds, current ranges, temperature limits, and status flags, the control unit can accurately identify various fault types, including power failure, abnormal output voltage, overload, short circuit, and device overheating. This intelligent diagnostic mechanism not only achieves rapid detection and accurate location of faults, but also provides key decision-making basis for subsequent redundancy switching and fault isolation strategies. This ensures that the system can execute optimal response measures according to different fault types, maintain power supply continuity to the maximum extent, and significantly improve the intelligence level and functional safety and reliability of the power management system.

[0043] In step S103, the combination of switching on and off of the corresponding MOS transistor switches in the dual redundant power management system is controlled according to the fault type to isolate the faulty power supply and switch to the redundant power supply path.

[0044] It is understood that the embodiments of this application can achieve precision and automation of the fault response mechanism by associating specific fault types with preset MOSFET switching combination strategies: after the control unit diagnoses a specific fault type, it can immediately trigger the corresponding MOSFET on / off combination (such as turning off the MOSFET connected to the faulty power supply while keeping or turning on the MOSFET of the redundant path), thereby quickly physically isolating the faulty power supply from the power supply circuit and simultaneously and seamlessly switching to the normal redundant power supply path to continue power supply; this dynamic reconfiguration capability ensures that the system can complete the seamless relay of energy supply in a very short time when encountering single or compound faults, and maintain the continuous operation of the vehicle's critical loads to the maximum extent.

[0045] In this embodiment, isolating the faulty power supply and switching to a redundant power path includes: when a DC-DC converter fault is detected, controlling the second and third MOSFETs to turn off, at which point the main battery and auxiliary battery jointly supply power to the load; when a main battery fault is detected, controlling the first MOSFET to turn off, at which point the DC-DC converter and auxiliary battery jointly supply power to the load; when an auxiliary battery fault is detected, controlling the fourth MOSFET to turn off, at which point the DC-DC converter and main battery jointly supply power to the load; when both the main battery and the DC-DC converter are detected as faulty, controlling the first, second, and third MOSFETs to turn off, so that the auxiliary battery supplies power to the load; when both the auxiliary battery and the DC-DC converter are detected as faulty, controlling the second, third, and fourth MOSFETs to turn off, so that the main battery supplies power to the load; when both the main battery and the auxiliary battery are detected as faulty, controlling the first and fourth MOSFETs to turn off, so that the DC-DC converter supplies power to the load.

[0046] It is understood that the embodiments of this application can isolate faulty power supplies and switch to redundant power paths, including: when a DC-DC converter fault is detected, controlling the second and third MOSFETs to turn off, at which time the main battery and auxiliary battery jointly supply power to the load; when a main battery fault is detected, controlling the first MOSFET to turn off, at which time the DC-DC converter and auxiliary battery jointly supply power to the load; when an auxiliary battery fault is detected, controlling the fourth MOSFET to turn off, at which time the DC-DC converter and main battery jointly supply power to the load; when both the main battery and the DC-DC converter are detected to fail, controlling the first MOSFET and the second MOSFET to turn off... When the first and third MOSFETs are turned off, the auxiliary battery supplies power to the load. When a simultaneous failure of the auxiliary battery and DC-DC converter is detected, the second, third, and fourth MOSFETs are turned off, allowing the main battery to supply power to the load. When a simultaneous failure of the main battery and auxiliary battery is detected, the first and fourth MOSFETs are turned off, allowing the DC-DC converter to supply power to the load. This ensures that the system can achieve millisecond-level fault isolation and power supply path reconstruction in the event of any single-point or superimposed fault, thereby providing a seamless and highly reliable power supply to the vehicle and completely eliminating the risk of single-point failure of the power system.

[0047] In this embodiment of the application, it further includes: identifying the electrical state of the output channel in the secondary power distribution circuit; determining the fault type based on the electrical state of the output channel, including open circuit fault, overcurrent fault, overtemperature fault and short circuit fault; and performing corresponding isolation or protection actions according to the fault type.

[0048] It is understood that the embodiments of this application can achieve refined identification and classification of load circuit faults by real-time monitoring of the electrical status (such as output voltage, current, and chip temperature) of each output channel in the secondary power distribution circuit. This allows for accurate differentiation between open-circuit faults, overcurrent faults, overtemperature faults, and short-circuit faults. The system executes a graded protection strategy based on different fault types: reporting open-circuit faults, implementing intelligent management such as delayed disconnection or self-recovery after temperature recovery for overcurrent and overtemperature faults, and triggering hardware-level protection for short-circuit faults. s The high-speed protection system ensures the safety of electrical equipment while maintaining power supply continuity to the maximum extent. Through accurate identification and recording of fault types, it provides core data support for system status monitoring, remote diagnosis, and predictive maintenance, comprehensively improving the intelligence level and system reliability of power distribution management.

[0049] In this embodiment, the corresponding isolation or protection action is performed according to the fault type, including: when an open circuit fault is determined, the high-side drive unit feeds back the fault information to the control unit, and the control unit reports it to the vehicle via the CAN bus; when a steady-state overcurrent fault is determined, the control unit controls the high-side drive unit to cut off the output after a target duration; when an overtemperature fault is determined, the high-side drive unit automatically shuts off the output and automatically restarts after the temperature returns to normal; when a short circuit fault is determined, the hardware protection circuit of the high-side drive unit immediately cuts off the output.

[0050] It is understood that the embodiments of this application can achieve precise management and rapid protection of secondary power distribution circuit faults by constructing a hierarchical and categorized fault response mechanism: For open circuit faults, the system executes a "detection-reporting" strategy to complete fault recording and remote diagnosis without affecting power supply; for steady-state overcurrent, a soft shutdown method with configurable delay by the control unit is adopted to effectively distinguish between transient impacts and continuous anomalies, avoiding false triggering; for over-temperature faults, intelligent temperature management of "shutdown-self-recovery" is achieved by relying on the built-in protection function of the high-side drive unit to ensure chip safety and automatic functional recovery; for the most dangerous short-circuit faults, hardware-level u s The system features rapid disconnection, achieving the highest priority and ultra-fast protection. Its multi-layered collaborative protection architecture ensures the safety of electrical equipment and power distribution systems while maximizing power supply continuity, significantly improving system availability, intelligent management level, and functional safety level.

[0051] According to the dual-redundant power management method proposed in this application, a systematic power fault monitoring system is constructed by continuously acquiring the status parameters of the main battery, auxiliary battery, and DC-DC converter. Based on the real-time analysis of these status parameters, the control unit can accurately diagnose whether a fault has occurred in the power system and accurately locate the fault type. Then, according to the preset fault handling strategy, the corresponding MOSFET switch combination is controlled to perform on / off operations, realizing rapid isolation of faulty power and seamless switching of redundant power paths, ensuring that the system can maintain uninterrupted power supply when any single point or compound fault occurs, significantly improving the reliability, availability, and functional safety level of the power system.

[0052] The following will combine Figure 2 This application provides a detailed description of the dual-redundant power management system and method. The power distribution module (SJB) of this application achieves high integration, intelligence, and scalability, possessing controllable, networkable, diagnostic, programmable, and configurable functions. A single SJB can meet the power supply requirements of L4 autonomous driving and is backward compatible to L2 level autonomous driving power supply requirements. The SJB integrates a primary power distribution and a secondary power distribution method, and has power redundancy and fault isolation functions. The primary power distribution consists of two sets of batteries and an 800V / 24V DC-DC converter (hereinafter referred to as DC-DC), which is isolated internally by MOS1, MOS2, MOS3, and MOS4. The secondary power distribution uses HSD (High-Side Driver) chips for output power control, and has functions such as current and temperature detection. The power distribution method is described in [details omitted]. Figure 2 The specific steps are as follows: (1) The primary power supply redundancy and fault isolation methods are as follows: 1) Redundancy mode: The main battery + DC-DC converter is used as one input power source; the redundant battery + DC-DC converter is used as one input power source, and the two power inputs can be redundant to each other. 2) Fault isolation method: Fault 1: When the DC-DC power supply fails, SJB controls MOS2 and MOS3 to shut down. At this time, the main battery and redundant battery provide power, which can meet the vehicle's normal operation for a short period of time until the vehicle is safely pulled over to the side of the road. Fault 2: When the main battery power supply fails, SJB controls MOS1 to shut down. At this time, the DC-DC + redundant battery is used as the main power supply, and the vehicle can run normally. Fault 3: When the redundant battery power supply fails, the MCU in SJB controls MOS4 to shut down. At this time, the DC-DC + main battery is used as the main power supply, and the vehicle can run normally. Fault 4: When the main battery and DC-DC power supply fail simultaneously, SJB controls MOS1, MOS2 and MOS3 to shut down. At this time, the auxiliary battery supplies power, which can meet the normal operation of the vehicle for a short period of time until the vehicle is safely pulled over to the side of the road. Fault 5: When the auxiliary battery and DC-DC power supply fail simultaneously, the SJB controls MOS2, MOS3 and MOS4 to shut down. At this time, the main battery supplies power, which can meet the normal operation of the vehicle for a short period of time until the vehicle is safely pulled over to the side of the road. Fault 6: When the power supply of the main battery and the auxiliary battery fails simultaneously, the SJB controls MOS1 and MOS4 to shut down. At this time, the DC-DC power supply is used, and the vehicle can run normally.

[0053] (2) Secondary power distribution redundancy and fault isolation scheme: 1) Redundancy method: For power supply of safety components (such as EBS), there are two different HSD control power outputs. When one power supply fails, the other power supply can maintain the normal operation of EBS, ensuring power supply redundancy for safety components.

[0054] 2) Fault isolation method: Open circuit fault: When HSD detects no current output, HSD will feed back the open circuit fault to MCU. After the MCU collects the fault, it will feed back to the bus via CAN signal. Overcurrent fault: When the HSD detects that the steady-state current is greater than the rated current, after a certain period of time, the MCU controls the HSD to cut off the output, so as to protect the vehicle circuit and electrical appliances. Over-temperature fault: When the temperature of the HSD detection chip is too high, the protection mechanism will be triggered. At this time, the HSD will shut down the power output and turn the power output back on after the temperature drops to the normal operating range. Short circuit fault: When the HSD detected current is several times greater than the rated current, the HSD hardware protection is triggered, and the output is immediately cut off. The cut-off time is on the order of μs.

[0055] 3) Functional safety level: 3.1) Power supply functional safety: Primary power distribution: Consists of two ALS Class B power supplies: main battery + DC-DC converter; auxiliary battery + DC-DC converter, which can meet ALS Class D requirements. Secondary power distribution: Safety components are supplied with two ALS B-level HSD output power supplies, which can meet ALS D-level requirements; Communication redundancy: The communication section consists of a main MCU and a secondary MCU. Under normal operation, the main MCU controls the overall power system, and the secondary MCU communicates with the main MCU periodically. When the main MCU fails, the secondary MCU will restart the main MCU. If the restart fails, the secondary MCU will take over control and enter limp home mode to improve the power safety of the whole vehicle.

[0056] 4) High integration: Replacing relays and fuses with MOSFETs and HSDs integrates the main power switch function, achieving higher integration, which is beneficial for vehicle weight reduction and simplifies overall vehicle layout.

[0057] 5) Intelligentization: SJB can individually control the opening or closing of any MOSFET and HSD, enabling remote control functions and intelligent power management to optimize vehicle energy consumption.

[0058] 6) Platformization and scalability: All chips can be configured with protection parameters, which enables platformization and scalability.

[0059] 7) OTA upgrade: SJB uses programmable MOSFETs and HSD, supports OTA upgrades, and is easy to handle future changes and upgrades to electrical systems.

[0060] 8) Ease of maintenance: SJB feeds back fault information to the bus via CAN signal, which can help maintenance personnel locate the cause of the fault more quickly and improve maintenance convenience.

[0061] The power distribution module SJB of this application has a power diagnostic function, which reports faults and improves maintenance convenience; the power distribution module SJB has a power redundancy function to meet the requirements of L4 high-level intelligent driving, while being backward compatible with L2 low-level intelligent driving; the power distribution module SJB has functional safety levels, and one SJB can meet the power supply ALS D and ALS B levels; the power distribution module SJB has a fault isolation function to improve the power safety of the whole vehicle; the power distribution module SJB has a communication redundancy function, using a main MCU + a secondary MCU for control, improving the overall system reliability; the power distribution module SJB can independently control any MOSFET and HSD chip to turn on or off, realizing intelligent power management and optimizing the energy consumption of the whole vehicle; the power distribution module SJB has an OTA upgrade function to adapt to future changes and upgrades to the electrical system.

[0062] In summary, SJB uses MOSFETs and HSDs to replace relays and fuses, achieving intelligent and electrified operation, which improves the overall vehicle power safety and reliability to a certain extent. It can also be platformized and expanded through configuration and improve maintenance convenience through diagnostics, thus meeting the power safety requirements of advanced intelligent driving.

[0063] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0064] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0065] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0066] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or more of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0067] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

Claims

1. A dual-redundant power management system, characterized in that, include: The intelligent power distribution unit integrates a primary power distribution circuit and a secondary power distribution circuit. The primary power distribution circuit includes a first power supply, a second power supply, and a redundancy switching circuit. The first power supply includes a main battery and a DC-DC converter, and the second power supply includes an auxiliary battery and a DC-DC converter. The first power supply and the second power supply are redundant inputs to each other. The primary power distribution circuit is equipped with multiple MOSFETs, which are used to perform corresponding switching operations according to different power failure modes. The secondary power distribution circuit includes multiple high-side drive units for providing controlled power output to the load. The high-side drive units have current detection, temperature detection and fault protection functions. The control unit is used to control the on / off state of the MOS transistor and the high-side drive unit, and to realize fault information feedback and remote control through the bus.

2. The dual-redundant power management system according to claim 1, characterized in that, The MOSFETs include a first MOSFET, a second MOSFET, a third MOSFET, and a fourth MOSFET, wherein, The source of the first MOSFET is connected to the positive terminal of the main battery, and the drain is connected to the input terminal of the secondary power distribution circuit. The sources of the second and third MOSFETs are connected to the output of the DC-DC converter, and their drains are connected to the input of the secondary power distribution circuit. The source of the fourth MOS transistor is connected to the positive terminal of the auxiliary battery, and the drain is connected to the input terminal of the secondary power distribution circuit.

3. The dual-redundant power management system according to claim 1, characterized in that, The first input port of the primary power distribution circuit is electrically connected to the main battery, the second input port is electrically connected to the auxiliary battery, and the third input port is electrically connected to the DC-DC converter.

4. The dual-redundant power management system according to claim 1, characterized in that, The input terminals of the high-side drive units are electrically connected to the power nodes of the first-level power distribution circuit, and the output terminals of the multiple high-side drive units are used to supply power to multiple external loads.

5. The dual-redundant power management system according to claim 1, characterized in that, In the secondary power distribution circuit, for at least one safety-class load, two high-side drive units are provided. The two high-side drive units are respectively connected to the first-level power circuit and the second-level power circuit, and their output terminals are respectively used to connect to different power supply pins of the safety-class load, forming a redundant power supply channel.

6. The dual-redundant power management system according to claim 1, characterized in that, The control unit further includes a main controller and a secondary controller, wherein the main controller and the secondary controller are electrically connected via a serial communication interface; the secondary controller is used to take over control of the MOS transistor and the high-side drive unit when the main controller fails.

7. A dual-redundant power supply management method, characterized in that, The method is applied to the dual-redundant power management system according to any one of claims 1-6, wherein the method includes the following steps: Obtain the status parameters of the main battery, auxiliary battery, and DC-DC converter; Based on the status parameters, determine whether a fault has occurred in the power system and identify the type of fault. The dual-redundant power management system controls the combination of on / off switching of corresponding MOS transistor switches according to the fault type, in order to isolate the faulty power supply and switch to the redundant power supply path.

8. The dual-redundant power management method according to claim 7, characterized in that, The isolation of the faulty power supply and switching to a redundant power path includes: When a fault is detected in the DC-DC converter, the second and third MOSFETs are turned off, and the main battery and auxiliary battery jointly supply power to the load. When a fault is detected in the main battery, the first MOSFET is turned off, and the DC-DC converter and the auxiliary battery jointly supply power to the load. When a fault is detected in the auxiliary battery, the fourth MOSFET is turned off, and the load is powered by the DC-DC converter and the main battery. When it is determined that the main battery and the DC-DC converter are both faulty, the first MOSFET, the second MOSFET and the third MOSFET are turned off so that the auxiliary battery supplies power to the load. When it is determined that the auxiliary battery and the DC-DC converter have both failed, the second MOSFET, the third MOSFET and the fourth MOSFET are turned off so that the main battery can supply power to the load. When it is determined that both the main battery and the auxiliary battery have failed simultaneously, the first MOSFET and the fourth MOSFET are turned off, so that the DC-DC converter supplies power to the load.

9. The dual-redundant power management method according to claim 7, characterized in that, Also includes: Identify the electrical status of the output channels in the secondary power distribution circuit; The fault type is determined based on the electrical state of the output channel, and the fault types include open circuit fault, overcurrent fault, overtemperature fault and short circuit fault. Perform the corresponding isolation or protection action based on the fault type.

10. The dual-redundant power management method according to claim 9, characterized in that, The step of performing the corresponding isolation or protection action according to the fault type includes: When an open circuit fault is detected, the high-side drive unit feeds back the fault information to the control unit, and the control unit reports it to the vehicle via the CAN bus. When a steady-state overcurrent fault is detected, the control unit controls the high-side drive unit to cut off the output after the target duration. When an over-temperature fault is detected, the high-side drive unit automatically shuts down the output and automatically restarts after the temperature returns to normal. When a short-circuit fault is detected, the output is immediately cut off by the hardware protection circuit of the high-side drive unit.

Images