Power control apparatus and method for autonomous vehicle

Abstract

A power control apparatus and method for an autonomous vehicle, the power control apparatus including: a first power supply device, a main power; a second power supply device, supplying an auxiliary power; a power distributor, distributing the main power input from the first power supply; a first controller, connected to a first output terminal of the power distributor to control power supply to a first in-vehicle load by connecting or disconnecting the main power with the auxiliary power; and a second controller, connected to a second output terminal of the power distributor to control power supply to a second in-vehicle load using the main power. The first controller and the second controller cooperate with each other to diagnose a power failure, and supply redundant power using the main power or the auxiliary power based on a power failure diagnosis result.

Description

[0001] Cross-citation of related applications

[0002] This application claims priority to Korean Patent Application No. 10-2020-0107945, filed on August 26, 2020, with the Korean Intellectual Property Office, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure relates to an electrical control device and method for autonomous vehicles. Background Technology

[0004] Typically, when an unexpected situation occurs during driving, the driver assesses the situation and controls at least one of the vehicle's steering and braking functions to bring the vehicle to a stop. In autonomous vehicle systems, the Electronic Control Unit (ECU) is the entity that controls the vehicle's driving (behavior). When an electrical failure such as a short circuit or open circuit occurs during autonomous driving, there is a possibility that the autonomous vehicle system may reset due to low voltage across the entire vehicle, potentially rendering the vehicle inoperable. To address this issue, redundancy technology is implemented in autonomous vehicle systems by replicating the ECU and power supply unit to ensure occupant safety in emergency situations. This ECU and power supply unit perform accident avoidance and / or emergency stopping.

[0005] Furthermore, information and communication technologies for autonomous vehicles have been further developed, for example, by providing a 12V power supply to the battery or a low-voltage DC / DC converter (LDC) to provide separate redundant power to key systems related to autonomous driving, such as steering and braking, to ensure power supply in the event of a malfunction during driving. However, implementing redundancy in this way presents the following problems: with the recent introduction of dual power supplies to vehicles, wiring in mass-produced vehicles has changed significantly, and costs have increased substantially.

[0006] The information included in this Background section is intended only to enhance the understanding of the general background of this disclosure and is not to be construed as an admission or suggestion of prior art known to those skilled in the art. Summary of the Invention

[0007] This disclosure has solved the aforementioned problems in the prior art while fully maintaining the advantages achieved by the prior art.

[0008] One aspect of this disclosure provides an electrical control apparatus and method for an autonomous vehicle, wherein a dual power supply provides power to the primary load of autonomous driving in the event of a power failure during autonomous driving of the vehicle.

[0009] The technical problems to be solved by the present invention are not limited to those described above, and any other technical problems not mentioned herein will be clearly understood by those skilled in the art from the following description.

[0010] According to one aspect of this disclosure, a power control device includes: a first power supply unit for supplying main power; a second power supply unit for supplying auxiliary power; a power distributor connected to the first power supply unit and distributing the main power supplied from the first power supply unit; a first controller connected to a first output terminal of the power distributor to control the power supply to in-vehicle loads by connecting or disconnecting the main power and auxiliary power; and a second controller connected to a second output terminal of the power distributor to control the power supply to in-vehicle loads using the main power, wherein the first controller and the second controller cooperate with each other to diagnose power faults and selectively use the main power and auxiliary power to supply redundant power based on the power fault diagnosis results.

[0011] The first power supply device may include a low-voltage DC / DC converter that converts high-voltage power supplied from a high-voltage battery to low-voltage power, and the second power supply device may include an auxiliary battery that supplies low-voltage power.

[0012] The first controller may include: a communication circuit for communicating with the second controller; a first switch for monitoring the main power and auxiliary power between the first power supply and the second power supply, and supplying or cutting off at least one of the main power and auxiliary power according to the monitoring results; a second switch for supplying or cutting off power to loads inside the vehicle; and a processor for cooperating with the second controller to diagnose power faults, and controlling at least one of the first switch and the second switch based on the diagnostic results.

[0013] The first controller may further include: a current determination circuit for detecting overcurrent in at least one of a main power input terminal, an auxiliary power input terminal, and a load power output terminal; and a current cut-off circuit for cutting off the overcurrent detection section when an overcurrent is detected.

[0014] When a major power failure is detected, the first controller can disconnect the main power supply from the first controller and cut off the main power supply. When cooperating with the second controller to identify a major power output failure of the first power supply unit, auxiliary power is used to supply power to the loads inside the vehicle.

[0015] When the first controller identifies a major power output failure in the power distributor, it can send a notification message to the second controller to indicate a power failure. The second controller can then supply power to the vehicle's loads using the major power source in a manner independent of the first controller.

[0016] The first controller can monitor the status of the current input from the second power supply unit, and when an auxiliary power failure is detected, the first controller cuts off the auxiliary power to maintain the main power.

[0017] When a power output failure is detected in the first controller for at least one of the multiple in-vehicle loads, the second controller can use the main power to supply power to at least one of the multiple in-vehicle loads for which a power output failure was detected in the first controller.

[0018] When a power output failure of the second controller to at least one of the in-vehicle loads is detected, the first controller may use auxiliary power to supply power to at least one of the plurality of in-vehicle loads in which the power output failure of the second controller is detected.

[0019] Each of the in-vehicle loads may include at least one of a steering system, a braking system, an autonomous driving system, an airbag system, an instrument panel system, a lighting system, a door system, or a communication system.

[0020] According to one aspect of this disclosure, a power control method may include: diagnosing power faults by means of a first controller and a second controller cooperating with each other; and providing redundant power to in-vehicle loads by means of the first controller and the second controller selectively using primary power from a first power source and auxiliary power from a second power source, respectively, based on the power fault diagnosis results.

[0021] Diagnosing power faults may include: monitoring the status of primary power and auxiliary power output from a first power supply unit and a second power supply unit, respectively, via a first controller; in response to detecting a power fault, determining via the first controller whether the power fault exists on the primary power input side or the auxiliary power input side; if it is determined that the power fault exists on the auxiliary power input side, determining via the first controller that there is an auxiliary power input fault; and if it is determined that there is no power fault on the auxiliary power input side, determining via the first controller that there is a load power output fault of the first controller.

[0022] Supplying redundant power may include: cutting off the auxiliary power input via a first controller when an auxiliary power input failure is determined; and using the main power via a second controller to maintain the power supply to the loads inside the vehicle when an auxiliary power input failure is detected via the first controller.

[0023] Supplying redundant power may include: when a load power output failure is determined by the first controller, the first controller uses auxiliary power to cut off the load power output; and in response to the detection of a load power output failure by the first controller, the second controller uses primary power to supply power to at least one in-vehicle load whose power supply by the first controller has been cut off from the in-vehicle loads.

[0024] Diagnosing power faults may include: when the first controller detects a major power fault in the first controller, the second controller determines a major power input fault based on the major power input state of the second controller; when no major power input fault is detected, the second controller determines a first controller power output fault in the power distributor located between the first power supply unit and the first controller based on the major power input state of the first controller communicating with the first controller; when the major power input of the first controller is normal, the second controller determines whether the load power output of the second controller is faulty based on whether load power can be supplied to the second controller; and when it is determined that load power can be supplied, the second controller determines a high-current load power output fault in the power distributor.

[0025] Supplying redundant power may include: cutting off the main power input by the second controller when a main power input failure is detected; and supplying power to the loads inside the vehicle by the first controller using auxiliary power.

[0026] Supplying redundant power may include: in response to determining a power output failure from the power distributor to the first controller, the first controller disconnects the main power input; and the first controller and the second controller supply power to the loads inside the vehicle in an independent manner.

[0027] Supplying redundant power may include: cutting off the power supply to at least one of the multiple in-vehicle loads by the second controller when a load power output failure is determined by the second controller; or supplying power to at least one of the multiple in-vehicle loads whose power supply has been cut off by the second controller by the first controller.

[0028] Diagnosing power faults may include: monitoring the current status of the input and output power of the first and second controllers; and, in response to the detection of an overcurrent, immediately cutting off at least one of the input and output power.

[0029] Each of the in-vehicle loads may include at least one of a steering system, a braking system, an autonomous driving system, an airbag system, an instrument panel system, a lighting system, a door system, and a communication system. Attached Figure Description

[0030] The above and other objects, features and accompanying advantages of this disclosure will become more apparent and readily understood from the following detailed description taken in conjunction with the accompanying drawings:

[0031] Figure 1 This is a block diagram illustrating an electric control device for an autonomous vehicle according to an embodiment of the present disclosure;

[0032] Figure 2 Show Figure 1 The configuration diagram of the first controller is shown below;

[0033] Figure 3 This is a flowchart illustrating a method for diagnosing power faults according to embodiments of the present disclosure;

[0034] Figure 4 This is a flowchart illustrating a power control method according to a first embodiment of the present disclosure;

[0035] Figure 5 An example of power control according to a first embodiment of the present disclosure is shown;

[0036] Figure 6 This is a flowchart illustrating a power control method according to a second embodiment of the present disclosure;

[0037] Figure 7 An example of power control according to a second embodiment of the present disclosure is shown;

[0038] Figure 8 This is a flowchart illustrating a power control method according to a third embodiment of the present disclosure;

[0039] Figure 9 An example of power control according to a third embodiment of the present disclosure is shown;

[0040] Figure 10 An example of power control according to a third embodiment of the present disclosure is shown;

[0041] Figure 11 This is a flowchart illustrating a power control method according to a fourth embodiment of the present disclosure;

[0042] Figure 12 An example of power control according to a fourth embodiment of the present disclosure is shown;

[0043] Figure 13 An example of power control according to a fourth embodiment of the present disclosure is shown;

[0044] Figure 14 An example of power control according to a fourth embodiment of the present disclosure is shown;

[0045] Figure 15 This is a flowchart illustrating a power control method according to a fifth embodiment of the present disclosure;

[0046] Figure 16 An example of power control according to a fifth embodiment of the present disclosure is shown;

[0047] Figure 17 An example of power control according to a fifth embodiment of the present disclosure is shown;

[0048] Figure 18 An example of power control according to a fifth embodiment of the present disclosure is shown; and

[0049] Figure 19 This is a block diagram of a computing system for performing a power control method according to an embodiment of the present disclosure. Detailed Implementation

[0050] In the following, some embodiments of the present disclosure will be described in detail with reference to the exemplary accompanying drawings. When adding reference numerals to components in each drawing, it should be noted that even if the same or equivalent components are shown in other drawings, the components are designated by the same reference numerals. Furthermore, in describing embodiments of the present disclosure, detailed descriptions of well-known features or functions will be excluded so as not to unnecessarily obscure the spirit of the disclosure.

[0051] In describing components according to embodiments of this disclosure, terms such as first, second, "A", "B", (a), (b), etc., may be used. These terms are intended only to distinguish one component from another, and they do not limit the nature, order, or sequence of the constituent components. Unless otherwise defined, all terms used herein (including technical or scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. Terms defined in general dictionaries should be interpreted as having the same meaning as in the context of the relevant technical field, and should not be interpreted as having an ideal or overly formal meaning unless expressly defined in this application.

[0052] This disclosure proposes a power redundancy technique in which, when an electrical accident such as a short circuit and / or open circuit occurs while an autonomous vehicle is in motion, the autonomous driving system resets and becomes inoperable due to low voltage across the entire vehicle. The power redundancy technique then stabilizes the power to allow the vehicle to evacuate to a safe area (e.g., a road shoulder and / or a service center).

[0053] The power redundancy system proposed in this paper can be configured to include dual power supplies by altering the wiring paths of the low-voltage DC / DC converter and the 12V battery (i.e., the auxiliary battery) and adding a switching controller that supplies or disconnects power to minimize changes to existing vehicle systems. Furthermore, the power redundancy technique can be implemented by separately supplying primary and auxiliary power to the main loads used for autonomous driving, and by detecting faults such as short circuits through monitoring power output and controlling the cutting-off / disconnection of power supply.

[0054] In this paper, redundant driving can refer to driving in an emergency stop in a safe location in the event of a power failure such as a short circuit during autonomous driving, while redundant power can refer to the power supplied to the main load used for autonomous driving in the event of a power failure.

[0055] Figure 1 This is a block diagram illustrating an electric control device for an autonomous vehicle according to an embodiment of the present disclosure, and Figure 2 Show Figure 1 The diagram shows the configuration of the first controller.

[0056] Electrical control equipment can be installed on autonomous vehicles to supply or disconnect power to loads installed within the vehicle (in-vehicle loads). Additionally, the electrical control equipment can detect electrical faults and perform fail-safe operations. Here, the vehicle can be an electrified vehicle such as an electric vehicle (EV) and / or a hybrid electric vehicle (HEV).

[0057] refer to Figure 1 The power control equipment may include a first power supply 110, a second power supply 120, a power distributor 130, a first controller 140, a second controller 150, and an in-vehicle load 160.

[0058] The first power source 110 may be a device that supplies primary power. The first power source 110 may include a low-voltage DC / DC converter (LDC) that converts the high-voltage power output from a high-voltage battery (not shown) into low-voltage power. Here, the high-voltage battery (not shown) may supply the power required to drive the vehicle. Here, high voltage may refer to a potential large enough to cause injury or damage. For example, high voltage refers to any voltage difference between conductors that is greater than 1000V AC or 1500V ripple-free DC. Low voltage may, for example, refer to a voltage in the range of 50V AC to 1000V AC or 120V DC to 1500V DC as defined in IEC standards.

[0059] The second power source 120 can be a device for supplying auxiliary power. The second power source 120 may include an auxiliary battery (e.g., a low-voltage battery or a 12V battery) for redundant power. Lithium-ion batteries or lead-acid batteries can be used as auxiliary batteries. To shorten power stabilization time in situations requiring redundant driving and to ensure the auxiliary battery's SOC (state of charge) as much as possible, the faulty power source can be immediately disconnected, and the auxiliary battery can be used to supply power only to the loads necessary to maintain the minimum functionality of the vehicle.

[0060] The power distributor 130 may be located in the vehicle's powertrain electrical (PE) compartment and may be electrically connected to the output terminals of the first power source 110. The power distributor 130 may distribute the main power output (supply) from the first power source 110 to high-power loads in the first controller 140, the second controller 150, and / or the in-vehicle load 160. The power distributor 130 may include fuses and / or relays.

[0061] The first controller 140 may be a power grid safety control unit (PSU) and may be connected to the first output terminal of the power distributor 130. The first controller 140 may combine (connect) or separate (disconnect) the output power of the first power source 110 (primary power) with the output power of the second power source 120 (auxiliary power). The first controller 140 may monitor the power output of the first power source 110 and the power output of the second power source 120 to determine the power supply fault status and perform connection or disconnection control. When the power supply recovers from the fault, the first controller 140 may connect the disconnected power. The first controller 140 may disconnect the normal power supply before vehicle control is impossible due to low voltage across the vehicle or due to concentrated current caused by a power fault during autonomous driving, resulting in the initialization of the autonomous driving system.

[0062] The first controller 140 can monitor the output power of the first power supply 110, the output power of the second power supply 120, and the status of the main load power used for autonomous driving. In other words, the first controller 140 can monitor the status of the main power input side, the auxiliary power input side, and the load power output side. The first controller 140 can comprehensively determine the power status by measuring voltage, current, and temperature information. The criteria used to determine the power status can be applied differently depending on the vehicle's rated current requirements for each vehicle type and / or for each option. In the event of a power failure, the first controller 140 can determine the cause of the power failure and the faulty component, and cut off power to the corresponding faulty component.

[0063] In the event of a power failure, the first controller 140 can quickly disconnect the power to ensure the auxiliary battery's state of charge (SOC) as much as possible, thereby maintaining redundant driving performance and supporting emergency stops. In situations requiring dual power control and redundancy, the first controller 140 can supply normal power to the primary load used for autonomous driving after a power outage.

[0064] refer to Figure 2 The first controller 140 may include a first power control switch 141, a second power control switch 142, a power and communication circuit 143, a current determination circuit 144, a current cut-off circuit 145, and a processor 146.

[0065] A first power control switch 141 can always supply high power between the first power supply 110 and the second power supply 120. The first power control switch 141 can connect or disconnect the main power and auxiliary power. The first power control switch 141 may include at least one metal-oxide-semiconductor field-effect transistor (MOSFET) that performs power-on or power-off operations, and may include a gate driver that controls the voltage (or current) applied to the gate of each MOSFET. A bidirectional MOSFET can be used as the MOSFET to cut off the back electromotive force flowing through the body diode inside the semiconductor when the main power or auxiliary power is cut off. While monitoring the output of the dual power supplies (i.e., the first power supply 110 and the second power supply 120) and in the event of a fault in either of the two power supplies, the MOSFET can cut off the faulty power supply. The MOSFET can be configured as a bidirectional N-channel MOSFET such that it does not affect the other power supply when cutting off the faulty power supply. The gate drivers can collectively control the gate power of at least one bidirectional MOSFET.

[0066] The second power control switch 142 can supply (connect) or disconnect (turn off) power to the main loads used for autonomous driving (e.g., steering loads, braking loads, loads related to achieving autonomous driving functions, etc.), so that autonomous driving functions can be maintained in the event of an emergency stop to maintain redundant driving. The second power control switch 142 may include a semiconductor switch connected to each of the in-vehicle loads 160. Here, IPS (intelligent power switch) and / or MOSFET (including gate driver) can be used as semiconductor switches.

[0067] The power and communication circuitry 143 can supply power to the processor 146 and perform functions that enable the first controller 140 to communicate with other devices in the vehicle, such as sensors, electronic control units (ECUs), and / or the second controller 150. For example, a Controller Area Network (CAN), a Media-Oriented System Transport (MOST) network, a Local Interconnect Network (LIN), and / or Flexray can be used as the communication technology.

[0068] The current determination circuit 144 can detect (determine) whether an overcurrent greater than or equal to a predetermined reference current occurs on the input side of the main power or auxiliary power. When an overcurrent is detected by the current determination circuit 144, the current interruption circuit 145 can interrupt the overcurrent by separating (interrupting) the main power and auxiliary power. Once an overcurrent is detected, the current interruption circuit 145 can interrupt the power within 1 ms, regardless of the determination of the processor 146. Therefore, delays in overcurrent interruption due to the determination and retries of the power state of the processor 146 can be prevented.

[0069] Processor 146 can control the overall operation of first controller 140. Processor 146 can be implemented using at least one of application-specific integrated circuit (ASIC), digital signal processor (DSP), programmable logic device (PLD), field-programmable gate array (FPGA), central processing unit (CPU), microcontroller (MCU), or microprocessor. Memory (not shown) can be a non-transitory storage medium that stores instructions to be executed by processor 146. Memory (not shown) can be implemented using storage media such as flash memory, hard disk, SD card (Secure Digital Card), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), programmable read-only memory (PROM), electrically erasable programmable ROM (EEPROM), erasable programmable ROM (EPROM), registers, etc.

[0070] Processor 146 can connect or disconnect the dual power supply by determining the cause of the fault and the faulty component based on predetermined fault determination criteria. When the current cut-off circuit 145 controls the gate driver to cut off the overcurrent, processor 146 can diagnose (re-identify) the power fault by executing fault determination logic previously stored in memory (not shown).

[0071] The processor 146 can share power fault information (power fault diagnosis results) with the second controller 150 using the power and communication circuit 143. Based on the power fault diagnosis results, the processor 146 can control the first power control switch 141 to cut off the input of main power or auxiliary power. Based on the power fault diagnosis results, the processor 146 can control the second power control switch 142 to cut off the power output to the vehicle load 160.

[0072] The second controller 150 may be an integrated central control unit (ICU) and may be connected to a second output terminal of the power distributor 130 and a specific output terminal of the first controller 140. The second controller 150 may include: communication circuitry for communicating with the first controller 140; a processor for controlling the overall operation of the second controller 150; and a memory for storing instructions to be executed by the processor.

[0073] The second controller 150 can cooperate with the first controller 140 to diagnose (detect) electrical faults. The second controller 150 can supply or disconnect power to the vehicle load 160 based on the electrical fault diagnosis results.

[0074] The in-vehicle load 160 may include at least one electronic load installed on the vehicle. The in-vehicle load 160 may include a first load group 161, a second load group 162, a third load group 163, a general load group 164, a high-power load group 165 (e.g., a drive motor), etc. Here, the first load group 161, the second load group 162, and the third load group 163 may be collectively referred to as redundant loads. Redundant loads may refer to the primary load used for autonomous driving, which needs to maintain a stable power supply and is essential in redundant driving situations. Redundant loads may include devices that can maintain predetermined functions even in the event of a power failure by connecting dual power sources (redundant power supplies). Alternatively, redundant loads may be devices performing similar functions (e.g., braking devices, lighting devices, and / or door devices), and can maintain predetermined functions even in the event of a failure by using different power supplies. The redundant loads may be varied according to the fail-safe operation requirements of the autonomous driving system for each vehicle type and / or for each option.

[0075] The first load group 161 can be a steering device, and may include an electric power steering (Motor Driven Power Steering, MDPS) or similar device. The MDPS can receive 50% of its rated power as primary power, while the remaining 50% serves as auxiliary power. In redundant driving situations, the steering device can maintain its function even with a 50% performance reduction.

[0076] The second load group 162 can be a braking load and may include an integrated electronic brake (IEB), a redundant control unit (RCU), an electronic parking brake (EPB), etc. The IEB can perform four-wheel hydraulic control. In redundant driving conditions, the RCU can perform front wheel hydraulic control, while the EPB can control the rear wheel brake calipers.

[0077] The third load group 163 may include advanced driver assistance systems (ADAS), lighting devices (e.g., lights), door unlocking devices, airbag control units (ACU), instrument cluster units (CLU), autonomous driving ECUs, communication devices (e.g., gateways), etc. Even in redundant driving situations (emergency situations), the autonomous driving ECU (autonomous driving device) can receive 100% power to prevent accidents and induce a safe stop based on an assessment of the driving situation. When an accident occurs during an emergency stop, power may be supplied to the ACU (airbag control unit) to deploy the airbags. Power may be supplied to the CLU (instrument cluster) to notify the driver of the emergency stop. Lighting devices may need to maintain their function to maintain positive recognition rates and share the vehicle's abnormal status with nearby vehicles and pedestrians. After an emergency stop, power may be supplied to the door unlocking devices to assist the driver's escape. Power may be supplied to the communication devices to perform the vehicle's gateway functions.

[0078] Figure 3 This is a flowchart illustrating a method for diagnosing power faults according to embodiments of the present disclosure;

[0079] The first controller 140 can detect power faults (S100). When the current determination circuit 144 detects an overcurrent equal to or greater than a predetermined reference current (threshold current), the current cut-off circuit 145 of the first controller 140 can cut off the overcurrent.

[0080] When a power fault is detected, the first controller 140 can determine whether a major power fault has occurred (S105). The first controller 140 can determine whether the major power supplied from the first power source 110 has failed. The major power output from the first power source 110 can supply various controllers (ECUs) in the vehicle and can be supplied in the direction of charging the auxiliary battery (e.g., a 12V battery) of the second power source 120. Therefore, the first controller 140 can determine whether a major or auxiliary power fault has occurred by using current. For example, the first power control switch 141 of the first controller 140 can determine a major power fault when the current is "-", and an auxiliary power fault when the current is "+". The first power control switch 141 can send a power fault diagnostic signal (e.g., a fault code) to the processor 146.

[0081] When it is not a major power failure, the first controller 140 can determine whether a fault exists on the auxiliary power input side (S110). In the event of an auxiliary power failure, the first controller 140 can determine whether a fault has occurred in the second power supply 120 (i.e., on the auxiliary battery side).

[0082] In the event of a fault on the auxiliary power input side, the first controller 140 can determine that the auxiliary power input is faulty (S115). In other words, when a fault has already occurred on the second power supply 120 side, the first controller 140 can diagnose the auxiliary power input fault.

[0083] When the fault is not on the auxiliary power input side, the first controller 140 can determine (diagnose) the fault at the load power output of the first controller 140 (S120).

[0084] In the event of a major power failure in S105, the first controller 140 can send a message notifying the second controller 150 of the major power failure (fault diagnosis result) using the power and communication circuit 143.

[0085] The second controller 150 can identify whether the input of the main power is normal (S125). The second controller 150 can monitor the current and / or voltage of the main power output from the first power source 110 and then input to the second controller 150 through the power distributor 130, and diagnose the status of the main power.

[0086] When the main power input is abnormal, the second controller 150 can determine a main power input fault (S130). In the event of a fault on the first power supply 110 side, the second controller 150 can determine a main power input fault.

[0087] When the main power input is normal in S125, the second controller 150 can identify whether the SOC of the auxiliary battery can be maintained above a predetermined level (S135). The second controller 150 can identify whether the auxiliary battery is being charged using the main power through communication with the first controller 140. The second controller 150 can determine whether the SOC of the auxiliary battery can be maintained when the auxiliary battery is being charged, and can determine whether the SOC of the auxiliary battery cannot be maintained when the auxiliary battery is not being charged.

[0088] When it is determined in S135 that the SOC of the auxiliary battery cannot be maintained, the second controller 150 can determine (diagnose) a power output fault relative to the first controller 140 of the power distributor 130 (S140). The second controller 150 can determine that a fault has occurred on the power line between the power distributor 130 and the first controller 140.

[0089] When it is determined in S135 that the SOC of the auxiliary battery can be maintained, the second controller 150 can identify whether power can be supplied to the load (S145). The second controller 150 can identify whether power can be supplied to the in-vehicle load 160 connected to the output terminal of the second controller 150.

[0090] When it is difficult to supply power to the load, the second controller 150 can determine the fault in the load power output of the second controller 150 (S150).

[0091] When power can be supplied to the load, the second controller 150 can determine a fault in the high-current load power output of the power distributor 130 (S155).

[0092] Figure 4 This is a flowchart illustrating a power control method according to a first embodiment of the present disclosure. Figure 5 An example of power control according to a first embodiment of the present disclosure is shown;

[0093] refer to Figure 4 The first controller 140 can detect major power faults (S200). The first controller 140 can monitor the current state of the major power input terminal using a current determination circuit 144, and determine that a major power fault has occurred when the current input to the major power input terminal is an overcurrent greater than a reference current (e.g., 300A). When an overcurrent is detected, the first controller 140 can immediately cut off the major power input using a current cutoff circuit 145.

[0094] The second controller 150 can diagnose (detect) major power failures (S205). The second controller 150 can maintain its function by using auxiliary power supplied from the first controller 140. The second controller 150 can determine the status of the power input via the power input pins of the processor 146. For example, the second controller 150 can determine that the major power is abnormal and the auxiliary power is normal.

[0095] When a major power fault is detected, the first controller 140 can re-diagnose (re-identify) the major power fault (S210). The first controller 140 can re-identify the average value (RMS) of the current input to the major power input terminal over a predetermined time (e.g., 1 ms). When the re-identified average current is equal to or greater than the reference current, the first controller 140 can determine that a short-circuit fault exists in the major power supply.

[0096] The first controller 140 can send the main power fault diagnosis results to the second controller 150 (S220).

[0097] The second controller 150 can ultimately diagnose the major power fault by comparing the major power fault diagnosis results received from the first controller 140 with the fault diagnosis results it performs itself (S230).

[0098] The second controller 150 can send the final diagnostic results to the first controller 140 (S235). The second controller 150 can also send a message to the lighting device commanding the activation of a warning light indicating a major power failure. Additionally, the second controller 150 can periodically monitor the status of auxiliary power or enter sleep mode.

[0099] The first controller 140 can determine a major power fault based on the final diagnostic results received from the second controller 150 (S240). The first controller 140 can receive a major power fault determination message from the second controller 150.

[0100] The first controller 140 can use auxiliary power to supply power to the in-vehicle load 160 (S250). Reference Figure 5 The first controller 140 can supply 50% of its rated power to the first load group L1 (e.g., MDPS) and 100% of its rated power to the second load group L22 (e.g., RCU and EPB) and the third load groups L31 to L33 (e.g., ACU and CLU) using auxiliary power supplied from the second power source 120. Additionally, the first controller 140 can supply partial power to the third load groups L34 to L36 (e.g., lighting (lamp) devices and door devices). Furthermore, in an emergency, the first controller 140 can support a stop at a safe area (e.g., a path).

[0101] Subsequently, when faulty power is restored, the second controller 150 can identify that the main power warning light is off by deleting a vehicle fault code (DTC). The second controller 150 can send a message to the first controller 140 indicating that the main power warning light is off. Furthermore, the second controller 150 can identify the restoration of main power by checking the main power input pin, and confirms the restoration of main power when it receives a message from the first controller 140 indicating that main power is normal. When the restoration of main power is confirmed, the second controller 150 can send a message notifying the first controller 140 of the restoration of main power.

[0102] When the first controller 140 receives a message from the second controller 150 notifying that the main power warning light is off, the first controller 140 can connect the main power and auxiliary power and determine the status of the main power. The first controller 140 can then send the result of determining the status of the main power to the second controller 150.

[0103] Figure 6This is a flowchart illustrating a power control method according to a second embodiment of the present disclosure. Figure 7 An example of power control according to a second embodiment of the present disclosure is shown.

[0104] The first controller 140 can detect auxiliary power faults (S300). When an overcurrent is detected at the auxiliary power input terminal, the first controller 140 can monitor the current state of the auxiliary power input terminal and determine that an auxiliary power fault exists. When an overcurrent is detected at the auxiliary power input terminal, the first controller 140 can immediately disconnect the auxiliary power input terminal using the current cutoff circuit 145.

[0105] When an auxiliary power failure is detected, the first controller 140 can diagnose the auxiliary power failure (S310). The first controller 140 can re-identify the average current value of the auxiliary power input terminal over a predetermined time. The first controller 140 can determine whether a power output failure has occurred in the auxiliary battery by comparing the re-identified average current value with the input power to the processor 146.

[0106] The first controller 140 can send the auxiliary power fault diagnosis results to the second controller 150 (S320). When a power output fault of the auxiliary battery is determined, the first controller 140 can send a message indicating an auxiliary power input fault to the second controller 150.

[0107] When a power output failure of the auxiliary battery is detected, the first controller 140 can cut off the auxiliary power (S330). The first controller 140 can disconnect and cut off the auxiliary battery.

[0108] The second controller 150 can detect auxiliary power faults based on fault diagnosis results from the first controller 140 (S340). When the second controller 150 receives a message from the first controller 140 indicating that an auxiliary power output fault has been identified, the second controller 150 can identify the auxiliary power fault.

[0109] The second controller 150 can supply power to the in-vehicle load 160 using the main power supply (S350). Reference Figure 7 The second controller 150 can supply 50% of its rated power to the first load group L1 and the second load group L21 using the main power supply, and 100% of its rated power to the third load groups L31 to L36. Additionally, the second controller 150 can support normal operation by supplying power to most loads connected to it after the auxiliary battery fault warning light is activated.

[0110] Subsequently, when auxiliary power is restored, the second controller 150 can send a notification message to the first controller 140 indicating that the warning light is off by deleting a fault code. The first controller 140 can wake up upon receiving the notification message to reconnect the auxiliary battery. When the auxiliary battery is reconnected, the first controller 140 can identify the state of the auxiliary battery's output power to determine if the auxiliary power is normal. The first controller 140 can send a notification message to the second controller 150 indicating that the auxiliary power is normal, and the second controller 150 can determine the restoration of auxiliary power based on the received message. The second controller 150 can send a message indicating that auxiliary power has been restored to the first controller 140. Upon receiving the message indicating that auxiliary power has been restored, the first controller 140 can sequentially supply power to the in-vehicle load 160 connected to the first controller 140. The first controller 140 can use mains power to charge the auxiliary battery.

[0111] Figure 8 This is a flowchart illustrating a power control method according to a third embodiment of the present disclosure. Figure 9 An example of power control according to a third embodiment of the present disclosure is shown. Figure 10 An example of power control according to a third embodiment of the present disclosure is shown.

[0112] The first controller 140 can detect major power faults (S400). The first controller 140 can monitor the current state of the major power input terminal using the current determination circuit 144, and determine that a major power fault has occurred when the current input to the major power input terminal is an overcurrent greater than a reference current (e.g., 300A). When an overcurrent is detected, the first controller 140 can immediately cut off the major power input using the current cut-off circuit 145.

[0113] The second controller 150 itself can diagnose (detect) major power failures (S405). The second controller 150 can maintain its function by using auxiliary power supplied from the first controller 140 during the fuse blowing period. The second controller 150 can determine the status of the power input via the power input pins of the processor 146. For example, the second controller 150 can determine that both the major power and auxiliary power are normal.

[0114] When a major power fault is detected, the first controller 140 can re-diagnose (re-identify) the major power fault (S410). The first controller 140 can re-identify the root mean square (RMS) of the current input to the major power input terminal within a predetermined time (e.g., 1 ms). When the re-identified current RMS is equal to or greater than the reference current, the first controller 140 can determine that a major power fault has occurred.

[0115] The first controller 140 can send the main power fault diagnosis results to the second controller 150 (S420). When a main power fault is diagnosed, the first controller 140 can cut off the main power supply and maintain the auxiliary power supply, such as... Figure 9 As shown.

[0116] The second controller 150 can ultimately diagnose a major power output fault relative to the first controller 140 by comparing the major power fault diagnosis results received from the first controller 140 with the fault diagnosis results performed by itself (S430).

[0117] The second controller 150 can transmit the final diagnostic results to the first controller 140 (S435). The second controller 150 can send a message indicating that a warning light for a main power output failure should be turned on to the lighting device. The second controller 150 can periodically monitor the status of the auxiliary power.

[0118] The first controller 140 can determine a major power output fault based on a message sent from the second controller 150 (S440).

[0119] When a major power output failure is detected, the first controller 140 can supply power to the in-vehicle load 160 connected to the first controller 140 by using auxiliary power (S445).

[0120] When a major power output failure is detected, the second controller 150 can supply power to the in-vehicle load 160 connected to the second controller 150 by using auxiliary power (S450). Reference Figure 10 When a short circuit occurs between the power distributor 130 and the first controller 140, the first controller 140 and the second controller 150 can independently supply power to the in-vehicle load 160. Therefore, in this situation, all loads operate normally and can maintain their functions until the auxiliary battery discharges.

[0121] After the fuse blows, the second controller 150 can monitor the power input through the main power input pin to determine whether the main power has been restored. When the restoration of the main power is determined, the second controller 150 can share the status of the main power through communication with the first controller 140.

[0122] Figure 11 This is a flowchart illustrating a power control method according to a fourth embodiment of the present disclosure;

[0123] The second controller 150 can detect load power faults (S500). The second controller 150 can monitor the current or voltage at the load power output terminals to determine if a load power fault has occurred. The second controller 150 can determine that a load power fault has occurred when an overcurrent exceeding twice the rated current occurs at the load power output terminals or when the voltage fluctuation at the load power output terminals exceeds a predetermined threshold range. The second controller 150 can then disconnect the detected faulty load power.

[0124] The second controller 150 can re-diagnose the load power fault (S510). The second controller 150 can re-identify whether a load power fault has occurred by using the average current value of the load power output terminal over a predetermined time. The second controller 150 can identify the in-vehicle load 160 for which a power fault has been detected.

[0125] The second controller 150 can send the fault diagnosis results to the first controller 140 (S520). The second controller 150 can send a message containing a fault code mapped to the fault location and fault type (e.g., short circuit or low voltage) to the first controller 140.

[0126] The second controller 150 can cut off the power to the detected faulty load (S530). The second controller 150 can cut off the main power supply to the in-vehicle load 160 connected to the load power output terminal. The second controller 150 can instruct the instrument panel device to turn on the warning light indicating a load power fault. In addition, the second controller 150 can monitor the power supply status of the load with the power fault of the first controller 140 through communication with the first controller 140.

[0127] The first controller 140 can detect a load power fault in the second controller 150 based on a fault diagnosis result sent from the second controller 150 (S540). When the first controller 140 receives a fault diagnosis result message sent from the second controller 150, the first controller 140 can identify a fault that has occurred in the power output terminal of the in-vehicle load 160 connected to the second controller 150 based on the diagnosis result included in the received message.

[0128] The first controller 140 can use auxiliary power to supply power to the in-vehicle load 160 where the main power is cut off (S550).

[0129] Figure 12 An example of power control according to a fourth embodiment of the present disclosure is shown.

[0130] refer to Figure 12When a short circuit occurs in the power line from the second controller 150 to the first load group L1 (e.g., MDPS), the second controller 150 can detect a power output fault in the first load group L1 via the current determination circuit 144. The processor in the second controller 150 can re-identify the power output fault in the first load group L1 by executing power fault determination logic. The second controller 150 can disconnect the switch used to control the power supply and disconnect the first load group L1. The second controller 150 can send a CAN message to the first controller 140 containing a fault code indicating a power fault in the first load group L1 connected to the second controller 150. In this case, the second controller 150 can also send a CAN message containing the fault code to the controller of the first load group L1.

[0131] The first controller 140 can detect power failures in the first load group L1 connected to the second controller 150 through communication with the second controller 150. The first controller 140 can use auxiliary power to maintain a power supply of 50% of the rated power for the first load group L1. The first controller 140 can monitor the operating status of the first load group L1 and periodically share monitoring information with the second controller 150.

[0132] Subsequently, when the warning light is detected to be off after after-sales service (AS), the second controller 150 can supply 50% of the rated power to the first load group L1 using the main power. The second controller 150 can send a message notifying the first load group L1 of power restoration to the first controller 140. The second controller 150 can monitor the power restoration status of the first load group L1, and when the following condition is met: 'Power of the first load group L1 before the fault = Current power of the first load group L1 of the first controller 140 + Current power of the first load group L1 of the second controller 150 + Allowable error [%]', it will send a message notifying the first load group L1 of power restoration completion to the first controller 140. The second controller 150 can periodically monitor the status of the first load group L1.

[0133] When the first controller 140 receives a message from the second controller 150 notifying that power has been restored to the first load group L1, it can cross-check whether the voltage level of the first load group L1 has returned to its pre-fault state. The first controller 140 can send the power information of the first load group L1 before the fault and the current power information of the first load group L1 to the second controller 150. When the first controller 140 receives a message from the second controller 150 notifying that power restoration of the first load group L1 is complete, it can monitor the status of the first load group L1 and share the monitoring information with the second controller 150.

[0134] Figure 13An example of power control according to a fourth embodiment of the present disclosure is shown.

[0135] refer to Figure 13 When a short circuit occurs on the power output side of the second load group L21 (e.g., IEB) connected to the second controller 150, the second controller 150 can detect the power fault in the second load group L21 and disconnect the power to the second load group L21. The second controller 150 can share the power fault of the second load group L21 with the first controller 140 via CAN communication. The second controller 150 can also share the power fault of the second load group L21 with the controllers (e.g., RCU and EPB) of the second load group L22 via CAN communication. The second controller 150 can command the instrument panel device to activate the warning light indicating the power fault of the second load group L21.

[0136] The first controller 140 can detect electrical faults in the second load group L21 via the second controller 150, use auxiliary power to control the hydraulic pressure of the second front wheels to supply power to the RCU of the second load group L22, and control the rear wheel motor with brake calipers by supplying power to the EPB of the second load group L22 to ensure the braking capability of the front and rear wheels. The first controller 140 can monitor the operating status of the RCU and EPB, and periodically transmit the monitoring information to the second controller 150 for sharing.

[0137] Then, the second controller 150 can start supplying power to the second load group L21 using main power when it detects that the warning light is off, and send a message to the first controller 140 notifying that the power of the second load group L21 has been restored. The second controller 150 can monitor the power restoration status of the second load group L21, and when the condition 'the power before the fault = the current power of the second load group L22 of the first controller 140 (= the power of RCU and EPB) + the current power of the second load group L21 of the second controller 150 + the allowable error [%]' is met, it will send a message to the first controller 140 notifying that the power restoration of the second load group L21 is complete. The second controller 150 can periodically monitor the status of the second load group L21.

[0138] When the first controller 140 receives a message from the second controller 150 notifying that the second load group L21 has completed its restoration, the first controller 140 can adjust the power output of the second load group L22 and cross-check whether the power of the second load group L21 has been restored to its pre-fault state. The first controller 140 can transmit the power information of the second load group L21 before the fault and the current power information of the second load group L22 to the second controller 150. When the first controller 140 receives a message from the second controller 150 notifying that the power restoration of the second load group L21 is complete, the first controller 140 can monitor the operating status of the second load group L22 and share the monitoring information with the second controller 150.

[0139] Figure 14 An example of power control according to a fourth embodiment of the present disclosure is shown.

[0140] refer to Figure 14 When at least one of the third load groups L31 to L33 connected to the second controller 150 experiences a power failure, the second controller 150 can detect the power failure of the corresponding load L31 to L33 and cut off the power supply to the load L31 to L33 that has experienced a power failure. The second controller 150 can share the load power in which the power failure is detected with the first controller 140.

[0141] The first controller 140 can use auxiliary power to supply power to loads L31 to L33 in which a power fault is detected. The first controller 140 can monitor the operating status of loads L31 to L33 and periodically transmit the operating status to the second controller 150.

[0142] Then, the second controller 150 can detect the restoration of load power and share the restoration of load power with the first controller 140. When the restoration of load power is detected by the second controller 150, the first controller 140 can adjust the power output of the corresponding load.

[0143] Figure 15 This is a flowchart illustrating a power control method according to a fifth embodiment of the present disclosure.

[0144] refer to Figure 15 The first controller 140 can detect load power faults (S600). The first controller 140 can monitor the load power output of the first controller 140 to identify overcurrents exceeding twice the rated power or voltage fluctuation.

[0145] The first controller 140 can diagnose the load power fault again (S610). When a load power fault is detected, the first controller 140 can re-identify whether a load power fault has occurred based on the average current value of the corresponding load power output terminal within a predetermined time.

[0146] The first controller 140 can send the fault diagnosis results of the load power to the second controller 150 (S620). The first controller 140 can send a CAN message containing a fault code corresponding to the load power fault that has occurred to the second controller 150.

[0147] The first controller 140 can cut off the load power output (S630). The first controller 140 can cut off the auxiliary power supply to the load that has experienced a power failure by using the current cut-off circuit 145.

[0148] The second controller 150 can detect load power failures of the first controller 140 (S640). The second controller 150 can detect load power failures of the first controller 140 based on fault codes contained in messages received from the first controller 140.

[0149] The second controller 150 can supply power to the in-vehicle load 160 whose auxiliary power supply has been cut off by the first controller 140 using the main power (S640). The second controller 150 can also supply power to the corresponding load in which the first controller 140 experiences a load power failure.

[0150] Figure 16 An example of power control according to a fifth embodiment of this disclosure is shown.

[0151] refer to Figure 16 When a fault (e.g., short circuit) occurs in the first load group L1 (e.g., MDPS power line) of the first controller 140, the first controller 140 may notify the second controller 150 of the power failure of the first load group L1 and disconnect the first load group L1 from the first controller 140.

[0152] The second controller 150 can detect power failures in the first load group L1 of the first controller 140 through communication with the first controller 140. The second controller 150 can notify the controller of the first load group L1 of the power failure in the first load group L1 of the first controller 140.

[0153] The second controller 150 can maintain a power supply of 50% of the rated power of the first load group L1 by using the main power. The second controller 150 can monitor the operating status of the first load group L1 and output the power failure of the first load group L1 to the first controller 140 in a form that can be recognized by the user.

[0154] When power is restored to the first load group L1, the first controller 140 can send a message to the second controller 150 notifying the initiation of power restoration for the first load group L1. The first controller 140 can monitor the power restoration status of the first load group L1 and periodically transmit the monitoring information to the second controller 150. When the first controller 140 receives a message from the second controller 150 notifying that power restoration of the first load group L1 is complete, the first controller 140 can monitor the operational status of the first load group L1 and share the operational status with the second controller 150.

[0155] The second controller 150 can monitor the power recovery status of the first load group L1, and when the condition 'the power of the first load group L1 before the fault = the current power of the first load group L1 of the first controller 140 + the current power of the first load group L1 of the second controller 150 + the allowable error [%]' is met, it will transmit a message notifying the first load group L1 that the power recovery is complete to the first controller 140. The second controller 150 can periodically monitor the status of the first load group L1.

[0156] Figure 17 An example of power control according to a fifth embodiment of this disclosure is shown.

[0157] refer to Figure 17 When a power failure occurs in the second load group L22 (e.g., RCU and EPB), the first controller 140 can detect the power failure by monitoring the braking power output. Upon detecting a power failure in the second load group L22, the first controller 140 can immediately disconnect the power to the second load group L22. The first controller 140 can transmit a message containing a fault code indicating a power failure in the second load group L22 to the second controller 150.

[0158] The second controller 150 can detect a power fault in the second load group L22 of the first controller 140 based on a fault code contained in a message received from the first controller 140. The second controller 150 can notify the controller of the second load group L22 of the power fault status.

[0159] The second controller 150 can maintain 100% power supply to the IEB, enabling the IEB to perform hydraulic braking control of the front and rear wheels. The second controller 150 can monitor the braking operation status of the IEB.

[0160] When the first controller 140 identifies the power restoration of the RCU and EPB through the second controller 150, the first controller 140 can use auxiliary power to supply power to the second load group L22. The first controller 140 can monitor the power restoration status of the second load group L22 and periodically transmit the monitoring information to the second controller 150.

[0161] When the warning light indicating a power fault in the second load group L22 turns off, the second controller 150 can transmit a message notifying the first controller 140 of the restoration of power to the second load group L22. When the condition 'the power interruption before the fault = the current power of the second load group L22 in the first controller 140 (= the power interruption) + the current power of the second load group L21 in the second controller 150 + the allowable error [%]' is met, the second controller 150 can provide a message to the first controller 140 notifying the first controller 140 of the completion of power restoration to the second load group L22. The second controller 150 can periodically monitor the status of all braking loads L21 and L22 (such as IEB, RCU, and EPB).

[0162] Figure 18 An example of power control according to a fifth embodiment of this disclosure is shown.

[0163] refer to Figure 18 When at least one of the third load groups L31 to L36 connected to the first controller 140 experiences a power failure, the first controller 140 can detect the power failure and cut off the power supply to the load experiencing the power failure. The first controller 140 can share the power to the load in which the power failure is detected with the second controller 150.

[0164] The second controller 150 can use the main power supply to supply power to the load that has detected a power failure. The second controller 150 can monitor the operating status of the corresponding load.

[0165] The second controller 150 can detect the restoration of load power and share the restoration of load power with the first controller 140. When the restoration of load power is detected by the second controller 150, the first controller 140 can adjust the power output of the corresponding load.

[0166] Figure 19 This is a block diagram of a computing system for performing a power control method according to an embodiment of the present disclosure.

[0167] refer to Figure 19 The computing system 1000 may include at least one processor 1100, memory 1300, user interface input device 1400, user interface output device 1500, storage device 1600 and network interface 1700, which are connected to each other via bus 1200.

[0168] Processor 1100 may be a central processing unit (CPU) or semiconductor device that processes instructions stored in memory 1300 and / or storage device 1600. Memory 1300 and storage device 1600 may include various types of volatile or non-volatile storage media. For example, memory 1300 may include ROM (Read-Only Memory) 1310 and RAM (Random Access Memory) 1320.

[0169] Therefore, the operation of the methods or algorithms described in conjunction with the embodiments disclosed herein can be directly embodied in hardware or software modules executed by processor 1100, or in a combination of hardware and software modules. Software modules can reside on storage media such as RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disks, removable disks, and CD-ROMs (i.e., memory 1300 and / or storage device 1600). An exemplary storage medium can be coupled to processor 1100, and processor 1100 can read information from and record information in the storage medium. Alternatively, the storage medium can be integrated with processor 1100. Processor 1100 and storage medium can reside in an application-specific integrated circuit (ASIC). The ASIC can reside within a user terminal. In another case, processor 1100 and storage medium can reside as separate components in the user terminal.

[0170] The above description is merely an illustration of the technical concept of this disclosure, and various modifications and variations can be made by those skilled in the art without departing from the basic characteristics of this disclosure. Therefore, the embodiments disclosed in this disclosure are not intended to limit the technical concept of this disclosure, but rather to describe this disclosure, and the scope of the technical concept of this disclosure is not limited by the embodiments. The scope of protection of this disclosure should be interpreted by the appended claims, and all technical concepts within the scope of the claims should be interpreted as included within the scope of this disclosure.

[0171] According to this disclosure, a power redundancy system can be implemented that can stably supply power to the main load of autonomous driving in the event of a power failure during autonomous driving.

[0172] Furthermore, according to this disclosure, redundant power can be ensured without adding a low-voltage DC / DC converter and / or a battery.

[0173] Furthermore, according to this disclosure, when a power failure occurs during autonomous driving, the faulty component can be immediately disconnected, thereby ensuring the voltage stability of the redundant power supply.

[0174] Furthermore, according to this disclosure, compared to fuses, power switches can be configured based on semiconductors and the power stabilization time can be shortened by reducing fault tripping time.

[0175] In addition, according to this disclosure, physical redundancy is implemented by disconnecting power and functional redundancy is implemented for the main load of autonomous driving, thereby achieving a fail-safe response to grid faults.

[0176] In the foregoing, although the present disclosure has been described with reference to exemplary embodiments and accompanying drawings, the present disclosure is not limited thereto, but various modifications and changes can be made by those skilled in the art to which this disclosure pertains without departing from the spirit and scope of the present disclosure as claimed in the appended claims.

Claims

1. A power control device, comprising: The first power supply unit is configured to supply the main power; The second power supply unit is configured to supply auxiliary power; A power distributor, connected to the first power supply unit and configured to distribute the main power supplied from the first power supply unit; A first controller is connected to a first output terminal of the power distributor to control the power supply to the vehicle load by connecting or disconnecting the main power supply from the auxiliary power supply. as well as A second controller is connected to the second output terminal of the power distributor to supply power to the in-vehicle loads using the main power control. The first controller and the second controller cooperate to diagnose power faults, and based on the diagnosis results, selectively use the primary power and the auxiliary power to supply redundant power. When the main power input is abnormal, the second controller determines that the main power input is faulty; When the main power input is normal, the second controller identifies whether the SOC of the auxiliary battery can be maintained above a predetermined level; When it is determined that the SOC of the auxiliary battery cannot be maintained, the second controller determines a power output failure relative to the first controller of the power distributor; When it is determined that the SOC of the auxiliary battery can be maintained, the second controller identifies whether power can be supplied to the load; When it is difficult to supply power to the load, the second controller determines that there is a fault in the load power output of the second controller; When power can be supplied to the load, the second controller determines that the power distributor is experiencing a fault in its high-current load power output.

2. The power control equipment according to claim 1, wherein, The first power supply device includes a low-voltage DC / DC converter configured to convert high-voltage power supplied from a high-voltage battery into low-voltage power. The second power supply device includes the auxiliary battery, which is configured to supply the low-voltage power.

3. The power control equipment according to claim 1, wherein, The first controller includes: A communication circuit is configured to communicate with the second controller; The first switch is configured as follows: Monitor the main power and the auxiliary power between the first power supply and the second power supply, and Based on monitoring results, supply or cut off at least one of the main power and the auxiliary power; A second switch is configured to supply or disconnect power to the loads inside the vehicle; and The processor is configured as follows: It works in conjunction with the second controller to diagnose the power fault, and Control at least one of the first switch and the second switch based on the diagnostic results.

4. The power control equipment according to claim 3, wherein, The first controller further includes: The current determination circuit is configured to detect overcurrent in at least one of the main power input terminal, the auxiliary power input terminal, and the load power output terminal; and The current interruption circuit is configured to interrupt the overcurrent detection section when the at least one overcurrent is detected.

5. The power control equipment according to claim 1, wherein, The first controller is configured as follows: Upon detecting a major power failure, the major power supply is disconnected from the first controller and the major power supply is cut off. When a major power output failure of the first power supply unit is detected in cooperation with the second controller, the auxiliary power is used to supply power to the load inside the vehicle.

6. The power control equipment according to claim 1, wherein, The first controller is configured to send a message notifying the second controller of a power fault when a major power output fault of the power distributor is detected, and The second controller is configured to supply power to the in-vehicle loads using the main power source in a manner independent of the first controller.

7. The power control equipment according to claim 1, wherein, The first controller is configured to monitor the state of the current input from the second power supply device, and When an auxiliary power failure is detected, the first controller cuts off the auxiliary power to maintain the main power supply.

8. The power control equipment according to claim 1, wherein, When the first controller detects a power output failure of at least one of the plurality of in-vehicle loads, the second controller is configured to use the main power to supply power to at least one of the plurality of in-vehicle loads for which the power output failure of the first controller was detected.

9. The power control equipment according to claim 1, wherein, When the second controller detects a power output failure of at least one of the plurality of in-vehicle loads, the first controller is configured to use the auxiliary power to supply power to at least one of the plurality of in-vehicle loads for which the power output failure of the second controller is detected.

10. The power control device according to claim 1, wherein, Each of the aforementioned in-vehicle loads includes at least one of a steering device, a braking device, an autonomous driving device, an airbag device, an instrument panel device, a lighting device, a door device, and a communication device.

11. A power control method, comprising: Connect the power distributor to the first power supply unit, so that the power distributor distributes the main power supplied from the first power supply unit; Connect the first controller to the first output terminal of the power distributor; Connect the second controller to the second output terminal of the power distributor; The power fault is determined by the cooperation between the first controller and the second controller. and Based on the diagnostic results of the power fault, the first controller and the second controller selectively use the main power from the first power supply unit and the auxiliary power from the second power supply unit to supply redundant power to the vehicle loads, respectively. The determination of the power fault includes: When the main power input is abnormal, the second controller determines that the main power input is faulty; When the main power input is normal, the second controller identifies whether the SOC of the auxiliary battery can be maintained above a predetermined level; When it is determined that the SOC of the auxiliary battery cannot be maintained, the second controller determines a power output failure relative to the first controller of the power distributor; When it is determined that the SOC of the auxiliary battery can be maintained, the second controller identifies whether power can be supplied to the load; When it is difficult to supply power to the load, the second controller determines that there is a fault in the load power output of the second controller; When power can be supplied to the load, the second controller determines that the power distributor is experiencing a fault in its high-current load power output.

12. The power control method according to claim 11, wherein, Diagnosing the power fault includes: The first controller monitors the status of the main power output from the first power supply device and the status of the auxiliary power output from the second power supply device, respectively. In response to the detection of the power fault, the first controller determines whether the power fault exists on the main power input side or on the auxiliary power input side; When it is determined that the power fault exists on the auxiliary power input side, the first controller determines that there is an auxiliary power input fault; and When it is determined that the power fault does not exist on the auxiliary power input side, the first controller determines that the load power output fault of the first controller exists.

13. The power control method according to claim 12, wherein, Supplying the redundant power includes: Upon determining that the auxiliary power input is faulty, the first controller cuts off the auxiliary power input; and When the auxiliary power input fault is detected by the first controller, the second controller uses the main power to maintain the power supply to the load inside the vehicle.

14. The power control method according to claim 12, wherein, Supplying the redundant power includes: When a fault is detected in the load power output of the first controller, the first controller cuts off the load power output using the auxiliary power; and In response to the detection of a load power output failure by the first controller via the first controller, the second controller uses the main power to supply power to at least one of the plurality of in-vehicle loads whose power supply by the first controller has been cut off.

15. The power control method according to claim 12, wherein, Diagnosing the power fault includes: When the first controller detects a major power fault, the second controller determines the major power input fault based on the major power input state of the second controller. When no major power input fault is detected, the second controller determines a first controller power output fault in the power distributor located between the first power supply unit and the first controller by using the major power input state of the first controller, which communicates with the first controller. When the main power input of the first controller is normal, the second controller determines whether its load power output is faulty based on whether it can supply power to its load. When it is determined that the second controller is capable of supplying power to the load, the second controller determines that the power distributor has a high current load power output fault.

16. The power control method according to claim 15, wherein, Supplying the redundant power includes: Upon determining that the main power input fault has occurred, the second controller disconnects the main power input; and The first controller uses the auxiliary power to supply power to the loads inside the vehicle.

17. The power control method according to claim 15, wherein, Supplying the redundant power includes: In response to determining a power output fault from the power distributor to the first controller, the first controller disconnects the main power input; and The first controller and the second controller supply power to the in-vehicle loads independently.

18. The power control method according to claim 15, wherein, Supplying the redundant power includes: Upon determining a load power output failure by the second controller, the second controller disconnects the power supply to at least one of the plurality of in-vehicle loads; and The first controller supplies power to at least one of the multiple in-vehicle loads whose power supply has been cut off by the second controller.

19. The power control method according to claim 11, wherein, Diagnosing the power fault includes: Monitor the current status of the input and output power of the first and second controllers; and In response to the detection of overcurrent, at least one of the input power and the output power is immediately cut off.

20. The power control method according to claim 11, wherein, Each of the aforementioned in-vehicle loads includes at least one of a steering device, a braking device, an autonomous driving device, an airbag device, an instrument panel device, a lighting device, a door device, and a communication device.

Images