Functional safety-based vehicle controller, control system and vehicle

Abstract

The present application discloses a vehicle controller, control system and vehicle based on functional safety, which relates to the field of vehicle electronic technology. The vehicle controller includes a power chip, a processor MCU and a CAN / LIN transceiver, and also includes an AND gate circuit, wherein two input ends of the AND gate circuit are connected to the power chip and the processor MCU one by one, and one output end is connected to the CAN / LIN transceiver, and the power chip is connected to the processor MCU; the power chip is configured to monitor the output voltage of the power chip, and determine whether to send a first fault signal to the AND gate circuit according to the processor MCU and the output voltage; the processor MCU is configured to monitor the input voltage of the power chip, and determine whether to send a second fault signal to the AND gate circuit according to the power chip and the input voltage; the AND gate circuit is configured to trigger the CAN / LIN transceiver to stop sending and receiving messages after receiving the first fault signal and the second fault signal. The present application improves the safety and reliability of the controller operation and prevents the vehicle controller from interacting with the outside world and causing danger.

Description

Technical Field

[0001] The present application relates to the field of automotive electronic technology, and in particular to a functional safety-based vehicle-mounted controller, control system and vehicle. Background Art

[0002] In controller communication, the battery generally provides input power to one or more controller ECUs, and then the battery voltage is stepped down by the power chip inside the controller ECU to power chips such as the processor MCU and / or CAN / LIN transceiver. At the same time, the CAN / LIN transceivers in one or more controller ECUs communicate with other controller ECUs through the CAN / LIN bus to realize information exchange between different controller ECUs.

[0003] However, the current controller notification still has the following disadvantages:

[0004] When errors occur in the controller's input voltage VIN, output voltage VOUT, and processor MCU, it may also cause abnormal power supply and message reception and transmission errors in the processor MCU and CAN / LIN transceiver, which in turn may lead to abnormal communication between the controller and the outside world and create safety hazards. Summary of the invention

[0005] The embodiments of the present application provide a vehicle-mounted controller, a control system and a vehicle based on functional safety to solve the technical problem in the related art that there are hidden dangers in safety and reliability when the controller communicates with the outside world.

[0006] In a first aspect, an embodiment of the present application provides a functional safety-based vehicle controller, the vehicle controller comprising a power chip, a processor MCU and a CAN / LIN transceiver, and further comprising:

[0007] An AND gate circuit, wherein two input ends of the AND gate circuit are connected to the power chip and the processor MCU one by one, and one output end is connected to the CAN / LIN transceiver, and the power chip is connected to the processor MCU;

[0008] At the same time, the power chip is configured to monitor the output voltage of the power chip, and determine whether to send a first fault signal to the AND gate circuit according to the processor MCU and the output voltage;

[0009] The processor MCU is configured to monitor the input voltage of the power chip, and determine whether to send a second fault signal to the AND gate circuit according to the power chip, the processor MCU and the input voltage;

[0010] The AND gate circuit is configured to trigger the CAN / LIN transceiver to stop sending and receiving messages after receiving the first fault signal and the second fault signal.

[0011] In some embodiments, the on-board controller is a system on a chip.

[0012] In some embodiments, the power chip and the processor MCU both have:

[0013] The two serial communication modules are configured to transmit the output voltage to the processor MCU, so that the processor MCU determines whether the output voltage is abnormal according to the output voltage.

[0014] In some embodiments, the serial communication module includes SPI / IIC.

[0015] In some embodiments, if the second fault signal includes an abnormal output voltage and an abnormal input voltage, the processor MCU is further configured to determine whether the input voltage is abnormal, and the processor MCU further has:

[0016] A fault monitoring module is configured to determine that an abnormal output voltage or an abnormal input voltage is activated by the processor MCU, and send a second fault signal related to the output voltage or the input voltage to the AND gate circuit and the power chip.

[0017] In some embodiments, if the output voltage is above a voltage threshold set in the processor MCU, the processor MCU sends a second fault signal related to the output voltage through its fault monitoring module;

[0018] If the output voltage is lower than the voltage threshold, the processor MCU does not send out a second fault signal related to the output voltage.

[0019] In some embodiments, if the second fault signal also includes an MCU operation fault, the fault monitoring module is further configured to determine, by the processor MCU, that an abnormal MCU operation signal is activated, and send a second fault signal related to the MCU operation signal to the AND gate circuit and the power chip;

[0020] Furthermore, the power chip is further configured to determine whether to issue the first fault signal according to a second fault signal related to the MCU operation signal.

[0021] In a second aspect, an embodiment of the present application further provides a functional safety-based vehicle control system, including a battery, a CAN / LIN transceiver bus, and at least one functional safety-based vehicle controller as described above;

[0022] One end of the vehicle-mounted controller is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

[0023] In some embodiments, the number of the vehicle-mounted controllers is at least two, and one end of each of the vehicle-mounted controllers is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

[0024] In a third aspect, an embodiment of the present application also provides a vehicle having an on-board control system based on functional safety as described above.

[0025] The beneficial effects brought about by the technical solution provided in this application include: mutual monitoring of faults is achieved through the power chip and processor MCU on the controller, and an additional AND gate circuit is added to avoid excessively frequent error rates, thereby improving the safety and reliability of the controller's operation and preventing dangerous situations caused by errors in the interaction between the on-board controller and the outside world. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 A structural schematic diagram of a functional safety-based vehicle control system provided in an embodiment of the present application.

[0028] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0030] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0031] The embodiment of the present application provides a vehicle-mounted controller based on functional safety, which realizes mutual monitoring of faults through the power chip and processor MCU on the controller, and avoids excessively frequent error rates by adding an AND gate circuit, thereby improving the safety and reliability of the controller's operation and preventing dangers caused by errors in the interaction between the controller and the outside world.

[0032] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0033] Please refer to Figure 1 The embodiment of the present application provides a functional safety-based vehicle controller, the vehicle controller includes a power chip, a processor MCU and a CAN / LIN transceiver, and also includes:

[0034] An AND gate circuit, wherein two input ends of the AND gate circuit are connected to the power chip and the processor MCU one by one, and one output end is connected to the CAN / LIN transceiver, and the power chip is connected to the processor MCU;

[0035] At the same time, the power chip is configured to monitor the output voltage of the power chip, and determine whether to send a first fault signal to the AND gate circuit according to the processor MCU and the output voltage;

[0036] The processor MCU is configured to monitor the input voltage of the power chip, and determine whether to send a second fault signal to the AND gate circuit according to the power chip, the processor MCU and the input voltage;

[0037] The AND gate circuit is configured to trigger the CAN / LIN transceiver to stop sending and receiving messages after receiving the first fault signal and the second fault signal.

[0038] In the embodiment of the present application, compared with the conventional vehicle-mounted controller, only an AND gate circuit is added to the hardware, and the overall structural changes are relatively small. In addition, the power chip and the processor MCU are optimized, and the input voltage of the power chip, that is, the input voltage state of the battery, is monitored by the processor MCU, and the detection parameter can be determined to be abnormal based on the monitored input voltage; the output voltage of the power chip is monitored by the power chip, and the output voltage can be determined by the power chip on the one hand to determine whether it is abnormal and send a first fault signal, and on the other hand, it will also be sent to the processor MCU for arbitration to determine whether the processor MCU needs to send a second fault signal to control the CAN / LIN transceiver to stop sending and receiving messages through the AND gate circuit.

[0039] The controller's built-in power chip and processor MCU can monitor each other's faults, and an AND gate circuit can be added to avoid excessive error reporting, thereby improving the safety and reliability of the controller's operation and preventing errors in the interaction between the controller and the outside world that may cause danger.

[0040] As a preferred embodiment of the present application, the vehicle-mounted controller is a system on chip. The newly added AND gate circuit has a simple structure and is easy to integrate and set up, and the original hardware structure will not be changed to a large extent under the premise of improving functional safety.

[0041] As a preferred embodiment of the embodiment of the present application, the power chip and the processor MCU both have:

[0042] The two serial communication modules are configured to transmit the output voltage to the processor MCU, so that the processor MCU determines whether the output voltage is abnormal according to the output voltage.

[0043] Furthermore, the serial communication module includes SPI / IIC.

[0044] In this embodiment, the serial communication module is SPI / IIC, wherein SPI occupies only four wires on the chip pins, thus saving the chip pins and space for PCB layout, and is simple and easy to use; the IIC bus is a bidirectional, two-wire, serial, multi-master interface standard with a bus arbitration mechanism, and is very suitable for short-distance, non-frequent data communication between devices.

[0045] It should be noted that the serial communication module in this embodiment is used to transmit the output voltage signal, but is not limited to transmitting this information, and can also transmit data between the power chip and the processor MCU according to actual needs.

[0046] As a preferred embodiment of the embodiment of the present application, if the second fault signal includes an abnormal output voltage and an abnormal input voltage, the processor MCU is further configured to determine whether the input voltage is abnormal, and the processor MCU also has:

[0047] A fault monitoring module is configured to determine that an abnormal output voltage or an abnormal input voltage is activated by the processor MCU, and send a second fault signal related to the output voltage or the input voltage to the AND gate circuit and the power chip.

[0048] Further, if the output voltage is above a voltage threshold set in the processor MCU, the processor MCU sends a second fault signal related to the output voltage through its fault monitoring module;

[0049] If the output voltage is lower than the voltage threshold, the processor MCU does not send out a second fault signal related to the output voltage.

[0050] In this embodiment, the monitoring parameters involved in the second fault signal include the output voltage and the input voltage. After the output voltage is judged to be abnormal by the power supply chip and the first fault signal is issued, the processor MCU needs to make another judgment on the monitored output voltage, which increases the accuracy of the abnormal result judgment. It can control whether the CAN / LIN transceiver stops sending and receiving messages through the setting of the AND gate circuit when an abnormality occurs.

[0051] Further, if the second fault signal also includes an MCU operation fault, the fault monitoring module is further configured to determine, by the processor MCU, that an abnormal MCU operation signal is activated, and send a second fault signal related to the MCU operation signal to the AND gate circuit and the power chip;

[0052] Furthermore, the power chip is further configured to determine whether to issue the first fault signal according to a second fault signal related to the MCU operation signal.

[0053] In this embodiment, in addition to the abnormalities in the input voltage and output voltage of the power chip, there is also an operating failure of the processor MCU. The processor MCU sends various fault signals through the fault monitoring module, but it is unable to determine the degree of the fault. Therefore, another fault monitoring module is provided on the power chip. The two fault monitoring modules are connected, and the fault monitoring module on the processor MCU transmits the fault signal unidirectionally to the fault monitoring module on the power chip. Afterwards, the power chip performs arbitration judgment based on the received fault signal to determine whether to send a first fault signal. The fault type involved in the first fault signal is similar to that of the second fault signal, so it will not be described in detail here.

[0054] Specifically, the first fault signal is output by the fail-safe output pin FO in the power chip. The power chip has a voltage input pin VIN, an output voltage pin VOUT, an output voltage monitoring pin, an SPI / IIC pin, a fault monitoring pin and a fail-safe output pin FO. The processor MCU has a pin VCC, an input voltage monitoring pin, an SPI / IIC pin and a fault monitoring pin. The CAN / LIN transceiver has a pin VCC and an enable pin EN.

[0055] Among them, the present application implements an input voltage monitoring module that monitors the input voltage on the processor MCU, and monitors whether the voltage state is normal through the processor MCU; the power chip adds an output voltage self-test module and a fail-safe output FO module, and the self-test module is also an output voltage monitoring module. When the output voltage of the power chip is detected to be abnormal, the power chip transmits the output voltage information to the processor MCU through SPI / IIC, and outputs the first fault signal through the fail-safe output FO pin; the power chip is increased to monitor the state of the processor MCU. When an error occurs in the operation of the MCU, the processor MCU outputs an error through the fault monitoring pin, and the fault monitoring module on the power chip can monitor the fault corresponding to the error; the power chip fail-safe output FO and the fault monitoring output of the processor MCU are logically operated by the AND gate circuit to control the CAN / LIN transceiver to enable EN; when an error occurs in the input voltage, output voltage or MCU operation, the power chip and the processor MCU are comprehensively arbitrated and the CAN / LIN transceiver is controlled through the AND gate circuit to stop sending and receiving messages, so as to prevent the vehicle controller from causing danger due to information interaction errors with other vehicle controllers ECUs through the CAN / LIN bus, thereby improving the safety and reliability of the vehicle controller.

[0056] The following is an explanation of the embodiments of the present application in conjunction with several specific scenarios.

[0057] When an error occurs in the input voltage, output voltage or MCU operation, the power chip and MCU conduct comprehensive arbitration and control the CAN / LIN transceiver chip through the AND gate to stop sending and receiving messages, thereby preventing the vehicle controller ECU1 from causing danger due to information exchange errors with other ECUs through the bus.

[0058] Scenario 1: When the input voltage VIN, output voltage VOUT and MCU are operating normally, the CAN / LIN chip communicates normally with other ECUs through the bus;

[0059] Scenario 2: If the battery input voltage VIN is E (working voltage A-C, overvoltage monitoring threshold D, where A<C<D<E), and the MCU monitors that the input voltage VIN exceeds the overvoltage monitoring threshold, the MCU activates the fault monitoring module, the power chip activates the fail-safe output FO module, and the AND gate activates the control CAN / LIN chip to stop sending and receiving messages, preventing ECU1 from exchanging information with other ECUs through the bus;

[0060] Scenario 3: If the battery input voltage VIN is B (working voltage A-C, overvoltage monitoring threshold D, where A<B<C<D), and the MCU monitors that the input voltage VIN exceeds the working voltage but does not exceed the overvoltage monitoring threshold, the MCU will not activate the fault monitoring module, the AND gate will not be activated, and the CAN / LIN chip will communicate normally with other ECUs through the bus. When the battery input voltage VIN exceeds the overvoltage monitoring threshold, scenario 2 will be entered;

[0061] Scenario 4: If the output voltage VOUT monitored by the power chip self-test module exceeds the normal output range of the power chip, the power chip activates the fail-safe output FO module, the MCU activates the fault monitoring module, and the AND gate activates the control CAN / LIN chip to stop sending and receiving messages, preventing ECU1 from interacting with other ECUs through the bus.

[0062] Scenario 5: When the power chip monitors the MCU status through the fault monitoring module, when an error occurs during MCU operation, the fault is output through the fault monitoring module. The power chip conducts comprehensive arbitration based on the fault level and controls whether the CAN / LIN chip is enabled through the AND gate, thereby preventing ECU1 from exchanging information with other ECUs through the bus.

[0063] like Figure 1 As shown, an embodiment of the present application provides a functional safety-based vehicle control system, including a battery, a CAN / LIN transceiver bus, and at least one functional safety-based vehicle controller as described above;

[0064] One end of the vehicle-mounted controller is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

[0065] Furthermore, in actual application scenarios, the number of vehicle-mounted controllers is more than one, and the number of the vehicle-mounted controllers is at least two, and one end of each of the vehicle-mounted controllers is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

[0066] The vehicle controller includes a power chip, a processor MCU and a CAN / LIN transceiver, and also includes:

[0067] An AND gate circuit, wherein two input ends of the AND gate circuit are connected to the power chip and the processor MCU one by one, and one output end is connected to the CAN / LIN transceiver, and the power chip is connected to the processor MCU;

[0068] At the same time, the power chip is configured to monitor the output voltage of the power chip, and determine whether to send a first fault signal to the AND gate circuit according to the processor MCU and the output voltage;

[0069] The processor MCU is configured to monitor the input voltage of the power chip, and determine whether to send a second fault signal to the AND gate circuit according to the power chip, the processor MCU and the input voltage;

[0070] The AND gate circuit is configured to trigger the CAN / LIN transceiver to stop sending and receiving messages after receiving the first fault signal and the second fault signal.

[0071] In the embodiment of the present application, compared with the conventional vehicle-mounted controller, only an AND gate circuit is added to the hardware, and the overall structural changes are relatively small. In addition, the power chip and the processor MCU are optimized, and the input voltage of the power chip, that is, the input voltage state of the battery, is monitored by the processor MCU, and the detection parameter can be determined to be abnormal based on the monitored input voltage; the output voltage of the power chip is monitored by the power chip, and the output voltage can be determined by the power chip on the one hand to determine whether it is abnormal and send a first fault signal, and on the other hand, it will also be sent to the processor MCU for arbitration to determine whether the processor MCU needs to send a second fault signal to control the CAN / LIN transceiver to stop sending and receiving messages through the AND gate circuit.

[0072] The controller's built-in power chip and processor MCU can monitor each other's faults, and an AND gate circuit can be added to avoid excessive error reporting, thereby improving the safety and reliability of the controller's operation and preventing errors in the interaction between the controller and the outside world that may cause danger.

[0073] As a preferred embodiment of the present application, the vehicle-mounted controller is a system on chip. The newly added AND gate circuit has a simple structure and is easy to integrate and set up, and the original hardware structure will not be changed to a large extent under the premise of improving functional safety.

[0074] As a preferred embodiment of the embodiment of the present application, the power chip and the processor MCU both have:

[0075] The two serial communication modules are configured to transmit the output voltage to the processor MCU, so that the processor MCU determines whether the output voltage is abnormal according to the output voltage.

[0076] Furthermore, the serial communication module includes SPI / IIC.

[0077] In this embodiment, the serial communication module is SPI / IIC, wherein SPI occupies only four wires on the chip pins, thus saving the chip pins and space for PCB layout, and is simple and easy to use; the IIC bus is a bidirectional, two-wire, serial, multi-master interface standard with a bus arbitration mechanism, and is very suitable for short-distance, non-frequent data communication between devices.

[0078] It should be noted that the serial communication module in this embodiment is used to transmit the output voltage signal, but is not limited to transmitting this information, and can also transmit data between the power chip and the processor MCU according to actual needs.

[0079] As a preferred embodiment of the embodiment of the present application, if the second fault signal includes an abnormal output voltage and an abnormal input voltage, the processor MCU is further configured to determine whether the input voltage is abnormal, and the processor MCU also has:

[0080] A fault monitoring module is configured to determine that an abnormal output voltage or an abnormal input voltage is activated by the processor MCU, and send a second fault signal related to the output voltage or the input voltage to the AND gate circuit and the power chip.

[0081] Further, if the output voltage is above a voltage threshold set in the processor MCU, the processor MCU sends a second fault signal related to the output voltage through its fault monitoring module;

[0082] If the output voltage is lower than the voltage threshold, the processor MCU does not send out a second fault signal related to the output voltage.

[0083] In this embodiment, the monitoring parameters involved in the second fault signal include the output voltage and the input voltage. After the output voltage is judged to be abnormal by the power supply chip and the first fault signal is issued, the processor MCU needs to make another judgment on the monitored output voltage, which increases the accuracy of the abnormal result judgment. It can control whether the CAN / LIN transceiver stops sending and receiving messages through the setting of the AND gate circuit when an abnormality occurs.

[0084] Further, if the second fault signal also includes an MCU operation fault, the fault monitoring module is further configured to determine, by the processor MCU, that an abnormal MCU operation signal is activated, and send a second fault signal related to the MCU operation signal to the AND gate circuit and the power chip;

[0085] Furthermore, the power chip is further configured to determine whether to issue the first fault signal according to a second fault signal related to the MCU operation signal.

[0086] In this embodiment, in addition to the abnormalities in the input voltage and output voltage of the power chip, there is also an operating failure of the processor MCU. The processor MCU sends various fault signals through the fault monitoring module, but it is unable to determine the degree of the fault. Therefore, another fault monitoring module is provided on the power chip. The two fault monitoring modules are connected, and the fault monitoring module on the processor MCU transmits the fault signal unidirectionally to the fault monitoring module on the power chip. Afterwards, the power chip performs arbitration judgment based on the received fault signal to determine whether to send a first fault signal. The fault type involved in the first fault signal is similar to that of the second fault signal, so it will not be described in detail here.

[0087] Specifically, the first fault signal is output by the fail-safe output pin FO in the power chip. The power chip has a voltage input pin VIN, an output voltage pin VOUT, an output voltage monitoring pin, an SPI / IIC pin, a fault monitoring pin and a fail-safe output pin FO. The processor MCU has a pin VCC, an input voltage monitoring pin, an SPI / IIC pin and a fault monitoring pin. The CAN / LIN transceiver has a pin VCC and an enable pin EN.

[0088] Among them, the present application implements an input voltage monitoring module that monitors the input voltage on the processor MCU, and monitors whether the voltage state is normal through the processor MCU; the power chip adds an output voltage self-test module and a fail-safe output FO module, and the self-test module is also an output voltage monitoring module. When the output voltage of the power chip is detected to be abnormal, the power chip transmits the output voltage information to the processor MCU through SPI / IIC, and outputs the first fault signal through the fail-safe output FO pin; the power chip is increased to monitor the state of the processor MCU. When an error occurs in the operation of the MCU, the processor MCU outputs an error through the fault monitoring pin, and the fault monitoring module on the power chip can monitor the fault corresponding to the error; the power chip fail-safe output FO and the fault monitoring output of the processor MCU are logically operated by the AND gate circuit to control the CAN / LIN transceiver to enable EN; when an error occurs in the input voltage, output voltage or MCU operation, the power chip and the processor MCU are comprehensively arbitrated and the CAN / LIN transceiver is controlled through the AND gate circuit to stop sending and receiving messages, so as to prevent the vehicle controller from causing danger due to information interaction errors with other vehicle controllers ECUs through the CAN / LIN bus, thereby improving the safety and reliability of the vehicle controller.

[0089] An embodiment of the present application also provides a vehicle having an on-board control system based on functional safety as described above.

[0090] Wherein, the vehicle control system includes a battery, a CAN / LIN transceiver bus and at least one vehicle controller based on functional safety as described above;

[0091] One end of the vehicle-mounted controller is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

[0092] Furthermore, in actual application scenarios, the number of vehicle-mounted controllers is more than one, and the number of the vehicle-mounted controllers is at least two, and one end of each of the vehicle-mounted controllers is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

[0093] Furthermore, the vehicle controller includes a power chip, a processor MCU and a CAN / LIN transceiver, and also includes:

[0094] An AND gate circuit, wherein two input ends of the AND gate circuit are connected to the power chip and the processor MCU one by one, and one output end is connected to the CAN / LIN transceiver, and the power chip is connected to the processor MCU;

[0095] At the same time, the power chip is configured to monitor the output voltage of the power chip, and determine whether to send a first fault signal to the AND gate circuit according to the processor MCU and the output voltage;

[0096] The processor MCU is configured to monitor the input voltage of the power chip, and determine whether to send a second fault signal to the AND gate circuit according to the power chip, the processor MCU and the input voltage;

[0097] The AND gate circuit is configured to trigger the CAN / LIN transceiver to stop sending and receiving messages after receiving the first fault signal and the second fault signal.

[0098] In the embodiment of the present application, compared with the conventional vehicle-mounted controller, only an AND gate circuit is added to the hardware, and the overall structural changes are relatively small. In addition, the power chip and the processor MCU are optimized, and the input voltage of the power chip, that is, the input voltage state of the battery, is monitored by the processor MCU, and the detection parameter can be determined to be abnormal based on the monitored input voltage; the output voltage of the power chip is monitored by the power chip, and the output voltage can be determined by the power chip on the one hand to determine whether it is abnormal and send a first fault signal, and on the other hand, it will also be sent to the processor MCU for arbitration to determine whether the processor MCU needs to send a second fault signal to control the CAN / LIN transceiver to stop sending and receiving messages through the AND gate circuit.

[0099] The controller's built-in power chip and processor MCU can monitor each other's faults, and an AND gate circuit can be added to avoid excessive error reporting, thereby improving the safety and reliability of the controller's operation and preventing errors in the interaction between the controller and the outside world that may cause danger.

[0100] As a preferred embodiment of the present application, the vehicle-mounted controller is a system on chip. The newly added AND gate circuit has a simple structure and is easy to integrate and set up, and the original hardware structure will not be changed to a large extent under the premise of improving functional safety.

[0101] As a preferred embodiment of the embodiment of the present application, the power chip and the processor MCU both have:

[0102] The two serial communication modules are configured to transmit the output voltage to the processor MCU, so that the processor MCU determines whether the output voltage is abnormal according to the output voltage.

[0103] Furthermore, the serial communication module includes SPI / IIC.

[0104] In this embodiment, the serial communication module is SPI / IIC, wherein SPI occupies only four wires on the chip pins, thus saving the chip pins and space for PCB layout, and is simple and easy to use; the IIC bus is a bidirectional, two-wire, serial, multi-master interface standard with a bus arbitration mechanism, and is very suitable for short-distance, non-frequent data communication between devices.

[0105] It should be noted that the serial communication module in this embodiment is used to transmit the output voltage signal, but is not limited to transmitting this information, and can also transmit data between the power chip and the processor MCU according to actual needs.

[0106] As a preferred embodiment of the embodiment of the present application, if the second fault signal includes an abnormal output voltage and an abnormal input voltage, the processor MCU is further configured to determine whether the input voltage is abnormal, and the processor MCU also has:

[0107] A fault monitoring module is configured to determine that an abnormal output voltage or an abnormal input voltage is activated by the processor MCU, and send a second fault signal related to the output voltage or the input voltage to the AND gate circuit and the power chip.

[0108] Further, if the output voltage is above a voltage threshold set in the processor MCU, the processor MCU sends a second fault signal related to the output voltage through its fault monitoring module;

[0109] If the output voltage is lower than the voltage threshold, the processor MCU does not send out a second fault signal related to the output voltage.

[0110] In this embodiment, the monitoring parameters involved in the second fault signal include the output voltage and the input voltage. After the output voltage is judged to be abnormal by the power supply chip and the first fault signal is issued, the processor MCU needs to make another judgment on the monitored output voltage, which increases the accuracy of the abnormal result judgment. It can control whether the CAN / LIN transceiver stops sending and receiving messages through the setting of the AND gate circuit when an abnormality occurs.

[0111] Further, if the second fault signal also includes an MCU operation fault, the fault monitoring module is further configured to determine, by the processor MCU, that an abnormal MCU operation signal is activated, and send a second fault signal related to the MCU operation signal to the AND gate circuit and the power chip;

[0112] Furthermore, the power chip is further configured to determine whether to issue the first fault signal according to a second fault signal related to the MCU operation signal.

[0113] In this embodiment, in addition to the abnormalities in the input voltage and output voltage of the power chip, there is also an operating failure of the processor MCU. The processor MCU sends various fault signals through the fault monitoring module, but it is unable to determine the degree of the fault. Therefore, another fault monitoring module is provided on the power chip. The two fault monitoring modules are connected, and the fault monitoring module on the processor MCU transmits the fault signal unidirectionally to the fault monitoring module on the power chip. Afterwards, the power chip performs arbitration judgment based on the received fault signal to determine whether to send a first fault signal. The fault type involved in the first fault signal is similar to that of the second fault signal, so it will not be described in detail here.

[0114] Specifically, the first fault signal is output by the fail-safe output pin FO in the power chip. The power chip has a voltage input pin VIN, an output voltage pin VOUT, an output voltage monitoring pin, an SPI / IIC pin, a fault monitoring pin and a fail-safe output pin FO. The processor MCU has a pin VCC, an input voltage monitoring pin, an SPI / IIC pin and a fault monitoring pin. The CAN / LIN transceiver has a pin VCC and an enable pin EN.

[0115] Among them, the present application implements an input voltage monitoring module that monitors the input voltage on the processor MCU, and monitors whether the voltage state is normal through the processor MCU; the power chip adds an output voltage self-test module and a fail-safe output FO module, and the self-test module is also an output voltage monitoring module. When the output voltage of the power chip is detected to be abnormal, the power chip transmits the output voltage information to the processor MCU through SPI / IIC, and outputs the first fault signal through the fail-safe output FO pin; the power chip is increased to monitor the state of the processor MCU. When an error occurs in the operation of the MCU, the processor MCU outputs an error through the fault monitoring pin, and the fault monitoring module on the power chip can monitor the fault corresponding to the error; the power chip fail-safe output FO and the fault monitoring output of the processor MCU are logically operated by the AND gate circuit to control the CAN / LIN transceiver to enable EN; when an error occurs in the input voltage, output voltage or MCU operation, the power chip and the processor MCU are comprehensively arbitrated and the CAN / LIN transceiver is controlled through the AND gate circuit to stop sending and receiving messages, so as to prevent the vehicle controller from causing danger due to information interaction errors with other vehicle controllers ECUs through the CAN / LIN bus, thereby improving the safety and reliability of the vehicle controller.

[0116] In the description of the present application, it should be noted that the terms "upper", "lower", etc. indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application. Unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0117] It should be noted that, in this application, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0118] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A vehicle controller based on functional safety, the vehicle controller comprises a power chip, a processor MCU and a CAN / LIN transceiver, characterized in that: Also includes: An AND gate circuit, wherein two input ends of the AND gate circuit are connected to the power chip and the processor MCU one by one, and one output end is connected to the CAN / LIN transceiver, and the power chip is connected to the processor MCU; At the same time, the power chip is configured to monitor the output voltage of the power chip, and determine whether to send a first fault signal to the AND gate circuit according to the processor MCU and the output voltage; The processor MCU is configured to monitor the input voltage of the power chip, and determine whether to send a second fault signal to the AND gate circuit according to the power chip, the processor MCU and the input voltage; The AND gate circuit is configured to trigger the CAN / LIN transceiver to stop sending and receiving messages after receiving the first fault signal and the second fault signal.

2. The functional safety-based vehicle controller according to claim 1, characterized in that: The on-vehicle controller is a system on a chip.

3. The functional safety-based vehicle controller according to claim 1, characterized in that: The power chip and the processor MCU both have: The two serial communication modules are configured to transmit the output voltage to the processor MCU, so that the processor MCU determines whether the output voltage is abnormal according to the output voltage.

4. The functional safety-based vehicle controller according to claim 3, characterized in that: The serial communication module includes SPI / IIC.

5. The functional safety-based vehicle controller according to claim 3, characterized in that: If the second fault signal includes an abnormal output voltage and an abnormal input voltage, the processor MCU is further configured to determine whether the input voltage is abnormal, and the processor MCU also has: A fault monitoring module is configured to determine that an abnormal output voltage or an abnormal input voltage is activated by the processor MCU, and send a second fault signal related to the output voltage or the input voltage to the AND gate circuit and the power chip.

6. The functional safety-based vehicle controller according to claim 5, characterized in that: If the output voltage is above a voltage threshold set in the processor MCU, the processor MCU sends a second fault signal related to the output voltage through its fault monitoring module; If the output voltage is lower than the voltage threshold, the processor MCU does not send out a second fault signal related to the output voltage.

7. The functional safety-based vehicle controller according to claim 5, characterized in that: If the second fault signal also includes an MCU operation fault, the fault monitoring module is further configured to determine by the processor MCU that an abnormal MCU operation signal is activated, and send a second fault signal related to the MCU operation signal to the AND gate circuit and the power chip; Furthermore, the power chip is further configured to determine whether to issue the first fault signal according to a second fault signal related to the MCU operation signal.

8. A vehicle control system based on functional safety, characterized in that: It comprises a battery, a CAN / LIN transceiver bus and at least one functional safety-based vehicle controller according to any one of claims 1 to 7; One end of the vehicle-mounted controller is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

9. The vehicle control system based on functional safety as claimed in claim 8, characterized in that: The number of the vehicle-mounted controllers is at least two, and one end of each of the vehicle-mounted controllers is connected to the battery, and the other end is connected to the CAN / LIN transceiver bus.

10. A vehicle having an on-board control system based on functional safety according to claim 8 or 9.

Images