Control method of redundant power supply control system

Abstract

The present invention relates to the technical field of automotive power supply control, and more particularly to a control method for a redundant power supply control system. The control method includes controlling the system in the following eight states: a dormant state, a protective switch closed state, a main switch closed and disconnected state, a main switch closed state, a main switch emergency switching state, a protective switch disconnected state, a main switch locked state, and a fault damage state. When the system receives two IG wake-up signals, it switches from the dormant state to a state in which the protective switch is closed and the main switch is disconnected. When the system is fault-free, the difference between the main circuit voltage and the redundant circuit voltage is less than a set voltage difference threshold, and the engine speed is greater than a set speed threshold, the main switch in the system switches from the disconnected state to the closed state. When the system receives two IG wake-up signals and they are invalid, that is, the vehicle power supply IG is shut down, the system switches to the dormant state.

Description

Technical field:

[0001] The present invention relates to the technical field of automobile power supply control, and in particular to a control method for a redundant power supply control system capable of realizing dual-power redundant power supply, safety and reliability, and stable data communication. Background technology:

[0002] Existing redundancy solutions cannot meet the automotive industry's requirements for functional safety of high-level autonomous driving systems. Specifically, existing solutions only conceptualize the design of the entire power system from the perspective of the vehicle's power system. The redundant power control system itself has a single power supply channel. If the power supply is abnormal, the system will directly lose power, which is inconsistent with the system safety level requirements for autonomous driving. In addition, the redundant power control system in the existing solution has a single CAN communication channel. If the single CAN communication channel is abnormal, normal system communication cannot be ensured, which is inconsistent with the system safety level requirements for autonomous driving. The existing solution implements a single-channel switch design. If the switch itself fails, such as a short circuit, the consequences of a fire caused by a vehicle power failure are unimaginable. Summary of the invention:

[0003] In view of the shortcomings and deficiencies in the prior art, the present invention proposes a control method for a redundant power supply control system that can realize dual-power redundant power supply, safety and reliability, and stable data communication.

[0004] The present invention is achieved by the following measures:

[0005] A control method for a redundant power supply control system, characterized in that the redundant power supply control system includes a controller MCU, a main switching switch, a protection switch, a main circuit voltage acquisition circuit, a current acquisition circuit, a temperature acquisition circuit, a main switching switch drive circuit, a CAN communication circuit, a protection switch drive circuit, a redundant circuit voltage acquisition circuit, and a power supply circuit, wherein the main switching switch is connected between the main circuit and the redundant circuit, the control end of the main switching switch is connected to the output end of the main switching switch drive circuit, the protection switch is connected in series between the main switching switch and the redundant circuit, and the control end of the protection switch is connected to the output end of the protection switch drive circuit, the input end of the main circuit voltage acquisition circuit is connected to the main circuit, the input end of the current acquisition circuit is connected to the main circuit, the input end of the temperature acquisition circuit is connected to the main circuit, the output end of the main circuit voltage acquisition circuit is connected to the output end of the current acquisition circuit and the temperature acquisition circuit The output ends of the circuit are respectively connected to the controller MCU; the input end of the redundant loop voltage acquisition circuit is connected to the redundant loop, and the output end is connected to the controller MCU; the power supply circuit is connected to the controller MCU, and the CAN communication circuit connected to the controller MCU includes a main loop CAN communication circuit and a redundant loop CAN communication circuit; a redundant loop current acquisition circuit and a redundant loop temperature acquisition circuit connected to the controller MCU are also provided; wherein, the control method of the redundant power supply control system includes controlling the system in the following eight states: sleep state, protection switch closed state, main switch closed and disconnected state, main switch closed state, main switch emergency switching state, protection switch cut-off state, main switch locked state and fault damage state, wherein when the system receives two IG wake-up signals, that is, when the power of the whole vehicle is turned on, it switches from the sleep state to the state where the protection switch is closed and the main switch is disconnected;

[0006] When the system has no faults, the difference between the main circuit voltage and the redundant circuit voltage is less than the voltage difference setting threshold, and the engine speed is greater than the set speed threshold, the main switch in the system switches from the open state to the main switch closed state;

[0007] When a fault causes irreversible damage to the main switch, the main switch switches to the fault damage state;

[0008] When the main circuit or redundant circuit has overvoltage, undervoltage, overtemperature, or overcurrent faults, and the main switch is not damaged, the main switch closed state is switched to the main switch emergency cut-off state;

[0009] If the main switch detects that the main switch is closed due to fault recovery multiple times in a row within the set time, the main switch will be locked in the open state;

[0010] When the system receives two invalid IG wake-up signals, the vehicle power IG is turned off and the system enters the sleep state.

[0011] The redundant power supply control system of the present invention is further provided with a data storage device connected to the controller MCU.

[0012] The main switching switch and the protection switch in the redundant power supply control system of the present invention are respectively implemented by MOS tubes.

[0013] When the present invention receives the wake-up signal output by the IGN power wake-up circuit and the power signal output by the IGN power detection circuit, the power of the entire vehicle is turned on and the power circuit starts to supply power. The controller MCU detects the main circuit voltage value U1 through the main circuit voltage acquisition circuit and obtains the redundant circuit voltage value U2 through the redundant circuit voltage acquisition circuit, and judges the difference △U between U1 and U2 and the threshold value. When the voltage difference △U is less than the threshold value and the engine speed is greater than the speed threshold value, the controller MCU determines that the device is working normally; when the main circuit or the redundant circuit has overvoltage, undervoltage, overcurrent, overtemperature, or overload, the controller MCU quickly cuts off the switch through the main switching switch drive circuit and the protection switch drive circuit, and the paper feed is automatically driven. When the fault is restored, the controller MCU controls the switch to close, allowing automatic driving; the controller MCU communicates with the entire vehicle through the CAN communication circuit, receives the vehicle status (such as engine speed, automatic driving status, terminal voltage, etc.) and uploads the working status of the redundant power control system to the vehicle controller, where the CAN communication circuit includes a main circuit CAN communication circuit and a redundant circuit CAN communication circuit. The controller MCU sends the same data to the main circuit and the redundant circuit through the main circuit CAN communication circuit and the redundant circuit CAN communication circuit respectively. The main circuit CAN communication circuit and the redundant circuit CAN communication circuit back up each other to avoid the redundant power controller being unable to send and receive signals due to a failure of a certain CAN communication circuit.

[0014] Compared with the existing technology, the present invention proposes a detailed and safe design scheme, which truly meets the requirements of the automatic driving system from a practical perspective; the system has a dual-power redundant power supply design to solve the problem that in the existing solution, when a single power supply fails, the system itself cannot be ensured to be safe, and the system safety level requirements for automatic driving cannot be met; the system has a dual-channel CAN communication design to solve the problem that in the existing solution, when a single-channel CAN communication fails, the system itself cannot be temporarily ensured to be normal, and the system safety level requirements for automatic driving cannot be met; the system has a dual-channel execution switch in series design to solve the problem that in the existing solution, when a single-channel switch design fails, the series switch cannot be disconnected, thereby avoiding accidental risks such as fire. Description of the drawings:

[0015] Attachment Figure 1 It is a system structure diagram of the present invention.

[0016] Attachment Figure 2 It is a system application flow chart of the present invention. Specific implementation method:

[0017] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0018] Embodiment 1:

[0019] As shown in the attached Figure 1 figure, the present invention relates to the field of automotive technology, and is particularly used in the power system redundancy solution for L4-level and above autonomous driving vehicles. The redundant power control system proposed by the present invention includes a controller MCU, a main switch, a protection switch, a main circuit voltage acquisition circuit, a current acquisition circuit, a temperature acquisition circuit, a main switch drive circuit, a CAN communication circuit, a protection switch drive circuit, a redundant circuit voltage acquisition circuit, and a power supply circuit. The main switch is connected between the main circuit and the redundant circuit, and the control end of the main switch is connected to the output end of the main switch drive circuit. The protection switch is connected in series between the main switch and the redundant circuit, and the control end of the protection switch is connected to the output end of the protection switch drive circuit. The input end of the main circuit voltage acquisition circuit is connected to the main circuit, the input end of the current acquisition circuit is connected to the main circuit, the input end of the temperature acquisition circuit is connected to the main circuit, and the output ends of the main circuit voltage acquisition circuit, the current acquisition circuit, and the temperature acquisition circuit are respectively connected to the controller MCU. The input end of the redundant circuit voltage acquisition circuit is connected to the redundant circuit, and the output end is connected to the controller MCU. The power supply circuit is connected to the controller MCU, and the CAN communication circuit connected to the controller MCU includes a main circuit CAN communication circuit and a redundant circuit CAN communication circuit. A redundant circuit current acquisition circuit and a redundant circuit temperature acquisition circuit connected to the controller MCU are also provided. A data memory connected to the controller MCU is also provided. The main switch and the protection switch are respectively implemented by MOS transistors.

[0020] As shown in the attached Figure 2 figure, the redundant power controller can achieve the following functions:

[0021] ① The redundant power controller receives two valid IG wake-up signals (vehicle power ON).

[0022] ② The system has no faults, the PCU detects that the difference between the main circuit voltage value U1 and the redundant circuit voltage value U2 is < xxV (calibratable), and the engine speed value is greater than xxr / min

[0023] ③ The engine speed value < xxr / min (maintains the original state between xxr / min and xx r / min)

[0024] ④ Faults such as overvoltage, undervoltage, overheating, and overcurrent in the main circuit and redundant circuit (ES is not damaged)

[0025] ⑤ Within xxS (calibrable), ES detects the ES switch closed due to fault recovery for x consecutive times, and the ES switch is locked in the open state

[0026] ⑥ The fault causes irreversible damage to the ES (ES switch short circuit, open circuit)

[0027] ⑦ The redundant power supply controller receives two IG wake-up signals which are invalid (the vehicle power supply is not IG OFF)

[0028] ⑧ The main power supply circuit or redundant power supply circuit has an overcurrent, overvoltage, overtemperature, or undervoltage emergency cutoff fault, the ES is not disconnected, and the protection switch is disconnected

[0029] The redundant power supply controller is independently powered by the main power bus and the redundant circuit bus, with the two power supply lines physically isolated. Failure of one power input prevents the redundant power supply controller from malfunctioning. The wiring connecting the main and redundant circuits to the redundant controller is physically separate, preventing single-point failures from shorting both circuits to ground. The controller can also collect real-time voltage and current data for both the main and redundant circuits with an error of ≤0.1V, ≤1A, and the redundant power supply's own temperature with an error of ≤0.5°C. The redundant power supply controller also reports its own status, including MOSFET and MOSFET driver status, in real time. It records and stores main and redundant circuit current and voltage values from xxms before to xxms after a fault such as main circuit overvoltage, main circuit overcurrent, main circuit overload, redundant circuit overvoltage, redundant circuit overcurrent, redundant circuit overload, or ES switch overtemperature, with a storage period of xxms. When overvoltage, undervoltage, overcurrent, overtemperature, or overload occur in the main or redundant circuits, the redundant power controller immediately disconnects and disables autonomous driving. When the fault is resolved, the redundant power control switch closes, enabling autonomous driving. The redundant power controller communicates with the vehicle via the CAN bus, receiving vehicle status (such as engine speed, autonomous driving status, and terminal voltage) and providing feedback on the redundant power controller's on / off status, circuit protection status, restoration status, MOSFET fault diagnosis, and status sampling. The CAN bus communication protocol complies with SAE J1939. The redundant power controller is equipped with two communication channels, CAN1 and CAN2, which simultaneously send the same data to the main CAN1 and redundant CAN2 buses, respectively. CAN1 and CAN2 data are backed up, ensuring that a failure in one CAN line prevents the redundant power controller from being unable to transmit and receive signals and malfunctioning. Furthermore, the redundant power controller detects the on / off status of each MOSFET and whether it is functioning properly. Interfaces are provided for external verification of the functioning of each MOSFET and its driver. The redundant power controller uses voltage, current, and temperature sensors to detect faults in the main and redundant circuits. The redundant power supply controller can feedback corresponding fault status via the CAN bus to support the vehicle in autonomous driving mode to smoothly exit the mode. The redundant power supply controller can record and store system faults, facilitating the location and analysis of system faults through diagnosis. The redundant power supply controller also supports the calibration function of different design parameters, and can calibrate the following related design parameters: a) overcurrent protection current flowing out to the main circuit, b) overcurrent protection current flowing out to the redundant circuit, c) protection switch current, d) the time it takes to detect undervoltage, overvoltage, overcurrent, and overtemperature and maintain the protection function, and e) if the redundant power supply controller recovers xx times and still enters the protection state, it will be locked and no longer recover.

[0030] In this example, when the redundant power supply control system implements data acquisition, the following process is executed:

[0031] a) Voltage acquisition: When the main power supply / redundant power supply IG is valid, the system voltage sampling module acquires the voltage values of the main circuit and the redundant circuit at a cycle of xx ms, and outputs the sampling values (hard-wired values and bus values);

[0032] b) Current acquisition: When the main power supply / redundant power supply IG is valid, the system current sampling module acquires the current values of the main circuit and the redundant circuit at a cycle of xx ms, and outputs the sampling values (hard-wired values and bus values);

[0033] c) Temperature acquisition: When the main power supply / redundant power supply IG is valid, the system temperature sampling module acquires the current values of the main circuit and the redundant circuit at a cycle of xx ms, and outputs the sampling values (hard-wired values and bus values);

[0034] d) MOS (QZ&QP) status acquisition: When the main power supply / redundant power supply IG is valid, the system MOS fault sampling module acquires the status of MOS transistors QZ&QP at a cycle of xx ms, and outputs the status of MOS transistors QZ&QP (hard-wired and bus) and the recovery status;

[0035] e) MOS (QZ&QP) drive status acquisition: When the main power supply / redundant power supply IG is valid, the system MOS drive fault sampling module acquires the drive status of MOS transistors QZ and QP at a cycle of xx ms, and outputs the drive status of MOS transistors QZ&QP (hard-wired and bus).

[0036] When the redundant power supply control system performs fault judgment, the following process is executed:

[0037] a) Undervoltage fault: When the power supply / redundant power supply IG is valid, when the sampled voltage value of the main circuit / redundant circuit acquired by the system < xxV, the system judges that the main circuit / redundant circuit has an undervoltage fault, and outputs the bus value of the undervoltage status signal;

[0038] b) Overvoltage fault: When the main power supply / redundant power supply IG is valid, when the sampled voltage value of the main circuit / redundant circuit acquired by the system > xxV, the system judges that the main circuit / redundant circuit has an overvoltage fault, and outputs the bus value of the overvoltage status signal;

[0039] c) Overcurrent fault: When the main power supply / redundant power supply IG is valid, when the sampled current value of the main circuit / redundant circuit acquired by the system > xxA, the system judges that the main circuit / redundant circuit has an overcurrent fault, and outputs the bus value of the overcurrent status signal;

[0040] d) Overload fault: The main power supply / redundant power supply IG is valid. When the sampled current value of the main circuit / redundant circuit collected by the system is greater than xx A and the ES switch has not had time to cut off yet, and the current continues to increase to ≥ xx A, the system determines that the main circuit / redundant circuit has an overload overcurrent fault and outputs the bus value of the overcurrent status signal;

[0041] e) Over-temperature fault: The main power supply / redundant power supply IG is valid. When the sampled temperature value of the PCU collected by the system > xx °C, the system determines that the PCU has an over-temperature fault and outputs the bus value of the over-temperature status signal. f) Fault judgment of MOS transistors QZ & QP: The main power supply / redundant power supply IG is valid. When the system collects the status of MOS transistors QZ & QP and determines whether there is a fault status of the MOS transistors according to the status of MOS transistors QZ & QP, it outputs the fault status value of the MOS transistors;

[0042] g) Fault judgment of the drive of MOS transistors QZ & QP: The main power supply / redundant power supply IG is valid. When the system collects the drive status of MOS transistors QZ & QP and determines whether there is a fault status of the drive of the MOS transistors according to the drive status of QZ & QP, it outputs the fault status value of the drive of the MOS transistors;

[0043] 3) Main switch closed: Path ②

[0044] The PCU detects that the system has no faults, the difference between the main circuit voltage value U1 and the redundant circuit voltage value U2 < xx V (calibratable). After the engine is powered on and started for the first time, the engine speed value > xx r / min, and the PCU controls the main switch to close for power-on intelligent judgment.

[0045] When the detected current > xx A, after xx s (calibratable) and the current is still > xx A, the PCU controls the main circuit to disconnect; if the current < xx A after xx s (calibratable), the PCU controls the main circuit to close;

[0046] 4) Main switch disconnected:

[0047] a) The PCU is in the sleep state. The PCU receives a valid wake-up signal from the main power supply / redundant power supply IG (the vehicle power supply is ON), and the PCU controller is powered on (the ES switch is disconnected in the initial state), Path ①

[0048] b) The PCU is in the normal working state. The main switch is closed. When the engine speed value < xx r / min (maintains the original state between xx r / min and xx r / min), the main switch is disconnected, Path ③

[0049] 5) Protection switch closed: Path ①

[0050] In the PCU sleep state, the PCU receives a valid wake-up signal from the main power supply / redundant power supply IG (the vehicle power is on), and the redundant controller is powered on (the protection switch is disconnected in the initial state) to control the protection switch;

[0051] 6) Protection switch disconnected: Path ⑦

[0052] PCU wake-up state (initial state protection switch closed), PCU receives invalid main power and redundant power IG wake-up signals or vehicle power is not in ON position, protection switch is disconnected

[0053] 7) Emergency shutoff of main transfer switch: Path ④

[0054] a) Undervoltage emergency cut-off: When the main transfer switch is closed and the voltage of the main circuit or redundant circuit is detected to be less than xxV, the redundant power supply controller controls the main transfer switch to be disconnected;

[0055] b) Overvoltage emergency cut-off: When the main transfer switch is closed and the voltage of the main circuit or redundant circuit is detected to be greater than xxV, the redundant power supply controller controls the main transfer switch to be disconnected;

[0056] c) Overcurrent emergency cutoff: When the main transfer switch is closed and the voltage of the main circuit or redundant circuit is detected to be greater than xxA, the redundant power supply controller controls the main transfer switch to be disconnected;

[0057] d) Over-temperature emergency cut-off: When the main switch is closed and the voltage of the main circuit or redundant circuit is detected to be greater than xx°C, the redundant power supply controller controls the main switch to be disconnected;

[0058] 8) Emergency cut-off of protective switch: Path ⑧

[0059] a) Undervoltage emergency cut-off: When the main switch is closed, if the voltage of the main circuit or redundant circuit is detected to be less than xxV, and the redundant power supply controller controls the main switch to not be cut off in an emergency, the protection switch will be disconnected.

[0060] b) Overvoltage emergency cut-off: When the main switch is closed, if the voltage of the main circuit or redundant circuit is detected to be greater than xxV, and the redundant power supply controller does not control the main switch to be cut off in an emergency, the protection switch will be disconnected.

[0061] c) Overcurrent emergency cutoff: When the main switch is closed, if the voltage of the main circuit or redundant circuit is detected to be greater than xxA, and the redundant power supply controller does not control the main switch to be cut off in an emergency, the protection switch will be disconnected.

[0062] d) Over-temperature emergency cut-off: When the main switch is closed, if the voltage of the main circuit or redundant circuit is detected to be greater than xx℃, and the redundant power supply controller does not control the main switch to be cut off in an emergency, the protection switch will be disconnected.

[0063] 9) Lock mode: ⑤

[0064] The PCU system enters the same protection mode and state quickly after xx consecutive attempts to restore the ES switch due to frequent occurrence of the same type of fault (overvoltage, overcurrent, overtemperature) within 5 seconds (calibrable). The PCU controls the ES circuit and pre-charge circuit to lock and no longer restore, and issues a power restoration abnormality signal.

[0065] Exit lock: Turn off the vehicle and restart the power switch from non-ON gear to ON gear, the system will be released from the dead state, path ①

[0066] 10) Fault damage: Path ⑥

[0067] a) When the ES switch is closed, a sudden fault causes the ES to be damaged and open, and the PCU sends a message to prohibit the vehicle from entering the autonomous driving mode;

[0068] b) When the ES switch is closed, a sudden fault causes the ES to be damaged and short-circuited. The PCU sends a message to prohibit the vehicle from entering the autonomous driving mode.

[0069] 11) Hibernation: Path ⑦

[0070] In any working mode, if the PCU receives invalid wake-up signals from the main power supply and redundant power supply IG or the vehicle power supply is not in the ON position, the ES enters the sleep state.

[0071] Compared with the existing technology, the present invention proposes a detailed and safe design scheme, which truly meets the requirements of the automatic driving system from a practical perspective; the system has a dual-power redundant power supply design to solve the problem that in the existing solution, when a single power supply fails, the system itself cannot be ensured to be safe, and the system safety level requirements for automatic driving cannot be met; the system has a dual-channel CAN communication design to solve the problem that in the existing solution, when a single-channel CAN communication fails, the system itself cannot be temporarily ensured to be normal, and the system safety level requirements for automatic driving cannot be met; the system has a dual-channel execution switch in series design to solve the problem that in the existing solution, when a single-channel switch design fails, the series switch cannot be disconnected, thereby avoiding accidental risks such as fire.

Claims

1. A control method for a redundant power supply control system, characterized in that: The redundant power supply control system is provided with a controller MCU, a main switching switch, a protection switch, a main circuit voltage acquisition circuit, a current acquisition circuit, a temperature acquisition circuit, a main switching switch drive circuit, a CAN communication circuit, a protection switch drive circuit, a redundant circuit voltage acquisition circuit, and a power supply circuit, wherein the main switching switch is connected between the main circuit and the redundant circuit, the control end of the main switching switch is connected to the output end of the main switching switch drive circuit, the protection switch is connected in series between the main switching switch and the redundant circuit, and the control end of the protection switch is connected to the output end of the protection switch drive circuit, the input end of the main circuit voltage acquisition circuit is connected to the main circuit, the input end of the current acquisition circuit is connected to the main circuit, the input end of the temperature acquisition circuit is connected to the main circuit, the output end of the main circuit voltage acquisition circuit, the output end of the current acquisition circuit, and the output end of the temperature acquisition circuit are respectively connected to the controller MCU connected; the input end of the redundant loop voltage acquisition circuit is connected to the redundant loop, and the output end is connected to the controller MCU; the power supply circuit is connected to the controller MCU, and the CAN communication circuit connected to the controller MCU includes a main loop CAN communication circuit and a redundant loop CAN communication circuit; a redundant loop current acquisition circuit and a redundant loop temperature acquisition circuit connected to the controller MCU are also provided; wherein, the control method of the redundant power supply control system includes controlling the system in the following eight states: sleep state, protection switch closed state, main switching switch disconnected state, main switching switch closed state, main switching switch emergency switching state, protection switch cut-off state, main switching switch locked state and fault damage state, wherein when the system receives two IG wake-up signals, that is, when the power of the whole vehicle is turned on, it switches from the sleep state to the state where the protection switch is closed and the main switching switch is disconnected; When the system has no faults, the difference between the main circuit voltage and the redundant circuit voltage is less than the voltage difference setting threshold, and the engine speed is greater than the set speed threshold, the main switch in the system switches from the open state to the main switch closed state; When a fault causes irreversible damage to the main transfer switch, the main transfer switch switches to the fault damage state; When the main circuit or redundant circuit has overvoltage, undervoltage, overtemperature, or overcurrent faults, and the main transfer switch is not damaged, the main transfer switch closed state is switched to the main transfer switch emergency cut-off state; If the main transfer switch detects that the main transfer switch is closed due to fault recovery multiple times within the set time, the main transfer switch will be locked in the open state; When the system receives two invalid IG wake-up signals, the vehicle power IG is turned off and the system enters the sleep state.

2. The control method of a redundant power supply control system according to claim 1, characterized in that: The redundant power supply control system is also provided with a data storage device connected to the controller MCU.

3. The control method of a redundant power supply control system according to claim 1, characterized in that: The main switching switch and the protection switch in the redundant power supply control system are respectively implemented using MOS tubes.

Images