A load driving circuit based on functional safety and fault diagnosis

Abstract

The present invention provides a load driving circuit based on functional safety and fault diagnosis; the first signal output end of a microcontroller unit is electrically connected to the signal input end of a high-side drive output module; the signal output end of the high-side drive output module is electrically connected to the high-side signal input end of a load; the second signal output end of the microcontroller unit is electrically connected to the signal input end of a low-side drive output module via a first AND gate module; the signal input end of the low-side drive output module is electrically connected to the low-side signal output end of the load; the signal output end of the low-side drive output module is grounded via a sampling resistor; the diagnostic signal end of the microcontroller unit is electrically connected to the signal end of a watchdog controller; the signal output end of the watchdog controller is output through dual-path redundancy, and positive and negative signals are used as inputs of a second AND gate module, and the output end of the second AND gate module is electrically connected to the input end of the first AND gate module; the present invention improves the safety of controller operation.

Description

Technical Field

[0001] The present invention belongs to the technical field of automotive electronic technology, and in particular relates to a load driving circuit based on functional safety and fault diagnosis. Background Art

[0002] There are two types of existing controller load driving modes, namely high-side driving and low-side driving.

[0003] High side driver Figure 1 As shown, V bat The MCU provides power supply voltage for the high-side driver output circuit, and controls the opening and closing of the high-side driver output through HS_Control, and then controls the on and off of the load; the sampling circuit collects the high-side driver output voltage for fault diagnosis of the high-side driver output.

[0004] Low side driver Figure 2 As shown, V bat The MCU provides the power supply voltage for the load, and controls the opening and closing of the low-side driver output through LS_Control, thereby controlling the on and off of the load; the sampling circuit collects the input voltage of the low-side driver for fault diagnosis of the low-side driver output.

[0005] The existing controller load driving method has the following problems:

[0006] (1) This drive mode can control the on and off of the load under normal circumstances. If a fault occurs, such as a high-side drive short circuit or a low-side drive short circuit, the high-side drive output is not controlled by the MCU and the load continues to work, which may lead to a violation of the safety goal and a safety hazard.

[0007] (2) This drive mode can control the on and off of the load under normal circumstances. If the MCU fails and the high-side drive control signal becomes abnormal, it may cause the high-side drive output to become abnormal. The load continues to work and violates the safety goal, posing a safety hazard.

[0008] (3) This driving method can perform fault diagnosis through a sampling circuit, but its diagnostic circuit can only diagnose some faults and cannot distinguish all fault types. Summary of the invention

[0009] The purpose of the present invention is to solve the deficiencies of the above-mentioned background technology and provide a load driving circuit based on functional safety and fault diagnosis to improve the safety of controller operation.

[0010] The technical solution adopted by the present invention is: a load driving circuit based on functional safety and fault diagnosis, comprising a microcontroller unit, a high-side driving output module, a first sampling circuit, a second sampling circuit, a watchdog controller, a first AND gate module, a low-side driving output, and a second AND gate module;

[0011] The first signal output terminal of the microcontroller unit is electrically connected to the signal input terminal of the high-side driver output module; the signal output terminal of the high-side driver output module is electrically connected to the high-side signal input terminal of the load; the input terminal of the high-side driver output module is connected to an external power supply;

[0012] The second signal output terminal of the microcontroller unit is electrically connected to the signal input terminal of the low-side drive output module via the first AND gate module; the signal input terminal of the low-side drive output module is electrically connected to the low-side signal output terminal of the load; the signal output terminal of the low-side drive output module is grounded via a sampling resistor;

[0013] The diagnostic signal end of the microcontroller unit is electrically connected to the signal end of the watchdog controller; the signal output end of the watchdog controller is output through dual redundant paths, and the positive and negative signals are used as inputs of the second AND gate module, and the output end of the second AND gate module is electrically connected to the input end of the first AND gate module;

[0014] The signal input end of the first sampling circuit is electrically connected to the signal output end of the high-side driver output module; the signal output end of the first sampling circuit is electrically connected to the first signal input end of the micro control unit;

[0015] The signal input end of the second sampling circuit is electrically connected to the signal input end of the low-side driver output module; the signal output end of the second sampling circuit is electrically connected to the second signal input end of the micro control unit;

[0016] The microcontroller controls the high-side driver module to drive the load by controlling the output of the first signal terminal; and diagnoses whether the high-side driver output module has a fault by using the signals fed back by the first sampling circuit and the second sampling circuit; when the microcontroller diagnoses that the high-side driver has a fault, it controls the low-side driver output module to turn off the load by controlling the output of the second signal terminal;

[0017] When the output of the second signal output terminal and the output of the second AND gate module are both high, the low-side drive output module can be turned on; when any value of the output of the second signal output terminal and the second AND gate module is low, the low-side drive output module is turned off to turn off the load.

[0018] In the above technical solution, the microcontroller feeds the watchdog controller via SPI to monitor whether there is a fault in the microcontroller; when the watchdog controller detects that there is a problem in feeding the watchdog to the microcontroller, the watchdog controller turns off the output signal of the second AND gate module to turn off the low-side driver output module; the microcontroller communicates with the watchdog controller via SPI and detects whether the watchdog controller is normal; when the microcontroller detects that there is an abnormality in the watchdog controller, the output of the second signal output terminal is turned off to turn off the low-side driver output module.

[0019] In the above technical solution, when the voltage collected by the first sampling circuit and the second sampling circuit when both the first signal output terminal and the second signal output terminal are not turned on is the voltage value of the external power supply, and when the second signal output terminal is turned on to turn on the low-side driver output module, the voltage collected by the second sampling circuit does not exceed the product of the sampling resistance and the current applied to the load under normal circumstances, it is determined that the high-side driver output module is short-circuited or the high side of the load is short-circuited to the external power supply. At this time, the high-side driver output module is not controlled by the microcontroller unit, and the low-side driver output module is turned off through the second signal terminal to turn off the load.

[0020] In the above technical solution, when the voltage collected by the first sampling circuit and the second sampling circuit when the first signal output terminal and the second signal output terminal are both not turned on is the voltage value of the external power supply, and when the second signal output terminal is turned on and the low-side drive output module is turned on, the voltage collected by the second sampling circuit is greater than the product of the sampling resistance and the current applied to the load under normal circumstances, it is determined that the low side of the load is short-circuited to the external power supply fault, and the load cannot work normally at this time.

[0021] In the above technical solution, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first sampling circuit collects a voltage of still 0 after the first signal output terminal is turned on and the high-side driver output module is turned on, it is judged that the output terminal of the high-side driver output module has an open circuit fault, and the load cannot work normally at this time.

[0022] In the above technical solution, when the voltage collected by the first sampling circuit and the second sampling circuit is 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal and the second signal output terminal are turned on and the high-side driver output module and the low-side driver output module are turned on, the voltage collected by the first sampling circuit is the voltage value of the external power supply, and the voltage value collected by the second sampling circuit is less than the product of the sampling resistance and the current applied to the load under normal circumstances, it is determined that the load is open circuit fault, and the load cannot work normally at this time.

[0023] In the above technical solution, when the voltage collected by the first sampling circuit and the second sampling circuit is 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal is turned on and the high-side driver output module is turned on, when the voltage difference between the voltage collected by the first sampling circuit and the voltage of the external power supply is greater than the product of the internal resistance of the high-side driver output module and the current applied to the load under normal circumstances, it is determined that the high side of the load is short-circuited to the ground, and the load cannot work normally at this time.

[0024] In the above technical solution, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal and the second signal output terminal are turned on to turn on the high-side drive output module and the low-side drive output module, the second sampling circuit collects a voltage less than the product of the sampling resistance and the current applied to the load under normal circumstances, and the voltage difference between the first sampling circuit and the external power supply is equal to the product of the internal resistance of the high-side drive output module and the current applied to the load under normal circumstances, it is determined that the low side of the load is short-circuited to the ground fault, and at this time the low-side drive output module is not controlled by the micro control unit, and the high-side drive output module is turned off through the first signal output terminal to turn off the load.

[0025] In the above technical solution, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal is turned on to turn on the high-side driver output module, the second sampling circuit collects a voltage equal to the product of the sampling resistance and the current applied to the load under normal circumstances, then it is judged that the low-side driver output module is short-circuited. At this time, the low-side driver output module is not controlled by the microcontroller unit, and the high-side driver output module is turned off through the first signal output terminal to turn off the load.

[0026] In the above technical solution, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal and the second signal output terminal are turned on to turn on the high-side drive output module and the low-side drive output module, the collected voltages of the first sampling circuit and the second sampling circuit are both the voltage values ​​of the external power supply, it is determined that the low-side drive output module has an open circuit fault, and the load cannot work normally at this time.

[0027] In the above technical solution, the first sampling circuit and the second sampling circuit are tested once within a driving cycle through power-on self-test to diagnose whether the first sampling circuit and the second sampling circuit themselves are normal; when the first sampling circuit and the second sampling circuit detect a fault during the power-on self-test, the microcontroller unit controls the low-side drive output module through the output of the second signal output terminal to turn off the load.

[0028] The beneficial effects of the present invention are as follows: the present invention provides a method and device for driving a load of an automobile controller based on functional safety and fault diagnosis, which can improve the safety of the operation of the controller. The present invention designs a load driving function layer and a safety mechanism layer, the function layer realizes load driving control, and the safety mechanism realizes fault diagnosis and fault response to the function layer to meet the single-point fault diagnosis requirements. The present invention designs a diagnostic scheme for the safety mechanism to meet the multi-point (latent) fault diagnosis requirements, and prevents the latent fault of the safety mechanism and the single-point fault covered by the safety mechanism from violating the safety goal together and causing harm. The present invention designs a load driving fault diagnosis scheme to realize the diagnosis of load high-side short circuit to power supply fault, high-side short circuit to ground fault, low-side short circuit to power supply fault, low-side short circuit to ground fault, and load open circuit fault, so as to implement relevant protection mechanisms and improve maintenance convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a schematic diagram of a high-side driving circuit in the prior art;

[0030] Figure 2 It is a schematic diagram of a low-side driving circuit in the prior art;

[0031] Figure 3 is a circuit diagram of the present invention;

[0032] Figure 4 This is a schematic diagram of a high-side driver output short circuit / load high-side short circuit to power supply failure of the present invention;

[0033] Figure 5 This is a schematic diagram of a load low side short circuit to a power supply fault in the present invention;

[0034] Figure 6 This is a schematic diagram of an open circuit fault of a high-side driver output of the present invention;

[0035] Figure 7 This is a schematic diagram of a load open circuit fault of the present invention;

[0036] Figure 8 This is a schematic diagram of a load high side short-circuited to ground fault in the present invention;

[0037] Fig. 9 This is a schematic diagram of a load low side short circuit to ground fault in the present invention;

[0038] Fig.10 This is a schematic diagram of a low-side driver output short-circuit fault of the present invention;

[0039] Fig.11 This is a schematic diagram of a low-side driver open circuit fault of the present invention;

[0040] Fig.12 This is a schematic diagram of a micro control unit failure of the present invention;

[0041] Fig.13 This is a schematic diagram of the failure of the watchdog controller of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments to facilitate a clear understanding of the present invention, but they do not constitute a limitation on the present invention.

[0043] like Figure 3 As shown, the present invention provides a load driving circuit based on functional safety and fault diagnosis, including a micro control unit ( Figure 1 MCU shown in the figure), high-side driver output module, first sampling circuit ( Figure 1 The sampling circuit 1 shown in FIG. 1 ), the second sampling circuit ( Figure 1 Sampling circuit shown in 2), watchdog controller, first AND gate module, low side driver output, second AND gate module;

[0044] The first signal output terminal of the microcontroller unit is electrically connected to the signal input terminal of the high-side driver output module; the signal output terminal of the high-side driver output module is electrically connected to the high-side signal input terminal of the load; the input terminal of the high-side driver output module is connected to an external power supply;

[0045] The second signal output terminal of the microcontroller unit is electrically connected to the signal input terminal of the low-side drive output module via the first AND gate module; the signal input terminal of the low-side drive output module is electrically connected to the low-side signal output terminal of the load; the signal output terminal of the low-side drive output module is grounded via a sampling resistor;

[0046] The diagnostic signal end of the microcontroller unit is electrically connected to the signal end of the watchdog controller; the signal output end of the watchdog controller is output through dual redundant paths, and the positive and negative signals are used as inputs of the second AND gate module, and the output end of the second AND gate module is electrically connected to the input end of the first AND gate module;

[0047] The signal input end of the first sampling circuit is electrically connected to the signal output end of the high-side driver output module; the signal output end of the first sampling circuit is electrically connected to the first signal input end of the micro control unit;

[0048] The signal input end of the second sampling circuit is electrically connected to the signal input end of the low-side drive output module; the signal output end of the second sampling circuit is electrically connected to the second signal input end of the micro control unit.

[0049] In order to solve the defects of the high-side drive / low-side drive solution in the prior art, the present invention designs a load drive solution based on functional safety and fault diagnosis.

[0050] The driving method of the prior art can control the conduction and disconnection of the load under normal circumstances. If a fault occurs, such as a high-side drive short circuit or a low-side drive short circuit fault, the high-side drive output is not controlled by the MCU, or the MCU fails and causes the high-side drive control signal to be abnormal, which may cause the high-side drive output to be abnormal. In the above case, the load continues to work, which may violate the safety goal and pose a safety hazard.

[0051] In this specific embodiment, the first signal output terminal of the microcontroller unit (MCU) and the high-side driver output module form module 1, and the control signal output by the first signal output terminal to the high-side driver output module is HS_Control.

[0052] The first signal input terminal, the second signal input terminal, the first sampling circuit, the second sampling circuit, the SPI signal terminal, the watchdog controller, the second signal output terminal, the first AND gate module, the second AND gate module, the low-side driver output module and the sampling resistor of the MCU constitute module 2. The control signal output by the second signal output terminal to the first AND gate module is LS_Control. The signal output by the second AND gate module to the first AND gate module is RESET / OutPutEnable.

[0053] One end of the load connected to the high-side drive output module is the load high side, and one end of the load connected to the low-side drive output module is the load low side.

[0054] Based on functional safety, this specific embodiment uses module 1 as the functional layer to implement load drive control, and uses module 2 as the safety mechanism of module 1 to implement fault diagnosis and fault response of the functional layer.

[0055] When facing a single point of failure, perform the following steps:

[0056] 1) Fault diagnosis:

[0057] a) Regarding high-side driver fault diagnosis: The MCU in module 1 controls the high-side driver output module through HS_Control to drive the load, and diagnoses the high-side driver output module output faults, such as short circuit faults, open circuit faults, etc., through the first sampling circuit and the second sampling circuit in module 2.

[0058] b) About MCU fault diagnosis: The watchdog controller in module 2 communicates with the MCU via SPI, and the MCU feeds the watchdog controller via SPI to monitor whether it has any fault.

[0059] 2) Safety mechanism:

[0060] a) When the first sampling circuit and the second sampling circuit diagnose that the high-side driver output module is faulty, the low-side driver output module is controlled by LS_Control in module 2 to turn off the load.

[0061] b) When the watchdog controller detects a problem with the MCU feeding the dog, the watchdog controller turns off the OutPutEnable signal to turn off the output of the low-side driver output module.

[0062] c) The watchdog controller uses dual redundant outputs and uses positive and negative signals as AND gate inputs to jointly control the OutPutEnable signal. When the positive and negative signals are valid at the same time, the OutPut Enable signal can be effectively output.

[0063] d) LS_Control and RESET / OutPutEnable are connected through an AND gate to control the low-side driver output module. When LS_Control and RESET / OutPutEnable are high at the same time, the low-side driver output module can be turned on, that is, when any value of LS_Control and RESET / OutPutEnable is low, the low-side driver output module can be turned off to turn off the load.

[0064] When facing multiple points of failure, perform the following steps:

[0065] 1) Fault diagnosis:

[0066] a) The first sampling circuit and the second sampling circuit in module 2 are tested once in one driving cycle through power-on self-test, that is, one driving cycle diagnoses whether their own sampling circuits are normal.

[0067] b) The MCU in module 2 communicates with the watchdog controller via SPI and detects whether the watchdog controller is normal.

[0068] 2) Safety mechanism:

[0069] a) When the first sampling circuit and the second sampling circuit detect a fault in the power-on self-test, the low-side driver output module is controlled by LS_Control in module 2 to turn off the load to prevent violation of the safety goal.

[0070] b) When the MCU detects an abnormality in the watchdog controller, it turns off LS_Control to turn off the low-side driver output module to prevent violation of the safety goal.

[0071] In view of the problem that the driving method of the prior art can perform fault diagnosis through a sampling circuit, but its diagnostic circuit can only diagnose some faults and cannot distinguish all fault types, the present invention jointly diagnoses load high-side short-circuit to power supply fault, high-side short-circuit to ground fault, low-side short-circuit to power supply fault, low-side short-circuit to ground fault, and load open circuit fault through the first sampling circuit and the second sampling circuit in module 2.

[0072] Scenario 1: Figure 4As shown, when the first sampling circuit and the second sampling circuit collect voltage V when both HS_Control and LS_Control are not turned on, bat (is the voltage value of the external power supply), and when LS_Control is turned on to turn on the output of the low-side driver output module, the second sampling voltage does not exceed U t1 (Among them, U t1 is the product of the sampling resistance and the current applied to the load under normal circumstances), it is determined that the high-side drive output module is short-circuited or the high side of the load is short-circuited to the power supply. At this time, the high-side drive output module is not controlled by the MCU. The low-side drive output module is turned off through LS_Control to turn off the load to prevent the load from continuing to work in violation of the safety goal and causing harm. At the same time, the fault diagnosis result provides guidance for maintenance services.

[0073] Scenario 2: If Figure 5 As shown, when the first sampling circuit and the second sampling circuit collect voltage V when both HS_Control and LS_Control are not turned on, bat , and when LS_Control is turned on to turn on the low-side drive output, the second sampling circuit collects a voltage greater than U t1 When the load low side is short-circuited to the power supply fault, the load cannot work normally. The fault diagnosis result provides guidance for maintenance service.

[0074] Scenario 3: If Figure 6 As shown, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both HS_Control and LS_Control are not turned on, and when HS_Control is turned on to turn on the high-side driver output module, when the first sampling circuit collects a voltage still of 0, it is determined that the high-side driver output module has an open circuit fault. At this time, the load cannot work normally. The fault diagnosis result provides guidance for maintenance services.

[0075] Scenario 4: Figure 7 As shown, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both HS_Control and LS_Control are not turned on, and when HS_Control and LS_Control are turned on to turn on the high-side drive output module and the low-side drive output module, the first sampling circuit collects a voltage of V bat , the second sampling circuit 2 collects the voltage less than U t1 When the load is open circuit fault, the load cannot work normally. The fault diagnosis result provides guidance for maintenance service.

[0076] Scenario 5: Figure 8As shown, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both HS_Control and LS_Control are not turned on, and when HS_Control is turned on to turn on the high-side drive output module, the first sampling circuit collects a voltage of 0 and V bat The voltage difference is greater than U t2 (Among them, U t2 When the load high side is short-circuited to ground, the load cannot work normally. The fault diagnosis result can provide guidance for maintenance service.

[0077] Scenario 6: Fig. 9 As shown, when the first sampling circuit and the second sampling circuit collect a voltage of 0 when both HS_Control and LS_Control are not turned on, and when HS_Control and LS_Control are turned on to turn on the high-side drive output module and the low-side drive output module, the second sampling circuit collects a voltage less than U t1 , the first sampling circuit collects the voltage and V bat The voltage difference is equal to U t2 (Among them, U t2 When the load is short-circuited to ground due to the high-side drive internal resistance multiplied by the current normally applied to the load), the low-side of the load is determined to be faulty. At this time, the low-side drive output is not controlled by the MCU. The high-side drive output module is turned off through HS_Control to turn off the load to prevent the load from continuing to work in violation of the safety goal and causing harm. At the same time, the fault diagnosis result provides guidance for maintenance services.

[0078] Scenario 7: Fig.10 As shown, when the first sampling circuit and the second sampling circuit collect voltages of 0 when both HS_Control and LS_Control are not turned on, and only when HS_Control is turned on to turn on the output of the high-side driver output module, the second sampling circuit collects voltages equal to U t1 , it is judged as a low-side driver output module short circuit fault. At this time, the low-side driver output module is not controlled by the MCU. The high-side driver output module is turned off through HS_Control to turn off the load to prevent the load from continuing to work in violation of the safety goal and causing harm. At the same time, the fault diagnosis result provides guidance for maintenance services.

[0079] Scenario 8: Fig.11As shown, when the first sampling circuit and the second sampling circuit collect voltages of 0 when both HS_Control and LS_Control are not turned on, and when HS_Control and LS_Control are turned on to open the high-side drive output module and the low-side drive output module, the first sampling circuit and the second sampling circuit collect voltages of V bat , it is judged as a low-side driver open circuit fault. At this time, the load cannot work normally. The fault diagnosis result provides guidance for maintenance services.

[0080] Scenario 9: Fig.12 As shown, when the watchdog controller monitors the MCU feeding error, it determines that the MCU has a fault, and the watchdog controller turns off the OutPutEnable signal, and then turns off the low-side driver output module through the AND gate module to turn off the load, preventing the MCU from sending an error signal and violating the safety goal to cause harm.

[0081] Scene 10: Fig.13 As shown, when the MCU detects an error in the watchdog controller through SPI, it determines that the watchdog controller has failed. The watchdog controller turns off LS_Control and then turns off the load by turning off the low-side driver output module through the AND gate, preventing the formation of latent faults due to the failure of the watchdog controller, which then violates the safety goal together with the MCU failure and causes harm.

[0082] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

Claims

1. A load driving circuit based on functional safety and fault diagnosis, characterized in that: It includes a micro control unit, a high-side drive output module, a first sampling circuit, a second sampling circuit, a watchdog controller, a first AND gate module, a low-side drive output, and a second AND gate module; The first signal output terminal of the microcontroller unit is electrically connected to the signal input terminal of the high-side driver output module; the signal output terminal of the high-side driver output module is electrically connected to the high-side signal input terminal of the load; the input terminal of the high-side driver output module is connected to an external power supply; The second signal output terminal of the microcontroller unit is electrically connected to the signal input terminal of the low-side drive output module via the first AND gate module; the signal input terminal of the low-side drive output module is electrically connected to the low-side signal output terminal of the load; the signal output terminal of the low-side drive output module is grounded via a sampling resistor; The diagnostic signal end of the microcontroller unit is electrically connected to the signal end of the watchdog controller; the signal output end of the watchdog controller is output through dual redundant paths, and the positive and negative signals are used as inputs of the second AND gate module, and the output end of the second AND gate module is electrically connected to the input end of the first AND gate module; The signal input end of the first sampling circuit is electrically connected to the signal output end of the high-side driver output module; the signal output end of the first sampling circuit is electrically connected to the first signal input end of the micro control unit; The signal input end of the second sampling circuit is electrically connected to the signal input end of the low-side driver output module; the signal output end of the second sampling circuit is electrically connected to the second signal input end of the micro control unit; The microcontroller controls the high-side driver module to drive the load by controlling the output of the first signal terminal; and diagnoses whether the high-side driver output module has a fault through the signals fed back by the first sampling circuit and the second sampling circuit; When the microcontroller unit diagnoses that the high-side driver has a fault, it controls the low-side driver output module to turn off the load by controlling the output of the second signal terminal; When the output of the second signal output terminal and the output of the second AND gate module are both high, the low-side driver output module can be turned on; when any value of the output of the second signal output terminal and the second AND gate module is low, the low-side driver output module is turned off to turn off the load.

2. A load driving circuit based on functional safety and fault diagnosis according to claim 1, characterized in that: The microcontroller feeds the watchdog controller via SPI to monitor whether the microcontroller has a fault; when the watchdog controller detects that there is a problem with the microcontroller feeding the watchdog, the watchdog controller turns off the output signal of the second AND gate module to turn off the low-side drive output module; The microcontroller unit communicates with the watchdog controller via SPI and detects whether the watchdog controller is normal; when the microcontroller unit detects that the watchdog controller is abnormal, the output of the second signal output terminal is turned off to turn off the low-side drive output module.

3. A load driving circuit based on functional safety and fault diagnosis according to claim 2, characterized in that: When the voltage collected by the first sampling circuit and the second sampling circuit when both the first signal output terminal and the second signal output terminal are not turned on is the voltage value of the external power supply, and when the second signal output terminal is turned on to turn on the low-side driver output module, the voltage collected by the second sampling circuit does not exceed the product of the sampling resistance and the current applied to the load under normal circumstances, it is determined that the high-side driver output module is short-circuited or the high side of the load is short-circuited to the external power supply. At this time, the high-side driver output module is not controlled by the microcontroller unit, and the low-side driver output module is turned off through the second signal terminal to turn off the load.

4. A load driving circuit based on functional safety and fault diagnosis according to claim 2, characterized in that: When the voltage collected by the first sampling circuit and the second sampling circuit at the first signal output terminal and the second signal output terminal are both not turned on, and the voltage collected by the second sampling circuit after the second signal output terminal is turned on and the low-side drive output module is turned on, is greater than the product of the sampling resistance and the current applied to the load under normal circumstances, it is determined that the low side of the load is short-circuited to the external power supply, and the load cannot work normally.

5. The load driving circuit based on functional safety and fault diagnosis according to claim 2, characterized in that: When the voltage collected by the first sampling circuit and the second sampling circuit is 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the voltage collected by the first sampling circuit is still 0 after the first signal output terminal is turned on and the high-side driver output module is turned on, it is judged that the output terminal of the high-side driver output module has an open circuit fault, and the load cannot work normally at this time.

6. A load driving circuit based on functional safety and fault diagnosis according to claim 1, characterized in that: When the voltage collected by the first sampling circuit and the second sampling circuit when both the first signal output terminal and the second signal output terminal are not turned on is 0, and when the first signal output terminal and the second signal output terminal are turned on to turn on the high-side driver output module and the low-side driver output module, the voltage collected by the first sampling circuit is the voltage value of the external power supply, and the voltage value collected by the second sampling circuit is less than the product of the sampling resistance and the current applied to the load under normal circumstances, it is determined that the load has an open circuit fault, and the load cannot work normally at this time.

7. A load driving circuit based on functional safety and fault diagnosis according to claim 1, characterized in that: When the voltage collected by the first sampling circuit and the second sampling circuit at the first signal output terminal and the second signal output terminal are both not turned on is 0, and when the first signal output terminal is turned on and the high-side driver output module is turned on, when the voltage difference between the voltage collected by the first sampling circuit and the voltage of the external power supply is greater than the product of the internal resistance of the high-side driver output module and the current applied to the load under normal circumstances, it is determined that the high side of the load is short-circuited to the ground, and the load cannot work normally at this time.

8. The load driving circuit based on functional safety and fault diagnosis according to claim 1, characterized in that: When the first sampling circuit and the second sampling circuit collect a voltage of 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal and the second signal output terminal are turned on to turn on the high-side drive output module and the low-side drive output module, the second sampling circuit collects a voltage less than the product of the sampling resistance and the current applied to the load under normal circumstances, and the voltage difference between the first sampling circuit and the external power supply is equal to the product of the internal resistance of the high-side drive output module and the current applied to the load under normal circumstances, it is determined that the low side of the load is short-circuited to the ground. At this time, the low-side drive output module is not controlled by the micro control unit, and the high-side drive output module is turned off through the first signal output terminal to turn off the load.

9. A load driving circuit based on functional safety and fault diagnosis according to claim 1, characterized in that: When the voltage collected by the first sampling circuit and the second sampling circuit is 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal is turned on to turn on the high-side driver output module, the voltage collected by the second sampling circuit is equal to the product of the sampling resistance and the current applied to the load under normal circumstances, it is judged that the low-side driver output module is short-circuited. At this time, the low-side driver output module is not controlled by the microcontroller unit, and the high-side driver output module is turned off through the first signal output terminal to turn off the load.

10. A load driving circuit based on functional safety and fault diagnosis according to claim 1, characterized in that: When the voltage collected by the first sampling circuit and the second sampling circuit is 0 when both the first signal output terminal and the second signal output terminal are not turned on, and when the first signal output terminal and the second signal output terminal are turned on to open the high-side drive output module and the low-side drive output module, the voltage collected by the first sampling circuit and the second sampling circuit are both the voltage values ​​of the external power supply, it is determined that the low-side drive output module has an open circuit fault, and the load cannot work normally at this time.

Images