A method for ASIL-B MCU to implement ASIL-C automotive backup power supply

Abstract

The present invention discloses a method for implementing an ASIL-C automotive backup power supply using an ASIL-B MCU, and belongs to the technical field of automotive backup power supplies. The system includes an ASIL-B functional safety level MCU and a monitoring circuit composed of a digital circuit for monitoring power grid failures and generating a first switch control signal; the MCU outputs a CAN message signal to a redundant circuit in a notification manner, and the redundant circuit generates a second switch control signal to ensure that the correct control signal is output when the MCU is abnormal; the first switch control signal and the second switch control signal are output to the power supply switch after passing through a logic OR gate. The present invention adopts an ASIL-B level MCU and an ASIL-A level hardware circuit to form a backup power system design that meets the ASIL-C level functional safety goals, thereby reducing material costs and development cycles, and in particular reducing the complex redundancy and verification difficulty of software development.

Description

Technical Field

[0001] The present invention relates to the technical field of automobile backup power supplies, and in particular to a method for implementing an ASIL-C automobile backup power supply using an ASIL-B MCU. Background Art

[0002] The backup power system supplies power to the brake system ECU, EPB system, automatic door unlocking system, and emergency call system. The power supply to the brake system ECU must meet the customer's ASIL (Automotive Safety Integrity Level) C requirements.

[0003] The functional architecture of BMS (Battery Management System) is as follows Figure 1 As shown, the voltage, current, and temperature signals measured by sensors serve as input signals for the BMS, denoted as S1, S2, and S3, respectively. These three input signals are detected by independent sensors. The MCU converts the calculated input signals into trigger information and sends them to the actuators. Its safety objective is to calculate the battery's SOF (State of Function) and determine whether it meets the power output requirements for the brake system ECU. Since the brake system ECU power supply must meet the customer's ASIL-C requirements, the BMS's ASIL requirement is ASIL-C. Therefore, all components of the BMS inherit the BMS's ASIL rating, meaning that sensors, MCUs, and actuators must all be developed to ASIL-C standards. In typical technical implementations, core components, such as the microcontroller (MCU), typically meet ASIL-C standards. However, due to the limited availability of processor chip suppliers, only higher-level ASIL-D components can be used for downward coverage, requiring a design with redundant hardware. However, using an ASIL-D-rated MCU can lead to over-design of the system, including both hardware and software, increasing bill of materials and development costs. If an ASIL-B level MCU can be used, its functional safety architecture can be greatly simplified. Therefore, if an ASIL-B level MCU can be used to achieve the functional safety goals of the ASIL-C level, it will have advantages in terms of material cost and development cycle, especially reducing the complex redundancy and verification difficulty of software development. Summary of the Invention

[0004] To address the challenges of the existing technology, the present invention aims to provide a 12V automotive backup power system that uses an ASIL-B core processor component to achieve ASIL-C functional safety targets. The ASIL-C functional safety target is that when the power grid fails, the backup power supply must output to the brake system ECU within 2ms. Based on the principle of functional safety decomposition, the original ASIL-C functional safety target can be decomposed into the following two lower-level sub-targets:

[0005] A. Configure hardware components to monitor the 12V power grid. When the grid fails, the backup power supply should output the braking system ECU within 2ms (ASIL-A(C)).

[0006] B. Configure hardware and software (MCU) components to monitor the 12V power grid. When the grid fails, the backup power supply should output the braking system ECU-ASIL-B(C) within 2ms.

[0007] To achieve the above objectives, the present invention provides a method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU, comprising:

[0008] A monitoring loop consisting of an ASIL-B functional safety level MCU and digital circuits is used to monitor failures in the main power grid and generate a first switch control signal;

[0009] At the same time, the CAN message signal output by the MCU is notified to the redundant circuit, and the redundant circuit generates a second switch control signal to ensure that the correct control signal is output when the MCU is abnormal;

[0010] The first switch control signal and the second switch control signal are output to the power transmission switch after passing through a logic OR gate.

[0011] Furthermore, the MCU includes a CAN FD module for receiving CAN messages of the entire vehicle. The CAN FD module for receiving CAN messages of the entire vehicle receives and decodes the CAN messages of the entire vehicle, and outputs an enable / cancel signal of the backup power supply and a low-voltage network voltage recovery signal, which are sent to the redundant circuit as CAN message signals.

[0012] Furthermore, the digital circuit of the monitoring loop includes a second monostable trigger Q2, a second vehicle power-on signal judgment module and a second low-voltage network voltage acquisition module;

[0013] The second vehicle power-on signal judgment module receives the vehicle power-on IG ON signal; the second low-voltage network voltage acquisition module collects the low-voltage power supply network voltage BIN voltage; the output signal of the second vehicle power-on signal judgment module and the output signal of the second low-voltage network voltage acquisition module are ANDed through a logic AND gate and input into the CLK signal port of the second monostable trigger Q2; the CLR port input of the second monostable trigger Q2 comes from the output after the three signals are ANDed, as a condition for canceling the output, the three signals are respectively:

[0014] A2: The voltage recovery signal collected by the second low-voltage network voltage collection module is ANDed with the low-voltage network voltage recovery signal and the signal is inverted;

[0015] B2: an enable / cancel signal for outputting the backup power supply;

[0016] C2: the output of the Q output port of the second monostable trigger Q2 exceeds the signal after T2 time and is inverted;

[0017] The output of the Q output port of the second monostable trigger Q2 is the first switch control signal.

[0018] Furthermore, the output signal of the second low-voltage network voltage acquisition module passes through a high-frequency hardware voltage comparator and delay filtering before being sent to the logic AND gate; the delay requirement of the second vehicle power-on signal judgment module is 1s; the second low-voltage network voltage acquisition module makes a judgment within 1-1.5ms and outputs within 2ms, and T2 is 60s.

[0019] Furthermore, the redundant circuit includes a first vehicle power-on signal judgment module, a first low-voltage network voltage acquisition module, a first monostable trigger Q1, a third monostable trigger Q3 and a fourth monostable trigger Q4;

[0020] The first vehicle power-on signal judgment module receives the vehicle power-on IG ON signal; the first low-voltage network voltage acquisition module acquires the low-voltage power supply network voltage BIN voltage;

[0021] The enable / cancel signal output by the MCU is sent to the D port of the third monostable trigger Q3. When the enable / cancel signal output by the MCU changes, a positive pulse is generated and input to the CLK port of the third monostable trigger Q3. The third monostable trigger Q3 is preset to 1 by the hardware circuit when powered on.

[0022] The voltage recovery signal collected by the first low-voltage network voltage collection module is ANDed with the low-voltage network voltage recovery signal output by the MCU to generate a first signal; the first signal is sent to the D port of the fourth monostable trigger Q4, and when the first signal changes, a positive pulse is generated and input to the CLK port of the fourth monostable trigger Q4;

[0023] The output signals of the first vehicle power-on signal judgment module and the first low-voltage network voltage acquisition module are ANDed through a logic AND gate and input into the CLK signal port of the first monostable trigger Q1; the CLR port input of the first monostable trigger Q1 comes from the output of the ANDed three signals, which serves as the condition for canceling the output. The three signals are:

[0024] A1: a signal of the Q output port of the third monostable trigger Q3;

[0025] B1: the output of the Q output port of the first monostable trigger Q1 exceeds the signal after T1 time and is inverted;

[0026] C1: the output signal of the Q non-output port of the fourth monostable trigger Q4;

[0027] The output of the Q output port of the first monostable trigger Q1 is the second switch control signal.

[0028] Furthermore, the output signal of the first low-voltage network voltage acquisition module passes through a high-frequency hardware voltage comparator and delay filtering before being sent to the logic AND gate; the delay requirement of the first vehicle power-on signal judgment module is 1s; the first low-voltage network voltage acquisition module makes a judgment within 1-1.5ms and outputs within 2ms; the T1 is 60s.

[0029] Furthermore, the logic OR gate is implemented using hardware that meets ASIL-C requirements; and the redundant circuit is implemented using an ASIL-A digital circuit.

[0030] Furthermore, the redundant circuit also includes a fault simulation module, and the MCU also includes a power supply output recovery module; the input of the fault simulation module is the fault injection instruction sent by the MCU after each vehicle is powered on, and is output to the first low-voltage network voltage acquisition module; the output of the first monostable trigger Q1 is recovered through the power supply output recovery module to detect whether the redundant circuit is working normally.

[0031] Furthermore, the MCU also includes an enable signal module for retrieving the backup power supply. Each time the entire vehicle is powered on, the signal of the Q output port of the third monostable trigger Q3 is collected and compared with the enable / cancel signal of the output backup power supply. If they are inconsistent, an alarm signal will be sent to the entire vehicle.

[0032] Beneficial effects of the present invention:

[0033] The present invention can achieve the functional safety goal of ASIL-C level by using ASIL-B level MCU, which is advantageous in terms of material cost and development cycle, especially reducing the complexity, redundancy and verification difficulty of software development. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Schematic diagram of the BMS functional architecture according to an embodiment of the present invention.

[0035] Figure 2 This is a schematic diagram of the architecture of a method for implementing an ASIL-C automotive backup power supply using an ASIL-B MCU in an embodiment of the present invention.

[0036] Figure 3 1 is a circuit diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The present invention will be further explained below with reference to the accompanying drawings and embodiments.

[0038] The embodiment of the present invention is decomposed into two loops for the following two safety sub-goals: a monitoring loop and a redundant circuit. An ASIL-B-level MCU is used together with ASIL-A-level hardware to form a backup power system design that meets the ASIL-C level functional safety goal.

[0039] Set up hardware components to monitor the 12V power grid. When the power grid fails, the backup power supply should output the braking system ECU-ASIL-A(C) within 2ms.

[0040] Set up software and hardware (MCU) components to monitor the 12V power grid. When the power grid fails, the backup power supply should output the braking system ECU-ASIL-B(C) within 2ms.

[0041] like Figure 2 、 Figure 3 As shown, the method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU provided by an embodiment of the present invention includes:

[0042] The monitoring loop composed of S101, an MCU with ASIL-B functional safety level and a digital circuit is used to monitor failure of the main power grid and generate a first switch control signal.

[0043] Among them, the MCU includes a CAN FD module for receiving the CAN message of the whole vehicle. The CAN FD module for receiving the CAN message of the whole vehicle receives and decodes the CAN message of the whole vehicle, outputs the enable / cancel signal of the backup power supply and the low-voltage network voltage recovery signal, which are sent to the redundant circuit as a CAN message signal.

[0044] The digital circuit of the monitoring loop includes a second monostable trigger Q2, a second vehicle power-on signal judgment module and a second low-voltage network voltage acquisition module;

[0045] Second vehicle power-on signal judgment module (IG Monitoring Module 2): As one of the input conditions for backup power supply judgment, it receives the vehicle power-on IG ON signal. At the same time, according to customer requirements, the vehicle power-off IG OFF signal is delayed by 1s to expand the backup power supply coverage.

[0046] The second low-voltage network voltage acquisition module (BIN Monitoring Module 2) serves as the second input condition for backup power supply determination. It collects the BIN voltage (the voltage value of the low-voltage power supply network, i.e., 12V), makes a determination within 1-1.5ms, and outputs the result within 2ms (including the determination and output time). This is a core module of the backup power supply. The output signal of the second low-voltage network voltage acquisition module passes through a high-frequency hardware voltage comparator and delay filtering before being fed into the logic AND gate.

[0047] Second monostable trigger Q2: The output signal of the second vehicle power-on signal judgment module and the output signal of the second low-voltage network voltage acquisition module are ANDed through a logic AND gate and input into the CLK signal port of the second monostable trigger Q2. The CLR port input of the second monostable trigger Q2 comes from the output of the ANDed three signals, which serves as the condition for canceling the output. The three signals are:

[0048] A2: The voltage recovery signal collected by the second low-voltage network voltage collection module is ANDed with the low-voltage network voltage recovery signal and the signal is inverted;

[0049] B2: Output the enable / cancel signal of the backup power supply;

[0050] C2: The output of the Q output port of the second monostable trigger Q2 exceeds the signal after the T2 time and is inverted.

[0051] The second monostable trigger Q2 is preset to 0 through the hardware circuit when powered on.

[0052] The output of the Q output port of the second monostable trigger Q2 is the first switch control signal.

[0053] S102 : The CAN message signal output by the MCU is notified to the redundant circuit, and the redundant circuit generates a second switch control signal to ensure that a correct control signal is output when the MCU is abnormal.

[0054] The redundant circuit includes a first vehicle power-on signal judgment module, a first low-voltage network voltage acquisition module, a first monostable trigger Q1, a third monostable trigger Q3 and a fourth monostable trigger Q4.

[0055] The first vehicle power-on signal judgment module (IG Monitoring Module 1): As one of the input conditions for judging the backup power supply, it receives the vehicle power-on IG ON signal. At the same time, according to customer requirements, the IG OFF delay is 1s to expand the backup power supply coverage.

[0056] The first low-voltage network voltage acquisition module (BIN Monitoring Module 1) serves as the second input condition for determining backup power supply status. It collects BIN voltage, makes a determination within 1-1.5ms, and outputs the signal within 2ms (including the determination and output time). This is a core module of the backup power supply. The output signal of the first low-voltage network voltage acquisition module passes through a high-frequency hardware voltage comparator and delay filtering before being fed into a logic AND gate.

[0057] Third monostable trigger Q3: The enable / cancel signal output by the MCU is sent to the D port of the third monostable trigger Q3. When the enable / cancel signal output by the MCU changes, a positive pulse is generated and input to the CLK port of the third monostable trigger Q3. The third monostable trigger Q3 is preset to 1 through the hardware circuit when powered on.

[0058] Fourth monostable trigger Q4: The voltage recovery signal collected by the first low-voltage network voltage acquisition module is ANDed with the low-voltage network voltage recovery signal output by the MCU to generate a first signal; the first signal is sent to the D port of the fourth monostable trigger Q4, and when the first signal changes, a positive pulse is generated and input to the CLK port of the fourth monostable trigger Q4.

[0059] First monostable trigger Q1: The output signals of the first vehicle power-on signal judgment module and the first low-voltage network voltage acquisition module are ANDed together through a logic AND gate and then input into the CLK signal port of the first monostable trigger Q1. The CLR port of the first monostable trigger Q1 is input from the output of the ANDed three signals, which serves as the condition for canceling the output. The three signals are:

[0060] A1: signal of the Q output port of the third monostable trigger Q3;

[0061] B1: The output of the Q output port of the first monostable trigger Q1 exceeds the signal after T1 time and is inverted;

[0062] C1: output signal of the Q non-output port of the fourth monostable trigger Q4.

[0063] The first monostable trigger Q1 is preset to 0 through the hardware circuit when powered on.

[0064] The output of the Q output port of the first monostable trigger Q1 is the second switch control signal.

[0065] S103 : The first switch control signal and the second switch control signal are output to the power transmission switch after passing through a logic OR gate.

[0066] The logic OR gate uses hardware that meets the ASIL-C level requirements; the redundant circuit is implemented using an ASIL-A level digital circuit.

[0067] The redundant circuit also includes a fault simulation module, and the MCU also includes a power supply output recovery module. The fault simulation module's input is a fault injection command sent by the MCU after each vehicle power-up, which is then output to the first low-voltage network voltage acquisition module. The power supply output recovery module recovers the output of the first monostable trigger Q1 to verify the proper functioning of the redundant circuit. The operating principle is as follows: During each power-up, during the diagnostic phase, after stabilization for 1 second, the MCU controls the hardware to inject a fault into the combinational logic circuit. This is accomplished by sending a fault injection command to the fault simulation module. At t = T3 ms (measured from the start of the fault injection command), the power supply output recovery module detects the output voltage Um1 of the first monostable trigger Q1. If Um1 ≥ ​​Uahbg_on, the backup power supply meets the vehicle's power requirements. Otherwise, an alarm signal is sent to the vehicle. Uahbg_on represents the undervoltage threshold for the backup power supply output voltage.

[0068] The MCU also includes an enable signal module for retrieving the backup power supply. Each time the vehicle is powered on, it collects the signal from the Q output port of the third monostable trigger Q3 and compares it with the enable / cancel signal of the output backup power supply. If they are inconsistent, an alarm signal will be sent to the vehicle.

[0069] The key points of achieving ASIL-C in the embodiment of the present invention are:

[0070] Because the digital circuits cannot receive the vehicle's engine's CAN (Control Area Network) signals, they must share the CAN signals received by the ASIL-B MCU as part of their inputs. To prevent the lower-level MCU from impacting higher-level functional safety objectives, the selected MCU features a silent failure mode, meaning it simply remains silent without sending any signals when it fails. Furthermore, the CAN signals received by the MCU are transmitted to the digital circuits via a "notification" mechanism—a rising-edge-triggered D-type flip-flop, rather than a level-controlled RS latch. This ensures that if the MCU's CAN receiver module fails, erroneous signals are not input (in other words, the clock signal CLK can be input to the hardware logic circuit only when the MCU is operating normally). Finally, the D-type flip-flop is pre-set to 1 via hardware upon power-up, eliminating the possibility of the CAN transceiver transmitting erroneous signals during initial power-up. This "notification" mechanism decouples the two paths, ensuring high cohesion and low coupling.

[0071] Although the present invention has been described in detail through the above preferred embodiments, it should be understood that the above description is not intended to limit the present invention. After reading the above description, various modifications and substitutions of the present invention will become apparent to those skilled in the art. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU, characterized by: A monitoring loop consisting of an ASIL-B functional safety level MCU and digital circuits is used to monitor failures in the main power grid and generate a first switch control signal; At the same time, the CAN message signal output by the MCU is notified to the redundant circuit, and the redundant circuit generates a second switch control signal to ensure that the correct control signal is output when the MCU is abnormal; The first switch control signal and the second switch control signal are output to the power supply switch after passing through a logic OR gate; The MCU includes a CAN FD module for receiving vehicle CAN messages, the CAN FD module for receiving vehicle CAN messages receives and decodes the vehicle CAN messages, and outputs an enable / cancel signal of the backup power supply and a low-voltage network voltage recovery signal, which are sent as CAN message signals to the redundant circuit; The redundant circuit includes a first vehicle power-on signal judgment module, a first low-voltage network voltage acquisition module, a first monostable trigger Q1, a third monostable trigger Q3 and a fourth monostable trigger Q4; The first vehicle power-on signal judgment module receives the vehicle power-on IG ON signal; the first low-voltage network voltage acquisition module acquires the low-voltage power supply network voltage BIN voltage; The enable / cancel signal output by the MCU is sent to the D port of the third monostable trigger Q3. When the enable / cancel signal output by the MCU changes, a positive pulse is generated and input to the CLK port of the third monostable trigger Q3. The third monostable trigger Q3 is preset to 1 by the hardware circuit when powered on. The voltage recovery signal collected by the first low-voltage network voltage collection module is ANDed with the low-voltage network voltage recovery signal output by the MCU to generate a first signal; the first signal is sent to the D port of the fourth monostable trigger Q4, and when the first signal changes, a positive pulse is generated and input to the CLK port of the fourth monostable trigger Q4; The output signals of the first vehicle power-on signal judgment module and the first low-voltage network voltage acquisition module are ANDed through a logic AND gate and input into the CLK signal port of the first monostable trigger Q1; the CLR port input of the first monostable trigger Q1 comes from the output of the ANDed three signals, which serves as the condition for canceling the output. The three signals are: A1: a signal of the Q output port of the third monostable trigger Q3; B1: the output of the Q output port of the first monostable trigger Q1 exceeds the signal after T1 time and is inverted; C1: the output signal of the Q non-output port of the fourth monostable trigger Q4; The output of the Q output port of the first monostable trigger Q1 is the second switch control signal.

2. The method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU according to claim 1, wherein: The digital circuit of the monitoring loop includes a second monostable trigger Q2, a second vehicle power-on signal judgment module and a second low-voltage network voltage acquisition module; The second vehicle power-on signal judgment module receives a vehicle power-on IG ON signal; The second low-voltage network voltage acquisition module acquires the low-voltage power supply network voltage BIN voltage; the output signal of the second vehicle power-on signal judgment module and the output signal of the second low-voltage network voltage acquisition module are ANDed through a logic AND gate and input into the CLK signal port of the second monostable trigger Q2; the CLR port input of the second monostable trigger Q2 comes from the output after the three signals are ANDed, as a condition for canceling the output, the three signals are: A2: The voltage recovery signal collected by the second low-voltage network voltage collection module is ANDed with the low-voltage network voltage recovery signal and the signal is inverted; B2: an enable / cancel signal for outputting the backup power supply; C2: the output of the Q output port of the second monostable trigger Q2 exceeds the signal after T2 time and is inverted; The output of the Q output port of the second monostable trigger Q2 is the first switch control signal.

3. The method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU according to claim 2, characterized in that: The output signal of the second low-voltage network voltage acquisition module passes through a high-frequency hardware voltage comparator and delay filtering before being sent to the logic AND gate; the delay requirement of the second vehicle power-on signal judgment module is 1s; The second low-voltage network voltage acquisition module makes a judgment within 1-1.5ms and outputs within 2ms, and T2 is 60s.

4. The method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU according to claim 1, wherein: The output signal of the first low-voltage network voltage acquisition module is sent to the logic gate before passing through a high-frequency hardware voltage comparator and delay filtering; the delay requirement of the first vehicle power-on signal judgment module is 1s; The first low-voltage network voltage acquisition module makes a judgment within 1-1.5ms and outputs within 2ms; the T1 is 60s.

5. The method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU according to claim 1, wherein: The logic OR gate is implemented using hardware that meets ASIL-C requirements; the redundant circuit is implemented using ASIL-A digital circuits.

6. The method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU according to claim 1, characterized in that: The redundant circuit also includes a fault simulation module, and the MCU also includes a power supply output recovery module; the input of the fault simulation module is the fault injection instruction sent by the MCU after each vehicle power-on, and is output to the first low-voltage network voltage acquisition module; the output of the Q output port of the first monostable trigger Q1 is recovered through the power supply output recovery module to detect whether the redundant circuit is operating normally.

7. The method for implementing an ASIL-C automotive backup power supply with an ASIL-B MCU according to claim 1, characterized in that: The MCU also includes an enable signal module for retrieving the backup power supply. Each time the vehicle is powered on, it collects the signal of the Q output port of the third monostable trigger Q3 and compares it with the enable / cancel signal of the output backup power supply. If they are inconsistent, an alarm signal will be sent to the vehicle.

Images