An intelligent power module that ensures the power supply safety of autonomous driving safety loads

Abstract

The present invention relates to an intelligent power supply module for ensuring the safety of power supply to safety loads in autonomous driving, comprising: a power supply isolation switch, a safety power distribution unit, a first power supply chip, a second power supply chip, a power reuse chip, a first detection module, a second detection module, a first CAN transceiver chip, a second CAN transceiver chip, a shunt resistor, an FPGA, an MCU, and a MOS tube driver chip. The module can realize real-time monitoring of the voltage, current, and temperature of the vehicle's low-voltage busbar and safety loads, determine electrical faults in the low-voltage power supply system through the FPGA, achieve fault isolation and power switching by controlling the disconnection of the power supply isolation switch, and protect the safety load and its wiring harness through a safety power distribution unit composed of E-Fuse. The module can effectively detect and isolate all single-point electrical faults in the low-voltage power supply system, and uses the FPGA as a fault logic processing unit to reduce the time required to isolate the fault and meet the fault tolerance time interval required by the safety load.

Description

Technical Field

[0001] The present invention relates to an intelligent power supply module for ensuring the power supply safety of autonomous driving safety loads, and can be used in the field of automotive electronic and electrical technology. Background Art

[0002] With the rapid development and increasing adoption of assisted driving and autonomous driving technologies, the reliability and safety requirements for a vehicle's low-voltage power supply system have become increasingly stringent. Safety loads are low-voltage loads that ensure vehicle safety. According to the functional safety standard ISO 26262, the safety loads of autonomous vehicles, such as autonomous driving computers, braking, steering, and sensing components, must meet an Automotive Safety Integration Level (ASIL) of up to ASIL D. Accordingly, the power supply for these safety loads must also meet ASIL D. To achieve ASIL D-level power supply for safety loads, appropriate fault detection, fault isolation, and redundant power supply switching capabilities are required.

[0003] Traditional on-board low-voltage power supply systems feature power redundancy, such as a DC / DC + dual-battery redundant power topology that switches to the low-voltage battery to provide emergency power to the load in the event of a DC / DC failure. However, these redundant power supply systems simply connect the backup battery in parallel with the DC / DC output or switch between them using two diodes. This results in low isolation reliability, long switching times, and an inability to cover all power supply system faults, making them difficult to meet ASIL D requirements. Summary of the Invention

[0004] To address the power supply needs of safety loads and the shortcomings of existing redundant power supply systems, the present invention proposes an intelligent power module suitable for autonomous vehicles, capable of low-voltage grid status monitoring, rapid fault identification and isolation, and backup power supply switching. The present invention designs a functional module capable of quickly and reliably performing fault detection, isolation, and power supply switching, and integrates functional safety design into the module to ensure that when any single-point electrical fault occurs in the autonomous vehicle's low-voltage power supply system, the fault can be quickly identified and isolated, and the power supply can be switched to the backup battery. This provides the vehicle with a low-voltage power supply that can still operate in the event of a fault, supports the vehicle in performing minimal-risk operations in the event of a low-voltage power supply failure, and ensures vehicle safety.

[0005] Technical Solution

[0006] The present invention proposes an intelligent power module comprising a power isolating switch, a safety power distribution unit, a detection circuit, and a control circuit. This module enables real-time monitoring of the voltage, current, and temperature of a vehicle's low-voltage busbar and safety loads. It uses a field programmable gate array (FPGA) to detect electrical faults in the low-voltage power supply system, controls the disconnection of the power isolating switch to achieve fault isolation and power switching, and protects the safety loads and their wiring harnesses through a safety power distribution unit comprised of electronic fuses (E-fuses). This module effectively detects and isolates all single-point electrical faults in the low-voltage power supply system. Furthermore, the use of an FPGA as a fault logic processing unit reduces the time required to isolate faults, thereby meeting the fault tolerance interval required by safety loads.

[0007] The details are as follows:

[0008] An intelligent power module for ensuring the power supply safety of autonomous driving safety loads, including: a power isolation switch, a safety power distribution unit, a first power chip, a second power chip, a power multiplexing chip, a first detection module, a second detection module, a first CAN transceiver chip, a second CAN transceiver chip, shunt resistors shunt1 / shunt2, an FPGA, an MCU, and a MOS tube driver chip;

[0009] Its external electrical interfaces include: DC / DC and general load distribution box interface, low-voltage battery interface, safety load interface, and vehicle CAN bus interface.

[0010] The power isolation switch is connected to the DC / DC and the common load distribution box interface on one side, and to the low-voltage battery interface and the safety distribution unit on the other side, thereby realizing bidirectional power isolation between the DC / DC and the low-voltage battery.

[0011] The safety power distribution unit is composed of multiple groups of electronic fuses, and is connected to an external safety load through a safety load interface to protect the safety load and its wiring harness.

[0012] The first power chip is connected to the DC / DC output terminal and is used to introduce power supply 3V31 from the DC / DC to the intelligent power module.

[0013] The second power chip is connected to the low-voltage battery interface for introducing 3V32 power supply from the low-voltage battery to the intelligent power module; the two 3V3 power supplies are realized or function by the power multiplexing chip, and the output is used to power the intelligent power module itself;

[0014] The shunt resistors shunt1 and shunt2 are respectively connected in series on both sides of the power isolation switch to sample the current flowing through the power isolation switch, and the two realize a redundant current sampling function.

[0015] The first detection module detects the voltage and current on the left side of the power isolation switch, and reports the measured data to the FPGA via the SPI interface;

[0016] The second detection module detects the voltage and current on the right side of the power isolation switch, and reports the measured data to the FPGA through the I2C interface;

[0017] The power isolation switch is equipped with a temperature detection chip, which is used to detect the temperature of the back-to-back N-MOS tubes of the power isolation switch and report it to the FPGA.

[0018] The FPGA collects detection values ​​and configures the disconnection conditions of the power isolation switch according to actual needs. When the detection value reaches the set disconnection condition, the FPGA controls the MOS tube driver chip to disconnect the power isolation switch to achieve fault isolation.

[0019] The MOS transistor driver chip is used to boost the drive signal provided by the FPGA to drive the back-to-back N-MOS transistors in the power isolation switch. When the control signal provided by the FPGA is low, the power isolation switch is driven to be closed. When the control signal provided by the FPGA is high, the power isolation switch is driven to be turned on.

[0020] The first CAN transceiver chip and the second CAN transceiver chip are connected to the MCU and connected to the vehicle CAN bus through the vehicle CAN bus interface to form two-way CAN communication with the vehicle;

[0021] The MCU is used to monitor the status of key components and realize the monitoring and switching of two-way CAN communication.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] When any single-point electrical fault occurs in a low-voltage power supply system, the present invention can isolate the fault within 0.1 seconds and switch to a backup power source connected to an intelligent power module to provide emergency power to safety loads. The present invention is applicable to various power supply schemes, such as "single DC / DC + single battery" and "single DC / DC + dual batteries." The present invention features redundant self-power supply, redundant voltage, current, and temperature detection, and redundant CAN communication functions. It uses an ASIL D-rated microcontroller unit (MCU) to monitor the status of key components, and its random hardware failure rate can meet ASIL B or ASIL D design requirements. By placing interfaces for common loads and safety loads at both ends of the power isolation switch, the present invention prevents common load electrical faults from interfering with the power supply to safety loads. Only E-fuses are required for power distribution to safety loads, while a distribution box consisting of fuses and relays is still used for power distribution to common loads, reducing the number of E-fuses used and lowering costs. The present invention adopts a hardware-integrated design, using fewer components and controllers. A single MCU can perform diagnostics for its own power supply, grid status monitoring, fault isolation, and E-fuses. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a schematic diagram of the structure of the intelligent power module proposed in the present invention;

[0025] Figure 2 This is an application example of the intelligent power module proposed in the present invention in the "single DC / DC + dual battery" power supply solution;

[0026] Figure 3 This is a verification waveform of the time required for the intelligent power module to isolate a fault according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0028] The technical solutions of the present invention are as follows:

[0029] An intelligent power supply module that ensures the power supply safety of autonomous driving safety loads, its structure is as follows Figure 1As shown, it includes: a power isolation switch, a safety power distribution unit, a first power chip, a second power chip, a power multiplexing chip, a first detection module, a second detection module, a first CAN transceiver chip, a second CAN transceiver chip, shunt resistors shunt1 / shunt2, FPGA, MCU and MOS tube driver chip;

[0030] Its external electrical interfaces include: DC / DC and general load distribution box interface, low-voltage battery interface, safety load interface, and vehicle CAN bus interface.

[0031] The power isolation switch is connected to the DC / DC and the common load distribution box interface on one side, and to the low-voltage battery interface and the safety distribution unit on the other side. It can replace the mechanical relay and realize bidirectional power isolation between the DC / DC and the low-voltage battery.

[0032] Furthermore, the power isolation switch is composed of back-to-back N-MOS tubes connected with a common gate. For DC / DC, the left N-MOS tube acts as a switch, and the right N-MOS tube acts as an anti-reverse connection. For low-voltage batteries, the opposite is true.

[0033] The safety power distribution unit is composed of multiple groups of electronic fuses (E-Fuses), and is connected to an external safety load through a safety load interface to protect the safety load and its wiring harness.

[0034] The first power chip is connected to the DC / DC output terminal and is used to introduce power supply 3V31 from the DC / DC to the intelligent power module.

[0035] The second power supply chip is connected to the low-voltage battery interface and is used to introduce 3V32 power supply from the low-voltage battery to the intelligent power module; the two 3V3 power supplies are realized through the power multiplexing chip to realize the or function, and the output is used to power the intelligent power module itself; any 3V3 power supply is normal and can ensure its own power supply is normal, thereby ensuring that when any one of the DC / DC or low-voltage battery fails, the intelligent power module has reliable self-power supply, realizing redundant power supply for the intelligent power module.

[0036] The shunt resistors shunt1 and shunt2 are respectively connected in series on both sides of the power isolation switch to sample the current flowing through the power isolation switch, and the two realize a redundant current sampling function.

[0037] The first detection module detects the voltage and current on the left side of the power isolation switch, and reports the measured data to the FPGA via the SPI interface;

[0038] The second detection module detects the voltage and current on the right side of the power isolation switch, and reports the measured data to the FPGA through the I2C interface;

[0039] The power isolation switch is equipped with a temperature detection chip, which is used to detect the temperature of the back-to-back N-MOS tubes of the power isolation switch and report it to the FPGA.

[0040] Therefore, the intelligent power module can detect the voltage across the power isolation switch, the current flowing through the power isolation switch, and the temperature of the back-to-back N-MOS tubes of the power isolation switch in real time.

[0041] The FPGA collects detection values ​​and configures the disconnection conditions of the power isolation switch according to actual needs. When the detection value reaches the set disconnection condition, the FPGA controls the MOS tube driver chip to disconnect the power isolation switch to achieve fault isolation.

[0042] For example, the disconnection condition can be configured to meet any of the following conditions: (1) the current flowing through the power isolation switch is greater than 200A; (2) any voltage on either side of the power isolation switch is greater than 16V or less than 9V; (3) the voltage difference on both sides of the power isolation switch is greater than 3V; (4) the temperature of the back-to-back N-MOS tubes of the power isolation switch is higher than 120℃.

[0043] The MOS transistor driver chip is used to boost the drive signal provided by the FPGA to drive the back-to-back N-MOS transistors in the power isolation switch. When the control signal provided by the FPGA is low, the power isolation switch is driven to be closed. When the control signal provided by the FPGA is high, the power isolation switch is driven to be turned on.

[0044] The first CAN transceiver chip and the second CAN transceiver chip are connected to the MCU and connected to the vehicle CAN bus through the vehicle CAN bus interface to form two-way CAN communication with the vehicle;

[0045] The MCU is used to monitor the status of key components and realize the monitoring and switching of two-way CAN communication.

[0046] Furthermore, the ASIL level of the MCU can be selected according to different power supply solutions. For example, for the "single DCDC + single battery" solution, an ASIL D level MCU is selected, and for the "single DCDC + dual battery" solution, an ASIL B level MCU is selected.

[0047] Furthermore, the MCU implements status monitoring of key components through an analog-to-digital conversion (ADC) interface to improve the diagnostic coverage and ASIL level of the intelligent power module. The status includes: the voltage and current detected by the first / second detection module, the output voltage and current of the first / second power chip, the control signal of the FPGA to the MOS tube driver chip, the gate voltage of the MOS tube driver chip to the power isolation switch, and the voltage, current and temperature of the E-Fuse.

[0048] The intelligent power module proposed in the present invention can be applied to different power supply schemes, such as "single DC / DC + single battery", "single DC / DC + dual batteries", "dual DC / DC + single battery", etc.

[0049] Application of intelligent power module in "single DC / DC + dual battery" power supply solution Figure 2 As shown, in Figure 2 The DC / DC is required to be QM (Quality Managed), low-voltage battery 1 can achieve one ASIL B power supply under the management of BMS1, and low-voltage battery 2 can achieve another ASIL B power supply under the management of BMS2. The functional safety level of intelligent power module 1 / 2 is ASIL B. The following is Figure 2 The application example shown implements the logic description for powering safety loads up to ASIL D level:

[0050] Under normal power supply conditions, the DC / DC and low-voltage battery 1 and low-voltage battery 2 jointly power the safety loads; the DC / DC supplies power to the normal loads.

[0051] When a DC / DC fails, intelligent power module 1 and intelligent power module 2 will disconnect the power isolation switch, and low-voltage battery 1 will provide emergency power supply for the safety load. If low-voltage battery 1 also fails at this time, low-voltage battery 2 will provide emergency power supply for the safety load.

[0052] When the low-voltage battery 1 fails, the corresponding intelligent power module 1 will be disconnected to isolate the fault of the low-voltage battery 1. The intelligent power module 2 will remain closed, and the DC / DC and low-voltage battery 2 will jointly power the safety load. If the DC / DC also fails at this time, the intelligent power module 2 will be disconnected, and the low-voltage battery 2 will provide emergency power supply to the safety load.

[0053] When low-voltage battery 2 fails, the processing process is the same as when low-voltage battery 1 fails.

[0054] Safety load failures are isolated by E-fuses in the safety power distribution unit. For example, if a short circuit occurs in the steering system's main power supply circuit, the corresponding E-fuses on intelligent power module 1 will open, clearing the short circuit and switching to safety power distribution unit 2 to provide backup power for the steering system. The number of E-fuses can be configured based on actual design requirements. Safety loads refer to ASIL-rated loads, such as the autonomous driving computer, autonomous driving sensors, steer-by-wire systems, brake-by-wire systems, and lighting systems.

[0055] Common load faults are isolated by the power isolation switch on the intelligent power module. When a common load fault occurs (e.g., a short circuit), both intelligent power modules 1 and 2 disconnect the power isolation switch, isolating the common load. Low-voltage batteries 1 and 2 then provide redundant emergency power to safe loads, enabling the vehicle to perform minimal-risk maneuvers (such as pulling over). Therefore, power distribution for common loads eliminates the need for more expensive E-fuses and instead utilizes a distribution box consisting of traditional automotive fuses and circuit breakers, reducing costs. Common loads are those with a functional safety level of QM, such as audio and video entertainment systems and air conditioning blowers.

[0056] The solution of the present invention has the following characteristics:

[0057] Feature 1: The intelligent power module proposed in this invention can monitor the bus voltage, current, and MOS tube temperature in real time. When the detection value reaches the set disconnection condition, the power isolation switch will be disconnected to achieve fault isolation.

[0058] Feature 2: The intelligent power module proposed in this invention uses an ASIL D-level MCU to monitor the status of key components and has redundant power supply, redundant detection, and redundant CAN communication functions.

[0059] The intelligent power module proposed in this invention has the following functional safety designs:

[0060] It has two independent and redundant power supplies. The first power chip introduces 3V3 1 power supply from the left side of the power isolation switch for itself, and the second power chip introduces 3V3 2 power supply from the right side of the power isolation switch for itself. The two 3V3 power supplies are realized through the power multiplexing chip to achieve the OR function. When any 3V3 power supply is normal, its own power supply can be guaranteed to be normal.

[0061] It has heterogeneous redundant detection functions. The bus voltage and current detection functions of the first detection module and the second detection module are redundant, and different communication methods are used to meet heterogeneous design.

[0062] The system features redundant CAN communication. The first and second CAN transceiver chips form two CAN communication channels with the vehicle. An ASIL D-rated MCU monitors and switches between these two channels. If the first CAN transceiver chip fails, the system automatically switches to the second CAN transceiver chip. Similarly, the first and second CAN transceiver chips should be different models to support heterogeneous design.

[0063] The ADC interface of an ASIL D-rated MCU is used to monitor the status of key components, improving the diagnostic coverage and ASIL rating of the intelligent power module. The monitored status variables include: the voltage and current detected by the first and second detection modules, the output voltage and current of the first and second power chips, the FPGA's control signal to the MOSFET driver chip, the gate voltage of the MOSFET driver chip to the power isolation switch, and the voltage, current, and temperature of the E-Fuse. If any of these monitored values ​​are abnormal, the MCU will report a fault to the entire vehicle's intelligent power module via CAN communication. For example, if the power isolation switch is disconnected due to an erroneous control signal output from the FPGA to the MOSFET driver chip, the MCU will determine based on the monitored status values ​​that "there is no fault in the low-voltage power supply system, the power isolation switch should be closed, and the FPGA's control signal to the MOSFET driver chip is erroneous" and report this information to the entire vehicle via CAN communication.

[0064] By selecting components in the redundant design that meet the corresponding functional safety level, the random hardware failure rate of the intelligent power module proposed in the present invention can meet ASIL B or ASIL D, so as to be applicable to different power supply solutions.

[0065] Feature 3: The intelligent power module proposed in this invention can be applied to different low-voltage power supply solutions to achieve ASIL D level power supply for safety loads.

[0066] Feature 4: The intelligent power module proposed in this invention uses FPGA as the fault logic processing unit, which can reduce the time required to isolate the fault

[0067] The intelligent power module proposed in the present invention uses FPGA to judge and respond to faults in the low-voltage power supply system. Compared with the solution using MCU, the fault response speed is improved. When a fault occurs, the intelligent power module can realize fault identification and isolation in hundreds of milliseconds.

[0068] As an example, the fault isolation response speed of the "single DC / DC + dual battery" power supply scenario was tested as follows: The test waveform when the bus overvoltage fault is injected into the intelligent power module is as follows: Figure 3 As shown in the figure, during the test, an adjustable DC power supply is connected to the DC / DC output interface of the intelligent power module, a DC resistor is connected to the safety load interface, and the voltage on both sides of the power isolation switch is measured with two voltage probes of an oscilloscope. The power isolation switch is disconnected when the bus voltage is higher than 16V in the FPGA. The output voltage of the DC power supply is continuously increased, and the waveform when the power isolation switch is disconnected is obtained with an oscilloscope. Figure 3 It can be seen that 62.4ms after the busbar 16V overvoltage fault occurs, the power isolation switch is disconnected, isolating the fault.

[0069] The above description is only a description of the preferred embodiments of the present application and does not limit the scope of the present application. Any changes or modifications made by any person skilled in the art based on the above disclosed technical content should be regarded as equivalent valid embodiments and fall within the scope of protection of the technical solution of the present application.

Claims

1. An intelligent power supply module for ensuring the power supply safety of autonomous driving safety loads, characterized in that: include: Power isolation switch, safety power distribution unit, first power chip, second power chip, power multiplexing chip, first detection module, second detection module, first CAN transceiver chip, second CAN transceiver chip, shunt resistors shunt1 / shunt2, FPGA, MCU and MOS tube driver chip; Its external electrical interfaces include: DC / DC and common load distribution box interface, low-voltage battery interface, safety load interface, and vehicle CAN bus interface; The power isolation switch is connected to the DC / DC and the common load distribution box interface on one side, and to the low-voltage battery interface and the safety distribution unit on the other side, thus realizing bidirectional power isolation between the DC / DC and the low-voltage battery; The safety power distribution unit is composed of multiple groups of electronic fuses, and is connected to an external safety load through a safety load interface to protect the safety load and its wiring harness; The first power chip is connected to the DC / DC output terminal and is used to introduce 3V31 power supply from the DC / DC to the intelligent power module; The second power chip is connected to the low-voltage battery interface for introducing 3V32 power supply from the low-voltage battery to the intelligent power module; the two 3V3 power supplies are realized or function by the power multiplexing chip, and the output is used to power the intelligent power module itself; The shunt resistors shunt1 and shunt2 are connected in series on both sides of the power isolation switch, respectively, to sample the current flowing through the power isolation switch, and the two realize redundant current sampling function; The first detection module detects the voltage and current on the left side of the power isolation switch, and reports the measured data to the FPGA via the SPI interface; The second detection module detects the voltage and current on the right side of the power isolation switch, and reports the measured data to the FPGA through the I2C interface; The power isolation switch is equipped with a temperature detection chip, which is used to detect the temperature of the back-to-back N-MOS tubes of the power isolation switch and report it to the FPGA; The FPGA collects detection values ​​and configures the disconnection conditions of the power isolation switch according to actual needs. When the detection value reaches the set disconnection condition, the FPGA controls the MOS transistor driver chip to disconnect the power isolation switch to achieve fault isolation; The MOS transistor driver chip is used to boost the driving signal provided by the FPGA to drive the back-to-back N-MOS transistors in the power isolation switch. When the control signal provided by the FPGA is low, the power isolation switch is driven to be closed. When the control signal provided by the FPGA is high, the power isolation switch is driven to be turned on. The first CAN transceiver chip and the second CAN transceiver chip are connected to the MCU and connected to the vehicle CAN bus through the vehicle CAN bus interface to form two-way CAN communication with the vehicle; The MCU is used to monitor the status of key components and realize the monitoring and switching of two-way CAN communication.

2. The intelligent power supply module for ensuring power supply safety of autonomous driving safety loads according to claim 1, characterized in that: The power isolation switch is composed of back-to-back N-MOS transistors connected with a common gate. For DC / DC, the left N-MOS transistor acts as a switch, and the right N-MOS transistor acts as an anti-reverse connection. For low-voltage batteries, the opposite is true.

3. The intelligent power supply module for ensuring power supply safety of autonomous driving safety loads according to claim 1, characterized in that: Select the ASIL level of the MCU based on different power supply solutions. For the "single DCDC + single battery" solution, choose an ASIL D-level MCU, and for the "single DCDC + dual battery" solution, choose an ASIL B-level MCU.

4. The intelligent power supply module for ensuring power supply safety of autonomous driving safety loads according to claim 1, characterized in that: The MCU monitors the status of key components through the ADC interface to improve the diagnostic coverage and ASIL level of the intelligent power module. The status includes: the voltage and current detected by the first / second detection module, the output voltage and current of the first / second power chip, the control signal of the FPGA to the MOS tube driver chip, the gate voltage of the MOS tube driver chip to the power isolation switch, and the voltage, current, and temperature of the E-Fuse.

Images