High-voltage loop control system, high-voltage loop control method, circuit board and vehicle

Abstract

The invention discloses a high-voltage loop control system, a high-voltage loop control method, a circuit board and a vehicle. The system comprises a high-voltage loop main positive and main negative relay, a first driving chip, a second driving chip, a PMIC and an MCU. Four GPIO (General Purpose Input / Output) ports of the MCU are respectively connected with two driving input ports of the first driving chip and the second driving chip; the driving output ports of the first driving chip and the second driving chip are respectively connected with the positive electrode and the negative electrode of a main positive relay and a main negative relay in the high-voltage loop main positive and main negative relays; two fault indication protocol ports of the MCU are connected with two MCU monitor ports of the PMIC; and two functional safety output ports of the PMIC are connected with a first driving input port and a second driving input port of the first driving chip through four switching circuits. According to the technical scheme provided by the embodiment of the invention, the security risk caused by random hardware failure and network attack of the electronic device can be effectively reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer hardware, and in particular to a high-voltage circuit control system, a high-voltage circuit control method, a circuit board and a vehicle. Background Art

[0002] In recent years, with the rapid development of new energy and autonomous driving, automobiles are increasingly involved in electronics and Internet of Things. The impact is that more and more controllers and chips are integrated into the car body, as well as access to the external Internet.

[0003] For new energy vehicles, high-voltage circuit control directly affects the operation of the vehicle and is an electronic control system that has a direct impact on driver safety. Therefore, as more and more electronic devices are integrated, the functional safety of the high-voltage circuit has brought huge challenges. At the same time, due to the access to the network environment, the information security of the high-voltage circuit also has risks. Summary of the invention

[0004] The embodiments of the present invention provide a high-voltage circuit control system, a high-voltage circuit control method, a circuit board and a vehicle to reduce the security risks caused by random hardware failure of electronic devices or network attacks.

[0005] According to one aspect of an embodiment of the present invention, a high-voltage circuit control system is provided, comprising: a main positive and negative relay of a high-voltage circuit, a first driver chip, a second driver chip, a PMIC (Power Management Integrated Circuits, power management chip) and an MCU (Microcontroller Unit, micro control unit);

[0006] The first GPIO (General Purpose Input Output) port of the MCU is connected to the first driving input port of the first driving chip, the second GPIO port is connected to the second driving input port of the first driving chip, the third GPIO port is connected to the first driving input port of the second driving chip, and the fourth GPIO port is connected to the second driving input port of the second driving chip;

[0007] The two drive output ports of the first drive chip are respectively connected to the positive electrodes of the main positive relay and the main negative relay in the high-voltage circuit, and the two drive output ports of the second drive chip are respectively connected to the negative electrodes of the main positive relay and the main negative relay in the high-voltage circuit;

[0008] A first fault indication protocol (FIP) port of the MCU is connected to a first MCU monitor port of the PMIC, and a second fault indication protocol port is connected to a second MCU monitor port of the PMIC;

[0009] The first functional safety output (FSO) port of the PMIC is connected to the first driving input port of the first driving chip through a first switching circuit, the second functional safety output port of the PMIC is connected to the second driving input port of the first driving chip through a second switching circuit, and the first functional safety output port of the PMIC is connected to the first driving input port of the second driving chip through a third switching circuit, and the second functional safety output port of the PMIC is connected to the second driving input port of the second driving chip through a fourth switching circuit.

[0010] The MCU also includes: HSM (Hardware Security Module, hardware security module);

[0011] Among them, the first hardware security information output pin in the HSM is connected to the first functional security output port of the PMIC, and the second hardware security information output pin is connected to the second functional security output port of the PMIC.

[0012] On the basis of the above embodiments, the first switch circuit includes a first PNP transistor, the collector of the first PNP transistor is grounded, the base is connected to the first functional safety output port of the PMIC, and the emitter is connected to the first driving input port of the first driving chip;

[0013] The second switch circuit includes a second PNP transistor, the collector of the second PNP transistor is grounded, the base is connected to the second functional safety output port of the PMIC, and the emitter is connected to the second driving input port of the first driving chip;

[0014] The third switch circuit includes a third PNP transistor, the collector of the third PNP transistor is grounded, the base is connected to the first functional safety output port of the PMIC, and the emitter is connected to the first driving input port of the second driving chip;

[0015] The fourth switch circuit includes a fourth PNP transistor, the collector of the fourth PNP transistor is grounded, the base is connected to the second functional safety output port of the PMIC, and the emitter is connected to the second driving input port of the second driving chip.

[0016] On the basis of the above embodiments, the system further comprises: a first recovery monitoring circuit, a second recovery monitoring circuit, a third recovery monitoring circuit and a fourth recovery monitoring circuit;

[0017] The input end of the first recovery monitoring circuit is connected to the first driving output port of the first driving chip, and the output end of the first recovery monitoring circuit is connected to the MCU;

[0018] The input end of the second recovery monitoring circuit is connected to the second driving output port of the first driving chip, and the output end of the second recovery monitoring circuit is connected to the MCU;

[0019] The input end of the third recovery monitoring circuit is connected to the first drive output port of the second drive chip, and the output end of the third recovery monitoring circuit is connected to the MCU;

[0020] The input end of the fourth recovery monitoring circuit is connected to the second driving output port of the second driving chip, and the output end of the fourth recovery monitoring circuit is connected to the MCU;

[0021] The first recovery monitoring circuit, the second recovery monitoring circuit, the third recovery monitoring circuit and the fourth recovery monitoring circuit respectively include a filter circuit and a voltage divider circuit;

[0022] The PMIC is connected to the third recovery monitoring circuit and the fourth recovery monitoring circuit respectively, and is used to provide a 5V pull-up power supply for the third recovery monitoring circuit and the fourth recovery monitoring circuit.

[0023] On the basis of the above embodiments, a 0 ohm resistor is provided on the first branch where the first switch circuit is located, for selecting or not selecting to introduce the first branch into the high voltage loop control system;

[0024] On the second branch where the second switch circuit is located, a 0 ohm resistor is provided for selecting or not selecting to introduce the second branch into the high voltage loop control system;

[0025] On the third branch where the third switch circuit is located, a 0 ohm resistor is provided for selecting or not selecting to introduce the third branch into the high voltage loop control system; and

[0026] On the fourth branch where the fourth switch circuit is located, a 0-ohm resistor is provided for selecting or not selecting to introduce the fourth branch into the high-voltage loop control system.

[0027] The present disclosure also provides a high-voltage circuit control method, which is applied to a high-voltage circuit control system as described in any one of the embodiments of the present disclosure, and the method includes:

[0028] When the HOST in the MCU detects a functional safety anomaly, a first fault signal and a second fault signal are generated;

[0029] The HOST in the MCU sends the first fault signal and the second fault signal through the first fault indication protocol port and the second fault indication protocol port respectively;

[0030] When the first fault signal and the second fault signal are detected via the first MCU monitor port and the second MCU monitor port by the PMIC, a first functional safety signal and a second functional safety signal of low level are generated;

[0031] Sending the first functional safety signal and the second functional safety signal through the first functional safety output port and the second functional safety output port through the PMIC;

[0032] Among them, the first functional safety signal and the second functional safety signal are used to control the conduction of the first switch circuit, the second switch circuit, the third switch circuit and the fourth switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit according to the first functional safety signal and the second functional safety signal.

[0033] Based on the above embodiments, the method further includes:

[0034] When an information security anomaly is detected by the HSM in the MCU, a low-level first information security signal and a second information security signal are generated;

[0035] The first information security signal and the second information security signal are output through the first hardware security information output pin and the second hardware security information output pin by the HSM in the MCU;

[0036] Among them, the first information security signal and the second information security signal are used to control the conduction of the first switch circuit, the second switch circuit, the third switch circuit and the fourth switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit according to the first information security signal and the second information security signal.

[0037] Based on the above embodiments, the method further includes:

[0038] The HOST in the MCU monitors the first driver chip under normal working conditions according to the signal collected by the first sampling monitoring circuit at the first driver output port of the first driver chip and the signal collected by the second sampling monitoring circuit at the second driver output port of the first driver chip; and

[0039] Under normal working condition, the HOST in the MCU monitors the second driver chip according to the signal collected by the third sampling monitoring circuit at the first driver output port of the second driver chip and the signal collected by the fourth sampling monitoring circuit at the second driver output port of the second driver chip.

[0040] Based on the above embodiments, the method further includes:

[0041] Sending an enable signal to the HSM through the HOST in the MCU to trigger and start the high-voltage circuit control function of the HSM; and

[0042] A disable signal is sent to the HSM via the HOST in the MCU to trigger the shutdown of the high voltage circuit control function of the HSM.

[0043] On the basis of the above embodiments, when the HOST in the MCU detects a functional safety abnormality, a first fault signal and a second fault signal are generated, including:

[0044] When the HOST in the MCU detects a functional safety anomaly, it generates a first fault signal and a second fault signal after waiting for a first buffer time; and

[0045] When an information security anomaly is detected by the HSM in the MCU, a low-level first information security signal and a second information security signal are generated, including:

[0046] When an information security anomaly is detected by the HSM in the MCU, a low-level first information security signal and a second information security signal are generated after waiting for a second buffer time.

[0047] An embodiment of the present invention further provides a circuit board, which is loaded with a high-voltage circuit control system as described in any one of the embodiments of the present invention.

[0048] An embodiment of the present invention further provides a vehicle, comprising a high-voltage circuit control system as described in any one of the embodiments of the present invention.

[0049] The technical solution of the embodiment of the present invention is based on the existing high-voltage circuit control system, and adds a PMIC that communicates with the MCU and a plurality of switch circuits arranged at the drive input ports of a plurality of driver chips of the main positive and negative relays of the high-voltage circuit. When the HOST in the MCU detects a functional safety abnormality, it can trigger the PMIC to generate two low-level functional safety signals, and provide the above-mentioned functional safety signals to the first driver chip and the second driver chip respectively through the adaptive switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit. Such a setting can directly skip the MCU's drive control of the first driver chip and the second driver chip when the MCU suffers from a functional safety-related failure, thereby effectively reducing the safety risks caused by random hardware failures of electronic devices.

[0050] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 is a structural schematic diagram of a high-voltage circuit control system provided according to an embodiment of the present invention;

[0053] Figure 2 is a structural schematic diagram of another high-voltage circuit control system provided according to an embodiment of the present invention;

[0054] Figure 3 is a structural schematic diagram of another high-voltage circuit control system provided according to an embodiment of the present invention;

[0055] Figure 4 is a flow chart of a high-voltage circuit control method provided according to an embodiment of the present invention;

[0056] Figure 5 is a flow chart of another high-voltage circuit control method provided according to an embodiment of the present invention;

[0057] Figure 6 is a structural diagram of a circuit board provided according to an embodiment of the present invention;

[0058] Figure 7 is a structural diagram of a vehicle provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0060] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0061] Figure 1 The present invention provides a schematic diagram of a high-voltage circuit control system. This embodiment is applicable to the case where the high-voltage circuit is shut down in time when a functional safety abnormality occurs in the MCU. Figure 1 As shown, the high-pressure circuit control system may specifically include:

[0062] High voltage circuit main positive and negative relays 110, a first driver chip 120, a second driver chip 130, a PMIC 140 and an MCU 150;

[0063] Among them, the first GPIO port (GPIO1) of MCU150 is connected to the first drive input port of the first driver chip 120 (INPUT1 in the first driver chip 120), the second GPIO port (GPIO2) is connected to the second drive input port of the first driver chip 120 (INPUT2 in the first driver chip 120), the third GPIO (GPIO3) port is connected to the first drive input port of the second driver chip 130 (INPUT1 in the second driver chip 130), and the fourth GPIO port (GPIO4) is connected to the second drive input port of the second driver chip 130 (INPUT2 in the second driver chip 130).

[0064] The two driving output ports of the first driving chip 120 (OUT1 and OUT2 in the first driving chip 120) are respectively connected to the positive poles of the main positive relay and the main negative relay in the high-voltage circuit main positive and negative relays 110, and the two driving output ports of the second driving chip 130 (OUT1 and OUT2 in the second driving chip 130) are respectively connected to the negative poles of the main positive relay and the main negative relay in the high-voltage circuit main positive and negative relays 110.

[0065] In this embodiment, when the entire high-voltage circuit control system is operating normally, the MCU150 communicates with the high-side driver chip (i.e., the first driver chip 120) through SPI (Serial Peripheral Interface) communication (not shown in the figure), controls the multi-channel high-side driver chip through GPIO1 and GPIO2, and then controls the positive pole of the main positive and negative relays 110 of the high-voltage circuit. Similarly, the MCU150 also controls the multi-channel low-side driver chip (i.e., the second driver chip 130) through GPIO3 and GPIO4, and then controls the negative pole of the main positive and negative relays 110 of the high-voltage circuit.

[0066] The specific control principle is: when MCU150 corresponds to GPIO1, GPIO2, GPIO3 and GPIO4 and all output high level, OUT1 and OUT2 of the high-side driver chip, and OUT1 and OUT2 of the low-side driver chip OUT all output high level. The above-mentioned high levels can control the coil of the main positive and negative relays 110 of the high-voltage circuit to close the switch, connecting the high-voltage circuit. Similarly, when MCU150 corresponds to GPIO1, GPIO2, GPIO3 and GPIO4 and all output low level, OUT1 and OUT2 of the high-side driver chip, and OUT1 and OUT2 of the low-side driver chip all output low level, and the above-mentioned low levels can control the coil of the main positive and negative relays 110 of the high-voltage circuit to no longer close the switch, thereby disconnecting the high-voltage circuit.

[0067] It should be noted that the MCU 150 may generally include a plurality of processors, wherein the processors that do not belong to the HSM among the plurality of processors are collectively referred to as the HOST (host) in the MCU.

[0068] The first fault indication protocol port (FIP1) of the MCU 150 is connected to the first MCU monitor port (Monitor1) of the PMIC 140 , and the second fault indication protocol port (FIP2) is connected to the second MCU monitor port (Monitor2) of the PMIC 140 .

[0069] In this embodiment, the inventors have fully considered that when an abnormality occurs in the corresponding GPIO port of the MCU 150, the corresponding GPIO port cannot be controlled to effectively drive and control the first driver chip 120 and the second driver chip 130. Alternatively, when the MCU 150 has a software failure abnormality, the control information will be stuck or delayed. At this time, using the corresponding GPIO port to control the first driver chip 120 or the second driver chip 130 to control the time to disconnect the high-voltage circuit cannot meet the actual disconnection time requirement. At this time, a great safety hazard is caused by the loss of control over the high-voltage circuit.

[0070] Based on this, the inventor creatively considered that no matter an abnormality occurs in the GPIO port corresponding to MCU150 or a software failure abnormality occurs in MCU150, at this time, if ASILD (Automotive Safety Integrity Level) functional safety design is performed inside MCU150, the corresponding failure information can be sent to the two fault indication protocol ports of MCU150, namely, FIP1 and FIP2.

[0071] Furthermore, by connecting the two MCU monitor ports (Monitor1 and Monitor2) of PMIC140 to the two fault indication protocol ports FIP1 and FIP2 of MCU150 respectively, PMIC140 can capture the failure information in time, and drive and control the first driver chip 120 and the second driver chip 130 instead of MCU150.

[0072] Accordingly, the first functional safety output port (FSO1) of the PMIC140 is connected to the first driving input port (INPUT1 in the first driving chip 120) of the first driving chip 120 through the first switching circuit 160, the second functional safety output port (FSO2) of the PMIC140 is connected to the second driving input port (INPUT2 in the first driving chip 120) of the first driving chip 120 through the second switching circuit 170, and the first functional safety output port (FSO1) of the PMIC140 is connected to the first driving input port (INPUT1 in the second driving chip 130) of the second driving chip 130 through the third switching circuit 180, and the second functional safety output port (FSO1) of the PMIC140 is connected to the second driving input port (INPUT1 in the second driving chip 130) of the second driving chip 130 through the fourth switching circuit 190.

[0073] Specifically, when PMIC140 receives the failure information through two MCU monitor ports, two low-level signals can be output through two functional safety output ports (FSO1 and FSO2), and then, the first switch circuit 160, the second switch circuit 170, the third switch circuit 180 and the fourth switch circuit 190 are controlled to be in the on state through the two low-level signals, so that PMIC140 skips MCU150 and directly controls INPUT1 and INPUT2 of the first driver chip 120 and the second driver chip to control the output of the first driver chip 120 and the second driver chip, that is, by outputting two low-level signals from PMIC140 through FSO1 and FSO2 to INPUT1 and INPUT2 of the first driver chip 120 and the second driver chip, the goal of directly shutting down the high-voltage circuit is achieved. This design fully meets the functional safety requirements of the high-voltage circuit control system when the MCU is abnormal.

[0074] The technical solution of the embodiment of the present invention is based on the existing high-voltage circuit control system, and adds a PMIC that communicates with the MCU and a plurality of switch circuits arranged at the drive input ports of a plurality of driver chips of the main positive and negative relays of the high-voltage circuit. When the HOST in the MCU detects a functional safety abnormality, it can trigger the PMIC to generate two low-level functional safety signals, and provide the above-mentioned functional safety signals to the first driver chip and the second driver chip respectively through the adaptive switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit. Such a setting can directly skip the MCU's drive control of the first driver chip and the second driver chip when the MCU suffers from a functional safety-related failure, thereby effectively reducing the safety risks caused by random hardware failures of electronic devices.

[0075] On the basis of the above embodiments, the system may further include: a first recovery monitoring circuit, a second recovery monitoring circuit, a third recovery monitoring circuit and a fourth recovery monitoring circuit (not shown in the figure);

[0076] The input end of the first recovery monitoring circuit is connected to the first driving output port of the first driving chip 120 (OUT1 of the first driving chip 120), and the output end of the first recovery monitoring circuit is connected to the MCU 150;

[0077] The input end of the second recovery monitoring circuit is connected to the second driving output port of the first driving chip 120 (OUT2 of the first driving chip 120), and the output end of the second recovery monitoring circuit is connected to the MCU150;

[0078] The input end of the third recovery monitoring circuit is connected to the first driving output port of the second driving chip 130 (OUT1 of the second driving chip 130), and the output end of the third recovery monitoring circuit is connected to the MCU 150;

[0079] The input end of the fourth recovery monitoring circuit is connected to the second driving output port of the second driving chip 130 (OUT2 of the second driving chip 130), and the output end of the fourth recovery monitoring circuit is connected to the MCU 150;

[0080] The first recovery monitoring circuit, the second recovery monitoring circuit, the third recovery monitoring circuit and the fourth recovery monitoring circuit respectively include a filter circuit and a voltage divider circuit;

[0081] The PMIC 140 is connected to the third recovery monitoring circuit and the fourth recovery monitoring circuit respectively, and is used to provide a 5V pull-up power supply for the third recovery monitoring circuit and the fourth recovery monitoring circuit.

[0082] Through the above settings, MCU150 can monitor in real time whether the driving control of the main positive and negative relays 110 of the high-voltage circuit meets expectations, so as to further ensure the safety and reliability of the entire high-voltage circuit control. That is, the technical solution of the embodiment of the present invention is designed for the recovery of the output of the first driver chip 120 and the second driver chip 130. The high-side loop (the loop where the first driver chip 120 is located) can directly use the corresponding filter circuit and the voltage divider circuit for voltage recovery, and the low-side loop (the loop where the second driver chip 130 is located) needs to use the 5V pull-up power supply of PMIC140 additionally. Through the recovery signal output by the first driver chip 120 and the second driver chip 130, the failure of the output of the first driver chip 120 and the second driver chip 130 can be effectively diagnosed to meet the requirements of functional safety.

[0083] Figure 2 This is a schematic diagram of the structure of another high-voltage circuit control system provided in an embodiment of the present invention. This embodiment can be applied to the situation where the high-voltage circuit is shut down in time when an information security anomaly occurs in the MCU.

[0084] Correspondingly, such as Figure 2 As shown, the high pressure circuit control system may further include: HSM210.

[0085] Among them, the first hardware security information output pin (HSM PIN1) in HSM210 is connected to the first functional security output port (FSO1) of the PMIC, and the second hardware security information output pin (HSM PIN2) is connected to the second functional security output port (FSO2) of the PMIC.

[0086] As mentioned above, in the MCU, multiple processors may be included. When the above processors include HSM, the above processors may be divided into two categories, one is the processors in the MCU except the HSM, which constitute the HOST of the MCU, and the other is the HSM of the MCU. In the related art, the HSM has reserved HSM PIN1 and HSM PIN2. In the embodiments of the present invention, by making full use of the above HSM PIN1 and HSM PIN2, the HSM may replace the MCU to drive and control the first driver chip and the second driver chip in the high-voltage circuit control system.

[0087] That is, when the MCU suffers a network security attack, the system information in the MCU's HOST is stolen or cannot be effectively transmitted (for example, by illegally modifying the register information to mask the fault signal). At this time, since the PMIC cannot receive the failure signal output by the MCU through the two fault indication protocol ports, the PMIC also loses control of the first driver chip 120 and the second driver chip.

[0088] Based on this, in this embodiment, the inventor creatively proposes to use the HSM210 integrated in the MCU, and also connect the reserved HSM Pin1 and HSM Pin2 in the HSM210 to the FSO1 and FSO2 of the PMIC. Since the HSM, as an information security island, has the ability to resist network security attacks, its power supply and reset clock circuits are independent of the MCU's HOST. At the same time, the HSM Pin1 and HSM Pin2 dedicated to the HSM210 have a locking function, which cannot be reconfigured after locking. In addition, the HSM Pin1 and HSM Pin2 can represent the internal state of the HSM210. When the HSM210 detects that it is under attack, it will control the HSM Pin1 and HSM Pin2 to directly output a low-level signal.

[0089] Furthermore, by using these two low-level signals to respectively control the first switch circuit, the second switch circuit, the third switch circuit and the fourth switch circuit of the high-voltage loop control system to be in the on state, the HSM210 is used to skip the HOST of the MCU and directly control the INPUT1 and INPUT2 of the first driver chip 120 and the second driver chip to control the output of the first driver chip 120 and the second driver chip, that is, by outputting two low-level signals from the HSM210 via HSM Pin1 and HSM Pin2 to the INPUT1 and INPUT2 of the first driver chip 120 and the second driver chip respectively, the goal of directly shutting off the high-voltage loop is achieved. This design fully meets the information security requirements of the high-voltage loop control system when the MCU is subjected to a network security attack.

[0090] In this embodiment, PMIC and HSM are introduced into the high-voltage loop control system to assist MCU in jointly controlling the high-voltage loop, thereby ensuring that the high-voltage loop control system fully meets the functional safety and information security requirements.

[0091] Based on the above embodiments, Figure 3 Schematic diagram of the structure of another high-voltage circuit control system applicable to the embodiment of the present invention is shown in FIG.

[0092] Specifically, Figure 3 As shown, based on the above embodiments, the first switching circuit includes a first PNP transistor Q1, the collector of the first PNP transistor Q1 is grounded, the base is connected to the first functional safety output port (FSO1) of the PMIC, and the emitter is connected to the first driving input port of the first driving chip (INPUT1 in the first driving chip).

[0093] The second switching circuit includes a second PNP transistor Q2, the collector of the second PNP transistor Q2 is grounded, the base is connected to the second functional safety output port (FSO2) of the PMIC, and the emitter is connected to the second drive input port of the first driver chip (INPUT2 in the first driver chip).

[0094] The third switch circuit includes a third PNP transistor Q3, the collector of the third PNP transistor Q3 is grounded, the base is connected to the first functional safety output port (FSO1) of the PMIC, and the emitter is connected to the first drive input port of the second drive chip (INPUT1 in the second drive chip).

[0095] The fourth switch circuit includes a fourth PNP transistor Q4, the collector of the fourth PNP transistor Q4 is grounded, the base is connected to the second functional safety output port (FSO1) of the PMIC, and the emitter is connected to the second drive input port (INPUT2 in the second drive chip) of the second drive chip.

[0096] In this embodiment, by using a simple transistor, when a low level is received from the PMIC or the HSM of the MCU, the transistor is turned on to block the MCU's control over the first driver chip and the second driver chip, and the low level is directly transmitted to the first driver chip and the second driver chip to control the disconnection of the high-voltage circuit, thereby meeting the functional safety and information security of the high-voltage circuit control system with the lowest cost investment and the simplest circuit design.

[0097] Further, in Figure 3The circuit connection method of the first recovery monitoring circuit, the second recovery monitoring circuit, the third recovery monitoring circuit and the fourth recovery monitoring circuit is specifically defined. The above four recovery monitoring circuits collect four recovery signals of MCU1, MCU2, MCU3 and MCU4 from the two positive terminals and two negative terminals of the main positive and negative relays of the high-voltage circuit respectively, and feed back the above four recovery signals to the HOST of the MCU to realize the monitoring of the driving results of the first drive chip and the second drive control chip.

[0098] On the basis of the above embodiments, a 0 ohm resistor is provided on the first branch where the first switch circuit is located, for selecting or not selecting to introduce the first branch into the high voltage loop control system;

[0099] On the second branch where the second switch circuit is located, a 0 ohm resistor is provided for selecting or not selecting to introduce the second branch into the high voltage loop control system;

[0100] On the third branch where the third switch circuit is located, a 0 ohm resistor is provided for selecting or not selecting to introduce the third branch into the high voltage loop control system; and

[0101] On the fourth branch where the fourth switch circuit is located, a 0-ohm resistor is provided for selecting or not selecting to introduce the fourth branch into the high-voltage loop control system.

[0102] When carrying out specific circuit design, the installation position of the 0 ohm resistor can be designed on the branch where each switching circuit is located. When it is hoped that the high-voltage circuit control system can take into account functional safety or information security, the 0 ohm resistor can be respectively installed in the above four branches to connect the above four branches to the high-voltage circuit control system; otherwise, the 0 ohm resistor can be not installed in the above four branches to disconnect the connection between the above four branches and the high-voltage circuit control system.

[0103] Figure 4 This is a flow chart of a high-voltage circuit control method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to the situation where the high-voltage circuit is disconnected in time when a functional safety risk occurs in the high-voltage circuit control system. The method of this embodiment can be executed by various devices in the high-voltage circuit system described in any embodiment of the present invention.

[0104] Correspondingly, such as Figure 4 As shown, the method may specifically include:

[0105] S410 , when the HOST in the MCU detects a functional safety anomaly, a first fault signal and a second fault signal are generated.

[0106] As mentioned above, if ASILD functional safety design is performed inside the vehicle's MCU, when the HOST in the MCU detects GPIO abnormalities or software failures, it will trigger the generation of the first fault signal and the second fault signal for describing the above failure status.

[0107] In this embodiment, considering that the first fault signal and the second fault signal will immediately drive the first driver chip and the second driver chip to control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit after being generated, in order to give the driver of the vehicle sufficient preparation time, optionally, the HOST in the MCU can generate the first fault signal and the second fault signal after waiting for the first buffer time when a functional safety abnormality is detected, so as to avoid immediately disconnecting the high-voltage circuit and leave the driver sufficient reaction time.

[0108] In this embodiment, the first buffer time (for example, 30 ms or 50 ms, etc.) can be preset according to actual conditions, and this embodiment does not limit this.

[0109] S420 , sending out the first fault signal and the second fault signal through the first fault indication protocol port and the second fault indication protocol port respectively through the HOST in the MCU.

[0110] S430 , generating, by the PMIC, a first functional safety signal and a second functional safety signal of low level when the first fault signal and the second fault signal are detected via the first MCU monitor port and the second MCU monitor port.

[0111] S440 , sending the first functional safety signal and the second functional safety signal through the first functional safety output port and the second functional safety output port through the PMIC.

[0112] Among them, the first functional safety signal and the second functional safety signal are used to control the conduction of the first switch circuit, the second switch circuit, the third switch circuit and the fourth switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit according to the first functional safety signal and the second functional safety signal.

[0113] The technical solution of the embodiment of the present invention can directly skip the MCU's driving control of the first driver chip and the second driver chip when the MCU suffers a functional safety-related failure, and the PMIC replaces the MCU to control the first driver chip and the second driver chip to drive and disconnect the high-voltage circuit, so as to effectively reduce the safety risks caused by random hardware failures of electronic devices.

[0114] Based on the above embodiments, the method may further include:

[0115] The HOST in the MCU monitors the first driver chip according to the signal collected by the first sampling monitoring circuit at the first driver output port of the first driver chip and the signal collected by the second sampling monitoring circuit at the second driver output port of the first driver chip; and

[0116] The second driver chip is monitored by the HOST in the MCU according to the signal collected by the third sampling monitoring circuit at the first driver output port of the second driver chip and the signal collected by the fourth sampling monitoring circuit at the second driver output port of the second driver chip.

[0117] Figure 5 It is a flow chart of another high-voltage circuit control method provided by an embodiment of the present invention. The embodiment of the present invention can be further applied to the situation of disconnecting the high-voltage circuit in time when information security risks occur in the high-voltage circuit control system.

[0118] Correspondingly, such as Figure 5 As shown, the method includes:

[0119] S510 , when the HOST in the MCU detects a functional safety anomaly, a first fault signal and a second fault signal are generated.

[0120] S520 , sending out the first fault signal and the second fault signal through the first fault indication protocol port and the second fault indication protocol port respectively through the HOST in the MCU.

[0121] S530 , generating, by the PMIC, a first functional safety signal and a second functional safety signal of low level when the first fault signal and the second fault signal are detected via the first MCU monitor port and the second MCU monitor port.

[0122] S540 , sending the first functional safety signal and the second functional safety signal through the first functional safety output port and the second functional safety output port through the PMIC.

[0123] S550: When an information security anomaly is detected, the HSM in the MCU generates a first information security signal and a second information security signal of a low level.

[0124] Similarly, in order to reserve sufficient reaction time for the driver of the vehicle, when an information security anomaly is detected by the HSM in the MCU, a low-level first information security signal and a second information security signal can be generated after waiting for a second buffer time.

[0125] The second buffer time may be preset according to actual conditions, and this embodiment does not limit this.

[0126] S560. Output the first information security signal and the second information security signal through the first hardware security information output pin and the second hardware security information output pin through the HSM in the MCU.

[0127] Among them, the first information security signal and the second information security signal are used to control the conduction of the first switch circuit, the second switch circuit, the third switch circuit and the fourth switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit according to the first information security signal and the second information security signal.

[0128] It needs to be emphasized again that, since the first hardware safety information output pin (HSMPin1) and the second hardware safety information output pin (HSM Pin2) in the embodiment of the present invention directly control the high voltage circuit, its functional safety design requirements need to be considered.

[0129] Among them, the enabling of HSM Pin1 and Pin2 is generally configured through a dedicated HOST OTP (One Time Programmable) bit. Therefore, the firmware is verified based on the register readback method, and the read firmware configuration items are compared with the reference values ​​stored in FLASH to ensure that there is no abnormality in the enabling control. After enabling, the output control of HSM Pin1 and HSM Pin2 is protected by adding a lock bit or password register. In addition, the status bits of HSM Pin1 and HSM Pin2 are represented to the HOST in the MCU through the Firewall. The HOST in the MCU can read the Pin status bit at any time (without write permission) to ensure that the main core that meets the ASIL D on the HOST side can always obtain the status of HSM Pin1 and HSM Pin2.

[0130] Accordingly, the method may further include:

[0131] Sending an enable signal to the HSM through the HOST in the MCU to trigger and start the high-voltage circuit control function of the HSM; and

[0132] A disable signal is sent to the HSM via the HOST in the MCU to trigger the shutdown of the high voltage circuit control function of the HSM.

[0133] The basic solution of the embodiment of the present invention introduces PMIC and HSM into the high-voltage loop control system to assist MCU in jointly controlling the high-voltage loop, thereby ensuring that the high-voltage loop control system fully meets the functional safety and information security requirements.

[0134] Figure 6 A schematic diagram of the structure of a circuit board provided by an embodiment of the present invention. Figure 6 As shown, the circuit board is loaded with a high-voltage circuit control system 610 as described in any one of the embodiments of the present invention.

[0135] In this embodiment, the circuit board may be a PCB (Printed Circuit Board). Accordingly, each component included in the high-voltage loop control system 610 is printed on the PCB.

[0136] Figure 7 A schematic diagram of the structure of a vehicle provided by an embodiment of the present invention. Figure 7 As shown, the vehicle includes: a high-voltage circuit control system 710 as described in any one of the embodiments of the present invention.

[0137] Through the above settings, when a vehicle equipped with the high-voltage circuit control system 710 is actually driving, when the MCU in the high-voltage circuit control system 710 suffers from functional safety-related failures and network attacks, the high-side and low-side driver chips can be directly controlled to disconnect the high-voltage circuit by skipping the MCU, thereby avoiding the occurrence of damage events.

[0138] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0139] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A high-voltage circuit control system, characterized in that: include: High-voltage circuit main positive and negative relays, a first driver chip, a second driver chip, a power management chip PMIC and a microcontroller unit MCU; The first general purpose input and output GPIO port of the MCU is connected to the first driving input port of the first driving chip, the second GPIO port is connected to the second driving input port of the first driving chip, the third GPIO port is connected to the first driving input port of the second driving chip, and the fourth GPIO port is connected to the second driving input port of the second driving chip; The two drive output ports of the first drive chip are respectively connected to the positive electrodes of the main positive relay and the main negative relay in the high-voltage circuit, and the two drive output ports of the second drive chip are respectively connected to the negative electrodes of the main positive relay and the main negative relay in the high-voltage circuit; The first fault indication protocol port of the MCU is connected to the first MCU monitor port of the PMIC, and the second fault indication protocol port is connected to the second MCU monitor port of the PMIC; The first functional safety output port of the PMIC is connected to the first driving input port of the first driving chip through the first switching circuit, the second functional safety output port of the PMIC is connected to the second driving input port of the first driving chip through the second switching circuit, and the first functional safety output port of the PMIC is connected to the first driving input port of the second driving chip through the third switching circuit, and the second functional safety output port of the PMIC is connected to the second driving input port of the second driving chip through the fourth switching circuit.

2. The high-voltage circuit control system according to claim 1, characterized in that: The MCU also includes: a hardware security module HSM; Among them, the first hardware security information output pin in the HSM is connected to the first functional security output port of the PMIC, and the second hardware security information output pin is connected to the second functional security output port of the PMIC.

3. The high-voltage circuit control system according to claim 1 or 2, characterized in that: The first switch circuit includes a first PNP transistor, the collector of the first PNP transistor is grounded, the base is connected to the first functional safety output port of the PMIC, and the emitter is connected to the first driving input port of the first driving chip; The second switch circuit includes a second PNP transistor, the collector of the second PNP transistor is grounded, the base is connected to the second functional safety output port of the PMIC, and the emitter is connected to the second driving input port of the first driving chip; The third switch circuit includes a third PNP transistor, the collector of the third PNP transistor is grounded, the base is connected to the first functional safety output port of the PMIC, and the emitter is connected to the first driving input port of the second driving chip; The fourth switch circuit includes a fourth PNP transistor, the collector of the fourth PNP transistor is grounded, the base is connected to the second functional safety output port of the PMIC, and the emitter is connected to the second driving input port of the second driving chip.

4. The high-voltage circuit control system according to claim 1 or 2, characterized in that: The system further comprises: a first recovery monitoring circuit, a second recovery monitoring circuit, a third recovery monitoring circuit and a fourth recovery monitoring circuit; The input end of the first recovery monitoring circuit is connected to the first driving output port of the first driving chip, and the output end of the first recovery monitoring circuit is connected to the MCU; The input end of the second recovery monitoring circuit is connected to the second driving output port of the first driving chip, and the output end of the second recovery monitoring circuit is connected to the MCU; The input end of the third recovery monitoring circuit is connected to the first drive output port of the second drive chip, and the output end of the third recovery monitoring circuit is connected to the MCU; The input end of the fourth recovery monitoring circuit is connected to the second driving output port of the second driving chip, and the output end of the fourth recovery monitoring circuit is connected to the MCU; The first recovery monitoring circuit, the second recovery monitoring circuit, the third recovery monitoring circuit and the fourth recovery monitoring circuit respectively include a filter circuit and a voltage divider circuit; The PMIC is connected to the third recovery monitoring circuit and the fourth recovery monitoring circuit respectively, and is used to provide a 5V pull-up power supply for the third recovery monitoring circuit and the fourth recovery monitoring circuit.

5. The high-voltage circuit control system according to claim 1 or 2, characterized in that: On the first branch where the first switch circuit is located, a 0 ohm resistor is provided for selecting or not selecting to introduce the first branch into the high-voltage loop control system; On the second branch where the second switch circuit is located, a 0 ohm resistor is provided for selecting or not selecting to introduce the second branch into the high voltage loop control system; On the third branch where the third switch circuit is located, a 0 ohm resistor is provided for selecting or not selecting to introduce the third branch into the high voltage loop control system; as well as On the fourth branch where the fourth switch circuit is located, a 0-ohm resistor is provided for selecting or not selecting to introduce the fourth branch into the high-voltage loop control system.

6. A high-voltage circuit control method, characterized in that: Applied to the high-voltage circuit control system according to any one of claims 1 to 5, the method comprises: When the HOST in the MCU detects a functional safety anomaly, a first fault signal and a second fault signal are generated; The HOST in the MCU sends the first fault signal and the second fault signal through the first fault indication protocol port and the second fault indication protocol port respectively; When the first fault signal and the second fault signal are detected via the first MCU monitor port and the second MCU monitor port by the PMIC, a first functional safety signal and a second functional safety signal of low level are generated; Sending the first functional safety signal and the second functional safety signal through the first functional safety output port and the second functional safety output port through the PMIC; Among them, the first functional safety signal and the second functional safety signal are used to control the conduction of the first switch circuit, the second switch circuit, the third switch circuit and the fourth switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit according to the first functional safety signal and the second functional safety signal.

7. The method according to claim 6, characterized in that The method further comprises: When an information security anomaly is detected by the HSM in the MCU, a low-level first information security signal and a second information security signal are generated; The first information security signal and the second information security signal are output through the first hardware security information output pin and the second hardware security information output pin by the HSM in the MCU; Among them, the first information security signal and the second information security signal are used to control the conduction of the first switch circuit, the second switch circuit, the third switch circuit and the fourth switch circuit, so that the first driver chip and the second driver chip control the main positive and negative relays of the high-voltage circuit to disconnect the high-voltage circuit according to the first information security signal and the second information security signal.

8. The method according to claim 6 or 7, characterized in that: The method further comprises: The HOST in the MCU monitors the first driver chip according to the signal collected by the first sampling monitoring circuit at the first driver output port of the first driver chip and the signal collected by the second sampling monitoring circuit at the second driver output port of the first driver chip; and The second driver chip is monitored by the HOST in the MCU according to the signal collected by the third sampling monitoring circuit at the first driver output port of the second driver chip and the signal collected by the fourth sampling monitoring circuit at the second driver output port of the second driver chip.

9. The method according to claim 7, characterized in that: The method further comprises: Sending an enable signal to the HSM through the HOST in the MCU to trigger and start the high-voltage circuit control function of the HSM; and A disable signal is sent to the HSM via the HOST in the MCU to trigger the shutdown of the high voltage circuit control function of the HSM.

10. The method according to claim 7, characterized in that When the HOST in the MCU detects a functional safety anomaly, a first fault signal and a second fault signal are generated, including: When the HOST in the MCU detects a functional safety anomaly, it generates a first fault signal and a second fault signal after waiting for a first buffer time; and When an information security anomaly is detected by the HSM in the MCU, a low-level first information security signal and a second information security signal are generated, including: When an information security anomaly is detected by the HSM in the MCU, a low-level first information security signal and a second information security signal are generated after waiting for a second buffer time.

11. A circuit board, characterized in that: The device is equipped with a high-voltage circuit control system as described in any one of claims 1 to 5.

12. A vehicle, characterized in that: It comprises a high-voltage circuit control system as described in any one of claims 1 to 5.

Images