Explosive fuse driving device based on functional safety and electronic equipment
By designing the decomposed high-side and low-side drive modules and redundant control signals, the functional safety of ASIL D-level is achieved, avoiding single-point failure and reducing costs, and solving the functional safety of point-explosion fuse drive device in the prior art The problems of low-level and single-point failure achieve fast triggering and higher security.
Patent Information
- Application Number
- CN202411248714.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-05
- Publication Date
- 2025-01-10
AI Technical Summary
The prior art is difficult to realize a point-explosion explosion fuse drive device with high functional safety level ASIL D, and there is a risk of single point failure, which cannot be triggered quickly to reduce hazards and reduce costs.
Design an explosion fuse driving device based on functional safety, adopting the decomposed first and second driving modules, including high-side and low-side driving modules, respectively, to ensure a quick point in the event of circuit abnormality through redundant control signals and diagnostic mechanisms. Explode and avoid single point failure, use TTL static level signals to reduce costs and increase trigger speed.
It achieves the requirements of meeting the functional safety level ASIL D, avoids single point failure, quickly triggers and reduces hazards, and reduces costs, ensuring higher safety and reliability and hardware failure efficiency.
Smart Images
Figure CN119297921A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of electronic circuits, and in particular to an explosion fuse driving device and electronic equipment based on functional safety. Background Art
[0002] At present, with the vigorous development of new energy vehicles, the requirements for safety are getting higher and higher. In the field of high-voltage power supply, when overcurrent or overvoltage such as high-voltage short circuit occurs, protection functions are required to quickly disconnect the high-voltage power supply to prevent losses caused by continued overcurrent / overvoltage. The functional safety standard in the automotive field is ISO26262.
[0003] A quick protection measure is to detonate the explosive fuse, but the functional safety level of the current driver circuit on the market is low, such as ASIL A. However, there are no corresponding solutions and driver chips on the market to meet the higher functional safety requirements of ASIL D. When the functional safety is high-level ASIL C or ASIL D, single point failures need to be avoided (failure of a certain device will cause the entire function to fail).
[0004] In view of the above defects and needs, it is very necessary to design a driving device for detonating explosive fuses based on functional safety, so as to effectively meet the requirements of functional safety level ASIL D, avoid single point failure, trigger as quickly as possible to reduce hazards, and reduce costs as much as possible. Summary of the invention
[0005] Based on this, it is necessary to provide an explosion fuse driving device and electronic equipment based on functional safety to address the above technical problems.
[0006] In a first aspect, an embodiment of the present application provides an explosion fuse driving device based on functional safety, including a first driving module and a second driving module.
[0007] The first driving module meets the first safety level after the decomposition of the total safety level requirement, and includes a first high-side driving module and a first low-side driving module, which are respectively connected to the explosive fuse and are used to output a first driving signal to drive the explosive fuse to explode when the first control signal or the second control signal is valid;
[0008] The second driving module meets the second safety level after the total safety level requirement is decomposed, and includes a second high-side driving module and a second low-side driving module, which are respectively connected to the explosive fuse and are used to output a second driving signal to drive the explosive fuse to explode when the first control signal or the second control signal is valid;
[0009] The first control signal and the second control signal are generated when a circuit is abnormal.
[0010] In one embodiment, the first driving module is an integrated chip that meets the first safety level, and the integrated chip includes a first pin and a second pin.
[0011] The first pin is used to receive the first control signal and send the first control signal to the first high-side driver module and the first low-side driver module;
[0012] The second pin is used to receive the second control signal and send the second control signal to the first high-side driver module and the first low-side driver module.
[0013] In one embodiment, the second driving module further includes a first prohibiting detonation output module and a second prohibiting detonation output module.
[0014] The first prohibition detonation output module is connected to the second high-side driver module, and is used to prohibit the second high-side driver module from turning on when receiving a first prohibition signal;
[0015] The second detonation prohibition output module is connected to the second low-side driver module, and is used to prohibit the second low-side driver module from turning on when receiving a second prohibition signal.
[0016] In one embodiment, the first prohibiting detonation output module is a first MOS tube, and the second prohibiting detonation output module is a second MOS tube.
[0017] The gate of the first MOS tube is connected to the first prohibition signal, the drain of the first MOS tube is connected to the input end of the second high-side driving module, and the source of the first MOS tube is connected to the common ground;
[0018] The gate of the second MOS tube is connected to the second prohibition signal, the drain of the second MOS tube is connected to the input end of the second low-side driving module, and the source of the second MOS tube is connected to the common ground.
[0019] In one embodiment, the second driving module further includes a first filtering circuit and a second filtering circuit.
[0020] The first filtering circuit includes a first resistor and a first capacitor, one end of the first resistor is connected to the drain of the first MOS tube, the other end of the first resistor is connected to the second high-side driving module and one end of the first capacitor, and the other end of the first capacitor is connected to a common ground;
[0021] The first filtering circuit includes a second resistor and a second capacitor, one end of the second resistor is connected to the drain of the second MOS tube, the other end of the second resistor is connected to the second low-side driving module and one end of the second capacitor, and the other end of the second capacitor is connected to a common ground.
[0022] In one embodiment, the second driver module further includes a second high-side driver diagnosis module.
[0023] The second high-side driver diagnostic module is used to detect whether the voltage output by the second high-side driver module is the power supply voltage when only the second high-side driver module is turned on, so as to determine whether the second high-side driver module is normal.
[0024] In one embodiment, the second driver module further includes a second low-side driver diagnostic module.
[0025] The second low-side driver diagnosis module is used to detect whether the voltage input to the second low-side driver module is a ground voltage when only the second low-side driver module is turned on, so as to determine whether the second low-side driver module is normal.
[0026] In one embodiment, the driving device further includes a first redundant power supply unit and a second redundant power supply unit.
[0027] The first redundant power supply unit is connected to the first driving module, and is used to provide a first redundant power supply to the first driving module;
[0028] The second redundant power supply unit is connected to the second driving module, and is used to provide a second redundant power supply to the second driving module.
[0029] In one embodiment, the first control signal and the second control signal are TTL static level signals.
[0030] In a second aspect, an embodiment of the present application further provides an electronic device, comprising an explosive fuse driving device as described in any one of claims 1 to 9 and an explosive fuse connected to the fuse driving device.
[0031] The above-mentioned explosion fuse driving device and electronic equipment based on functional safety include a first driving module and a second driving module. The first driving module meets the first safety level after the decomposition of the total safety level requirement, includes a first high-side driving module and a first low-side driving module, which are respectively connected to the explosion fuse and are used to output a first driving signal to drive the explosion fuse to explode when the first control signal or the second control signal is received effectively; the second driving module meets the second safety level after the decomposition of the total safety level requirement, includes a second high-side driving module and a second low-side driving module, which are respectively connected to the explosion fuse and are used to output a second driving signal to drive the explosion fuse to explode when the first control signal or the second control signal is received effectively, so as to effectively solve the requirement of the total safety level ASIL D and avoid the risk of single point failure.
[0032] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0034] Figure 1 is a circuit diagram of an explosion fuse driving device based on functional safety in one embodiment;
[0035] Figure 2 is a circuit diagram of an explosion fuse driving device based on functional safety in one embodiment;
[0036] Figure 3 The present invention is a circuit diagram of an explosion fuse driving device based on functional safety in one embodiment. DETAILED DESCRIPTION
[0037] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0038] See also Figure 1The embodiment of the present application provides an explosion fuse driving device based on functional safety, including a first driving module 10 and a second driving module 20. The first driving module meets the first safety level after the total safety level requirement is decomposed, including a first high-side driving module and a first low-side driving module, which are respectively connected to the explosion fuse, and are used to output a first driving signal to drive the explosion fuse to explode when the first control signal or the second control signal is valid; the second driving module meets the second safety level after the total safety level requirement is decomposed, including a second high-side driving module and a second low-side driving module, which are respectively connected to the explosion fuse, and are used to output a second driving signal to drive the explosion fuse to explode when the first control signal or the second control signal is valid; wherein the first control signal and the second control signal are generated when the circuit is abnormal.
[0039] The total safety level is divided into ASIL QM, ASIL A, ASIL B, ASIL C, and ASIL D from low to high. The higher the level, the fewer unidentified risks and the smaller the harm. According to the functional safety standard, the total safety level can be decomposed and implemented. For example, the total safety level ASIL D can be decomposed into ASIL QM (D) + ASIL D (D), or ASIL A (D) + ASIL C (D), or ASIL B (D) + ASIL B (D), etc.
[0040] In an example embodiment, the total safety level is ASIL D, which is decomposed into ASIL C(D)+ASIL A(D). ASIL C(D) and ASIL A(D) can be composed of independent discrete circuits or integrated chips. Among them, ASIL C(D) and ASIL A(D) can both be composed of high-side drive and low-side drive control. The high-side drive and low-side drive must be turned on at the same time to drive effectively. ASIL A(D) is a combination of discrete high-side drive and low-side drive to improve the functional safety level.
[0041] When an abnormal situation such as overcurrent / overvoltage occurs in the high-voltage power supply circuit, the controller will send out two redundant control signals, namely the first control signal Trigger_A and the second control signal Trigger_B, to avoid the risk of failure caused by single point failure. The first control signal and the second control signal are both sent to the first driver module 10 and the second driver module 20. The first high-side driver module and the first low-side driver module receive the first control signal and the second control signal, and start to drive effectively when the first control signal or the second control signal is valid, driving the explosion fuse to explode. At the same time, the second high-side driver module and the second low-side driver module also receive the first control signal and the second control signal, and start to drive effectively when the first control signal or the second control signal is valid, driving the explosion fuse to explode. The present application reduces the hardware failure rate by increasing decomposition (redundancy) and related safety mechanisms, meeting high-level functional safety requirements. The functional safety-based explosion fuse driving device of this embodiment effectively solves the requirements of reaching the overall safety level ASIL D, avoids single point failure, and triggers as quickly as possible to reduce hazards, and reduces costs as much as possible.
[0042] The functional safety-based explosion fuse driving device provided in this embodiment can meet the requirements of functional safety level ASIL D, is safer and more reliable, and by increasing decomposition (redundancy) and related safety mechanisms, the hardware failure rate will also be low, meeting high-level functional safety requirements. Since the circuit has been decomposed, each is independent after decomposition and does not affect each other, that is, redundant, so it is a non-single point failure. According to standard specifications, for the diagnosis of non-single point failures, it is only necessary to trigger the input signal state during the power-on initialization diagnosis. At the same time, this solution or the decomposed part of the circuit can also be used to meet other levels of functional safety, such as ASIL A, ASIL B, and ASIL C.
[0043] Among them, the redundant two-way control signal of the present application is TTL static level, which avoids the disadvantage of PWM signal delay, has a shorter trigger time, reduces the duration of danger, makes the drive faster, and reduces the risks faced in abnormal situations such as overcurrent or overvoltage. TTL static level trigger is a high level and a low level each in one state; for example, low level is normal, high level is triggered, and when the level changes from low level to high level, it means that it has been triggered. The PWM signal trigger needs to wait for at least 2 PWM cycles to confirm the signal before triggering the signal delay. The PWM trigger is judged by adjusting the duty cycle; for example, 25% duty cycle is normal, 75% duty cycle is triggered; so it takes more than or equal to 2 PWM cycles to judge normal. At the same time, TTL static level trigger control replaces PWM trigger control to reduce costs. When the control signal is PWM, another lower-level functional safety level circuit (discrete circuit) after ASIL D decomposition usually does not have a PWM trigger function, and an additional circuit is required to convert the PWM trigger signal into a TTL static level trigger, resulting in increased costs. The TTL static level does not require this signal processing circuit, reducing costs.
[0044] In one embodiment, the first driver module is an integrated chip that meets the first safety level, and the integrated chip includes a first pin and a second pin, the first pin is used to receive the first control signal, and send the first control signal to the first high-side driver module and the first low-side driver module; the second pin is used to receive the second control signal, and send the second control signal to the first high-side driver module and the first low-side driver module.
[0045] Exemplarily, after decomposition, the first safety level ASIL C (D) is met. There are ASIL C integrated chips on the market. This embodiment adopts an ASIL C integrated chip. The integrated chip has a first pin and a second pin for receiving a control signal, a high-side driver, a low-side driver, redundant control signal input pin status detection, thermal protection, output prohibition, output current limiting, output pulse width control, load (fuse) resistance detection, output short circuit to ground detection, output short circuit to power supply detection, output open circuit detection and other functions. It also has a communication interface to send relevant diagnostic results to the main control. If the diagnosis finds an abnormality, it is necessary to promptly feedback the abnormal information to the main control, and the main control takes corresponding countermeasures. If the integrated chip does not have these relevant diagnoses, the external system circuit needs to add corresponding diagnoses.
[0046] Since there is no redundancy in the circuits and loads after the drive output, single point failure cannot be avoided. According to safety standards, real-time monitoring is required during operation. It is necessary to diagnose whether the output circuit is normal in real time through load (fuse) resistance detection, output short circuit to ground detection, output short circuit to power supply detection, output open circuit detection, etc.
[0047] In one embodiment, the second driving module further includes a first prohibiting detonation output module and a second prohibiting detonation output module, wherein the first prohibiting detonation output module is connected to the second high-side driving module and is used to prohibit the second high-side driving module from turning on when a first prohibition signal is received; and the second prohibiting detonation output module is connected to the second low-side driving module and is used to prohibit the second low-side driving module from turning on when a second prohibition signal is received.
[0048] For the second driving module of the discrete circuit, a first detonation output prohibition module is added to prohibit the second high-side driving module from detonating output to diagnose the second low-side driving module; a second detonation output prohibition module is added to prohibit the second low-side driving module from detonating output to diagnose the second high-side driving module.
[0049] For details, see Figure 2 , the first driver module is an integrated chip of ASIL C (D) after the total safety level ASIL D is decomposed, and the second driver module is an independent discrete circuit of ASIL A (D) after the total safety level ASIL D is decomposed. For the second driver module of the discrete circuit, the first control signal Trigger_A and the second control signal Trigger_B are processed by "OR" logic to obtain the control signal Trigger_x_Combine, indicating that when any of the first control signal and the second control signal is valid, the control signal Trigger_x_Combine is valid, which is represented by a high level 1. When diagnosing the second low-side driver module, the first detonation output prohibition module receives the first prohibition signal HSD_disable. At this time, even if the control signal Trigger_x_Combine is valid, the detonation output of the second high-side driver module is prohibited through the HSD_control signal, thereby realizing the diagnosis of the second low-side driver module; when diagnosing the second high-side driver module, the second detonation output prohibition module receives the second prohibition signal LSD_disable. At this time, even if the control signal Trigger_x_Combine is valid, the detonation output of the second low-side driver module is prohibited through the LSD_control signal, thereby realizing the diagnosis of the second high-side driver module.
[0050] In one embodiment, the second driver module further includes a second high-side driver diagnostic module and a second low-side driver diagnostic module. The second high-side driver diagnostic module is used to detect whether the voltage output by the second high-side driver module is the power supply voltage when only the second high-side driver module is turned on, so as to determine whether the second high-side driver module is normally closed; the second low-side driver diagnostic module is used to detect whether the voltage input by the second low-side driver module is the ground voltage when only the second low-side driver module is turned on, so as to determine whether the second low-side driver module is normally closed.
[0051] For details, see Figure 2 During the initialization process, it is necessary to diagnose the ASIL A (D) or ASIL C (D) high-side driver and low-side driver to be good. The method for diagnosing ASIL C (D) and ASIL A (D) is the same. For the second driver module ASIL A (D), the HSD_disable signal and the LSD_disable signal can be used to prohibit the high-side driver or the low-side driver from being turned on, thereby avoiding the high-side driver and the low-side driver from being turned on at the same time, and also avoiding the mutual influence between ASIL A (D) and ASIL C (D) when they are turned on at the same time. Specifically, when diagnosing the second high-side driver, the second low-side driver module is prohibited from detonating the output through the second prohibition of detonation output module, and only the second high-side driver module is turned on, and the output is short-circuited to the power supply to detect whether the output is the power supply voltage; when diagnosing the second low-side driver, the second high-side driver module is prohibited from detonating the output through the first prohibition of detonation output module, and only the second low-side driver is turned on, and the output is short-circuited to the ground to detect whether the output is the ground voltage.
[0052] In one embodiment, the driving device also includes a first redundant power supply unit A and a second redundant power supply unit B, the first redundant power supply unit is connected to the first driving module, and is used to provide a first redundant power supply to the first driving module; the second redundant power supply unit is connected to the second driving module, and is used to provide a second redundant power supply to the second driving module to avoid single point failure.
[0053] See also Figure 3 In one embodiment, the first prohibition detonation output module is a first MOS tube, the second prohibition detonation output module is a second MOS tube, the gate of the first MOS tube is connected to the first prohibition signal, the drain of the first MOS tube is connected to the input end of the second high-side driver module, and the source of the first MOS tube is connected to a common ground. The gate of the second MOS tube is connected to the second prohibition signal, the drain of the second MOS tube is connected to the input end of the second low-side driver module, and the source of the second MOS tube is connected to a common ground.
[0054] See also Figure 3In one embodiment, the second driving module further includes a first filtering circuit and a second filtering circuit, the first filtering circuit is connected to the second high-side driving module, the second filtering circuit is connected to the second low-side driving module, the first filtering circuit includes a first resistor R1 and a first capacitor C1, one end of the first resistor R1 is connected to the drain of the first MOS tube, the other end of the first resistor R1 is connected to the second high-side driving module and one end of the first capacitor C1, and the other end of the first capacitor C1 is connected to a common ground; the first filtering circuit includes a second resistor R2 and a second capacitor, one end of the second resistor R2 is connected to the drain of the second MOS tube, the other end of the second resistor R2 is connected to the second low-side driving module and one end of the second capacitor C2, and the other end of the second capacitor C2 is connected to a common ground.
[0055] An embodiment of the present application further provides an electronic device, comprising an exploding fuse driving device as described in any of the above embodiments and an exploding fuse connected to the fuse driving device.
[0056] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0057] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.
Claims
1. An explosion fuse driving device based on functional safety, characterized in that: comprising a first driving module and a second driving module, The first driving module meets the first safety level after the decomposition of the total safety level requirement, and includes a first high-side driving module and a first low-side driving module, which are respectively connected to the explosive fuse and are used to output a first driving signal to drive the explosive fuse to explode when the first control signal or the second control signal is valid; The second driving module meets the second safety level after the total safety level requirement is decomposed, and includes a second high-side driving module and a second low-side driving module, which are respectively connected to the explosive fuse and are used to output a second driving signal to drive the explosive fuse to explode when the first control signal or the second control signal is valid; The first control signal and the second control signal are generated when a circuit is abnormal.
2. The device according to claim 1, characterized in that The first driving module is an integrated chip that meets the first safety level, and the integrated chip includes a first pin and a second pin. The first pin is used to receive the first control signal and send the first control signal to the first high-side driver module and the first low-side driver module; The second pin is used to receive the second control signal and send the second control signal to the first high-side driver module and the first low-side driver module.
3. The device according to claim 1, characterized in that The second driving module also includes a first prohibiting detonation output module and a second prohibiting detonation output module. The first prohibition detonation output module is connected to the second high-side driver module, and is used to prohibit the second high-side driver module from turning on when receiving a first prohibition signal; The second detonation prohibition output module is connected to the second low-side driver module, and is used to prohibit the second low-side driver module from turning on when receiving a second prohibition signal.
4. The device according to claim 3, characterized in that The first prohibiting detonation output module is a first MOS tube, and the second prohibiting detonation output module is a second MOS tube. The gate of the first MOS tube is connected to the first prohibition signal, the drain of the first MOS tube is connected to the input end of the second high-side driving module, and the source of the first MOS tube is connected to the common ground; The gate of the second MOS tube is connected to the second prohibition signal, the drain of the second MOS tube is connected to the input end of the second low-side driving module, and the source of the second MOS tube is connected to the common ground.
5. The device according to claim 3, characterized in that The second driver module further includes a second high-side driver diagnosis module, The second high-side driver diagnosis module is used to detect whether the voltage output by the second high-side driver module is the power supply voltage when only the second high-side driver module is turned on, so as to determine whether the second high-side driver module is normal.
6. The device according to claim 3, characterized in that The second driver module further includes a second low-side driver diagnosis module, The second low-side driver diagnosis module is used to detect whether the voltage input to the second low-side driver module is a ground voltage when only the second low-side driver module is turned on, so as to determine whether the second low-side driver module is normal.
7. The device according to claim 4, characterized in that The second driving module further includes a first filtering circuit and a second filtering circuit. The first filtering circuit includes a first resistor and a first capacitor, one end of the first resistor is connected to the drain of the first MOS tube, the other end of the first resistor is connected to the second high-side driving module and one end of the first capacitor, and the other end of the first capacitor is connected to a common ground; The first filtering circuit includes a second resistor and a second capacitor, one end of the second resistor is connected to the drain of the second MOS tube, the other end of the second resistor is connected to the second low-side driving module and one end of the second capacitor, and the other end of the second capacitor is connected to a common ground.
8. The device according to claim 1, characterized in that The driving device further includes a first redundant power supply unit and a second redundant power supply unit. The first redundant power supply unit is connected to the first driving module, and is used to provide a first redundant power supply to the first driving module; The second redundant power supply unit is connected to the second driving module, and is used to provide a second redundant power supply to the second driving module.
9. The device according to claim 1, characterized in that The first control signal and the second control signal are TTL static level signals.
10. An electronic device, characterized in that: It comprises an exploding fuse driving device as claimed in any one of claims 1 to 9 and an exploding fuse connected to the fuse driving device.