Watchdog circuit for functional safety of engine system

Abstract

The invention relates to the technical field of engine system control safety, in particular to a watchdog circuit for engine system function safety. According to the watchdog circuit for the function safety of the engine system, the watchdog circuit is provided with a plurality of channels which can monitor the running states of a plurality of MCUs at the same time, different channels can be configured with a plurality of reset voltages, and VREF voltages capable of continuously changing within a certain range are provided; according to the watchdog circuit provided by the invention, each channel of the watchdog circuit has different input and output voltages, the MCUs of different voltage domains on the PCB can be monitored, the MCUs of different voltage domains on the PCB are allowed, the watchdog circuit is suitable for a scene that a plurality of MCUs need to be monitored on a single PCB, the flexibility of chip type selection is increased, and meanwhile, the complexity of PCB design and the area of the PCB are reduced.

Description

Technical Field

[0001] The invention relates to the technical field of engine system control safety, and in particular to a watchdog circuit for engine system functional safety. Background Art

[0002] As the proportion of chips used in automobiles increases, consumers and manufacturers are paying more and more attention to automobile functional safety. For automotive electronic control systems, in order to prevent interference from external electromagnetic fields from causing errors in the operation of the automobile control chip, causing the system program to run away and fall into an infinite loop, it is generally necessary to use a watchdog circuit to monitor the operation status of the automobile control chip in real time. The operating status of the automobile engine is an important concern in automobile functional safety. In existing automotive electronic control systems, the microcontroller has a built-in watchdog circuit. When the system detects a key sensor failure related to the engine, the watchdog circuit will trigger a reset operation to avoid serious consequences such as excessive engine output torque or loss of control. Furthermore, in order to ensure the functional safety of the engine under other faults of the car, a watchdog independent of the automotive electronic control system is currently used to independently monitor the control chip of the automobile engine. When the engine's microcontroller (MCU), system program or circuit is disturbed, the main control system of the engine is reset and restarted, thereby ensuring that the engine recovers to normal operation from software and hardware errors.

[0003] The control chips of automobile engine systems are diverse, and there may even be scenarios where multiple MCUs are set on the same PCB and work simultaneously, and MCUs from different manufacturers have different reset voltages and operating voltages. Traditional watchdogs only have a single channel and a single output voltage. Therefore, if you want to use a watchdog circuit to monitor different MCUs in the engine control system, you need to select MCU chips with the same operating voltage, which limits the flexibility of chip use and is not conducive to reducing costs. In the face of the situation where MCUs with different voltages from different manufacturers are used on the same PCB circuit, in order to ensure the functional safety of the automobile engine, each MCU needs to be individually configured with a watchdog circuit that meets the chip voltage domain requirements to ensure that the MCU can quickly restart after a crash, to prevent the MCU from running away or crashing for a long time. Figure 1In order to control multiple MCUs with different reset voltages on the same PCB to work simultaneously, the prior art uses two watchdog chips with different output voltages on the PCB to monitor the MCUs separately, wherein Watch_Dog_0 and MCU_0 share a voltage domain and can only be used to monitor MCU_0. After a certain period of time without receiving a confirmation signal, a reset voltage required by MCU_0 is output to reset MCU_0; Watch_Dog_1 and MCU_1 also have similar working principles. This working mode requires the use of multiple watchdog chips with different output voltages to monitor each MCU, which has a large chip cost. At the same time, multiple watchdog circuits require a more complex PCB layout, which increases the complexity of the circuit and the circuit manufacturing cost. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a watchdog circuit capable of reducing the number of watchdogs in a scenario where an MCU has multiple different output voltages on a single PCB.

[0005] In order to solve the above technical problems, the present invention provides a watchdog circuit for functional safety of an engine system, comprising a watchdog and a plurality of microcontroller chips MCU respectively connected to the watchdog, wherein the watchdog provides a plurality of input-output communication ports to connect the respective microcontroller chips MCU; the watchdog comprises an output voltage reference port VREF, a reference voltage enable terminal VREF_EN, and a plurality of output voltage selection ports V_SEL respectively connected to the respective microcontroller chips MCU through the input-output communication ports, and if the reference voltage enable terminal VREF_EN is enabled, the watchdog uses the voltage of the output voltage reference port VREF as a new output voltage of each group of input-output communication ports;

[0006] The voltage of the output voltage reference port VREF of the watchdog is adjustable, specifically: the watchdog includes a power input port Battery, a reference source, a voltage clamping circuit and a voltage output buffer connected in sequence, the power input port Battery is used to connect the VCC interface of the watchdog to access the power supply, and the voltage output buffer is used to connect the output end of the input-output communication port to output the voltage; the voltage clamping circuit includes multiple groups of voltage amplifiers and multiple field effect transistors respectively connected to the voltage amplifiers, the real-time output voltage of the reference source is used as the preset reference voltage VREF of the output voltage reference port VREF, and it and the voltage output buffer are used as the input of the comparison end of the first group of voltage amplifiers AMP_Clamp, the current reference voltage VREF of the reference source is a real-time adjustable voltage, if the voltage output buffer is lower than the reference voltage VREF, the voltage clamping circuit does not work; the maximum voltage output buffer voltage value of the current watchdog circuit is adjusted by adjusting the value of the reference voltage VREF.

[0007] Furthermore, the voltage of the output voltage reference port VREF is less than the minimum voltage of the power input port Battery.

[0008] Furthermore, the output of the first group of voltage amplifiers is connected to the gate of the field effect tube, the source of the field effect tube is connected to the VCC interface of the watchdog, and the drain of the field effect tube is connected to the output end of the next group of voltage amplifiers; if the voltage output buffer exceeds the preset reference voltage VREF, the voltage clamping circuit pulls up the gate of the field effect tube, thereby limiting the voltage rise amplitude of the output buffer and realizing voltage clamping.

[0009] Furthermore, the voltage output under non-enabled conditions: the output voltage is determined according to the access state of the V_SEL pin, specifically, when V_SEL is grounded, 3.3V is output; when V_SEL is connected to the battery of the power input port Battery, 5V is output.

[0010] Furthermore, it also includes multiple groups of amplifiers AMP whose amplification factors are much smaller than AMP_Clamp. The inputs of the comparison terminals of the amplifiers AMP are respectively the reset high-level signals corresponding to the MCUs and the standard voltage Vb divided by the reference source. If the corresponding MCU is abnormal, the watchdog generates a reset high-level signal to enable the corresponding amplifier AMP to synchronously output a high-level signal to the output Buffer, so that the MCU obtains a high level from the watchdog and triggers a reset operation.

[0011] Furthermore, in the voltage clamping circuit, the number of voltage amplifiers corresponds to the number of MCUs.

[0012] Furthermore, each group of input-output communication ports includes an input signal port WDI and an output signal port WDO; the input signal port WDI is connected to the GPIO pin of the microcontroller chip MCU, and the microcontroller chip MCU sends a confirmation signal to the watchdog circuit through the GPIO pin to indicate that it is working normally; the output signal terminal WDO is connected to the reset pin Res of the microcontroller chip MCU, and if the watchdog circuit detects an abnormality, a high-level signal is output to the reset pin Res of the microcontroller chip MCU through the output signal terminal WDO to reset the MCU.

[0013] The present invention has the following beneficial effects: the watchdog circuit of the present invention is used to meet the functional safety requirements of an automobile engine system, has multiple channels capable of simultaneously monitoring the operating states of multiple MCUs, and different channels can be configured with multiple reset voltages of 3.3V, 5V and VREF, and VREF is a voltage that can continuously change within a certain range, and the specific VREF voltage size is set by a user in real time or in advance in a control program, so that each channel of the watchdog circuit of the present invention has different input and output voltages, can monitor MCUs in different voltage domains on a PCB, allows MCUs in different voltage domains to be on the PCB, is suitable for scenarios where multiple MCUs need to be monitored on a single PCB, increases the flexibility of chip selection, and reduces the complexity of PCB design and the area of ​​the PCB. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 The present invention is a schematic diagram of the connection structure between multiple watchdog circuits and MCU in the prior art.

[0015] Figure 2 It is a circuit schematic diagram of a watchdog circuit for functional safety of an engine system.

[0016] Figure 3 It is a watchdog module diagram of a watchdog circuit for functional safety of an engine system.

[0017] Figure 4 This is the internal block diagram of the watchdog circuit for engine system functional safety.

[0018] Figure 5 This is an output voltage clamping circuit diagram of a watchdog circuit for functional safety of an engine system. DETAILED DESCRIPTION

[0019] The present invention is further described in detail below in conjunction with specific implementation methods.

[0020] The watchdog circuit for engine system functional safety in this embodiment is as follows: Figure 2As shown, it includes a watchdog and multiple microcontroller chips MCU respectively connected to the watchdog. In this embodiment, they are specifically two microcontroller chips MCU_1 and MCU_2. The watchdog correspondingly has two groups of communication ports WDI_0 and WDO_0 and WDI_1 and WDO_1. If the watchdog needs to be connected to three or more microcontroller chips, a watchdog with more communication ports is correspondingly used to realize the communication connection.

[0021] The pins of the watchdog circuit of this embodiment are as follows Figure 3 As shown, it includes a power supply port VCC, a ground terminal GND, an enable port WD_EN, two output ports WDO_0 and WDO_1, two input signal ports WDI_0 and WDI_1, a reset time adjustment terminal R_Time, output voltage selection ports V_SEL0 and V_SEL1, output voltage reference ports VREF_0 and VREF_1, and a reference voltage enable terminal VREF_EN.

[0022] Among them, VCC: As the power supply port of the circuit, it receives a voltage input of 3 to 40V to provide the required power for the entire watchdog circuit. GND: This is the ground terminal of the chip and needs to be connected to the ground terminal of the system to ensure that the circuit can work stably. WD_EN: Enable port. When this port receives a high level, the watchdog circuit will be activated. If a low level is received, the circuit will enter a dormant or disabled state. WDI_0 and WDI_1: These two ports are the confirmation input signal ports of the watchdog, which are used to receive confirmation signals from the MCU. The MCU needs to send signals to these ports regularly to indicate that it is still working normally. WDO_0 and WDO_1: These two ports are the output ports of the watchdog, which are used to reset the two MCUs (MCU_1 and MCU_2) respectively. When the watchdog circuit detects that the MCU does not send a confirmation signal, it will output a reset signal through these two ports. R_Time: Reset time adjustment terminal. By connecting a resistor R with different resistance values ​​to ground, the user can adjust the time required for the watchdog circuit to trigger a reset operation after detecting a fault. V_SEL0 and V_SEL1: These two ports are used to select the voltage of the watchdog output port. For example, when V_SEL0=0, WDO_0 will output 3.3V; and when V_SEL0=1, WDO_0 will output 5V. The control function of the V_SEL1 port on WDO_1 is similar to that of V_SEL0. VREF_0 and VREF_1: These two ports are the input signal terminals of the watchdog output reference voltage. By inputting a stable reference voltage to these ports, the user can further adjust the voltage of the watchdog output port. VREF_EN: Reference voltage enable terminal. When this port is activated (for example, a high level is received), the output voltage of WDO_X will no longer be controlled by V_SEL_X, but will uniformly output the voltage of VREF_X, where X corresponds to the number N of MCUs connected to the watchdog, X=N-1, and X=0 or 1 in this embodiment.

[0023] The internal block diagram of the watchdog circuit of this embodiment is shown in FIG. Figure 4 , including a Battey terminal for connecting to the power supply port VCC, and a reference source (voltage reference), a regulator, a timer, and an output buffer terminal respectively connected to the Battey terminal for power. The timer is connected to the output buffer terminal via a reference source or a voltage clamp circuit. The timer is connected to the reference source in the following ways: direct connection, connection via a regulator, and connection via a resistor adjustment confirmation time middleware, so as to realize different output voltage configuration functions of the watchdog.

[0024] Among them, the reference source (Voltage Reference) of this embodiment is responsible for generating a series of highly stable and accurate reference voltages, which are used as standards to ensure the consistency and accuracy of the operating voltage and working state of other modules in the system. The reference voltages provided by the reference source are crucial to the performance of the entire system because they directly affect the stability, accuracy and reliability of the circuit. The voltage regulator Regulator converts the externally provided 0 to 40 volt input voltage VCC into a stable voltage suitable for the operation of internal circuits such as counters based on the reference voltage from the reference source. The function of the voltage regulator is to ensure that no matter how the input voltage changes, the voltage output to the internal circuit always remains constant, thereby ensuring that the normal operation of the internal circuit is not affected by external voltage fluctuations. The timer (Timer) uses the reference voltage provided by the reference source to generate a fixed frequency clock signal, which is not only used for its own operation, but also provides a basis for the counting function. By adding resistors outside the circuit, the timing time of the timer can be adjusted, thereby adjusting the generated clock cycle or frequency. This flexibility allows users to customize the behavior of the timer according to specific needs. When the system receives a confirmation signal (Watchdog Signal), the timer resets its count and restarts the counting process. This is a common safety mechanism to prevent system deadlock or loss of control. If no confirmation signal is received within the set counting cycle, it means that the system may have encountered a problem. At this time, the timer will generate a reset high-level signal - called timer timeout (TimerOvertime), which is passed to the output buffer (Output Buffer). Once the output buffer receives the reset signal from the timer, it will output a high-level voltage signal WD_X with sufficient driving capability to trigger the reset operation of the monitored chip. In order to adapt to different application scenarios, the high-level voltage of WD_X can be adjusted by configuring the voltage clamping circuit. For example, in some cases, it may be necessary to set the high level of WD_X to 3.3 volts or 5 volts; in other cases, it may be the reference voltage VREF, which makes the system suitable for a wide range of application environments.

[0025] Under normal operating conditions, the MCU sends an acknowledgement signal to WDI_1 once per second through GPIO_1. If for some reason the MCU stops sending acknowledgement signals (e.g. the program is stuck), the WDT will detect this in the next cycle and reset the MCU by outputting a high level signal through WDO_X. The device supports MCUs with different output voltages, such as 3.3V for lower power consumption and 5V for higher performance. Users can switch between these two output voltages by changing the state of V_SEL. In addition, when specific functions are enabled, such as entering test or debug mode, VDO_X will output a voltage equal to the internal reference voltage VREF, which can be used for calibration or other special purposes. For different operating modes (3.3V / 5V), the state of V_SEL can be read in the software to determine which voltage output should be used at present. For example, the level state of V_SEL is checked in the initialization stage, and the corresponding register is set or the external circuit is configured accordingly to change the output voltage of VDO_X. When a specific function is enabled (such as entering a test or debug mode), a flag or specific condition can be set, and when these conditions are met, the VDO_X output is adjusted to be equal to the internal reference voltage VREF through software settings. This usually involves special considerations in hardware design, which may include additional DACs, MUXs, or other analog circuits to achieve this purpose.

[0026] The watchdog circuit of this embodiment can separately monitor two MCUs on the same PCB: MCU_1 and MCU_2, and output different reset voltages for adapting these two MCUs. The reset voltage refers to the voltage value that the MCU needs to reach or be lower than during startup or abnormal conditions to trigger a reset operation. Different MCUs may have different reset voltage requirements. For example: the reset voltage of some MCUs may be set at a lower voltage value, such as 1.8V or 2.4V, to ensure correct reset under low voltage conditions. Other MCUs may have higher reset voltage requirements, such as 3.3V or 5V. The watchdog circuit of this embodiment can provide three reset voltages of 3.3V, 5V and VREF according to demand and usage environment, where VREF is a voltage that can change continuously within a certain range. The specific implementation process is described in detail as follows.

[0027] VCC of the watchdog circuit is connected to the battery: The VCC pin of the watchdog circuit is connected to the battery to ensure that it can still work normally when the power fails. MCU is connected to the corresponding LDO voltage regulator input: An LDO voltage regulator is designed for each MCU to ensure that it obtains a stable power supply voltage. WDO_X is connected to the Res of MCU_X: The reset output (WDO_X) of the watchdog circuit is connected to the reset pin (Res) of the corresponding MCU. When the watchdog circuit detects an abnormality, it will output a high-level signal to reset the MCU. WDI_X is connected to the GPIO of MCU_X: The confirmation input (WDI_X) of the watchdog circuit is connected to the GPIO pin of the corresponding MCU. The MCU sends a confirmation signal to the watchdog circuit through this GPIO pin to indicate that it is working normally. Voltage output under non-enabled conditions: Through the voltage clamp circuit of the watchdog circuit, the circuit outputs different voltages according to the selection of the V_SEL pin under non-enabled conditions. When V_SEL is grounded, it outputs 3.3V; when V_SEL is connected to the battery, it outputs 5V. Voltage output under enable condition: Under enable condition, the output voltage of the voltage clamp circuit determines the VREF pin voltage, such as 1.2V, 1.8V, 3.3V or 5V, and in actual operation, the voltage of the output voltage reference port VREF is less than the minimum voltage provided by the power input port Battery, ensuring that the VREF pin is connected to a stable reference voltage source. Specifically, the watchdog's VCC is connected to the battery for operation, and the MCU is connected to the corresponding LDO voltage regulator input; WDO_0 is connected to the Res of MCU_0, and when no confirmation signal is received, WDO_X outputs a high level to reset MCU_0; WDI_1 is connected to the GPIO_1 of MCU_0 to receive the confirmation signal of MCU_0. When the watchdog is disabled, VREF_EN=1, the voltage of WDO_X is controlled by V_SEL, V_SEL is grounded, outputs 3.3V, V_SEL is connected to the battery of the power input port Battery, and outputs 5V; when the watchdog is enabled, VREF_EN=0, the voltage of WDO_X is equal to the VREF voltage.

[0028] Among them, see Figure 5, the voltage clamp circuit includes two groups of voltage amplifiers and field effect tubes respectively connected to the voltage amplifiers, which are used to achieve controllable output voltage. The two groups of voltage amplifiers in this embodiment match the two MCUs, and the voltage amplifiers can be set corresponding to the number of MCUs in other embodiments. Normal operation state: When the Timer Overtime signal is at a low level, the output end of the output Buffer maintains a low potential, that is, a constant 0 volt. This means that in the absence of a timer timeout, WD_X remains at a low level and does not trigger any reset action. When a timer timeout event occurs: Once the timer detects a timeout (for example, no confirmation signal is received within a specified time interval), it generates a high-level Timer Overtime signal. This high-level signal is passed to the output Buffer, causing the WD_X output to become a high level, which is used to trigger a reset operation. Voltage clamping mechanism: The high-level voltage of WD_X will be fed back to the comparator end in the voltage clamp circuit. If the WD_X voltage exceeds the preset reference voltage VREF, the voltage clamp circuit will generate a signal to pull the gate of the field effect tube high, thereby limiting the rise of WD_X and preventing it from reaching VCC. Conversely, if WD_X is lower than VREF, the voltage clamp circuit does not work, allowing WD_X to reach up to VREF under its dynamic balance. VREF adjustment: By adjusting the value of VREF, the maximum output voltage of WD_X can be changed. In this way, the appropriate reset signal level can be set according to the requirements of different application scenarios. Amplifier configuration: AMP1 is used to initially amplify or process the input signal, while AMP_Clamp is responsible for accurately controlling and clamping the WD_X voltage.

[0029] In the voltage clamping circuit of this embodiment, the input of the comparison end of each amplifier AMP is respectively the reset high level signal corresponding to each MCU and the standard voltage Vb divided by the reference source. If the corresponding MCU is abnormal, the watchdog generates a reset high level signal to make the corresponding amplifier AMP synchronously output a high level signal to the output Buffer, so that the MCU obtains a high level from the watchdog and triggers a reset operation. In order to ensure the normal operation of the clamping circuit, the amplification factor of AMP1 is controlled within a certain range to avoid excessive output signals causing the clamping element to fail to work properly. Specifically, if the amplification factor of AMP1 is too large, the level of the output signal may exceed the limit range of the clamping circuit, resulting in clamping failure. Therefore, the amplification factor of AMP1 needs to be much smaller than the amplification factor of AMP_Clamp to ensure that the clamping circuit can effectively limit the level of the output signal within a predetermined range. The AMP_Clamp of this embodiment has a higher amplification factor for further amplifying the clamped signal. This ensures that the clamped signal still has sufficient amplitude to meet the requirements of the subsequent circuit. At the same time, the amplification factor of AMP_Clamp also needs to be adjusted according to the specific requirements of the clamping circuit and the input requirements of the subsequent circuit. AMP_Clamp of this embodiment uses a higher gain to quickly respond to any voltage fluctuation exceeding VREF to ensure the effectiveness of the clamp circuit, while the gain of AMP1 is lower to ensure the stability of the overall system. Therefore, the amplification factor of AMP1 is much smaller than that of AMP_Clamp to ensure that the voltage clamp circuit can effectively respond to and stabilize the output voltage of WD_X. This configuration helps to ensure that the clamp circuit responds quickly to changes in the WD_X voltage while avoiding system instability caused by excessive gain.

[0030] The working process of the watchdog circuit of this embodiment is as follows: the reference source generates a series of reference voltages for use by other modules; the Regulator converts the input VCC of 0 to 40V into the working voltage of the internal circuits such as the counter according to the reference voltage of the reference source; the timer is used to generate a fixed frequency clock and counting frequency according to the reference voltage; the timing time of the timer is regulated by an external resistor; when a confirmation signal is received, the timer is reset and restarts counting; if no confirmation signal is received within a counting cycle, a reset high level signal Timer Overtime is generated to the output buffer; after receiving the reset signal from the timer, the output buffer will output a high voltage signal WD_X with driving capability to reset the monitored chip; the high potential voltage of WD_X is regulated by the voltage clamping circuit. In different application scenarios, the high level of WD_X can be made 3.3V, 5V and VREF by configuring the voltage clamping circuit.

[0031] The watchdog circuit of this embodiment is designed for the functional safety of the engine system, combining the working environment of automotive electronics and the requirements of engine functional safety, providing the engine MCU with an input operating voltage range of -0.3-40V, adjustable timing time and adjustable output voltage, outputting three reset voltages of 3.3V, 5V and VREF, and realizing multi-channel output of multiple MCUs with different output voltages, which is used to meet the functional safety requirements of automobile engines. The watchdog circuit of this embodiment has multiple monitoring and output channels, which can realize that one chip can monitor multiple MCUs separately at the same time, reducing the number of watchdog chips; each channel of the watchdog circuit of this embodiment has different input and output voltages, which can monitor MCUs in different voltage domains on the PCB, allowing MCUs in different voltage domains on the PCB, increasing the flexibility of chip selection, and reducing the complexity of PCB design and the area of ​​PCB.

[0032] The above is only an implementation method of the invention, and does not limit the scope of patent protection. Those skilled in the art can make non-substantial changes or substitutions based on the invention, which still fall within the scope of patent protection.

Claims

1. A watchdog circuit for engine system functional safety, characterized in that: The invention comprises a watchdog and a plurality of microcontroller chips MCU respectively connected to the watchdog, wherein the watchdog provides a plurality of input-output communication ports to connect the respective microcontroller chips MCU; the watchdog comprises an output voltage reference port VREF, a reference voltage enable terminal VREF_EN, and a plurality of output voltage selection ports V_SEL respectively connected to the respective microcontroller chips MCU through the input-output communication ports, and if the reference voltage enable terminal VREF_EN is enabled, the watchdog uses the voltage of the output voltage reference port VREF as the new output voltage of each group of input-output communication ports; The voltage of the output voltage reference port VREF of the watchdog is adjustable, specifically: the watchdog includes a power input port Battery, a reference source, a voltage clamping circuit and a voltage output buffer connected in sequence, the power input port Battery is used to connect the VCC interface of the watchdog to access the power supply, and the voltage output buffer is used to connect the output end of the input-output communication port to output the voltage; the voltage clamping circuit includes multiple groups of voltage amplifiers and multiple field effect transistors respectively connected to the voltage amplifiers, the real-time output voltage of the reference source is used as the preset reference voltage VREF of the output voltage reference port VREF, and it and the voltage output buffer are used as the input of the comparison end of the first group of voltage amplifiers AMP_Clamp, the current reference voltage VREF of the reference source is a real-time adjustable voltage, if the voltage output buffer is lower than the reference voltage VREF, the voltage clamping circuit does not work; the maximum voltage output buffer voltage value of the current watchdog circuit is adjusted by adjusting the value of the reference voltage VREF.

2. The watchdog circuit for engine system functional safety according to claim 1, characterized in that: The voltage of the output voltage reference port VREF is less than the minimum voltage provided by the power input port Battery.

3. The watchdog circuit for engine system functional safety according to claim 1, characterized in that: The output of the first group of voltage amplifiers is connected to the gate of the field effect tube, the source of the field effect tube is connected to the VCC interface of the watchdog, and the drain of the field effect tube is connected to the output end of the next group of voltage amplifiers; if the voltage output buffer exceeds the preset reference voltage VREF, the voltage clamping circuit pulls up the gate of the field effect tube, thereby limiting the voltage rise amplitude of the output buffer and realizing voltage clamping.

4. The watchdog circuit for engine system functional safety according to claim 1, characterized in that: Voltage output under non-enabled conditions: The output voltage is determined according to the access status of the V_SEL pin. Specifically, when V_SEL is grounded, 3.3V is output; when V_SEL is connected to the battery of the power input port Battery, 5V is output.

5. The watchdog circuit for engine system functional safety according to claim 4, characterized in that: It also includes multiple groups of amplifiers AMP with amplification factors much smaller than AMP_Clamp. The input of the comparison terminal of each amplifier AMP is respectively the reset high level signal corresponding to each MCU and the standard voltage Vb divided by the reference source. If the corresponding MCU is abnormal, the watchdog generates a reset high level signal to make the corresponding amplifier AMP synchronously output a high level signal to the output Buffer, so that the MCU obtains a high level from the watchdog and triggers a reset operation.

6. The watchdog circuit for engine system functional safety according to claim 1, characterized in that: In the voltage clamping circuit, the number of voltage amplifiers corresponds to the number of MCUs.

7. The watchdog circuit for engine system functional safety according to claim 1, characterized in that: Each group of input-output communication ports includes an input signal port WDI and an output signal port WDO; the input signal port WDI is connected to the GPIO pin of the microcontroller chip MCU, and the microcontroller chip MCU sends a confirmation signal to the watchdog circuit through the GPIO pin to indicate that it is working normally; the output signal terminal WDO is connected to the reset pin Res of the microcontroller chip MCU, and if the watchdog circuit detects an abnormality, a high-level signal is output through the output signal terminal WDO to the reset pin Res of the microcontroller chip MCU to reset the MCU.

Images