Function safety circuit for automobile electronic controller and control method

Abstract

The invention discloses a functional safety circuit for an automobile electronic controller and a control method. The functional safety circuit comprises a power supply filtering and protecting circuit, a processor circuit, a pulse detection circuit, a controlled reverse amplifying circuit, a reverse amplifying circuit, a high-side driving circuit and a low-side driving circuit. Through the pulse detection circuit, a function safety enable signal is output according to the working state of an automobile, when the automobile is in an ON gear, the function safety enable signal is output according to a watchdog monitoring signal, a function safety circuit can be activated in time, and when the automobile is not in the ON gear, the function safety enable signal outputs high resistance, so that the function safety is invalid, and the function safety circuit is forbidden; false triggering of the functional safety circuit can be prevented, and dark current of the automobile can be reduced; in a function safety activation state, circuit loads can be ensured to work in an expected state; and the circuit basically adopts discrete devices, so that the hardware cost can be reduced, device parameters can be changed according to requirements, and the circuit has good applicability and universality.

Description

Technical Field

[0001] The present invention relates to the technical field of automobile control functional safety, and in particular to a functional safety circuit and a control method for an automobile electronic controller. Background Art

[0002] With the rapid development of automobile intelligence and electrification, users have increasingly stringent requirements for automobile safety performance, and automobile manufacturers have made unremitting efforts in automobile functional safety. The application of functional safety in automobile EPS, ESP, ABS, EPB and other controllers has become relatively mature, and its application in body domain controllers such as BCM, VIU and ZCU is also gradually improving.

[0003] According to the two road vehicle functional safety standards ISO26262 and GB / T34590-2017, as well as the actual safety performance requirements of the vehicle, the functional safety level of the brake sensor power control, charging power control, low beam control, brake light control, position light control, width light control and front wiper control of the body domain controller is determined to be AsilB. Detection and redundant control are usually used to achieve Class B functional safety.

[0004] In the prior art, two controllers are used to control electrical equipment with a safety level of B or above, one controller is used as the main control and monitoring, and the other controller is used as monitoring and auxiliary control. However, in order to achieve a higher functional safety level, the control software design of multiple controllers is relatively complex, requiring twice the hardware circuit, and the implementation cost is relatively high. In the prior art, two MCUs are also used inside a controller, one MCU is used as the main control and monitoring, and the other MCU is used as the monitoring and auxiliary control. However, the control software design of the two MCUs and the communication protocol between the two MCUs are relatively complex, requiring two MCU systems and two MCU power supply systems, and the implementation cost is relatively high. In the prior art, MCU is also used as the main control, and a dedicated smart chip is used for status monitoring. When an abnormality is detected, the electrical equipment with a safety level of B or above is forced to be turned on or off to be in a safe state. However, the use of dedicated smart chips has high hardware costs, poor versatility, poor design flexibility, and is prone to battery depletion, which increases complaints from car owners. Summary of the invention

[0005] Aiming at the problems of complex design, high implementation cost and poor versatility of control circuits for automotive electronic controllers in existing technical solutions, the present invention designs a functional safety circuit and control method for automotive electronic controllers.

[0006] The technical solution adopted by the present invention is:

[0007] The present invention provides a functional safety circuit for an automotive electronic controller, comprising: a processor circuit, a pulse detection circuit, a controlled reverse amplifier circuit, a reverse amplifier circuit, a high-side drive circuit, and a low-side drive circuit;

[0008] Wherein, the processor circuit is used to output a watchdog monitoring signal, a control input signal and a system control signal;

[0009] A pulse detection circuit is connected to the processor circuit and is used to output a functional safety enable signal of a corresponding state according to a watchdog detection signal when the vehicle is in the ON gear;

[0010] A controlled reverse amplifier circuit is connected to the pulse detection circuit and is used to output a first functional safety output signal according to an external high-side switch signal and a functional safety enable signal;

[0011] a reverse amplification circuit, connected to the processor circuit and the pulse detection circuit respectively, and configured to output a second functional safety output signal according to the functional safety enable signal;

[0012] A high-side driving circuit is connected to the processor circuit, the pulse detection circuit and the reverse amplification circuit respectively, and is used to output a high-side driving output signal according to the control input signal, the functional safety enable signal and the second functional safety output signal;

[0013] The low-side driving circuit is respectively connected to the processor circuit, the pulse detection circuit and the controlled reverse amplification circuit, and is used to output a low-side driving output signal according to the system control signal, the functional safety enable signal and the first functional safety output signal.

[0014] According to the above scheme, it also includes a power supply filtering and protection circuit, which is used to input and process the car ON gear power supply voltage, and output the processed car ON gear power supply voltage to provide the power supply voltage.

[0015] According to the above scheme, the processor circuit is also used to obtain the high-side drive output current detection signal of the high-side drive circuit and the fault status information signal of the low-side drive circuit. When the high-side drive output and the low-side drive output status are abnormal, the status information and abnormal information of the high-side drive output and the low-side drive output are sent to other controllers through the bus.

[0016] According to the above scheme, the pulse detection circuit outputs high impedance when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with an input frequency within a preset range, a duty cycle within a preset range, a high level amplitude within a preset range, a low level amplitude within a preset range, a rise time less than a preset time, and a fall time less than a preset time; when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with a duty cycle of 0% or a duty cycle of 100%, the pulse detection circuit outputs a low level; when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with a frequency less than the preset frequency, the pulse detection circuit outputs a square wave of a combination of a low level and high impedance.

[0017] According to the above scheme, the pulse detection circuit is composed of a second transistor for pulse detection and isolation, a first transistor for improving output current capability and isolation, and its peripheral circuits; wherein,

[0018] The base of the second transistor is connected to the watchdog monitoring signal, the collector of the second transistor is connected to the ON gear power supply voltage of the car, and the emitter of the second transistor is grounded;

[0019] The base of the first triode is connected to the collector of the second triode through a resistor, the collector of the first triode outputs a functional safety enable signal, and the emitter of the first triode is grounded.

[0020] According to the above scheme, the controlled reverse amplifier circuit outputs a voltage according to the vehicle ON gear supply voltage when the external high-side switch signal input is high and the functional safety enable signal input is low; and outputs high impedance when the external high-side switch signal input is low or the functional safety enable signal input is high impedance.

[0021] According to the above scheme, the controlled reverse amplifier circuit is composed of a third transistor and its peripheral circuits for controlling output and isolation; wherein,

[0022] The emitter of the third transistor is connected to the external high-side switch signal, the base of the third transistor is connected to the functional safety enable signal, and the collector of the third transistor outputs the first functional safety output signal.

[0023] According to the above scheme, the reverse amplifier circuit outputs high impedance when there is the car ON gear power supply voltage and the functional safety enable signal input is high impedance; when there is the car ON gear power supply voltage and the functional safety enable signal input is low level, it outputs the corresponding voltage according to the car ON gear power supply voltage.

[0024] According to the above scheme, the reverse amplifier circuit is composed of the fourth transistor and the fifth transistor for controlling output and isolation and their peripheral circuits; wherein,

[0025] The emitter of the fourth transistor is connected to the ON gear power supply voltage of the car, the base of the fourth transistor is connected to the functional safety enable signal, and the collector of the fourth transistor outputs FS2 and FS3;

[0026] The emitter of the fifth transistor is connected to the ON gear power supply voltage of the car, the base of the fifth transistor is connected to the functional safety enable signal, and the collector of the fifth transistor outputs FS4 and FS5;

[0027] Among them, the second functional safety output signal of the reverse amplifier circuit includes FS2, FS3, FS4 and FS5, FS2 and FS4 are output to the high-side drive circuit, FS3 and FS5 are output to the low-side drive circuit; FS2 and FS4 are redundantly designed, and FS3 and FS5 are redundantly designed.

[0028] According to the above scheme, the high-side drive circuit includes a dual-channel high-side switch drive chip and its peripheral circuits; wherein the high-side drive output current detection signal pin of the dual-channel high-side switch drive chip is connected to the processor circuit.

[0029] According to the above scheme, the low-side driving circuit includes an eight-channel low-side switch driving chip and its peripheral circuits; wherein the fault status information signal pin of the eight-channel low-side switch driving chip is connected to the processor circuit.

[0030] The present invention also provides a control method for a functional safety circuit of an automotive electronic controller, the method comprising:

[0031] Output watchdog monitoring signal, control input signal and system control signal;

[0032] When the car is in the ON gear, the functional safety enable signal of the corresponding state is output according to the watchdog detection signal;

[0033] Outputting a first functional safety output signal according to an external high-side switch signal and a functional safety enable signal;

[0034] Outputting a second functional safety output signal according to the functional safety enable signal;

[0035] Outputting a high-side driver output signal according to a control input signal, a functional safety enable signal, and a second functional safety output signal;

[0036] A low-side driver output signal is output according to the system control signal, the functional safety enable signal, and the first functional safety output signal.

[0037] The beneficial effects produced by the present invention are:

[0038] The present invention outputs a corresponding functional safety enable signal according to the working state of the automobile through a pulse detection circuit. When the automobile is in the ON gear, the functional safety enable signal is output according to the watchdog monitoring signal, and the functional safety circuit can be activated in time. When the automobile is not in the ON gear, the functional safety enable signal outputs a high impedance, which makes the functional safety invalid and prohibits the functional safety circuit, thereby preventing the functional safety circuit from being falsely triggered and reducing the dark current of the automobile. In the functional safety activation state, it can ensure that the circuit loads all work in the expected state. Moreover, discrete devices are basically used in the circuit, which can reduce the hardware cost, and the device parameters can also be changed according to the needs, and the circuit has good applicability and versatility.

[0039] Furthermore, the present invention uses a processor circuit to monitor the status information of the high-side drive output signal and the low-side drive output signal of the circuit in real time and determine whether there is an abnormality. When there is an abnormality, abnormal alarm information is promptly sent through the bus to give a timely alarm, thereby ensuring the safety of personnel and vehicles and being reliable.

[0040] Furthermore, the reverse amplifier circuit in the present invention adopts a dual redundant design, so that the functional safety level of the output of the high-side drive circuit and the output of the low-side drive circuit can reach Asil-C, thereby increasing circuit safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 is a circuit diagram of a functional safety circuit for an automotive electronic controller according to an embodiment of the present invention;

[0042] Figure 2 is a circuit schematic diagram of a power supply filtering and protection circuit according to an embodiment of the present invention;

[0043] Figure 3 is a circuit schematic diagram of a pulse detection circuit according to an embodiment of the present invention;

[0044] Figure 4 is a circuit schematic diagram of a controlled reverse amplifier circuit according to an embodiment of the present invention;

[0045] Figure 5 is a circuit schematic diagram of an inverting amplifier circuit according to an embodiment of the present invention;

[0046] Figure 6 is a circuit schematic diagram of a high-side drive circuit according to an embodiment of the present invention;

[0047] Figure 7 is a circuit schematic diagram of a low-side driving circuit according to an embodiment of the present invention;

[0048] Figure 8 It is a schematic diagram of a functional safety circuit block diagram of another embodiment of the present invention.

[0049] In the figure: 1-power supply filtering and protection circuit; 2-pulse detection circuit; 3-controlled reverse amplifier circuit; 4-reverse amplifier circuit; 5-high-side drive circuit; 6-low-side drive circuit; 7-processor circuit. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0051] Example 1

[0052] In view of the problems of complex design, high implementation cost and poor versatility of control circuits used in automotive electronic controllers in the prior art, an embodiment of the present invention provides a functional safety circuit for automotive electronic controllers, such as Figure 1 As shown, the circuit includes: a processor circuit, a pulse detection circuit, a controlled reverse amplifier circuit, a reverse amplifier circuit, a high-side drive circuit, and a low-side drive circuit.

[0053] Among them, the processor circuit is used to output the watchdog monitoring signal DO1-WD, the control input signal and the system control signal; in this embodiment, the control input signal includes DO2 / PWMO2-HSD, DO3 / PWMO3-HSD, DO4-DEN, DO5-DSEL; the system control signal includes DO6-Reset, SPI0_CS1, SPI0_CLK, SPI0_MOSI and SPI0_MISO.

[0054] The pulse detection circuit is connected to the processor circuit and is used to output a functional safety enable signal FS_EN of a corresponding state according to the watchdog detection signal DO1-WD when the car is in the ON gear;

[0055] A controlled reverse amplifier circuit, connected to the pulse detection circuit, for outputting a first functional safety output signal according to an external high-side switch signal IDH1 and a functional safety enable signal FS_EN;

[0056] a reverse amplifier circuit, connected to the processor circuit and the pulse detection circuit respectively, and configured to output a second functional safety output signal according to the functional safety enable signal FS_EN;

[0057] A high-side driving circuit is connected to the processor circuit, the pulse detection circuit and the reverse amplification circuit respectively, and is used to output a high-side driving output signal according to the control input signal, the functional safety enable signal FS_EN and the second functional safety output signal;

[0058] The low-side driving circuit is respectively connected to the processor circuit, the pulse detection circuit and the controlled reverse amplification circuit, and is used to output a low-side driving output signal according to the system control signal, the functional safety enable signal FS_EN, and the first functional safety output signal.

[0059] In addition, the functional safety circuit of the embodiment of the present invention also includes a power supply filtering and protection circuit, which is used to connect to the battery, input and process the car ON gear power supply voltage KL15, and output the processed power supply voltage KL15_P to provide the power supply voltage.

[0060] Among them, the processor circuit is also used to obtain the high-side drive output current detection signal of the high-side drive circuit, the fault status information signal of the low-side drive circuit and determine whether the high-side drive output and the low-side drive output status are abnormal; when an abnormality occurs, the status information and abnormal information of the high-side drive output and the low-side drive output are sent to other controllers through the bus, wherein in this embodiment, the status information and abnormal information of the high-side drive output and the low-side drive output are sent through the CAN network.

[0061] Among them, Figure 2 As shown, the specific implementation circuit of the power supply filtering and protection circuit is composed of Figure 2 The first capacitor C1, the second capacitor C2, the third capacitor C3, the first diode D1 and the second diode D2 are composed. The diode D1, the capacitor C1, the capacitor C2, the capacitor C3 and the capacitor C2, the diode D2 form two parallel circuits. Among them, the anode of D1 is connected to KL15; one end of the capacitor C1 is connected to KL15 and is connected in series with the capacitor C3, and the other end of the capacitor C3 is grounded; one end of the capacitor C2 is connected to the cathode of D1, and the other end is grounded; D2 is connected in parallel to both ends of the capacitor C2, and one end is connected to KL15_P and the other end is grounded.

[0062] Specifically, KL15 is the car's ON gear power supply voltage input, its specified voltage range is (9-16)V, and the rated voltage is 13.5V. KL15_P is the processed car's ON gear power supply voltage, its specified voltage range is (8.3-15.3)V, and the rated voltage is 12.8V. Under the conditions that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the car is in the ON gear state, the voltage value of KL15 is the battery voltage, KL15_P is about 0.7V lower than KL15, and the maximum output current of KL15_P is 200mA; GND is the negative pole of the power supply.

[0063] Among them, D1 (BAV21) is a diode for input reverse connection protection and input crosstalk protection, and its current carrying capacity is 200mA, D2 (SMBJ28C) is a TVS for surge pulse protection, C1 (100nF) and C3 (100nF) are capacitors for anti-static and high-frequency filtering. The vertical arrangement of C1 and C3 can greatly reduce the circuit failure rate of KL15, C2 (1uF) is a capacitor for low-frequency filtering and energy storage, C1, C2 and C3 also play the role of electromagnetic interference protection and electromagnetic disturbance suppression, so the power supply filtering and protection circuit loop has the functions of filtering, human body electrostatic protection, automobile power supply pulse protection, electromagnetic interference protection and electromagnetic disturbance suppression.

[0064] Specifically, the pulse detection circuit consists of a second transistor for pulse detection and isolation, a first transistor for improving output current capacity and isolation, and its peripheral circuits; wherein, the base of the second transistor is connected to the watchdog monitoring signal, the collector of the second transistor is connected to the car ON gear power supply voltage, and the emitter of the second transistor is grounded; the base of the first transistor and the collector of the second transistor are connected through a resistor, the collector of the first transistor outputs a functional safety enable signal, and the emitter of the first transistor is grounded.

[0065] In this embodiment, Figure 3 As shown, the specific implementation circuit of the pulse detection circuit is composed of a first triode Q1, a second triode Q2, a third diode D3, a fourth capacitor C4, a fifth capacitor C5, a first resistor R1, a second resistor R2, a third resistor R3, a fourth resistor R4, a fifth resistor R5, a sixth resistor R6 and a seventh resistor R7. Among them, the emitter of Q1 is grounded, the collector is connected to FS_EN, and the resistor R5 is the base current limiting resistor of Q1; DO1-WD is connected to one end of the capacitor C4, and is connected to the base of Q2 through the capacitor C4 and the resistor R4, the cathode of the diode D3 is connected to the other end of the capacitor C4, the anode is connected to the resistor R7, and the other end of the resistor R7 is grounded; the resistor R6 is the base shunt resistor of Q2; the emitter of Q2 is grounded, and the collector is connected to KL15_P through the resistor R1; one end of the resistor R2 is connected to the collector of Q2, and the other end is connected to one end of the resistor R3 and one end of the capacitor C5, the other end of the capacitor C5 is grounded, and the other end of the resistor R3 is connected to the base of Q1. Among them, DO1-WD is the watchdog monitoring signal input, KL15_P is the power supply output after ON power processing, FS_EN is the output of the functional safety enable signal, and GND is the negative pole of the power supply.

[0066] Specifically, Q1 (BC817-25) is a transistor that improves the output current capability and acts as an isolation transistor, Q2 (BC817-25) is a transistor that acts as a pulse detection and isolation transistor, C4 (10uF) is a pulse detection capacitor that isolates DC, R4 (10kΩ) is the base current limiting resistor of Q2, which can prevent the base of Q2 from being damaged by overcurrent, R6 (10kΩ) is the base shunt resistor of Q2, which can also prevent Q2 from being mis-conducted, R4 and R6 form a voltage divider circuit, R4, C4 and Q2-be form a charging differential circuit, whose charging current is 0.27mA and the charging time constant is 100mS, R7 (3kΩ) is the discharge resistor of C4, D3 (BAV21) is a high-current discharge circuit conduction diode of C4, D4 blocks the charging circuit composed of C4 and R7, R7, D3 and C4 form a high-current discharge differential circuit, and its discharge current is 0.9mA, the discharge time constant is 30mS, R4, R6 and C4 form a small current discharge differential circuit, its discharge current is 0.135mA, and the discharge time constant is 200mS, C5 (10uF) is a filter capacitor with a larger capacity, R1 (20kΩ) is the load resistor of Q2 and also the charging capacitor of C5, R2 (100Ω) is the discharge capacitor of C5, R1, R2 and C5 form a charging integration circuit, its maximum charging current is 0.765mA, and the discharge time constant is 200mS, C5, R2 and Q2-ce form a discharge integration circuit, its maximum charging current is 26mA, and the discharge time constant is 1mS, R3 (20kΩ) is the base limiting current resistor of Q1, which can prevent the base of Q1 from being damaged by overcurrent, R5 (10kΩ) is the base shunt resistor of Q1, which can also prevent Q1 from being mis-conducted, and R3 and R5 form a voltage divider circuit.

[0067] Among them, the pulse detection circuit outputs high impedance when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with an input frequency within a preset range, a duty cycle within a preset range, a high level amplitude within a preset range, a low level amplitude within a preset range, a rise time less than a preset time, and a fall time less than a preset time; when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with a duty cycle of 0% or a duty cycle of 100%, it outputs a low level; when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with a frequency less than the preset frequency, it outputs a square wave of a combination of low level and high impedance.

[0068] In this embodiment, under the condition that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the car is in the ON gear state, if DO1-WD input frequency is (50-200)Hz, duty cycle is 30%-70%, high level amplitude is (3-3.6)V, low level amplitude is (0-0.3)V, rise time is less than 0.1ms, and fall time is less than 0.1ms square wave, FS_EN outputs high impedance; if DO1-WD input duty cycle is 0% or 100% square wave, FS_EN outputs low level, and its voltage value is less than 0.3V; if DO1-WD input frequency is less than 10Hz square wave, FS_EN outputs a square wave of low level and high impedance combination; if the input signal of DO1-WD is different from the above situation, the output state of FS_EN is uncertain. When the car is not in the ON gear, regardless of whether DO1-WD input is high or low level, FS_EN outputs high impedance.

[0069] Specifically, the controlled reverse amplifier circuit is composed of a third transistor and its peripheral circuits for controlling output and isolation; wherein, the emitter of the third transistor is connected to the external high-side switch signal, the base of the third transistor is connected to the functional safety enable signal, and the collector of the third transistor outputs the first functional safety output signal; wherein, the first functional safety output signal of the controlled reverse amplifier circuit includes FS1.

[0070] In this embodiment, Figure 4 As shown, the specific implementation circuit of the controlled reverse amplifier circuit is composed of an eighth resistor R8, a ninth resistor R9, a tenth resistor R10, an eleventh resistor R11, a sixth capacitor C6, a fourth diode D4, a fifth diode D5 and a third triode Q3. Among them, the emitter of triode Q3 is respectively connected to one end of resistor R8, one end of capacitor C6 and one end of resistor R10; the other end of resistor R8 is connected to IDH1; the other end of capacitor C6 is grounded; the other end of resistor R10 is connected to the base of Q3; the base of Q3 is connected to FS_EN through a diode D5 and a resistor R11 connected in series; the collector of Q3 is connected to FS1 through a diode D4 and a resistor R9 connected in series.

[0071] Specifically, Q3 (BC807-25) is an isolation transistor for output control, D4 (BAS21) and D5 (BAS21) are diodes for preventing reverse current and input-output isolation, R8 (10kΩ) is the input current limiting resistor of IDH1, C6 (47nF) is the anti-static and filter capacitor of IDH1, R10 (10kΩ) is the base shunt resistor of Q3, which can prevent Q3 from being mis-turned on, R11 (10kΩ) is the current limiting resistor of Q3 base and FS_EN, R8, R10, D5 and R11 form an input voltage divider circuit, and R8 (10kΩ) and R9 (51kΩ) are the output resistors of FS1.

[0072] Specifically, the controlled reverse amplifier circuit outputs a voltage according to the vehicle ON gear supply voltage when the external high-side switch signal input is high and the functional safety enable signal input is low; and outputs high impedance when the external high-side switch signal input is low or the functional safety enable signal input is high impedance.

[0073] In this embodiment, under the conditions that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the corresponding external high-side switch is closed, IDH1 inputs a high level, and its voltage value is approximately equal to the battery voltage. When the corresponding external high-side switch is disconnected, IDH1 inputs a low level; when IDH1 inputs a high level and FS_EN inputs a low level, the no-load output voltage value of FS1 is approximately 1.5V lower than the battery voltage, and the equivalent output resistance value of FS1 is 61kΩ. When IDH1 inputs a low level or FS_EN inputs a high resistance, FS1 outputs a high resistance; FS1, FS_EN and IDH1 are isolated from each other and are anti-series electrical circuits; IDH1 has functions such as high-frequency filtering and human body electrostatic protection.

[0074] Specifically, the reverse amplifier circuit is composed of a fourth transistor and a fifth transistor and their peripheral circuits for controlling output and isolation; wherein, the emitter of the fourth transistor is connected to the ON gear power supply voltage of the car, the base of the fourth transistor is connected to the functional safety enable signal, and the collector of the fourth transistor outputs FS2 and FS3; the emitter of the fifth transistor is connected to the ON gear power supply voltage of the car, the base of the fifth transistor is connected to the functional safety enable signal, and the collector of the fifth transistor outputs FS4 and FS5; wherein, the second functional safety output signal of the reverse amplifier circuit includes FS2, FS3, FS4 and FS5, FS2 and FS4 are output to the high-side drive circuit, and FS3 and FS5 are output to the low-side drive circuit; FS2 and FS4 are redundant designs for each other, and FS3 and FS5 are redundant designs for each other.

[0075] In this embodiment, Figure 5As shown, the specific implementation circuit of the reverse amplifier circuit is composed of a twelfth resistor R12, a thirteenth resistor R13, a fourteenth resistor R14, a fifteenth resistor R15, a sixteenth resistor R16, a seventeenth resistor R17, an eighteenth resistor R18, a nineteenth resistor R19, a sixth diode D6, a seventh diode D7, an eighth diode D8, a ninth diode D9, a tenth diode D10, an eleventh diode D11, a fourth triode Q4 and a fifth triode Q5. Among them, the emitter of Q4 is connected to KL15_P, the collector is connected to FS2 through a series diode D6 and a resistor R12, and is connected to FS3 through a series diode D7 and a resistor R13; the base is connected to FS_EN through a series diode D8 and a resistor R15; the two ends of the resistor R14 are respectively connected to the emitter and base of Q4; the emitter of Q5 is connected to KL15_P, the collector is connected to FS4 through a series diode D9 and a resistor R16, and is connected to FS5 through a series diode D10 and a resistor R17; the base is connected to FS_EN through a series diode D11 and a resistor R19; the two ends of the resistor R18 are respectively connected to the emitter and base of Q5.

[0076] Specifically, Q4 (BC807-25) and Q5 (BC807-25) are isolation transistors for output control, D6 (BAS21), D7 (BAS21), D8 (BAS21), D9 (BAS21), D10 (BAS21) and D11 (BAS21) are diodes for reverse current protection and input-output isolation, R14 (10kΩ) is the base shunt resistor of Q4, which can prevent Q4 from being mis-turned on, R 15 (10kΩ) is the current limiting resistor between the base of Q4 and FS_EN, R18 (10kΩ) is the base shunt resistor of Q5, which can prevent Q5 from being mis-turned on, R19 (10kΩ) is the current limiting resistor between the base of Q5 and FS_EN, R12 (62kΩ) is the output resistor of FS2, R13 (62kΩ) is the output resistor of FS3, R16 (62kΩ) is the output resistor of FS4, and R17 (62kΩ) is the output resistor of FS5.

[0077] Specifically, the reverse amplifier circuit outputs high impedance when there is a car ON gear power supply voltage and the functional safety enable signal input is high impedance; when there is a car ON gear power supply voltage and the functional safety enable signal input is low level, it outputs a corresponding voltage according to the car ON gear power supply voltage.

[0078] In this embodiment, in order to improve the functional safety level of OPH2 and OPL8, FS2 and FS4 are designed to be redundant with each other, and FS3 and FS5 are designed to be redundant with each other; under the conditions that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the car is in the ON gear state, when FS_EN inputs a low level, the no-load output voltage value of FS2, FS3, FS4 and FS5 is about 1.5V lower than the battery voltage, and the equivalent output resistance value of FS2, FS3, FS4 and FS5 is 62kΩ. When FS_EN inputs a high impedance, FS2, FS3, FS4 and FS5 output a high impedance; when the car is not in the ON gear, regardless of whether FS_EN inputs a high or low level, FS2, FS3, FS4 and FS5 output a high impedance; FS2, FS3, FS4, FS5, FS_EN and KL15_P are isolated from each other and are mutually anti-series electrical circuits.

[0079] The high-side drive circuit includes a dual-channel high-side switch drive chip and its surrounding circuits; wherein the high-side drive output current detection signal pin of the dual-channel high-side switch drive chip is connected to the processor circuit. Specifically, Figure 6As shown, the specific implementation circuit of the high-side drive circuit is composed of a first chip U1, a twelfth diode D12, a thirteenth diode D13, a fourteenth diode D14, a fifteenth diode D15, a sixteenth diode D16, a seventeenth diode D17, an eighteenth diode D18, a nineteenth diode D19, a twentieth resistor R20, a twenty-first resistor R21, a twenty-second resistor R22, a twenty-third resistor R23, a twenty-fourth resistor R24, a twenty-fifth resistor R25, a twenty-sixth resistor R26, a twenty-seventh resistor R27, a twenty-eighth resistor R28, a twenty-ninth resistor R29, a thirtieth resistor R30, a thirty-first resistor R31, a thirty-second resistor R32, a thirty-third resistor R33, a thirty-fourth resistor R34, a seventh capacitor C7, an eighth capacitor C8, a ninth capacitor C9, a tenth capacitor C10 and an eleventh capacitor C11. Among them, the GND pin of U1 is grounded through the series-connected diode D14 and resistor R24, and the series-connected diode D15 and resistor R25 respectively; the two ends of the resistor R24 ​​are connected in parallel with a capacitor C8; FS_EN is connected to the cathode of the diode D12, and the anode of the diode D12 is connected to the IN0 pin of U1; one end of the resistor R20 is connected to the anode of the diode D12, and the other end is grounded; the DO2 / PWMO2-HSD pin is connected to the IN0 of U1 through the series-connected diodes D13 and R21; the DO4 pin is connected to the DEN pin of U1 through the series-connected diode D16 and resistor R22; one end of the capacitor C9, the diode D17, and the resistor R26 are connected to AIn1, and the other end is grounded; one end of the resistor R23 is connected to AIn1, and the other end is connected to the IS pin of U1; One end of resistor R28 is connected to the IS pin of U1, and the other end is grounded; DO5-DSEL is connected to the DSEL pin of U1 through a series diode D18 and resistor R29; DO3 / PWMO3-HSD is connected to the IN1 pin of U1 through a series diode D19 and resistor R31; FS2 is connected to the IN1 pin of U1 through a resistor R32; FS4 is connected to the IN1 pin of U1 through a resistor R33; the IN1 pin of U1 is grounded through a resistor R34; the VS pin of U1 is connected to KL_30 and grounded through a capacitor C7; the OUT0 pin of U1 is grounded through a parallel capacitor C10 and resistor R27, and connected to OPH1; the OUT1 pin of U1 is grounded through a parallel capacitor C11 and resistor R30, and connected to OPH2.

[0080] Specifically, U1 (HD70152) is a dual-channel high-side switch driver chip, D12 (SMD110) is a low-on voltage Schottky diode that prevents reverse current, D13 (BAV21) is a diode that prevents reverse current, R21 (4.7kΩ) is a current limiting resistor, R20 (100kΩ) is an input load resistor, D12, D13, R21 and R20 realize the "AND" input of FS_EN and DO2 / PWMO2-HSD, and the "AND" operation result is input to IN0 (PIn2) of U1, D16 (BAV21) and D18 (BAV21) are used to prevent reverse current. The diode that prevents reverse current, R22 (4.7kΩ) and R29 (4.7kΩ) are current limiting resistors, D19 (BAV21) is a diode that prevents reverse current, R31 (4.7kΩ) is a current limiting resistor, R32 (0Ω) and R33 (0Ω) are resistors for compatible design, R34 (200kΩ) is an input load resistor, D19, R31, R32, R33 and R34 realize the "OR" input of DO3 / PWMO3-HSD, FS2 and FS4, and the "OR" operation result is input to IN1 (PIn6) of U1, R28 (1kΩ) is OPH1 and O The output current sampling resistor of PH2, R23 (15kΩ) and R26 (10kΩ) form a voltage divider circuit for output current sampling. R23 is also a current limiting resistor for output current sampling. D17 (BZT52B3V3) is a voltage limiting diode for output current sampling, and its voltage limiting value is 3.3V. C9 (10nF) is a filter capacitor for output current sampling. D14 (BAV21) is a diode that carries the forward current of U1. R24 (3.3R) is a DC current limiting resistor for the forward current of U1. C8 (1nF) is an accelerating capacitor for the forward current of U1. D15 (BAV21) is a capacitor that carries the reverse current of U1. The diode for current flow, R25 (33R) is the current limiting resistor for the reverse current of U1, the forward current of U1 ensures the normal operation of U1, and the reverse current of U1 turns on the reverse protection circuit inside U1, C7 (47nF) is the filter capacitor of the VS (Pin0) pin of U1, and C7 is also used for electrostatic protection of the power port, R27 (47kΩ) and R30 (47kΩ) are the load resistors of OPH1 and OPH2, R27 and R30 are used for no-load diagnosis, C10 (47nF) and C11 (47nF) are the filter capacitors of OPH1 and OPH2, and C10 and C11 are also used for electrostatic protection of the load port.

[0081] Specifically, OPH1 and OPH2 are high-side driver outputs, AIn1 is the high-side driver output current detection signal, which is the detection analog output of the output current of OPH1 or OPH2, KL30 is the positive electrode of the battery power supply, and GND is the negative electrode of the battery power supply; under the conditions that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the DO2 / PWM2-HSD input amplitude is about 3.3V high level and the FS_EN input is high impedance, the OPH1 output voltage value is about the high level of the battery voltage, and when the DO2 / PWM2-HSD input is about When the FS_EN input is high impedance and the low level is 0V, the OPH1 output voltage value is about 0V low level; when the DO2 / PWM2-HSD input frequency is 0-400Hz, the amplitude is (0-0.8)V for the low level and (2.4-3.6)V for the high level, the duty cycle is 0-100% square wave and the FS_EN input is high impedance, OPH1 outputs a square wave with the same frequency and duty cycle as DO2 / PWM2-HSD, the high level of the square wave is about the battery voltage, and the low level of the square wave is about 0V; when the FS_EN input is low level, regardless of the DO2 / PWM2-HSD input frequency, the DO2 / PWM2-HSD input frequency is 0-400Hz, the amplitude is (0-0.8)V for the low level and (2.4-3.6)V for the high level, the duty cycle is 0-100%, and the FS_EN input is high impedance, OPH1 outputs a square wave with the same frequency and duty cycle as DO2 / PWM2-HSD, the high level of the square wave is about the battery voltage, and the low level of the square wave is about 0V; when the FS_EN input is low level, regardless of the DO2 / PWM2-HSD input frequency, the OPH1 output voltage value is about 0V low level ... is about 0V low level. No matter what signal D inputs, OPH1 outputs a low level voltage of about 0V; when DO3 / PWM3-HSD inputs a high level of about 3.3V and FS2 and FS4 both input high resistance, OPH2 outputs a high level voltage of about the battery voltage; when DO3 / PWM3-HSD inputs a low level of about 0V and FS2 and FS4 both input high resistance, OPH2 outputs a low level voltage of about 0V; when DO3 / PWM3-HSD input frequency is 0-400Hz, low level amplitude is (0-0.8)V, high level amplitude is (2.4-3.6)V, When the duty cycle is 0-100% and both FS3 and FS5 input high impedance, OPH2 outputs a square wave with the same frequency and duty cycle as DO3 / PWM3-HSD. The high level of the square wave is about the battery voltage, and the low level of the square wave is about 0V. When FS2 and / or FS4 input a high level lower than the battery voltage by 1.5V and the internal resistance is 62KΩ, no matter what signal DO3 / PWM3-HSD inputs, OPH2 outputs a voltage value about the high level of the battery voltage. When DO4-DEN inputs a high level of about 3.3V, if DO5-DSEL inputs an amplitude of about 3.3V high level, the voltage value output by AIn1 is proportional to the current value output by OPH1. If the input amplitude of DO5-DSEL is about 0V low level, the voltage value output by AIn1 is proportional to the current value output by OPH2. When the input amplitude of DO4-DEN is about 0V low level, the voltage value output by AIn1 is about 0V. When the battery is reversely connected, that is, KL30 is connected to the negative pole of the battery power supply, and GND is connected to the positive pole of the battery power supply, the output voltage values ​​of OPH1 and OPH2 are about the voltage of KL30. When the high-voltage side circuit injects current into the low-voltage side circuit abnormally, the abnormal voltage generated by DO2 / PWMO2-HSD, DO3 / PWMO3-HSD, DO4-DEN, DO5-DSEL and AIn1 is not higher than 3.3V. The OPH1, OPH2 and KL30 circuits have functions such as high-frequency filtering and human body static electricity protection. .

[0082] The low-side drive circuit includes an eight-channel low-side switch drive chip and its surrounding circuits; wherein the fault status information signal pin of the eight-channel low-side switch drive chip is connected to the processor circuit. Specifically, Figure 7As shown, the specific implementation circuit of the low-side drive circuit includes the second chip U2, the twentieth diode D20, the twenty-first diode D21, the twenty-second diode D22, the twenty-third diode D23, the twenty-fourth diode D24, the sixth transistor Q6, the seventh transistor Q7, the thirty-fifth resistor R35, the thirty-sixth resistor R36, the thirty-seventh resistor R37, the thirty-eighth resistor R38, the thirty-ninth resistor R39, the fortieth resistor R40, the forty-first resistor R41, the forty-second resistor R42, and the forty-third resistor R43 , the forty-fourth resistor R44, the forty-fifth resistor R45, the forty-sixth resistor R46, the forty-seventh resistor R47, the forty-eighth resistor R48, the forty-ninth resistor R49, the fiftieth resistor R50, the twelfth capacitor C12, the thirteenth capacitor C13, the fourteenth capacitor C14, the fifteenth capacitor C15, the sixteenth capacitor C16, the seventeenth capacitor C17, the eighteenth capacitor C18, the nineteenth capacitor C19, the twentieth capacitor C20, the twenty-first capacitor C21, the twenty-second capacitor C22 and the twenty-third capacitor C23.Among them, the GND pin of U2 is grounded; the VDD pin of U2 is connected to the 3V3 normal power and is grounded through the capacitor C12; the VDDA pin of U2 is connected to the 5V0 normal power and is grounded through the capacitor C13; the OUT1 pin of U2 is connected to OPL1 and is grounded through the capacitor C21; the OUT2 pin of U2 is connected to OPL2 and is grounded through the capacitor C20; the OUT3 pin of U2 is connected to OPL3 and is grounded through the capacitor C19; the OUT4 pin of U2 is connected to OPL4 and is grounded through the capacitor C18; the OUT5 pin of U2 is connected to OPL5 and is grounded through the capacitor C17; the OUT6 pin of U2 is connected to OPL 6, and grounded through capacitor C16; OUT7 pin of U2 is connected to OPL7, and grounded through capacitor C15; OUT8 pin of U2 is connected to OPL8, and grounded through capacitor C14; IN1 pin of U2 is grounded through resistor R45; IN2 pin of U2 is grounded through resistor R46; IN3 pin of U2 is connected to FS1, and grounded through parallel capacitor C22 and resistor R49; IN4 pin of U2 is connected to FS3 and FS5 through resistor R47 and resistor R48 respectively, and grounded through parallel capacitor C23 and resistor R50; CS_B pin of U2 is connected to DIn1 and SPI0 respectively through resistor R40 CS1, and connected to the collector of transistor Q7 through diode D21; U2's SI pin is connected to SPI0MOSI through resistor R41, and connected to the collector of Q7 through diode D22; U2's RST_B pin is connected to DO6-Reset through resistor R42, and connected to the collector of Q7 through diode D23; U2's SClK pin is connected to SPI0 CLK and DIn2 through resistor R43, and connected to the collector of Q7 through diode D24; U2's SO pin is connected to SPI0 through resistor R44 MISO and DIn3; the DIR pin of U2 is connected to the collector of transistor Q6 through resistor R39; the emitter of Q6 is connected to the 3V3 constant voltage; the two ends of resistor R35 are respectively connected to the emitter and base of Q6; the base of Q6 is connected to FS_EN through resistor R36 and diode D20; the emitter of Q7 is grounded; the two ends of resistor R37 are respectively connected to the emitter and base of Q7; the two ends of resistor R38 are respectively connected to the base of Q7 and the collector of Q6.

[0083] Specifically, U2 (TPS4030Q) is an eight-channel low-side switch driver chip, C12 (100nF) is a 3V3 filter capacitor, C13 (100nF) is a 5V0 filter capacitor, D20 (BAV21) is a reverse current protection diode, Q6 (BC807-25) is a reverse amplifier transistor for input detection, R36 (4.7kΩ) is the base current limiting resistor of Q6, R35 (10kΩ) is the base shunt resistor of Q6, and R35 and R36 constitute the base-emitter coupling of Q6. The base-emitter voltage divider circuit ensures that Q6 can be turned on and off reliably. Q7 (BC817-25) is an inverting amplifier transistor that controls the output. R38 (4.7kΩ) is the base-current limiting resistor of Q7. R37 (4.7kΩ) is the base-current shunt resistor of Q6. R37 and R38 form the base-emitter voltage divider circuit of Q7 to ensure that Q7 can be turned on and off reliably. R39 (4.7kΩ) is the input current limiting resistor of DIR (Pin18) of U2. D21 (SMD110) and D22 (SMD1 10), D23 (SMD110) and D24 (SMD110) are Schottky diodes that isolate each other, R40 (4.7kΩ), R41 (4.7kΩ), R43 (4.7kΩ) and R44 (4.7kΩ) are damping input resistors, R42 (4.7kΩ), R45 (4.7kΩ) and R46 (4.7kΩ) are input current limiting resistors, R47 (0Ω) and R48 (0Ω) are resistors for compatible design, and R49 (220kΩ) is F S1 is the load resistor, C22 (10nF) is the filter capacitor of FS1, R50 (200kΩ) is the load resistor of FS3 and FS5, C23 (10nF) is the filter capacitor of FS3 and FS5, C14 (100nF), C15 (100nF), C16 (100nF), C17 (100nF), C18 (100nF), C19 (100nF), C20 (100nF) and C21 (100nF) are output filter and electrostatic protection capacitors.

[0084] Specifically, DO6-Reset, SPI0_CS1, SPI0_CLK, SPI0_MOSI and SPI0_MISO are 3.3V system control signals, DIn1, DIn2 and DIn3 are fault status information signals, wherein DIn1 is the fault status output start mark input, DIn2 is the fault status output end mark input, DIn3 is the overcurrent, overtemperature and open circuit fault status input, OPL1, OPL2, ..., OPL8 are low-side drive outputs, 5V0 is the 5V positive power supply, 3V3 is the 3.3V positive power supply, and GND is the negative power supply; when the battery voltage range is (9-16)V and the operating temperature range is (-40- 85)℃, 3V3 power-on stability lags behind 5V0 power-on stability by at least 1ms, DO6-Reset reset end output high level lags behind 3V3 power-on stability by at least 2ms, SPI0_CS1 output valid low level lags behind DO6-Reset output high level by at least 20us, FS_EN output valid low level lags behind 3V3 power-on stability by at least 2ms, FS2 and / or FS4 output valid high level lags behind FS_EN output valid low level by at least 20us; when FS_EN input is high impedance, OPL1, OPL2, ..., OPL8 outputs are controlled by DO6-Reset, SPI0_CS1, SPI0_CL K, SPI0_MOSI, SPI0_MISO signals, when an overcurrent fault occurs and lasts for 1ms, or when an open circuit fault occurs and lasts for 300us, or when an overtemperature fault occurs and lasts for 30us, the corresponding fault information is set to be valid, otherwise the fault information is set to be invalid. If an SPI communication fault occurs, during the SPI working cycle, from the falling edge of DIn1 to the rising edge of DIn2, DIn3 outputs a high level, otherwise DIn3 outputs a low level, where the voltage amplitude of the high level is (3.0-3.6)V, the voltage amplitude of the low level is (0-0.8)V, and the edge time of the falling edge and the rising edge is no more than 10us; when FS When the _EN input is low level, no matter whether the DO6-Reset, SPI0_CS1, SPI0_CLK, SPI0_MOSI, SPI0_MISO inputs are high or low level, OPL1, OPL2, ..., OPL6 all output high impedance. When the no-load voltage value of FS3 and / or FS5 inputs is about 1.5V lower than the battery voltage and the input resistance value is a high level of 63kΩ, OPL5 and / or OPL6 all output a low level not greater than 0.3V. When the FS3 and / or FS5 inputs high impedance, OPL5 and / or OPL6 all output high impedance. OPL1, OPL2, ..., OPL8 have functions such as high-frequency filtering and human body electrostatic protection.

[0085] In a preferred embodiment of the present invention, the processor circuit is specifically a SOC or MCU circuit, which is specifically implemented using the general-purpose processor E3640, wherein 3V3 is the positive 3.3V power supply of the general-purpose processor circuit, GND is the negative power supply, DO1_WD, DO2 / PWMO2-HSD, DO3 / PWMO3-HSD, DO4-DEN, DO5-DSEL and DO6-Reset are digital outputs, wherein DO2 / PWMO2-HSD and DO3 / PWMO3-HSD can be multiplexed as PWM outputs, DIn1, DIn2 and DIn3 are digital inputs, AIn1 and FS_EN are analog inputs, SPI0_CS1, SPI0_CLK, SPI0_MOSI and SPI0_MISO are SPI bus signals, and CAN0-Tx and CAN0-Rx are CAN communication signals.

[0086] In another embodiment of the present invention, MOSFETs may be used to replace transistors in each circuit, and the chip U1 and the chip U2 may be replaced by chips with the same or similar functions.

[0087] In addition, an embodiment of the present invention further provides a control method for a functional safety circuit of an automotive electronic controller, which is used to control the functional safety circuit of the automotive electronic controller. The method includes:

[0088] Output watchdog monitoring signal, control input signal and system control signal;

[0089] When the car is in the ON gear, the functional safety enable signal of the corresponding state is output according to the watchdog detection signal;

[0090] Outputting a first functional safety output signal according to an external high-side switch signal and a functional safety enable signal;

[0091] Outputting a second functional safety output signal according to the functional safety enable signal;

[0092] Outputting a high-side driver output signal according to a control input signal, a functional safety enable signal, and a second functional safety output signal;

[0093] A low-side driver output signal is output according to the system control signal, the functional safety enable signal, and the first functional safety output signal.

[0094] The functional safety circuit and control method for the automotive electronic controller provided by the embodiment of the present invention outputs the corresponding functional safety enable signal according to the working state of the automobile through the pulse detection circuit; when the automobile is in the ON gear, the functional safety enable signal is output according to the watchdog monitoring signal, and the functional safety circuit is activated in time when an abnormality occurs. When the automobile is not in the ON gear, the functional safety enable signal outputs high impedance, making the functional safety invalid and prohibiting the functional safety circuit, which can prevent the functional safety circuit from being triggered by mistake and reduce the dark current of the automobile; and the embodiment of the present invention adopts discrete devices to design the pulse detection circuit, which has stable and reliable performance and flexible performance parameter configuration. By changing the resistance and capacitance parameters in the circuit, pulses of different frequencies and duty cycles can be detected to meet different detection requirements. And the circuit also basically adopts discrete devices, which can reduce hardware costs and has good applicability and versatility.

[0095] Furthermore, the present invention uses a processor circuit to monitor the status information of the high-side drive output signal and the low-side drive output signal of the circuit in real time and determine whether there is an abnormality. When there is an abnormality, abnormal alarm information is promptly sent through the CAN network to give a timely alarm, thereby ensuring the safety of personnel and vehicles and being reliable.

[0096] Furthermore, the circuit of the reverse amplifier circuit in the present invention adopts a dual redundant design, so that the functional safety level of the output of the high-side drive circuit and the output of the low-side drive circuit reaches Asil-C. When the functional safety is activated, all drive circuit outputs output a certain state to ensure that their loads work in the expected state. In abnormal situations such as software runaway, microcontroller hardware failure, microcontroller power failure, etc., the functional safety circuit can be automatically turned on, ensuring the safety of the driver and the car and increasing the circuit safety.

[0097] Example 2

[0098] Based on Example 1, the present invention provides a functional safety circuit for an automotive electronic controller, such as Figure 8 As shown, where:

[0099] The KL15_P pin of the power supply filtering and protection circuit is connected to the KL15_P pin of the pulse detection circuit and the KL15_P pin of the reverse amplifier circuit;

[0100] The FS_EN pin of the pulse detection circuit is connected to the FS_EN pins of the controlled reverse amplifier circuit, the reverse amplifier circuit, the processor, the high-side drive circuit, and the low-side drive circuit;

[0101] The FS1 pin of the controlled reverse amplifier circuit is connected to the FS1 pin of the low-side driver circuit; the IDH1 pin is connected to the external high-side switch;

[0102] The FS2 pin of the reverse amplifier circuit is connected to the FS2 pin of the high-side drive circuit; the FS3 pin is connected to the FS3 pin of the low-side drive circuit; the FS4 pin is connected to the FS4 pin of the high-side drive circuit; and the FS5 pin is connected to the FS5 pin of the low-side drive circuit.

[0103] The DO2 / PWMO2-HSD pin, DO3 / PWMO3-HSD pin, DO4-DEN pin, and DO5-DSEL pin of the high-side driver circuit are respectively connected to the DO2 / PWMO2-HSD pin, DO3 / PWMO3-HSD pin, DO4-DEN pin, and DO5-DSEL pin of the processor, and the AIN1 pin is connected to the AIN1 pin of the processor circuit;

[0104] The SPI0_MISO pin, DIn1 pin, DIn2 pin and DIn3 pin of the low-side driving circuit are connected to the SPI0_MISO pin, DIn1 pin, DIn2 pin and DIn3 pin of the processor circuit;

[0105] The DO6-Reset pin, SPI0_CS1 pin, SPI0_CLK pin and SPI0_MOSI pin of the processor circuit are connected to the DO6-Reset pin, SPI0_CS1 pin, SPI0_CLK pin and SPI0_MOSI pin of the low-side drive circuit; the DO1-WD pin is connected to the DO1-WD pin of the pulse detection circuit;

[0106] The GND pins of the power supply filtering and protection circuit, the pulse detection circuit, the controlled reverse amplifier circuit, the reverse amplifier circuit, the high-side drive circuit, the low-side drive circuit and the processor circuit are connected to the power ground GND;

[0107] The 3V3 pins of the low-side driver circuit and the processor circuit are connected to a 3.3V normal power supply; the 5V0 pin of the low-side driver circuit is connected to a 5V normal power supply.

[0108] Example 3

[0109] The embodiment of the present invention provides a functional safety circuit control method for an automotive electronic controller based on a functional safety circuit for an automotive electronic controller in Embodiment 1. The method is specifically as follows:

[0110] Connect the car to the battery and put it in the ON position. 5V0 is powered normally. After a delay of 2ms, 3V3 is powered normally again.

[0111] After a delay of 5ms, the DO1-WD of the processor circuit outputs a square wave with a frequency of 100Hz, a duty cycle of 50% and an amplitude of 3.3V, and inputs the pulse detection circuit. At this time, FS_EN outputs high impedance and inputs the controlled reverse amplifier circuit and the reverse amplifier circuit. At this time, FS1, FS2, FS3, FS4 and FS5 output high impedance.

[0112] After a delay of 5ms, the processor circuit controls the output of OPH1 and OPH2 of the high-side drive circuit through DO2 / PWMO2-HSD and DO3 / PWMO3-HSD, and calculates the output current or working status of OPH1 and OPH2 by setting the digital output values ​​of DO4-DEN and DO5-DSEL and reading the analog input value of AIn1; when the output current is greater than the overcurrent threshold, for loads with functional safety requirements that need to maintain output, OPH1 and OPH2 continue to output, and for loads with functional safety requirements, the output is delayed to be turned off after entering the safe state, and the output can be turned off for loads without functional safety requirements. When short circuit and overheating protection occur, OPH1 and OPH2 outputs are turned off, and AIn1 outputs the corresponding fault voltage value. When overcurrent, short circuit and thermal protection abnormalities occur, the abnormality handling process is entered, and the processor circuit can send the output status of OPH1 and OPH2 and these abnormal information to other controllers through the CAN bus.

[0113] After a delay of 5ms, DO6-Reset of the processor circuit is set to a high level, the reset is completed and the processor enters a normal working state, and the output signals of OPL1, OPL2, ..., OPL8 of the low-side drive circuit are controlled and the status information of OPL1, OPL2, ..., OPL8 is read through SPI0_CS1, SPI0_CLK, SPI0_MOSI and SPI0_MISO; when overcurrent and overtemperature anomalies occur, the corresponding outputs of OPL1, OPL2, ..., OPL8 are turned off, DIn1 is set as the falling edge interrupt input of the processor circuit, and the digital input values ​​of DIn2 and DIn3 are read in the interrupt processing program of DIn1. If DIn2 is a low level and DIn3 is a high level, the communication error of the low-side drive circuit with functional safety is set to be valid, otherwise the communication error of the low-side drive circuit with functional safety is set to be invalid. When overcurrent, overtemperature, open circuit and communication anomalies occur, the exception handling process is entered, and the processor circuit can send the output status of OPL1, OPL2, ..., OPL8 and these exception information to other controllers through the CAN bus.

[0114] When an abnormality occurs in the circuit, such as software abnormality or hardware failure of the processor circuit, OPH1 of the high-side driver circuit outputs a low level, OPH2 outputs a high level, and OPL1, OPL2, ..., OPL6 of the low-side driver circuit output invalid high impedance. When IDH1 inputs a high level, OPL7 outputs a valid low level. When IDH1 inputs a low level or high impedance, OPL7 outputs an invalid high impedance, and OPL8 outputs a low level. If the 3V3 and 5V0 power supplies fail, OPH1 outputs a low level, OPH2 outputs a high level, and OPL1, OPL2, ..., OPL8 output invalid high impedance.

[0115] It should be pointed out that, according to the needs of implementation, the various steps / components described in this application can be split into more steps / components, and two or more steps / components or partial operations of steps / components can be combined into new steps / components to achieve the purpose of the present invention.

[0116] The order of execution of each step in the above embodiment does not mean the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0117] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should fall within the scope of protection of the appended claims of the present invention.

Claims

1. A functional safety circuit for an automotive electronic controller, characterized in that: include: Processor circuit, pulse detection circuit, controlled reverse amplifier circuit, reverse amplifier circuit, high-side driver circuit, low-side driver circuit; Wherein, the processor circuit is used to output a watchdog monitoring signal, a control input signal and a system control signal; A pulse detection circuit is connected to the processor circuit and is used to output a functional safety enable signal of a corresponding state according to a watchdog detection signal when the vehicle is in the ON gear; A controlled reverse amplifier circuit is connected to the pulse detection circuit and is used to output a first functional safety output signal according to an external high-side switch signal and a functional safety enable signal; a reverse amplification circuit, connected to the processor circuit and the pulse detection circuit respectively, and configured to output a second functional safety output signal according to the functional safety enable signal; A high-side driving circuit is connected to the processor circuit, the pulse detection circuit and the reverse amplification circuit respectively, and is used to output a high-side driving output signal according to the control input signal, the functional safety enable signal and the second functional safety output signal; The low-side driving circuit is respectively connected to the processor circuit, the pulse detection circuit and the controlled reverse amplification circuit, and is used to output a low-side driving output signal according to the system control signal, the functional safety enable signal and the first functional safety output signal.

2. A functional safety circuit for an automotive electronic controller according to claim 1, characterized in that: It also includes a power supply filtering and protection circuit, which is used for inputting and processing the automobile ON gear power supply voltage, and outputting the processed automobile ON gear power supply voltage to provide the power supply voltage.

3. A functional safety circuit for an automotive electronic controller according to claim 1, characterized in that: The processor circuit is also used to obtain the high-side drive output current detection signal of the high-side drive circuit and the fault status information signal of the low-side drive circuit. When the high-side drive output and the low-side drive output status are abnormal, the status information and abnormal information of the high-side drive output and the low-side drive output are sent to other controllers through the bus.

4. A functional safety circuit for an automotive electronic controller according to claim 2, characterized in that: The pulse detection circuit outputs high impedance when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with an input frequency within a preset range, a duty cycle within a preset range, a high level amplitude within a preset range, a low level amplitude within a preset range, a rise time less than a preset time, and a fall time less than a preset time; outputs a low level when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with a duty cycle of 0% or a duty cycle of 100%; outputs a square wave of a combination of a low level and high impedance when there is a car ON gear power supply voltage and the watchdog monitoring signal is a square wave with a frequency less than a preset frequency.

5. A functional safety circuit for an automotive electronic controller according to claim 4, characterized in that: The pulse detection circuit is composed of a second transistor for pulse detection and isolation, a first transistor for improving output current capability and isolation, and its peripheral circuits; wherein, The base of the second transistor is connected to the watchdog monitoring signal, the collector of the second transistor is connected to the ON gear power supply voltage of the car, and the emitter of the second transistor is grounded; The base of the first triode is connected to the collector of the second triode through a resistor, the collector of the first triode outputs a functional safety enable signal, and the emitter of the first triode is grounded.

6. A functional safety circuit for an automotive electronic controller according to claim 2, characterized in that: The controlled reverse amplifier circuit outputs a voltage according to the vehicle ON gear supply voltage when the external high-side switch signal input is high and the functional safety enable signal input is low; and outputs high impedance when the external high-side switch signal input is low or the functional safety enable signal input is high impedance.

7. A functional safety circuit for an automotive electronic controller according to claim 6, characterized in that: The controlled reverse amplifier circuit is composed of a third transistor and its peripheral circuits for controlling output and isolation; The emitter of the third transistor is connected to the external high-side switch signal, the base of the third transistor is connected to the functional safety enable signal, and the collector of the third transistor outputs the first functional safety output signal.

8. A functional safety circuit for an automotive electronic controller according to claim 2, characterized in that: The reverse amplifier circuit outputs high impedance when there is a car ON gear power supply voltage and the functional safety enable signal input is high impedance; when there is a car ON gear power supply voltage and the functional safety enable signal input is low level, the corresponding voltage is output according to the car ON gear power supply voltage.

9. A functional safety circuit for an automotive electronic controller according to claim 8, characterized in that: The reverse amplifier circuit is composed of the fourth transistor and the fifth transistor for output control and isolation and their peripheral circuits; among them, The emitter of the fourth transistor is connected to the ON gear power supply voltage of the car, the base of the fourth transistor is connected to the functional safety enable signal, and the collector of the fourth transistor outputs FS2 and FS3; The emitter of the fifth transistor is connected to the ON gear power supply voltage of the car, the base of the fifth transistor is connected to the functional safety enable signal, and the collector of the fifth transistor outputs FS4 and FS5; Among them, the second functional safety output signal of the reverse amplifier circuit includes FS2, FS3, FS4 and FS5, FS2 and FS4 are output to the high-side drive circuit, FS3 and FS5 are output to the low-side drive circuit; FS2 and FS4 are redundantly designed, and FS3 and FS5 are redundantly designed.

10. A functional safety circuit for an automotive electronic controller according to claim 3, characterized in that: The high-side drive circuit comprises a dual-channel high-side switch drive chip and its peripheral circuits; wherein the high-side drive output current detection signal pin of the dual-channel high-side switch drive chip is connected to the processor circuit.

11. A functional safety circuit for an automotive electronic controller according to claim 3, characterized in that: The low-side driving circuit comprises an eight-channel low-side switch driving chip and its peripheral circuits; wherein the fault state information signal pin of the eight-channel low-side switch driving chip is connected to the processor circuit.

12. A control method for a functional safety circuit of an automotive electronic controller, characterized in that: The method comprises: Output watchdog monitoring signal, control input signal and system control signal; When the car is in the ON gear, the functional safety enable signal of the corresponding state is output according to the watchdog detection signal; Outputting a first functional safety output signal according to an external high-side switch signal and a functional safety enable signal; Outputting a second functional safety output signal according to the functional safety enable signal; Outputting a high-side driver output signal according to a control input signal, a functional safety enable signal, and a second functional safety output signal; A low-side driver output signal is output according to the system control signal, the functional safety enable signal, and the first functional safety output signal.

Images