Functional safety circuit for an automotive electronic controller and control method

Abstract

The application discloses a functional safety circuit and a control method for an automobile electronic controller, and belongs to the field of automobile electronic controller technology.The functional safety circuit comprises a power supply filtering and protection circuit, a processor circuit, a pulse detection circuit, a controlled reverse amplification circuit, a reverse amplification circuit, a high-side drive circuit and a low-side drive circuit.According to the working state of the automobile, the pulse detection circuit outputs a functional safety enable signal.When the automobile is in the ON gear, the functional safety enable signal is output according to a watchdog monitoring signal, the functional safety circuit can be activated in time, and when the automobile is not in the ON gear, the functional safety enable signal outputs a high resistance, the functional safety is invalid, and the functional safety circuit is prohibited, so that the functional safety circuit can be prevented from being triggered by mistake, and the dark current of the automobile can be reduced.In the functional safety activated state, the circuit load can work in an expected state, and the circuit basically adopts discrete devices, so that the hardware cost can be reduced, the device parameters can be changed according to requirements, and the application has good applicability and universality.

Description

Technical Field

[0001] This invention relates to the field of automotive control function safety technology, and in particular to a functional safety circuit and control method for automotive electronic controllers. Background Technology

[0002] With the rapid development of intelligent and electric vehicles, users have increasingly stringent requirements for vehicle safety performance. As well as the unremitting efforts of automakers to improve vehicle functional safety, the application of functional safety in vehicle controllers such as EPS, ESP, ABS, and EPB has become relatively mature, and its application in body domain controllers such as BCM, VIU, and ZCU is gradually being improved.

[0003] Based on the two road vehicle functional safety standards, ISO26262 and GB / T34590-2017, and the actual safety performance requirements of vehicles, the functional safety level of the brake sensor power control, charging power control, low beam headlight control, brake light control, position light control, side marker light control, and windshield wiper control of the body domain controller is determined to be Asil B. Class B functional safety is usually achieved by detection and redundant control.

[0004] In existing technologies, two controllers are used to control electrical equipment with a safety level of B or higher. One controller acts as the main controller and monitors, while the other acts as a monitor and auxiliary controller. However, to achieve a higher functional safety level, the control software design of multiple controllers is more complex, requiring twice the amount of hardware circuitry, resulting in higher implementation costs. Existing technologies also use two MCUs within a single controller: one as the main controller and monitors, and the other as a monitor and auxiliary controller. However, the control software design and communication protocol between the two MCUs are complex, requiring two MCU systems and two MCU power supply systems, leading to higher implementation costs. Existing technologies also utilize an MCU as the main controller and a dedicated smart chip for status monitoring. When an anomaly is detected, electrical equipment with a safety level of B or higher is forcibly turned on or off to ensure a safe state. However, using a dedicated smart chip results in high hardware costs, poor versatility, limited design flexibility, and a tendency to cause battery depletion, increasing complaints from car owners. Summary of the Invention

[0005] This invention addresses the problems of complex control circuit design, high implementation cost, and poor versatility in existing technologies for automotive electronic controllers by designing a functional safety circuit and control method for automotive electronic controllers.

[0006] The technical solution adopted in this invention is:

[0007] This invention provides a functional safety circuit for an automotive electronic controller, comprising: a processor circuit, a pulse detection circuit, a controlled inverting amplifier circuit, an inverting amplifier circuit, a high-side drive circuit, and a low-side drive circuit.

[0008] The processor circuit is used to output watchdog monitoring signals, control input signals, and system control signals.

[0009] The pulse detection circuit, connected to the processor circuit, is used to output a functional safety enable signal corresponding to the state based on the watchdog detection signal when the car is in the ON position.

[0010] A controlled inverting amplifier circuit, connected to a pulse detection circuit, is used to output a first functional safety output signal based on an external high-side switch signal and a functional safety enable signal.

[0011] An inverting amplifier circuit is connected to the processor circuit and the pulse detection circuit respectively, and is used to output a second functional safety output signal according to the functional safety enable signal;

[0012] The high-side drive circuit is connected to the processor circuit, pulse detection circuit and inverting amplifier circuit respectively, and is used to output the high-side drive output signal according to the control input signal, the functional safety enable signal and the second functional safety output signal.

[0013] The low-side drive circuit is connected to the processor circuit, the pulse detection circuit, and the controlled inverting amplifier circuit, respectively, and is used to output the low-side drive output signal according to the system control signal, the functional safety enable signal, and the first functional safety output signal.

[0014] According to the above scheme, it also includes a power filtering and protection circuit, which is used to input the vehicle ON position power supply voltage, process it, and output the processed vehicle ON position power supply voltage to provide power supply voltage.

[0015] According to the above scheme, the processor circuit is also used to obtain the high-side drive output current detection signal of the high-side drive circuit and the fault status information signal of the low-side drive circuit. When the high-side drive output and low-side drive output status become abnormal, the processor circuit sends the status information and abnormal information of the high-side drive output and low-side drive output to other controllers through the bus.

[0016] According to the above scheme, the pulse detection circuit outputs a high impedance when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with an input frequency within a preset range, a duty cycle within a preset range, a high level amplitude within a preset range, a low level amplitude within a preset range, a rise time less than a preset time, and a fall time less than a preset time; outputs a low level when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with a duty cycle of 0% or 100%; and outputs a square wave with a combination of low level and high impedance when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with a frequency less than a preset frequency.

[0017] According to the above scheme, the pulse detection circuit consists of a second transistor for pulse detection and isolation, a first transistor for improving output current capability and isolation, and its peripheral circuitry; wherein...

[0018] The base of the second transistor is connected to the watchdog monitoring signal, the collector of the second transistor is connected to the power supply voltage of the car's ON position, and the emitter of the second transistor is grounded.

[0019] The base of the first transistor is connected to the collector of the second transistor through a resistor. The collector of the first transistor outputs a functional safety enable signal, and the emitter of the first transistor is grounded.

[0020] According to the above scheme, the controlled inverting amplifier circuit outputs voltage based on the automotive ON position power supply voltage when the external high-side switch signal input is high and the functional safety enable signal input is low; and outputs high impedance when the external high-side switch signal input is low or the functional safety enable signal input is high impedance.

[0021] According to the above scheme, the controlled inverting amplifier circuit consists of a third transistor for controlling the output and isolation, and its peripheral circuitry; wherein,

[0022] The emitter of the third transistor is connected to an external high-side switch signal, the base of the third transistor is connected to a functional safety enable signal, and the collector of the third transistor outputs the first functional safety output signal.

[0023] According to the above scheme, the inverting amplifier circuit outputs a high impedance when there is a car ON power supply voltage and the functional safety enable signal input is high impedance; when there is a car ON power supply voltage and the functional safety enable signal input is low level, it outputs the corresponding voltage according to the car ON power supply voltage.

[0024] According to the above scheme, the inverting amplifier circuit consists of a fourth transistor and a fifth transistor for output control and isolation, along with their peripheral circuitry; wherein,

[0025] The emitter of the fourth transistor is connected to the power supply voltage of the car's ON position, the base of the fourth transistor is connected to the functional safety enable signal, and the collector of the fourth transistor outputs FS2 and FS3.

[0026] The emitter of the fifth transistor is connected to the power supply voltage of the car's ON position, the base of the fifth transistor is connected to the functional safety enable signal, and the collector of the fifth transistor outputs FS4 and FS5.

[0027] The second functional safety output signals of the inverting amplifier circuit include FS2, FS3, FS4 and FS5. FS2 and FS4 are output to the high-side drive circuit, and FS3 and FS5 are output to the low-side drive circuit. FS2 and FS4 are redundantly designed for each other, and FS3 and FS5 are redundantly designed for each other.

[0028] According to the above scheme, the high-side drive circuit includes a dual-channel high-side switch driver chip and its surrounding circuitry; wherein the high-side drive output current detection signal pin of the dual-channel high-side switch driver chip is connected to the processor circuit.

[0029] According to the above scheme, the low-side drive circuit includes an eight-channel low-side switch driver chip and its surrounding circuitry; wherein the fault status information signal pin of the eight-channel low-side switch driver chip is connected to the processor circuit.

[0030] The present invention also provides a control method for a functional safety circuit of an automotive electronic controller, the method comprising:

[0031] Output watchdog monitoring signals, control input signals, and system control signals;

[0032] When the car is in the ON position, the corresponding functional safety enable signal is output based on the watchdog detection signal.

[0033] The first functional safety output signal is output based on the external high-side switch signal and the functional safety enable signal;

[0034] A second functional safety output signal is output based on the functional safety enable signal;

[0035] The high-side drive output signal is output based on the control input signal, the functional safety enable signal, and the second functional safety output signal.

[0036] The system outputs a low-side drive output signal based on the system control signal, the functional safety enable signal, and the first functional safety output signal.

[0037] The beneficial effects of this invention are:

[0038] This invention uses a pulse detection circuit to output a corresponding functional safety enable signal based on the vehicle's operating state. When the vehicle is in the ON position, the functional safety enable signal is output based on the watchdog monitoring signal, which can promptly activate the functional safety circuit. When the vehicle is not in the ON position, the functional safety enable signal outputs a high impedance, disabling the functional safety circuit and preventing it from being falsely triggered. This not only prevents the functional safety circuit from being falsely triggered but also reduces the vehicle's dark current. In the functional safety activated state, it ensures that the circuit load operates in the expected state. Furthermore, the circuit primarily uses discrete components, which reduces hardware costs and allows for changes in component parameters as needed, exhibiting good applicability and versatility.

[0039] Furthermore, this invention uses a processor circuit to monitor the status information of the high-side drive output signal and the low-side drive output signal of the circuit in real time and determine whether there is any abnormality. When an abnormality is detected, an abnormality alarm message is sent through the bus in a timely manner to ensure the safety of personnel and vehicles, thus demonstrating reliability.

[0040] Furthermore, the inverting amplifier circuit in this invention adopts a dual redundancy design, enabling the functional safety level of the output of the high-side drive circuit and the output of the low-side drive circuit to reach Asil-C, thereby increasing circuit safety. Attached Figure Description

[0041] Figure 1 This is a circuit diagram of a functional safety circuit for an automotive electronic controller according to an embodiment of the present invention;

[0042] Figure 2 This is a circuit diagram of a power filtering and protection circuit according to an embodiment of the present invention;

[0043] Figure 3 This is a circuit diagram of a pulse detection circuit according to an embodiment of the present invention;

[0044] Figure 4 This is a circuit diagram of a controlled inverting amplifier circuit according to an embodiment of the present invention;

[0045] Figure 5 This is a circuit diagram of an inverting amplifier circuit according to an embodiment of the present invention;

[0046] Figure 6 This is a circuit schematic diagram of a high-side driving circuit according to an embodiment of the present invention;

[0047] Figure 7 This is a circuit schematic diagram of a low-side driving circuit according to an embodiment of the present invention;

[0048] Figure 8 This is a schematic diagram of a functional safety circuit according to another embodiment of the present invention.

[0049] In the diagram: 1-Power supply filtering and protection circuit; 2-Pulse detection circuit; 3-Controlled inverting amplifier circuit; 4-Inverting amplifier circuit; 5-High-side drive circuit; 6-Low-side drive circuit; 7-Processor circuit. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0051] Example 1

[0052] To address the problems of complex design, high implementation cost, and poor versatility of control circuits used in existing automotive electronic controllers, embodiments of the present invention provide a functional safety circuit for automotive electronic controllers, such as... Figure 1 As shown, the circuit includes: a processor circuit, a pulse detection circuit, a controlled inverting amplifier circuit, an inverting amplifier circuit, a high-side drive circuit, and a low-side drive circuit.

[0053] The processor circuit is used to output watchdog monitoring signal DO1-WD, control input signal and system control signal; in this embodiment, the control input signal includes DO2 / PWMO2-HSD, DO3 / PWMO3-HSD, DO4-DEN, DO5-DSEL; the system control signal includes DO6-Reset, SPI0_CS1, SPI0_CLK, SPI0_MOSI and SPI0_MISO.

[0054] The pulse detection circuit, connected to the processor circuit, is used to output the corresponding functional safety enable signal FS_EN based on the watchdog detection signal DO1-WD when the car is in the ON position.

[0055] A controlled inverting amplifier circuit, connected to a pulse detection circuit, is used to output a first functional safety output signal based on the external high-side switch signal IDH1 and the functional safety enable signal FS_EN.

[0056] An inverting amplifier circuit is connected to the processor circuit and the pulse detection circuit respectively, and is used to output a second functional safety output signal according to the functional safety enable signal FS_EN.

[0057] The high-side drive circuit is connected to the processor circuit, pulse detection circuit and inverting amplifier circuit respectively, and is used to output the high-side drive output signal according to the control input signal, the functional safety enable signal FS_EN and the second functional safety output signal.

[0058] The low-side drive circuit is connected to the processor circuit, the pulse detection circuit, and the controlled inverting amplifier circuit, respectively, and is used to output the low-side drive output signal according to the system control signal, the functional safety enable signal FS_EN, and the first functional safety output signal.

[0059] In addition, the functional safety circuit of this embodiment of the invention also includes a power supply filtering and protection circuit, which is used to connect to the battery, input the vehicle ON position power supply voltage KL15 and process it, and output the processed power supply voltage KL15_P to provide the power supply voltage.

[0060] The processor circuit is also used to acquire the high-side drive output current detection signal of the high-side drive circuit and the fault status information signal of the low-side drive circuit, and to determine whether the high-side drive output and low-side drive output status are abnormal. When an abnormality occurs, the status information and abnormal information of the high-side drive output and low-side drive output are sent to other controllers through the bus. In this embodiment, the status information and abnormal information of the high-side drive output and low-side drive output are sent through the CAN network.

[0061] Among them, such as Figure 2 As shown, the specific implementation circuit of the power supply filtering and protection circuit is composed of... Figure 2 The circuit consists of a first capacitor C1, a second capacitor C2, a third capacitor C3, a first diode D1, and a second diode D2. Diode D1, capacitors C1, C2, and C3, and capacitor C2 and diode D2 form two parallel circuits. Specifically, the anode of D1 is connected to KL15; one end of capacitor C1 is connected to KL15 and connected in series with capacitor C3, with the other end of capacitor C3 grounded; one end of capacitor C2 is connected to the cathode of D1 and the other end is grounded; D2 is connected in parallel across capacitor C2, with one end connected to KL15_P and the other end grounded.

[0062] Specifically, KL15 is the input voltage for the car's ON position, with a specified voltage range of (9-16)V and a rated voltage of 13.5V. KL15_P is the processed supply voltage for the car's ON position, with a specified voltage range of (8.3-15.3)V and a rated voltage of 12.8V. Under the conditions that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the car is in the ON position, the voltage value of KL15 is the battery voltage, and KL15_P is about 0.7V lower than KL15. The maximum output current of KL15_P is 200mA; GND is the negative terminal of the power supply.

[0063] Among them, D1 (BAV21) is a diode for input reverse connection protection and input crosstalk protection, with a current carrying capacity of 200mA; D2 (SMBJ28C) is a TVS for surge pulse protection; C1 (100nF) and C3 (100nF) are capacitors for electrostatic discharge protection and high-frequency filtering. The vertical arrangement of C1 and C3 can greatly reduce the circuit failure rate of KL15; C2 (1uF) is a capacitor for low-frequency filtering and energy storage; C1, C2 and C3 also play a role in electromagnetic interference protection and electromagnetic disturbance suppression. Therefore, the power supply filtering and protection circuit has functions such as filtering, human body electrostatic discharge protection, automotive power pulse protection, electromagnetic interference protection and electromagnetic disturbance suppression.

[0064] Specifically, the pulse detection circuit consists of a second transistor for pulse detection and isolation, a first transistor for improving output current capability and isolation, and its peripheral circuitry. The base of the second transistor is connected to the watchdog monitoring signal, the collector of the second transistor is connected to the power supply voltage of the car's ON position, and the emitter of the second transistor is grounded. The base of the first transistor and the collector of the second transistor are connected through a resistor. The collector of the first transistor outputs a functional safety enable signal, and the emitter of the first transistor is grounded.

[0065] In this embodiment, as Figure 3 As shown, the pulse detection circuit consists of a first transistor Q1, a second transistor Q2, a third diode D3, a fourth capacitor C4, a fifth capacitor C5, a first resistor R1, a second resistor R2, a third resistor R3, a fourth resistor R4, a fifth resistor R5, a sixth resistor R6, and a seventh resistor R7. Specifically, the emitter of Q1 is grounded, and its collector is connected to FS_EN. Resistor R5 is the base current-limiting resistor for Q1. DO1-WD is connected to one end of capacitor C4 and then to the base of Q2 through capacitor C4 and resistor R4. The cathode of diode D3 is connected to the other end of capacitor C4, and its anode is connected to resistor R7, the other end of which is grounded. Resistor R6 is the base shunt resistor for Q2. The emitter of Q2 is grounded, and its collector is connected to KL15_P through resistor R1. One end of resistor R2 is connected to the collector of Q2, and the other end is connected to one end of resistor R3 and one end of capacitor C5. The other end of capacitor C5 is grounded, and the other end of resistor R3 is connected to the base of Q1. DO1-WD is the watchdog monitoring signal input, KL15_P is the power supply output after ON power processing, FS_EN is the functional safety enable signal output, and GND is the negative power supply terminal.

[0066] Specifically, Q1 (BC817-25) is a transistor that improves the output current capability and provides isolation; Q2 (BC817-25) is a transistor that provides pulse detection and isolation; C4 (10uF) is a pulse detection capacitor that isolates DC; R4 (10kΩ) is the base current-limiting resistor for Q2, which prevents damage to the base of Q2 due to overcurrent; R6 (10kΩ) is the base shunt resistor for Q2, which also prevents Q2 from being mistakenly turned on; R4 and R6 form a voltage divider circuit; R4, C4, and Q2-be form a charging differentiator circuit with a charging current of 0.27mA and a charging time constant of 100ms; R7 (3kΩ) is the discharge resistor for C4; D3 (BAV21) is the diode that conducts the high-current discharge circuit of C4; D4 blocks the charging circuit formed by C4 and R7; R7, D3, and C4 form a high-current discharge differentiator circuit with a discharge current of... 0.9mA, discharge time constant is 30ms. R4, R6 and C4 form a small current discharge differentiating circuit with a discharge current of 0.135mA and a discharge time constant of 200ms. C5 (10uF) is a large-capacity filter capacitor. R1 (20kΩ) is the load resistor of Q2 and also the charging capacitor of C5. R2 (100Ω) is the discharge capacitor of C5. R1, R2 and C5 form a charging integrating circuit with a maximum charging current of 0.765mA and a discharge time constant of 200ms. C5, R2 and Q2-ce form a discharge integrating circuit with a maximum charging current of 26mA and a discharge time constant of 1ms. R3 (20kΩ) is the base current limiting resistor of Q1, which can prevent the base of Q1 from being damaged by overcurrent. R5 (10kΩ) is the base shunt resistor of Q1, which can also prevent Q1 from being mis-conducted. R3 and R5 form a voltage divider circuit.

[0067] The pulse detection circuit enables the output to be high impedance when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with an input frequency within a preset range, a duty cycle within a preset range, a high-level amplitude within a preset range, a low-level amplitude within a preset range, a rise time less than a preset time, and a fall time less than a preset time; when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with a duty cycle of 0% or 100%, the output to be low level; and when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with a frequency less than a preset frequency, the output to be a square wave with a combination of low level and high impedance.

[0068] In this embodiment, under the conditions of a battery voltage range of (9-16)V and an operating temperature range of (-40-85)℃, when the car is in the ON position, if the DO1-WD input frequency is a square wave with a frequency of (50-200)Hz, a duty cycle of 30%-70%, a high-level amplitude of (3-3.6)V, a low-level amplitude of (0-0.3)V, a rise time of less than 0.1ms, and a fall time of less than 0.1ms, FS_EN outputs high impedance; if the DO1-WD input is a square wave with a duty cycle of 0% or 100%, FS_EN outputs low impedance with a voltage value less than 0.3V; if the DO1-WD input frequency is a square wave less than 10Hz, FS_EN outputs a square wave with a combination of low impedance and high impedance; if the DO1-WD input signal is different from the above, the output state of FS_EN is uncertain. When the car is not in the ON position, regardless of whether the DO1-WD input is high or low, FS_EN outputs high impedance.

[0069] Specifically, the controlled inverting amplifier circuit consists of a third transistor for controlling the output and isolation, and its peripheral circuitry; wherein, the emitter of the third transistor is connected to an external high-side switch signal, the base of the third transistor is connected to a functional safety enable signal, and the collector of the third transistor outputs a first functional safety output signal; wherein, the first functional safety output signal of the controlled inverting amplifier circuit includes FS1.

[0070] In this embodiment, as Figure 4 As shown, the controlled inverting amplifier circuit consists of an eighth resistor R8, a ninth resistor R9, a tenth resistor R10, an eleventh resistor R11, a sixth capacitor C6, a fourth diode D4, a fifth diode D5, and a third transistor Q3. The emitter of transistor Q3 is connected to one end of resistor R8, one end of capacitor C6, and one end of resistor R10; the other end of resistor R8 is connected to IDH1; the other end of capacitor C6 is grounded; the other end of resistor R10 is connected to the base of Q3; the base of Q3 is connected to FS_EN through a series connection of diode D5 and resistor R11; and the collector of Q3 is connected to FS1 through a series connection of diode D4 and resistor R9.

[0071] Specifically, Q3 (BC807-25) is an isolation transistor that controls the output; D4 (BAS21) and D5 (BAS21) are diodes that prevent reverse current and isolate the input and output; R8 (10kΩ) is the input current-limiting resistor of IDH1; C6 (47nF) is the anti-static and filtering capacitor of IDH1; R10 (10kΩ) is the base shunt resistor of Q3, which can prevent Q3 from being mistakenly turned on; R11 (10kΩ) is the current-limiting resistor between the base of Q3 and FS_EN; R8, R10, D5, and R11 form the input voltage divider circuit; and R8 (10kΩ) and R9 (51kΩ) are the output resistors of FS1.

[0072] Specifically, the controlled inverting amplifier circuit outputs a voltage based on the automotive ON position power supply voltage when the external high-side switch signal input is high and the functional safety enable signal input is low; and outputs a high impedance when the external high-side switch signal input is low or the functional safety enable signal input is high impedance.

[0073] In this embodiment, under the conditions of a battery voltage range of (9-16)V and an operating temperature range of (-40-85)℃, when the corresponding external high-side switch is closed, IDH1 inputs a high level, and its voltage value is approximately equal to the battery voltage. When the corresponding external high-side switch is open, IDH1 inputs a low level. When IDH1 inputs a high level and FS_EN inputs a low level, the no-load output voltage of FS1 is approximately 1.5V lower than the battery voltage, and the equivalent output resistance of FS1 is 61kΩ. When IDH1 inputs a low level or FS_EN inputs a high resistance, FS1 outputs a high resistance. FS1, FS_EN, and IDH1 are mutually isolated and form an anti-series circuit. IDH1 has functions such as high-frequency filtering and human body electrostatic protection.

[0074] Specifically, the inverting amplifier circuit consists of a fourth and a fifth transistor for output control and isolation, along with their peripheral circuitry. The emitter of the fourth transistor is connected to the automotive ON-position power supply voltage, the base of the fourth transistor is connected to the functional safety enable signal, and the collector of the fourth transistor outputs FS2 and FS3. Similarly, the emitter of the fifth transistor is connected to the automotive ON-position power supply voltage, the base of the fifth transistor is connected to the functional safety enable signal, and the collector of the fifth transistor outputs FS4 and FS5. The second functional safety output signal of the inverting amplifier circuit includes FS2, FS3, FS4, and FS5. FS2 and FS4 are output to the high-side drive circuit, and FS3 and FS5 are output to the low-side drive circuit. FS2 and FS4 are redundantly designed, as are FS3 and FS5.

[0075] In this embodiment, as Figure 5As shown, the specific implementation circuit of the inverting amplifier circuit consists of the twelfth resistor R12, the thirteenth resistor R13, the fourteenth resistor R14, the fifteenth resistor R15, the sixteenth resistor R16, the seventeenth resistor R17, the eighteenth resistor R18, the nineteenth resistor R19, the sixth diode D6, the seventh diode D7, the eighth diode D8, the ninth diode D9, the tenth diode D10, the eleventh diode D11, the fourth transistor Q4, and the fifth transistor Q5. In this configuration, the emitter of Q4 is connected to KL15_P, the collector is connected to FS2 via a series diode D6 and resistor R12, and to FS3 via a series diode D7 and resistor R13; the base is connected to FS_EN via a series diode D8 and resistor R15; resistor R14 is connected to the emitter and base of Q4 respectively; the emitter of Q5 is connected to KL15_P, the collector is connected to FS4 via a series diode D9 and resistor R16, and to FS5 via a series diode D10 and resistor R17; the base is connected to FS_EN via a series diode D11 and resistor R19; resistor R18 is connected to the emitter and base of Q5 respectively.

[0076] Specifically, Q4 (BC807-25) and Q5 (BC807-25) are isolation transistors that control the output; D6 (BAS21), D7 (BAS21), D8 (BAS21), D9 (BAS21), D10 (BAS21), and D11 (BAS21) are diodes that prevent reverse current and provide input-output isolation; R14 (10kΩ) is the base shunt resistor for Q4, which prevents Q4 from being mistakenly turned on. R15 (10kΩ) is the current-limiting resistor between the base of Q4 and FS_EN. R18 (10kΩ) is the shunt resistor between the base of Q5 to prevent Q5 from being mistakenly turned on. R19 (10kΩ) is the current-limiting resistor between the base of Q5 and FS_EN. R12 (62kΩ) is the output resistor of FS2. R13 (62kΩ) is the output resistor of FS3. R16 (62kΩ) is the output resistor of FS4. R17 (62kΩ) is the output resistor of FS5.

[0077] Specifically, the inverting amplifier circuit ensures that when there is a car ON power supply voltage and the functional safety enable signal input is high impedance, the output is high impedance; when there is a car ON power supply voltage and the functional safety enable signal input is low level, the output is the corresponding voltage according to the car ON power supply voltage.

[0078] In this embodiment, to improve the functional safety level of OPH2 and OPL8, FS2 and FS4 are designed to be redundant, and FS3 and FS5 are designed to be redundant. Under the conditions that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the car is in the ON position, when the FS_EN input is low, the no-load output voltage of FS2, FS3, FS4 and FS5 is about 1.5V lower than the battery voltage. The equivalent output resistance of FS2, FS3, FS4 and FS5 is 62kΩ. When the FS_EN input is high, the output resistance of FS2, FS3, FS4 and FS5 is high. When the car is not in the ON position, regardless of whether the FS_EN input is high or low, FS2, FS3, FS4 and FS5 output high resistance. FS2, FS3, FS4, FS5, FS_EN and KL15_P are isolated from each other and form a reverse series circuit.

[0079] The high-side drive circuit includes a dual-channel high-side switch driver chip and its surrounding circuitry; the high-side drive output current detection signal pin of the dual-channel high-side switch driver chip is connected to the processor circuitry. Specifically, such as... Figure 6As shown, the specific implementation circuit of the high-side drive circuit consists of the first chip U1, the twelfth diode D12, the thirteenth diode D13, the fourteenth diode D14, the fifteenth diode D15, the sixteenth diode D16, the seventeenth diode D17, the eighteenth diode D18, the nineteenth diode D19, the twentieth resistor R20, the twenty-first resistor R21, the twenty-second resistor R22, the twenty-third resistor R23, the twenty-fourth resistor R24, the twenty-fifth resistor R25, the twenty-sixth resistor R26, the twenty-seventh resistor R27, the twenty-eighth resistor R28, the twenty-ninth resistor R29, the thirtieth resistor R30, the thirty-first resistor R31, the thirty-second resistor R32, the thirty-third resistor R33, the thirty-fourth resistor R34, the seventh capacitor C7, the eighth capacitor C8, the ninth capacitor C9, the tenth capacitor C10, and the eleventh capacitor C11. Specifically, the GND pin of U1 is grounded via a series connection of diode D14 and resistor R24, and a series connection of diode D15 and resistor R25; a capacitor C8 is connected in parallel across resistor R24; FS_EN is connected to the cathode of diode D12, and the anode of diode D12 is connected to the IN0 pin of U1; one end of resistor R20 is connected to the anode of diode D12, and the other end is grounded; the DO2 / PWMO2-HSD pin is connected to the IN0 pin of U1 via a series connection of diode D13 and resistor R21; the DO4 pin is connected to the DEN pin of U1 via a series connection of diode D16 and resistor R22; one end of capacitor C9, diode D17, and resistor R26 is connected to AIn1, and the other end is grounded; one end of resistor R23 is connected to AIn1, and the other end is connected to the IS pin of U1. One end of resistor R28 is connected to the IS pin of U1, and the other end is grounded; DO5-DSEL is connected to the DSEL pin of U1 through a series diode D18 and resistor R29; DO3 / PWMO3-HSD is connected to the IN1 pin of U1 through a series diode D19 and resistor R31; FS2 is connected to the IN1 pin of U1 through resistor R32; FS4 is connected to the IN1 pin of U1 through resistor R33; the IN1 pin of U1 is grounded through resistor R34; the VS pin of U1 is connected to KL_30 and grounded through capacitor C7; the OUT0 pin of U1 is grounded through a parallel capacitor C10 and resistor R27, and connected to OPH1; the OUT1 pin of U1 is grounded through a parallel capacitor C11 and resistor R30, and connected to OPH2.

[0080] Specifically, U1 (HD70152) is a dual-channel high-side switch driver chip, D12 (SMD110) is a low-on-voltage Schottky diode for reverse current protection, D13 (BAV21) is a diode for reverse current protection, R21 (4.7kΩ) is a current-limiting resistor, and R20 (100kΩ) is an input load resistor. D12, D13, R21, and R20 implement the AND input of FS_EN and DO2 / PWMO2-HSD, and the result of the AND operation is input to IN0 (PIn2) of U1. D16 (BAV21) and D18 (BAV21) are diodes for reverse current protection. The diodes acting as reverse current protection, R22 (4.7kΩ) and R29 (4.7kΩ) are current-limiting resistors, D19 (BAV21) is a diode protecting against reverse current, R31 (4.7kΩ) is a current-limiting resistor, R32 (0Ω) and R33 (0Ω) are resistors for compatibility design, and R34 (200kΩ) is the input load resistor. D19, R31, R32, R33, and R34 implement the OR input of DO3 / PWMO3-HSD, FS2, and FS4, and the result of the OR operation is input to IN1 (PIn6) of U1. R28 (1kΩ) is the resistor between OPH1 and O... The output current sampling resistors for PH2 are: R23 (15kΩ) and R26 (10kΩ), which form a voltage divider circuit for output current sampling; R23 also acts as a current-limiting resistor for output current sampling; D17 (BZT52B3V3) is a voltage-limiting diode for output current sampling with a voltage limit of 3.3V; C9 (10nF) is a filter capacitor for output current sampling; D14 (BAV21) is a diode carrying the forward current of U1; R24 (3.3R) is a DC current-limiting resistor for the forward current of U1; C8 (1nF) is an accelerating capacitor for the forward current of U1; and D15 (BAV21) is a capacitor carrying the reverse current of U1. The diode is used for current control. R25 (33R) is a current-limiting resistor for the reverse current of U1. The forward current of U1 ensures that U1 works normally, and the reverse current of U1 activates the reverse protection circuit inside U1. C7 (47nF) is the filter capacitor for the VS (Pin0) pin of U1. C7 is also used for ESD protection of the power supply port. R27 (47kΩ) and R30 (47kΩ) are the load resistors for OPH1 and OPH2. R27 and R30 are used for no-load diagnostics. C10 (47nF) and C11 (47nF) are the filter capacitors for OPH1 and OPH2. C10 and C11 are also used for ESD protection of the load port.

[0081] Specifically, OPH1 and OPH2 are high-side drive outputs, AIn1 is the high-side drive output current detection signal, which is the analog output of the output current of OPH1 or OPH2. KL30 is the positive terminal of the battery power supply, and GND is the negative terminal of the battery power supply. Under the conditions that the battery voltage range is (9-16)V and the operating temperature range is (-40-85)℃, when the DO2 / PWM2-HSD input amplitude is approximately 3.3V high level and the FS_EN input impedance is high, the OPH1 output voltage value is approximately the high level of the battery voltage. When the DO2 / PWM2-HSD input is a low level of 0V and the FS_EN input has high impedance, the OPH1 output voltage is approximately a low level of 0V. When the DO2 / PWM2-HSD input frequency is 0-400Hz, the amplitude is (0-0.8)V for the low level and (2.4-3.6)V for the high level, and the duty cycle is 0-100%, and the FS_EN input has high impedance, the OPH1 output is a square wave with the same frequency and duty cycle as the DO2 / PWM2-HSD. The high level of the square wave is approximately the battery voltage, and the low level is approximately 0V. When the FS_EN input is low, regardless of the DO2 / PWM2-HSD input... Regardless of the input signal, OPH1 outputs a low voltage of approximately 0V. When the input amplitude of DO3 / PWM3-HSD is approximately 3.3V and both FS2 and FS4 have high impedance, OPH2 outputs a high voltage of approximately the battery voltage. When the input of DO3 / PWM3-HSD is approximately 0V and both FS2 and FS4 have high impedance, OPH2 outputs a low voltage of approximately 0V. When the input frequency of DO3 / PWM3-HSD is 0-400Hz, the low level amplitude is (0-0.8)V, and the high level amplitude is (2.4-3.6)V... When a square wave with a duty cycle of 0-100% is input and both FS3 and FS5 have high impedance, OPH2 outputs a square wave with the same frequency and duty cycle as DO3 / PWM3-HSD. The high level of the square wave is approximately the battery voltage, and the low level is approximately 0V. When FS2 and / or FS4 inputs a high level lower than the battery voltage by 1.5V and has an internal resistance of 62KΩ, regardless of the signal input to DO3 / PWM3-HSD, OPH2 outputs a voltage value approximately the high level of the battery voltage. When DO4-DEN inputs a high level with an amplitude of approximately 3.3V, if DO5-DSEL inputs an amplitude of approximately 3...With a 3V high level, the voltage output of AIn1 is proportional to the current output of OPH1. If the input amplitude of DO5-DSEL is approximately 0V low, the voltage output of AIn1 is proportional to the current output of OPH2. When the input amplitude of DO4-DEN is approximately 0V low, the voltage output of AIn1 is approximately 0V. When the battery is reverse-connected (KL30 connected to the negative terminal of the battery power supply and GND connected to the positive terminal), the output voltages of OPH1 and OPH2 are approximately the voltage of KL30. When an abnormality occurs where current flows from the high-voltage side circuit to the low-voltage side circuit, the abnormal voltage generated by DO2 / PWMO2-HSD, DO3 / PWMO3-HSD, DO4-DEN, DO5-DSEL, and AIn1 does not exceed 3.3V. The OPH1, OPH2, and KL30 circuits have high-frequency filtering and electrostatic discharge (ESD) protection functions.

[0082] The low-side drive circuit includes an eight-channel low-side switch driver chip and its surrounding circuitry; the fault status information signal pins of the eight-channel low-side switch driver chip are connected to the processor circuitry. Specifically, for example... Figure 7As shown, the specific implementation circuit of the low-side drive circuit consists of the second chip U2, the twentieth diode D20, the twenty-first diode D21, the twenty-second diode D22, the twenty-third diode D23, the twenty-fourth diode D24, the sixth transistor Q6, the seventh transistor Q7, the thirty-fifth resistor R35, the thirty-sixth resistor R36, the thirty-seventh resistor R37, the thirty-eighth resistor R38, the thirty-ninth resistor R39, the fortieth resistor R40, the forty-first resistor R41, the forty-second resistor R42, and the forty-third resistor R43. It consists of resistors R44 (44), R45 (45), R46 (46), R47 (47), R48 (48), R49 (49), R50 (50), capacitors C12 (12), C13 (13), C14 (14), C15 (15), C16 (16), C17 (17), C18 (18), C19 (19), C20 (20), C21 (21), C22 (22), and C23 (23).Specifically, U2's GND pin is grounded; U2's VDD pin is connected to a constant 3V3 voltage and grounded through capacitor C12; U2's VDDA pin is connected to a constant 5V0 voltage and grounded through capacitor C13; U2's OUT1 pin is connected to OPL1 and grounded through capacitor C21; U2's OUT2 pin is connected to OPL2 and grounded through capacitor C20; U2's OUT3 pin is connected to OPL3 and grounded through capacitor C19; U2's OUT4 pin is connected to OPL4 and grounded through capacitor C18; U2's OUT5 pin is connected to OPL5 and grounded through capacitor C17; and U2's OUT6 pin is connected to OPL... 6. U2's OUT7 pin is connected to OPL7 and grounded through capacitor C15; U2's OUT8 pin is connected to OPL8 and grounded through capacitor C14; U2's IN1 pin is grounded through resistor R45; U2's IN2 pin is grounded through resistor R46; U2's IN3 pin is connected to FS1 and grounded through parallel capacitor C22 and resistor R49; U2's IN4 pin is connected to FS3 and FS5 through resistors R47 and R48 respectively, and grounded through parallel capacitor C23 and resistor R50; U2's CS_B pin is connected to DIn1 and SPI0 respectively through resistor R40. CS1 is connected to the collector of transistor Q7 via diode D21; the SI pin of U2 is connected to SPI0MOSI via resistor R41 and to the collector of Q7 via diode D22; the RST_B pin of U2 is connected to DO6-Reset via resistor R42 and to the collector of Q7 via diode D23; the SC1K pin of U2 is connected to SPI0 CLK and DIn2 via resistor R43 and to the collector of Q7 via diode D24; the SO pin of U2 is connected to SPI0... MISO and DIn3; the DIR pin of U2 is connected to the collector of transistor Q6 through resistor R39; the emitter of Q6 is connected to a constant 3V; the two ends of resistor R35 are connected to the emitter and base of Q6 respectively; the base of Q6 is connected to FS_EN through resistor R36 and diode D20; the emitter of Q7 is grounded; the two ends of resistor R37 are connected to the emitter and base of Q7 respectively; the two ends of resistor R38 are connected to the base of Q7 and the collector of Q6 respectively.

[0083] Specifically, U2 (TPS4030Q) is an eight-channel low-side switch driver chip, C12 (100nF) is a 3V3 filter capacitor, C13 (100nF) is a 5V0 filter capacitor, D20 (BAV21) is a reverse current protection diode, Q6 (BC807-25) is an inverting amplifier transistor that performs input detection, R36 (4.7kΩ) is the base current limiting resistor of Q6, and R35 (10kΩ) is the base shunt resistor of Q6. R35 and R36 form the base-emitter junction of Q6. The base-emitter voltage divider circuit ensures reliable conduction and cutoff of Q6. Q7 (BC817-25) is an inverting amplifier transistor that controls the output. R38 (4.7kΩ) is the base-limiting current resistor for Q7, and R37 (4.7kΩ) is the base-shunt current resistor for Q6. R37 and R38 form the base-emitter voltage divider circuit for Q7, ensuring reliable conduction and cutoff of Q7. R39 (4.7kΩ) is the input current-limiting resistor for DIR (Pin18) of U2. D21 (SMD110) and D22 (SMD110) are also included. 10) D23 (SMD110) and D24 (SMD110) are Schottky diodes for mutual isolation; R40 (4.7kΩ), R41 (4.7kΩ), R43 (4.7kΩ), and R44 (4.7kΩ) are damping input resistors; R42 (4.7kΩ), R45 (4.7kΩ), and R46 (4.7kΩ) are input current-limiting resistors; R47 (0Ω) and R48 (0Ω) are resistors for compatibility design; R49 (220kΩ) is an F... The load resistor of S1, C22 (10nF) is the filter capacitor of FS1, R50 (200kΩ) is the load resistor of FS3 and FS5, C23 (10nF) is the filter capacitor of FS3 and FS5, and C14 (100nF), C15 (100nF), C16 (100nF), C17 (100nF), C18 (100nF), C19 (100nF), C20 (100nF) and C21 (100nF) are output filter and electrostatic protection capacitors.

[0084] Specifically, DO6-Reset, SPI0_CS1, SPI0_CLK, SPI0_MOSI, and SPI0_MISO are 3.3V system control signals; DIn1, DIn2, and DIn3 are fault status information signals, where DIn1 is the fault status output start flag input, DIn2 is the fault status output end flag input, and DIn3 is the overcurrent, overtemperature, and open-circuit fault status input; OPL1, OPL2, ..., OPL8 are low-side drive outputs; 5V0 is the 5V power supply positive; 3V3 is the 3.3V power supply positive; and GND is the power supply negative. The battery voltage range is (9-16)V and the operating temperature range is (-40-). Under 85℃ conditions, the 3V3 power-on stability lags behind the 5V0 power-on stability by at least 1ms; the DO6-Reset reset output high level lags behind the 3V3 power-on stability by at least 2ms; the SPI0_CS1 output valid low level lags behind the DO6-Reset output high level by at least 20us; the FS_EN output valid low level lags behind the 3V3 power-on stability by at least 2ms; and the FS2 and / or FS4 output valid high level lags behind the FS_EN output valid low level by at least 20us. When the FS_EN input is high impedance, the outputs of OPL1, OPL2, ..., OPL8 are controlled by DO6-Reset, SPI0_CS1, and SPI0_CL. The K, SPI0_MOSI, and SPI0_MISO signals are set to valid after an overcurrent fault lasting 1ms, an open-circuit fault lasting 300us, or an overtemperature fault lasting 30us; otherwise, the fault information is invalidated. If an SPI communication fault occurs, within the SPI operating cycle, from the falling edge of DIn1 to the rising edge of DIn2, DIn3 outputs a high level; otherwise, DIn3 outputs a low level. The high-level voltage amplitude is (3.0-3.6)V, and the low-level voltage amplitude is (0-0.8)V. The edge times of both the falling and rising edges are no greater than 10us. When FS... When the _EN input is low, regardless of whether the DO6-Reset, SPI0_CS1, SPI0_CLK, SPI0_MOSI, and SPI0_MISO inputs are high or low, OPL1, OPL2, ..., OPL6 will output high impedance. When the open-circuit voltage of FS3 and / or FS5 is about 1.5V lower than the battery voltage and the input resistance is 63kΩ, OPL5 and / or OPL6 will output a low level of no more than 0.3V. When the input impedance of FS3 and / or FS5 is high, OPL5 and / or OPL6 will output high impedance. OPL1, OPL2, ..., OPL8 have functions such as high-frequency filtering and human body electrostatic protection.

[0085] In a preferred embodiment of the present invention, the processor circuit is specifically a SOC or MCU circuit, specifically implemented using a general-purpose processor E3640. Here, 3V3 is the positive 3.3V power supply of the general-purpose processor circuit, GND is the negative power supply, DO1_WD, DO2 / PWMO2-HSD, DO3 / PWMO3-HSD, DO4-DEN, DO5-DSEL, and DO6-Reset are digital outputs, where DO2 / PWMO2-HSD and DO3 / PWMO3-HSD can be multiplexed as PWM outputs. DIn1, DIn2, and DIn3 are digital inputs, AIn1 and FS_EN are analog inputs, SPI0_CS1, SPI0_CLK, SPI0_MOSI, and SPI0_MISO are SPI bus signals, and CAN0-Tx and CAN0-Rx are CAN communication signals.

[0086] In another embodiment of the present invention, MOSFETs can be used to replace transistors in each circuit, and chips U1 and U2 can be replaced by chips with the same or similar functions.

[0087] In addition, embodiments of the present invention also provide a control method for a functional safety circuit of an automotive electronic controller, for controlling the aforementioned functional safety circuit of an automotive electronic controller, the method comprising:

[0088] Output watchdog monitoring signals, control input signals, and system control signals;

[0089] When the car is in the ON position, the corresponding functional safety enable signal is output based on the watchdog detection signal.

[0090] The first functional safety output signal is output based on the external high-side switch signal and the functional safety enable signal;

[0091] A second functional safety output signal is output based on the functional safety enable signal;

[0092] The high-side drive output signal is output based on the control input signal, the functional safety enable signal, and the second functional safety output signal.

[0093] The system outputs a low-side drive output signal based on the system control signal, the functional safety enable signal, and the first functional safety output signal.

[0094] The functional safety circuit and control method for automotive electronic controllers provided in this invention, through a pulse detection circuit, outputs a corresponding functional safety enable signal based on the vehicle's operating state. When the vehicle is in the ON position, the functional safety enable signal is output based on the watchdog monitoring signal, activating the functional safety circuit in a timely manner when an abnormality occurs. When the vehicle is not in the ON position, the functional safety enable signal outputs a high impedance, disabling the functional safety circuit and preventing it from being falsely triggered. This prevents accidental triggering of the functional safety circuit and reduces the vehicle's dark current. Furthermore, this invention uses discrete components to design the pulse detection circuit, resulting in stable and reliable performance. The performance parameters are flexibly configured, allowing for the detection of pulses with different frequencies and duty cycles by changing the resistance and capacitance parameters in the circuit, thus adapting to different detection needs. The circuit also primarily uses discrete components, reducing hardware costs and exhibiting good applicability and versatility.

[0095] Furthermore, this invention uses a processor circuit to monitor the status information of the high-side drive output signal and the low-side drive output signal of the circuit in real time and determine whether there is any abnormality. When an abnormality is detected, an abnormality alarm message is sent in a timely manner through the CAN network to ensure the safety of personnel and vehicles, thus demonstrating reliability.

[0096] Furthermore, the inverting amplifier circuit in this invention adopts a dual redundancy design, enabling the functional safety level of the outputs of the high-side drive circuit and the low-side drive circuit to reach Asil-C. In the functional safety activated state, all drive circuit outputs are in a definite state, ensuring that their loads operate in the expected state. In abnormal situations such as software crashes, microcontroller hardware failures, or microcontroller power supply failures, the functional safety circuit can be automatically activated, ensuring the safety of the driver and passengers and the vehicle, and increasing circuit safety.

[0097] Example 2

[0098] This invention, based on Embodiment 1, provides a functional safety circuit for automotive electronic controllers, such as... Figure 8 As shown, where:

[0099] The KL15_P pin of the power supply filtering and protection circuit is connected to the KL15_P pin of the pulse detection circuit and the KL15_P pin of the inverting amplifier circuit.

[0100] The FS_EN pin of the pulse detection circuit is connected to the FS_EN pin of the controlled inverting amplifier circuit, the inverting amplifier circuit, the processor, the high-side drive circuit, and the low-side drive circuit.

[0101] The FS1 pin of the controlled inverting amplifier circuit is connected to the FS1 pin of the low-side drive circuit; the IDH1 pin is connected to an external high-side switch.

[0102] The FS2 pin of the inverting amplifier circuit is connected to the FS2 pin of the high-side drive circuit; the FS3 pin is connected to the FS3 pin of the low-side drive circuit; the FS4 pin is connected to the FS4 pin of the high-side drive circuit; and the FS5 pin is connected to the FS5 pin of the low-side drive circuit.

[0103] The DO2 / PWMO2-HSD pin, DO3 / PWMO3-HSD pin, DO4-DEN pin, and DO5-DSEL pin of the high-side drive circuit are respectively connected to the DO2 / PWMO2-HSD pin, DO3 / PWMO3-HSD pin, DO4-DEN pin, and DO5-DSEL pin of the processor, and the AIN1 pin is connected to the AIN1 pin of the processor circuit.

[0104] The SPI0_MISO pin, DIn1 pin, DIn2 pin, and DIn3 pin of the low-side drive circuit are connected to the SPI0_MISO pin, DIn1 pin, DIn2 pin, and DIn3 pin of the processor circuit.

[0105] The DO6-Reset, SPI0_CS1, SPI0_CLK, and SPI0_MOSI pins of the processor circuit are connected to the DO6-Reset, SPI0_CS1, SPI0_CLK, and SPI0_MOSI pins of the low-side drive circuit; the DO1-WD pin is connected to the DO1-WD pin of the pulse detection circuit.

[0106] The GND pins of the power supply filtering and protection circuit, pulse detection circuit, controlled inverting amplifier circuit, inverting amplifier circuit, high-side drive circuit, low-side drive circuit, and processor circuit are connected to the power supply ground GND.

[0107] The 3V3 pin of the low-side drive circuit and the processor circuit is connected to a constant 3.3V power supply; the 5V0 pin of the low-side drive circuit is connected to a constant 5V power supply.

[0108] Example 3

[0109] This invention, based on a functional safety circuit for an automotive electronic controller according to Embodiment 1, provides a control method for a functional safety circuit for an automotive electronic controller. The method specifically includes:

[0110] Connect the car to the battery and put it in the ON position. 5V0 is powered normally, and after a 2ms delay, 3V3 is powered normally.

[0111] After a 5ms delay, the processor circuit's DO1-WD outputs a square wave with a frequency of 100Hz, a duty cycle of 50%, and an amplitude of 3.3V, which is then input to the pulse detection circuit. At this time, FS_EN outputs high impedance and is input to the controlled inverting amplifier circuit and the inverting amplifier circuit. At this time, FS1, FS2, FS3, FS4, and FS5 output high impedance.

[0112] After a 5ms delay, the processor circuit controls the outputs of OPH1 and OPH2 of the high-side drive circuit via DO2 / PWMO2-HSD and DO3 / PWMO3-HSD, and calculates the output current or operating status of OPH1 and OPH2 by setting the digital output values ​​of DO4-DEN and DO5-DSEL and reading the analog input value of AIn1. When the output current exceeds the overcurrent threshold, OPH1 and OPH2 continue to output for loads with functional safety requirements that need to maintain output. For loads with functional safety requirements, the output is delayed and shut off after entering a safe state. For loads without functional safety requirements, the output can be shut off. When a short circuit or overheat protection occurs, the outputs of OPH1 and OPH2 are turned off, and AIn1 outputs the corresponding fault voltage value. When an overcurrent, short circuit, or thermal protection abnormality occurs, the abnormal handling process is entered. The processor circuit can send the output status of OPH1 and OPH2 and these abnormal information to other controllers via the CAN bus.

[0113] After a 5ms delay, the processor circuit's DO6-Reset is set to high, resetting completes and entering normal operation. The output signals of the low-side drive circuit's OPL1, OPL2, ..., OPL8 are controlled via SPI0_CS1, SPI0_CLK, SPI0_MOSI, and SPI0_MISO, and the status information of OPL1, OPL2, ..., OPL8 is read. When overcurrent or overtemperature anomalies occur, the corresponding outputs of OPL1, OPL2, ..., OPL8 are shut down. DIn1 is set as the processor circuit's falling-edge interrupt input. The interrupt handler for DIn1 reads the digital input values ​​of DIn2 and DIn3. If DIn2 is low and DIn3 is high, the communication error of the low-side drive circuit with functional safety is enabled; otherwise, the communication error is disabled. When overcurrent, overtemperature, open circuit, or communication anomalies occur, the anomaly handling process begins. The processor circuit can send the output status of OPL1, OPL2, ..., OPL8 and these anomaly information to other controllers via the CAN bus.

[0114] When a circuit malfunctions, such as a software error or hardware failure in the processor circuit, the high-side drive circuit OPH1 outputs a low level, OPH2 outputs a high level, and the low-side drive circuit OPL1, OPL2, ..., OPL6 outputs an invalid high impedance. When IDH1 inputs a high level, OPL7 outputs a valid low level. When IDH1 inputs a low level or high impedance, OPL7 outputs an invalid high impedance, and OPL8 outputs a low level. If the 3V3 and 5V0 power supplies fail, OPH1 outputs a low level, OPH2 outputs a high level, and OPL1, OPL2, ..., OPL8 outputs an invalid high impedance.

[0115] It should be noted that, depending on the implementation needs, the various steps / components described in this application can be broken down into more steps / components, or two or more steps / components or parts of the operation of steps / components can be combined into new steps / components to achieve the purpose of this invention.

[0116] The order of the steps in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0117] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A functional safety circuit for an automotive electronic controller, characterized in that, include: Processor circuit, pulse detection circuit, controlled inverting amplifier circuit, inverting amplifier circuit, high-side drive circuit, low-side drive circuit; The processor circuit is used to output watchdog monitoring signals, control input signals, and system control signals. The pulse detection circuit, connected to the processor circuit, is used to output a functional safety enable signal corresponding to the state based on the watchdog detection signal when the car is in the ON position. A controlled inverting amplifier circuit, connected to a pulse detection circuit, is used to output a first functional safety output signal based on an external high-side switch signal and a functional safety enable signal. An inverting amplifier circuit is connected to the processor circuit and the pulse detection circuit respectively, and is used to output a second functional safety output signal according to the functional safety enable signal; The high-side drive circuit is connected to the processor circuit, pulse detection circuit and inverting amplifier circuit respectively, and is used to output the high-side drive output signal according to the control input signal, the functional safety enable signal and the second functional safety output signal. The low-side drive circuit is connected to the processor circuit, the pulse detection circuit, and the controlled inverting amplifier circuit, respectively, and is used to output the low-side drive output signal according to the system control signal, the functional safety enable signal, and the first functional safety output signal.

2. The functional safety circuit for an automotive electronic controller according to claim 1, characterized in that, It also includes power filtering and protection circuits, which are used to input the car ON position power supply voltage, process it, and output the processed car ON position power supply voltage to provide power supply voltage.

3. A functional safety circuit for an automotive electronic controller according to claim 1, characterized in that, The processor circuit is also used to acquire the high-side drive output current detection signal of the high-side drive circuit and the fault status information signal of the low-side drive circuit. When the high-side drive output and low-side drive output status become abnormal, the processor circuit sends the status information and abnormal information of the high-side drive output and low-side drive output to other controllers via the bus.

4. A functional safety circuit for an automotive electronic controller according to claim 2, characterized in that, The pulse detection circuit enables the output to be high impedance when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with an input frequency within a preset range, a duty cycle within a preset range, a high-level amplitude within a preset range, a low-level amplitude within a preset range, a rise time less than a preset time, and a fall time less than a preset time; when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with a duty cycle of 0% or 100%, the output to be low level; and when there is a car ON power supply voltage and the watchdog monitoring signal is a square wave with a frequency less than a preset frequency, the output to be a square wave with a combination of low level and high impedance.

5. A functional safety circuit for an automotive electronic controller according to claim 4, characterized in that, The pulse detection circuit consists of a second transistor for pulse detection and isolation, a first transistor for improving output current capability and isolation, and its peripheral circuitry; among which, The base of the second transistor is connected to the watchdog monitoring signal, the collector of the second transistor is connected to the power supply voltage of the car's ON position, and the emitter of the second transistor is grounded. The base of the first transistor is connected to the collector of the second transistor through a resistor. The collector of the first transistor outputs a functional safety enable signal, and the emitter of the first transistor is grounded.

6. A functional safety circuit for an automotive electronic controller according to claim 2, characterized in that, The controlled inverting amplifier circuit enables the output voltage to be based on the automotive ON position power supply voltage when the external high-side switch signal input is high and the functional safety enable signal input is low; and the output impedance is high when the external high-side switch signal input is low or the functional safety enable signal input is high impedance.

7. A functional safety circuit for an automotive electronic controller according to claim 6, characterized in that, The controlled inverting amplifier circuit consists of a third transistor for output control and isolation, and its peripheral circuitry; wherein, The emitter of the third transistor is connected to an external high-side switch signal, the base of the third transistor is connected to a functional safety enable signal, and the collector of the third transistor outputs the first functional safety output signal.

8. A functional safety circuit for an automotive electronic controller according to claim 2, characterized in that, The inverting amplifier circuit ensures that when there is automotive ON power supply voltage and the functional safety enable signal input is high impedance, the output is high impedance; when there is automotive ON power supply voltage and the functional safety enable signal input is low level, the output is the corresponding voltage according to the automotive ON power supply voltage.

9. A functional safety circuit for an automotive electronic controller according to claim 8, characterized in that, The inverting amplifier circuit consists of a fourth and a fifth transistor for output control and isolation, along with their peripheral circuitry; among which, The emitter of the fourth transistor is connected to the power supply voltage of the car's ON position, the base of the fourth transistor is connected to the functional safety enable signal, and the collector of the fourth transistor outputs FS2 and FS3. The emitter of the fifth transistor is connected to the power supply voltage of the car's ON position, the base of the fifth transistor is connected to the functional safety enable signal, and the collector of the fifth transistor outputs FS4 and FS5. The second functional safety output signals of the inverting amplifier circuit include FS2, FS3, FS4 and FS5. FS2 and FS4 are output to the high-side drive circuit, and FS3 and FS5 are output to the low-side drive circuit. FS2 and FS4 are redundantly designed for each other, and FS3 and FS5 are redundantly designed for each other.

10. A functional safety circuit for an automotive electronic controller according to claim 3, characterized in that, The high-side drive circuit includes a dual-channel high-side switch driver chip and its surrounding circuitry; the high-side drive output current detection signal pin of the dual-channel high-side switch driver chip is connected to the processor circuit.

11. A functional safety circuit for an automotive electronic controller according to claim 3, characterized in that, The low-side drive circuit includes an eight-channel low-side switch driver chip and its surrounding circuitry; the fault status information signal pin of the eight-channel low-side switch driver chip is connected to the processor circuitry.

12. A control method for a functional safety circuit in an automotive electronic controller, characterized in that, The control method is applied to a functional safety circuit for an automotive electronic controller as described in any one of claims 1-11, the method comprising: Output watchdog monitoring signals, control input signals, and system control signals; When the car is in the ON position, the corresponding functional safety enable signal is output based on the watchdog detection signal. The first functional safety output signal is output based on the external high-side switch signal and the functional safety enable signal; A second functional safety output signal is output based on the functional safety enable signal; The high-side drive output signal is output based on the control input signal, the functional safety enable signal, and the second functional safety output signal. The system outputs a low-side drive output signal based on the system control signal, the functional safety enable signal, and the first functional safety output signal.

Images