Intelligent power distribution controller, safety monitoring system thereof, controller and vehicle

Abstract

The invention discloses an intelligent power distribution controller, a safety monitoring system thereof, a controller and a vehicle. The intelligent power distribution controller comprises a main power supply channel used for supplying power to a first-level load and a second-level load, a backup power supply channel used for supplying power to the first-level load and a controller used for monitoring the main power supply channel and the backup power supply channel, and the safety monitoring system is applied to the controller. The safety monitoring system comprises a first software layer which is used for carrying out primary diagnosis on each power supply channel and carrying out communication management; the second software layer is used for carrying out secondary diagnosis and control on each power supply channel and carrying out fault mode processing; and the third software layer is used for carrying out hardware monitoring on the controller. According to the security monitoring system, different software functions are deployed to different software levels, so that the power supply of the intelligent power distribution controller to the load is easy to meet the target function security level requirement.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a safety monitoring system for an intelligent power distribution controller, a controller, an intelligent power distribution controller and a vehicle. Background Art

[0002] In order to meet the requirements of independent protection of each power supply channel and redundant power supply for important safety loads, intelligent power distribution controllers have become the mainstream solution for low-voltage power supply control.

[0003] When the intelligent power distribution controller is applied to the low-voltage power supply control of electric vehicles, along with the development of intelligent electric vehicles, in order to ensure safety and operability of vehicle components when they fail, the functional safety level of the low-voltage power supply of the whole vehicle needs to reach ASIL D under the ISO26262 standard. However, the technical solution of the safety monitoring system of the intelligent power distribution controller in the related technology is difficult to meet the functional safety level requirement. Summary of the invention

[0004] In view of the above problems, the present application provides an intelligent power distribution controller and its safety monitoring system, controller and vehicle. By analyzing the functional safety requirements and non-functional safety requirements of the intelligent power distribution controller, the application layer software functions of the intelligent power distribution device are modularly designed. The first-level diagnosis that does not affect the power supply control is deployed in the first software layer, the second-level diagnosis and power supply-related safety mechanisms involving power supply control are deployed in the second software layer, and the hardware monitoring function of the controller is deployed in the third software layer, so that the power supply of the intelligent power distribution controller to the load can easily meet the target functional safety level requirements.

[0005] In a first aspect, the present application provides a safety monitoring system for an intelligent power distribution controller, wherein the intelligent power distribution controller includes a main power supply channel for supplying power to a first level of loads and a second level of loads, a backup power supply channel for supplying power to the first level of loads, and a controller for monitoring the main power supply channel and the backup power supply channel, wherein the safety monitoring system is applied to the controller, and the safety monitoring system includes: a first software layer for performing a first-level diagnosis on each power supply channel and performing communication management; a second software layer for performing a second-level diagnosis and control on each power supply channel and performing fault mode processing; and a third software layer for performing hardware monitoring of the controller.

[0006] In the technical solution of the embodiment of the present application, the intelligent power distribution controller is used to receive electric energy provided by the power supply source and supply power to the first-level load and the second-level load, wherein a main power supply channel and a backup power supply channel are respectively provided for the first-level load, and a main power supply channel is provided for the second-level load. The controller monitors the main power supply channel and the backup power supply channel.

[0007] The safety monitoring system of the intelligent power distribution controller is applied to the controller. By analyzing the functional safety requirements and non-functional safety requirements of the intelligent power distribution controller, the application layer software functions of the intelligent power distribution device are modularly designed. The first-level diagnosis that does not affect the power supply control is deployed in the first software layer, the second-level diagnosis and power supply-related safety mechanisms involving power supply control are deployed in the second software layer, and the hardware monitoring function of the controller is deployed in the third software layer, so that the power supply of the intelligent distribution controller to the load can easily meet the target functional safety level requirements.

[0008] In some embodiments, the first software layer includes: a primary diagnosis module for performing primary diagnosis on each power supply channel; and a communication management module for performing communication management.

[0009] The first software layer performs the first-level diagnostic function on each power supply channel through the first-level diagnostic module, such as first-level over-current diagnosis, first-level over-voltage diagnosis and first-level over-temperature diagnosis on each power supply channel. The communication management module manages the communication signal between the controller and the outside, such as performing data processing and data packaging on the diagnostic results generated by the first-level diagnostic module, and sending the processed diagnostic results to the external communication bus.

[0010] In some embodiments, the first-level diagnostic module is used to perform a first-level diagnosis on each power supply channel to obtain a first-level fault signal; the communication management module is used to process the first-level fault signal and send the processed first-level fault signal to the external communication bus of the intelligent power distribution controller; wherein, the first-level diagnosis includes one or more of a first-level overcurrent diagnosis, a first-level overvoltage diagnosis, a first-level undervoltage diagnosis and a first-level overtemperature diagnosis.

[0011] The first-level diagnostic module can implement one or more of the first-level overcurrent diagnosis, first-level overvoltage diagnosis, first-level undervoltage diagnosis and first-level overtemperature diagnosis for the main power supply channel and the backup power supply channel, and generate corresponding first-level fault signals based on each power supply channel, the first-level diagnostic type and the diagnostic result. The communication management module receives and processes the first-level fault signal generated by the first-level diagnostic module, and sends the processed first-level fault signal to the external communication bus. For example, when the intelligent power distributor is used for low-voltage power supply of the vehicle, the communication management module sends the processed first-level fault signal to the vehicle communication bus such as the CAN bus, and then sends it to the vehicle controller through the vehicle communication bus. The vehicle controller issues a fault reminder based on the first-level fault signal.

[0012] In some embodiments, the functional safety level of the primary diagnostic module and the communication management module is QM under the ISO26262 standard.

[0013] The modules of the first software layer have no ASIL level requirements and only issue alarms based on the first-level fault signal, which will not affect the power supply control of the intelligent power distribution controller. For example, based on the first-level overcurrent fault signal of the corresponding power supply channel output by the first-level diagnostic module, only a reminder signal of the first-level overcurrent of the power supply channel is issued to keep the power supply of the power supply channel.

[0014] In some embodiments, the second software layer includes: a main secondary monitoring module, used to perform secondary diagnosis and control of the main power supply channel; a backup secondary monitoring module, used to perform secondary diagnosis and control of the backup power supply channel; and a fault mode processing module, used to perform fault mode processing.

[0015] The main power supply channel is diagnosed and controlled at the secondary level through the main secondary monitoring module, and the backup power supply channel is diagnosed and controlled at the secondary level through the backup secondary monitoring module. The fault module receives the fault signals and control signals diagnosed by the main secondary monitoring module and the backup secondary monitoring module to perform corresponding fault mode processing.

[0016] In accordance with the independence requirements after the decomposition of functional safety redundancy, this embodiment deploys the functions of secondary diagnosis and control of the main power supply channel and the functions of secondary diagnosis and control of the backup power supply channel in two different software modules, namely the main secondary monitoring module and the backup secondary monitoring module.

[0017] In some embodiments, the main secondary monitoring module is used to perform secondary diagnosis on the main power supply channel to obtain a secondary fault signal, and perform fault protection control on the main power supply channel; the backup secondary monitoring module is used to perform secondary diagnosis on the backup power supply channel to obtain a secondary fault signal, and perform fault protection control on the backup power supply channel; the fault mode processing module is used to arbitrate the secondary fault signal to obtain a fault mode signal, and send the fault mode signal to the external communication bus of the intelligent power distribution controller through the first software layer; wherein the secondary diagnosis includes one or more of secondary overcurrent diagnosis, secondary overvoltage diagnosis, secondary undervoltage diagnosis, secondary overtemperature diagnosis, power switch stuck diagnosis and current acquisition unit self-test diagnosis.

[0018] A secondary diagnosis is performed on the main power supply channel through the main secondary monitoring module to obtain a secondary fault signal, and fault protection control is performed on the main power supply channel, such as controlling the corresponding main power supply channel to be disconnected. A secondary diagnosis is performed on the backup power supply channel through the backup secondary monitoring module to obtain a secondary fault signal, and fault protection control is performed on the backup power supply channel, such as controlling the corresponding main power supply channel to be disconnected.

[0019] The fault mode processing module arbitrates the secondary fault signals obtained by the main secondary monitoring module and the backup secondary monitoring module to obtain a fault mode signal, and processes the fault mode signal through the communication management module of the first software layer and sends it to the external communication bus. For example, the fault mode processing module can determine the secondary fault signal with the highest priority based on the received multiple secondary fault signals, and use the secondary fault signal with the highest priority as the fault mode signal, or determine the corresponding fault mode with the secondary fault signal with the highest priority to obtain the corresponding fault mode signal, and send the fault mode signal to the vehicle communication bus after signal processing through the communication management module. The vehicle controller receives the fault mode signal through the vehicle control bus, and controls the vehicle based on the fault mode signal, such as controlling the vehicle to decelerate.

[0020] In some embodiments, each power supply channel includes a power switch and an electronic fuse, wherein the electronic fuse is used to output a secondary overcurrent signal and control the corresponding power switch to disconnect when the corresponding power supply channel has a secondary overcurrent, and output a secondary overcurrent recovery signal when the secondary overcurrent of the corresponding power supply channel is restored. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: receive the secondary overcurrent signal of the corresponding power supply channel; when receiving the secondary overcurrent signal of the corresponding power supply channel, output a secondary overcurrent fault signal, and send a power supply cut-off signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to disconnect; after a first preset delay time, obtain the power supply recovery number of the corresponding power supply channel, and when the power supply recovery number is less than the preset recovery number and the secondary overcurrent recovery signal of the corresponding power supply channel is received, send a power supply connection signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to close for power recovery.

[0021] When a secondary overcurrent occurs in the corresponding power supply channel, the electronic fuse outputs a secondary overcurrent signal to the corresponding secondary monitoring module and controls the corresponding power switch to be disconnected. For example, when the electronic fuse set on the main power supply channel determines that the secondary overcurrent occurs in the main power supply channel, the electronic fuse outputs a secondary overcurrent signal to the main secondary monitoring module and controls the corresponding power switch to be disconnected, so that the main power supply channel with the secondary overcurrent stops supplying power; when the electronic fuse set on the backup power supply channel determines that the secondary overcurrent occurs in the backup power supply channel, the electronic fuse outputs a secondary overcurrent signal to the backup secondary monitoring module and controls the corresponding power switch to be disconnected, so that the backup power supply channel with the secondary overcurrent stops supplying power. At the same time, when the electronic fuse determines that the secondary overcurrent of the corresponding power supply channel is restored based on current sampling, the electronic fuse outputs a secondary overcurrent recovery signal to the corresponding main secondary monitoring module and the backup secondary monitoring module, so that the main secondary monitoring module and the backup secondary monitoring module control the corresponding power switch to close based on the secondary overcurrent recovery signal.

[0022] The main secondary monitoring module and the backup secondary monitoring module receive the secondary overcurrent signal corresponding to the main power supply channel and the secondary overcurrent signal corresponding to the backup power supply channel respectively, and determine that the corresponding power supply channel has a secondary overcurrent based on the secondary overcurrent signal. The main secondary monitoring module and the backup secondary monitoring module output a secondary overcurrent fault signal to the fault mode processing module based on the received secondary overcurrent signal, and control the power switch of the corresponding power supply channel to disconnect. It can be understood that before the main secondary monitoring module and the backup secondary monitoring module send the power cut-off signal, the electronic fuse has completed the disconnection control of the corresponding power switch. The sending of the power cut-off signal by the main secondary monitoring module and the backup secondary monitoring module can make the electronic fuse confirm the disconnection of the power switch again, thereby improving the control stability.

[0023] After the disconnection time of the power switch reaches the first preset time, the power supply recovery times of the corresponding power supply channel are obtained. If the power supply recovery times are less than the preset recovery times and the secondary overcurrent recovery signal of the corresponding power supply channel is received, a power supply connection signal is sent to the electronic fuse of the corresponding power supply channel to control the power supply switch of the corresponding power supply channel to close, so that the corresponding power supply channel continues to supply power to the load.

[0024] In this embodiment, when a secondary overcurrent occurs in the power supply channel, the corresponding power supply channel is promptly controlled to stop supplying power based on the electronic fuse, and the power supply cut-off signal output by the main secondary monitoring module and the backup secondary monitoring module is used to perform another cut-off control, thereby improving control stability. The main secondary monitoring module and the backup secondary monitoring module control the closing of the power switch based on conditional judgment.

[0025] In some embodiments, each power supply channel includes a power switch and an electronic fuse, the electronic fuse is used to output a secondary overvoltage signal and control the corresponding power switch to disconnect when the corresponding power supply channel has a secondary overvoltage, and output a secondary overvoltage recovery signal when the corresponding power supply channel has a secondary overvoltage recovery. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: receive the secondary overvoltage signal of the corresponding power supply channel; when receiving the secondary overvoltage signal of the corresponding power supply channel, output a secondary overvoltage fault signal, and send a power supply cut-off signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to disconnect; receive the secondary overvoltage recovery signal of the corresponding power supply channel; when receiving the secondary overvoltage recovery signal of the corresponding power supply channel, send a power supply connection signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to close for power recovery.

[0026] In this embodiment, when a secondary overvoltage occurs in the power supply channel, the corresponding power supply channel is promptly controlled to stop supplying power based on the electronic fuse, and the power supply cut-off signal output by the main secondary monitoring module and the backup secondary monitoring module is used to perform another cut-off control, thereby improving control stability. When the main secondary monitoring module and the backup secondary monitoring module receive the secondary overvoltage recovery signal of the corresponding power supply channel, they control the closing of the power switch.

[0027] In some embodiments, each power supply channel includes a power switch and an electronic fuse, the electronic fuse is used to obtain the actual switch state of the corresponding power switch, and the main secondary monitoring module and the backup secondary monitoring module are respectively used to: receive the actual switch state of the corresponding power switch; when the actual switch state is different from the expected switch state, accumulate the stuck fault time of the corresponding power switch, and when the accumulated stuck fault time reaches a first preset value, output a power supply switch stuck fault signal; when the actual switch state is the same as the expected switch state, subtract the stuck fault time of the corresponding power switch, and when the subtracted stuck fault time reaches a second preset value, determine that the corresponding power switch is recovered from stuck.

[0028] When the power switch of the power supply channel is stuck, the intelligent distribution controller cannot correctly control the power supply to the load, violating the functional safety requirements. Therefore, it is necessary to diagnose the sticking of the power switch and inform the staff in time when the sticking fault occurs to avoid hazards.

[0029] The electronic fuse obtains the actual switch state of the corresponding power switch, and the main secondary monitoring module and the backup secondary monitoring module compare the actual switch state of the corresponding power switch with the expected switch state. When the actual switch state is different from the expected switch, it is considered that the power switch is stuck, and the stuck fault time of the power switch is increased by one. When the accumulated stuck fault time reaches a first preset value, it is determined that the power switch is stuck, and a power switch stuck fault signal is output. When the actual switch state is the same as the expected switch state, the stuck fault time of the corresponding power switch is reduced by one, and when the accumulated stuck fault time reaches a second preset value, it is determined that the corresponding power switch is recovered from being stuck.

[0030] In some embodiments, each power supply channel includes an electronic fuse, which includes a current acquisition unit for collecting the current of the corresponding power supply channel. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: send a current acquisition self-test instruction to the electronic fuse of the corresponding power supply channel, so that the electronic fuse of the corresponding power supply channel performs a self-test on its own current acquisition unit and outputs the sampling resistor voltage difference of the current acquisition unit; receive the sampling resistor voltage difference of the corresponding power supply channel; when the sampling resistor voltage difference does not reach a preset voltage difference threshold, output a current acquisition unit self-test fault signal; when the sampling resistor voltage difference reaches the preset voltage difference threshold, determine that the current acquisition unit self-test fault has been recovered.

[0031] The electronic fuse has a current acquisition unit. When a secondary overcurrent occurs in the corresponding power supply channel, the electronic fuse will send a secondary overcurrent fault signal and disconnect the power supply switch. If the current acquisition unit of the electronic fuse fails, the secondary overcurrent cannot be detected in time. When an overcurrent occurs in the power supply channel, the secondary overcurrent fault signal cannot be sent in time, and the intelligent power distribution controller cannot control the power supply switch of the corresponding power supply channel to disconnect in time, resulting in the intelligent power distribution controller being unable to work normally and the power supply of each power supply channel being uncontrolled, causing harm. Therefore, this embodiment diagnoses the current acquisition unit and issues a fault alarm in time.

[0032] This embodiment determines the working state of the current acquisition unit of the electronic fuse according to the sampling resistor voltage difference of the current acquisition unit obtained by the electronic fuse based on the current acquisition self-test instruction, so as to timely detect the fault of the current acquisition unit and issue a fault alarm reminder.

[0033] In some embodiments, the functional safety level of the main secondary monitoring module and the backup secondary monitoring module is greater than or equal to ASILB under the ISO26262 standard, and the functional safety level of the failure mode processing module is ASILD under the ISO26262 standard.

[0034] This embodiment adopts the idea of ​​redundant decomposition, by dividing the power supply control function into two ASIL B (D) level functional modules, namely the main secondary monitoring module and the backup secondary monitoring module, to respectively implement the secondary diagnostic function of the main power supply channel and the backup power supply channel, so that the power supply of the intelligent power distribution controller to the first level load meets the ASIL D level safety requirements.

[0035] In some embodiments, the third software layer includes: a system module for performing hardware monitoring on the controller; and a driver module for driving and controlling each power supply channel.

[0036] The third software layer is the related module of the underlying software BSW (Basic Software). Through the system module, it provides the basic operating system, watchdog monitoring, communication management and mode management functions for the intelligent power distribution controller, and further realizes the hardware monitoring of the controller. The driver module is used to receive the relevant instructions sent by the second software layer to control the electronic fuses in each power supply channel.

[0037] In some embodiments, the intelligent power distribution controller also includes a safety power chip, and the system module is used to: receive a watchdog seed of the safety power chip; the watchdog seed includes a target control instruction of a target power supply channel, and the target power supply channel is at least one of the main power supply channel and the backup power supply channel; send the watchdog seed to the second software layer, so that the main secondary monitoring module and the backup secondary monitoring module of the second software layer generate a drive control instruction for the target power supply channel based on the target control instruction, and send it to the drive module, so that the drive module generates a watchdog response signal; receive the watchdog response signal, and send the watchdog response signal to the safety power chip, so that the safety power chip determines whether the controller is normal based on the watchdog response signal.

[0038] The third software layer is combined with the safety power chip to monitor the running order and running time of the software modules in the second software layer. When the relevant software modules are executed in the correct running order within the specified time, the correct watchdog response signal is returned to the safety power chip. If the relevant software modules do not run correctly within the specified time, the correct watchdog response signal cannot be returned to the safety power chip, thereby realizing hardware monitoring of the controller.

[0039] In some embodiments, the functional safety level of the system module and the driver module is ASIL D under the ISO26262 standard.

[0040] In some embodiments, the first level of load is a safety load, and the second level of load is an unsafe load.

[0041] In a second aspect, the present application provides a controller, including a safety monitoring system of the above-mentioned intelligent power distribution controller.

[0042] In a third aspect, the present application provides an intelligent power distribution controller, including the safety monitoring system of the above-mentioned intelligent power distribution controller, or the above-mentioned controller.

[0043] In a fourth aspect, the present application provides a vehicle, comprising a safety monitoring system of the above-mentioned intelligent power distribution controller, or the above-mentioned controller, or the above-mentioned intelligent power distribution controller.

[0044] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Moreover, the same reference numerals are used throughout the drawings to represent the same components. In the drawings:

[0046] Figure 1 A block diagram of a safety monitoring system of an intelligent power distribution controller according to some embodiments of the present application;

[0047] Figure 2 A block diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0048] Figure 3 A connection diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0049] Figure 4 This is a schematic diagram of the architecture of a safety monitoring system of an intelligent power distribution controller according to some embodiments of the present application;

[0050] Figure 5 A secondary overcurrent control flow chart of some embodiments of the present application;

[0051] Figure 6 A secondary overvoltage control flow chart of some embodiments of the present application;

[0052] Figure 7 This is a flow chart of power switch stuck fault control in some embodiments of the present application;

[0053] Figure 8 A self-test flow chart of a current acquisition unit according to some embodiments of the present application;

[0054] Fig. 9 A block diagram of a controller according to some embodiments of the present application;

[0055] Fig.10 A block diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0056] Fig.11 A block diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0057] Fig.12 A schematic block diagram of a vehicle according to some embodiments of the present application;

[0058] Fig.13 A schematic block diagram of a vehicle according to some embodiments of the present application;

[0059] Fig.14 A block diagram of a vehicle according to some embodiments of the present application.

[0060] Reference numerals:

[0061] Intelligent power distribution controller 100, main power supply channel 110, backup power supply channel 120, controller 130, CAN module 140, power supply switch 150, electronic fuse 160, safety power chip 170, safety monitoring system 200 of intelligent power distribution controller, first software layer 210, first-level diagnostic module 211, communication management module 212, second software layer 220, main second-level monitoring module 221, backup second-level monitoring module 222, fault mode processing module 223, third software layer 230, system module 231, drive module 232, high-voltage power battery 300, DC / DC module 310, low-voltage battery 400, vehicle 1000. DETAILED DESCRIPTION

[0062] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0063] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0064] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0065] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0066] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0067] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0068] In the description of the embodiments of the present application, the technical terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc. indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the embodiments of the present application.

[0069] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0070] To meet the requirements of independent protection of each power supply channel and redundant power supply of important safety loads, intelligent power distribution controllers have become the mainstream solution for power supply control. When intelligent power distribution controllers are used in low-voltage power supply of vehicles, along with the development of intelligent electric vehicles, in order to ensure safety and operational failure of vehicle components, the low-voltage power supply of the entire vehicle needs to reach the functional safety level of ASIL D.

[0071] In the related art, the monitoring system of the functional unit of the vehicle includes: a functional module, a functional monitoring module and a controller monitoring module, wherein the functional module is used to perform corresponding control functions, including but not limited to torque control, functional component monitoring and verification module, the functional module and the functional monitoring module exchange safety data, the functional monitoring module performs fault monitoring and fault management on the safety-related data and programs in the functional module according to the internally defined algorithm, and the controller monitoring module performs fault management and fault monitoring on the functional module and the functional monitoring module based on hardware.

[0072] However, the monitoring system in the related technology is not suitable for intelligent power distribution controllers and cannot meet the functional safety level requirements of intelligent power distribution controllers. How to design a safety monitoring system for an intelligent power distribution controller and make it reach the target functional safety level has become a design difficulty for intelligent power distribution controllers.

[0073] To this end, this application proposes a safety monitoring system for an intelligent power distribution controller, applies the idea of ​​redundant decomposition to the power supply control monitoring of the software, and deploys software control modules with different functional safety levels to different software levels, so that the power supply of the intelligent power distribution controller to the load can reach the functional safety level of ASIL D.

[0074] For the convenience of explanation, the following embodiments are described with reference to the accompanying drawings, in conjunction with the safety monitoring system of the intelligent power distribution controller of the present application.

[0075] According to some embodiments of the present application, Figure 1 and Figure 2 As shown, the intelligent power distribution controller 100 includes a main power supply channel 110 for supplying power to a first level load and a second level load, a backup power supply channel 120 for supplying power to the first level load, and a controller 130 for monitoring the main power supply channel 110 and the backup power supply channel 120, and the security monitoring system 200 is applied to the controller 130.

[0076] Specifically, the function of the intelligent power distribution controller 100 is to automatically control and manage various components in the power distribution network to achieve energy-saving, safe and reliable operation. For example, the intelligent power distribution controller 100 can automatically adjust the working parameters of various components according to real-time data to ensure the normal operation of the power distribution system.

[0077] The first-level load and the second-level load can be divided based on the actual functional requirements of the application equipment. For example, the first-level load is a safety load, and the second-level load is a non-safety load. Exemplarily, when the intelligent power distribution controller 100 is used to supply low-voltage power to a vehicle, the first-level load is the load required to ensure the safety of vehicle driving, such as an electric power steering system, an electronic stability system, an electronic control braking system, etc., and the second-level load is other loads in the vehicle except the first-level load, such as a cabin controller, a wiper washing system, a speaker, an in-cabin camera, etc. In order to ensure that the vehicle can drive safely, it is necessary to ensure the normal power supply of the first-level load, and the second-level load can be powered or not powered, which can be flexibly adjusted according to the actual situation.

[0078] The intelligent power distribution controller 100 is provided with a main power supply channel 110 and a backup safety power supply channel 120 for the first level of load power supply, and is provided with a main power supply channel for the second level of load. Figure 3 For example, one end of multiple main power supply channels is connected to the high-voltage power battery 300 through a DC / DC (Direct Current-Direct Current) module 310, and the other end of each main power supply channel (main power supply channel 1, ..., main power supply channel n) is respectively connected to the corresponding first-level load and second-level load, wherein the DC / DC module 310 is used to convert the high-voltage direct current provided by the high-voltage power battery 300 into a low-voltage direct current output, and to supply power to the first-level load and the second-level load through the main power supply channel. One end of multiple backup power supply channels (backup power supply channel 1, ..., backup power supply channel n) is connected to the low-voltage battery 400, and the other end is connected to the corresponding first-level load, so as to supply power to the first-level load through the low-voltage direct current provided by the low-voltage battery 400.

[0079] The controller 130 of the intelligent power distribution controller 100 monitors the main power supply channel 110 and the backup power supply channel 120, and timely adjusts the power supply channels based on the monitoring results. For example, the controller 130 can monitor the current, voltage, temperature and other parameters of each power supply channel in real time. For example, when the current of any power supply channel exceeds the preset overcurrent threshold, the controller 130 controls the corresponding power supply channel to stop supplying power.

[0080] The intelligent power distribution controller 100 performs redundant design on the main power supply channel 110 used to supply power to the first level of loads through the backup power supply channel 120, so that when the main power supply channel 110 used to supply power to the first level of loads fails, the first level of loads can still continue to be supplied with power through the corresponding backup power supply channel 120.

[0081] Reference Figure 1As shown, the safety monitoring system 200 of the intelligent power distribution controller of the present application may include: a first software layer 210 , a second software layer 220 and a third software layer 230 .

[0082] The first software layer 210 is used to perform primary diagnosis on each power supply channel and perform communication management. The second software layer 220 is used to perform secondary diagnosis and control on each power supply channel and perform fault mode processing. The third software layer 230 is used to perform hardware monitoring on the controller.

[0083] Specifically, the first-level diagnosis and the second-level diagnosis are used to divide the diagnosis level, wherein the level of the second-level diagnosis is higher than the first-level diagnosis, and can be set based on the actual situation. For example, the first-level diagnosis is used to determine whether the current in each power supply channel exceeds the first threshold. If the current exceeds the first threshold, it is considered that there is an overcurrent risk, but it does not affect the power supply safety, and an alarm signal can be issued to remind; the second-level diagnosis is used to determine whether the current in each power supply channel exceeds the second threshold, wherein the second threshold is greater than the first threshold. When the current exceeds the second threshold, it is considered that the power supply channel has an overcurrent, affecting the power supply safety, and the power supply channel needs to be cut off.

[0084] Communication management may include data processing, data packaging, signal transmission, etc. of the controller's transmission signal, which is not limited here.

[0085] The safety monitoring system 200 of the intelligent power distribution controller performs a first-level diagnosis on each power supply channel based on the working parameters of each power supply channel obtained in real time through the first software layer 210, determines whether the working parameters of each power supply channel have reached the first-level fault threshold, and realizes communication with the outside through the first software layer 210. For example, when the working parameter is current, when the current of the power supply channel reaches the first current threshold, it is considered that the current of the power supply channel has reached the first-level fault threshold, and a corresponding fault warning signal is generated, and the warning signal is sent out through the first software layer 210.

[0086] The safety monitoring system 200 of the intelligent power distribution controller performs secondary diagnosis on each power supply channel based on the real-time working parameters of each power supply channel through the second software layer 220, and controls the corresponding power supply channel when it is determined that the power supply channel reaches the secondary fault threshold to ensure power supply safety, and at the same time, performs corresponding fault mode processing for the secondary fault of the corresponding power supply channel. Fault mode processing refers to determining the corresponding fault mode for the secondary diagnostic fault of each power supply channel to generate a corresponding fault mode signal. For example, taking the application of the intelligent power distribution controller 100 in the low-voltage power supply of the vehicle as an example, when it is determined that there is a secondary fault in the power supply channel, the corresponding fault mode signal is determined based on the secondary diagnostic fault, and the fault mode signal is sent to the vehicle controller through the first software layer 210. The vehicle controller controls the vehicle to enter the braking state based on the fault mode signal.

[0087] Based on different types of secondary diagnostic faults, corresponding fault mode processing strategies can be set, which are not limited here. For example, when the intelligent power distribution controller is applied to the low-voltage power supply of the vehicle, the working parameter is current. When the current of a certain power supply channel reaches the second current threshold, it is considered that the current of the power supply channel reaches the secondary fault threshold, and it is determined that the power supply channel has a secondary overcurrent fault. When the power supply channel is disconnected, a corresponding fault mode signal is generated to control the vehicle to perform a speed reduction control corresponding to the secondary overcurrent fault.

[0088] The safety monitoring system 200 of the intelligent power distribution controller performs hardware monitoring on the controller through the third software layer 230 to ensure that the controller works normally and meets functional safety requirements.

[0089] In the technical solution of the embodiment of the present application, the safety monitoring system 200 of the intelligent power distribution controller monitors the main power supply channel and the backup power supply channel through the first software layer 210 and the second software layer 220 to perform hazard analysis and risk assessment on the main power supply channel and the backup power supply channel to execute different safety strategies. For example, when the first software layer 210 determines that a first-level fault occurs in the power supply channel, a fault reminder is issued; when the second software layer 220 determines that a second-level fault occurs in the power supply channel, such as overcurrent or overvoltage, the power supply of the faulty channel is switched to ensure that the power supply of other channels is not affected. At the same time, the backup power supply channel corresponding to the faulty main power supply channel can still provide normal power supply to the first-level load. At the same time, the hardware of the controller is monitored through the third software layer 230, so that the above-mentioned safety monitoring strategy can be implemented when the controller is normal, meeting the functional safety requirements.

[0090] Therefore, the safety monitoring system of the present application, through analysis of functional safety requirements and non-functional safety requirements, modularly designs the application layer software functions of the intelligent power distribution controller, deploys the first-level diagnosis that does not affect power supply control in the first software layer 210, deploys the second-level diagnosis and power supply-related safety mechanisms involving power supply control in the second software layer 220, and the hardware monitoring function is deployed in the third software layer 230.

[0091] According to some embodiments of the present application, Figure 4 As shown, the first software layer 210 includes: a primary diagnosis module 211, used for performing primary diagnosis on each power supply channel; and a communication management module 212, used for communication management.

[0092] Specifically, the first software layer 210 can perform a first-level diagnosis on each power supply channel through the first-level diagnostic module 211 based on the working parameters of each power supply channel obtained in real time and based on a pre-set first-level diagnostic threshold. The first-level diagnosis may include a first-level overcurrent diagnosis, a first-level overvoltage diagnosis, and a first-level overtemperature diagnosis, etc. The first-level diagnostic module 211 compares the working parameters obtained in real time with the first-level diagnostic threshold to determine the first-level diagnostic result of each power supply channel. For example, when it is determined that the current of a power supply channel reaches the first-level overcurrent diagnostic threshold, it is determined that the power supply channel has an overcurrent risk and generates a corresponding overcurrent warning signal.

[0093] The communication management module 212 receives the reminder signal generated by the primary diagnostic module 211 and sends the reminder signal. In addition, the communication management module 212 also processes and sends the transmission signals generated by the second software layer 220 and the third software layer 230. For example, when the intelligent power distribution controller 100 is applied to a vehicle, the communication management module 212 sends the reminder signal generated by the primary diagnostic module 211 to the CAN bus of the vehicle through the CAN module 140.

[0094] According to some embodiments of the present application, the first-level diagnostic module 211 is used to perform a first-level diagnosis on each power supply channel to obtain a first-level fault signal; the communication management module 212 is used to process the first-level fault signal and send the processed first-level fault signal to the external communication bus of the intelligent power distribution controller; wherein the first-level diagnosis includes one or more of a first-level overcurrent diagnosis, a first-level overvoltage diagnosis, a first-level undervoltage diagnosis and a first-level overtemperature diagnosis.

[0095] Specifically, the first-level diagnostic module 211 can set a first overcurrent threshold based on the first-level overcurrent diagnosis, a first overvoltage threshold based on the first-level overvoltage diagnosis, a first undervoltage threshold based on the first-level undervoltage diagnosis, and a first overtemperature threshold based on the first-level overtemperature diagnosis. The first-level diagnostic module 211 compares the current, voltage and temperature parameters of each power supply channel acquired in real time with the preset threshold to determine the corresponding first-level fault signal. For example, the first-level diagnostic module 211 is used to perform a first-level overcurrent diagnosis on each power supply channel. The first-level diagnostic module 211 compares the current of the received power supply channel with the first overcurrent threshold, and generates a first-level overcurrent fault signal when it is determined that the current exceeds the first current threshold.

[0096] The communication management module 212 processes the primary fault signal generated by the primary diagnosis module 211, for example, encapsulates and packages the primary fault signal, and then sends the processed primary fault signal to the external communication bus of the smart power distributor.

[0097] According to some embodiments of the present application, the functional safety level of the primary diagnostic module 211 and the communication management module 212 is QM.

[0098] Specifically, ISO26262 defines five QM, ASIL-A, B, C and D safety levels. Taking vehicles as an example, QM means that as long as the standard quality management process (IATF16949) is followed, no additional safety measures are required. ASILA represents the lowest level of automotive hazards, while ASILD represents the highest level of automotive hazards. For example, airbags, anti-lock braking systems, and power steering systems must reach ASILD level, which is the most stringent level applied to safety assurance because the risk of failure is the highest. The lowest level of the safety level range, such as rear lights, only needs to reach ASILA level. Headlights and brake lights are usually ASILB level, while cruise control is usually ASILC level.

[0099] In this implementation, the functional safety level of the first-level diagnostic module 211 and the communication management module 212 is QM, that is, the modules in the first software layer 210 have no ASIL level requirements and only issue alarms based on the first-level fault signal, which will not affect the power supply control of the intelligent distribution controller.

[0100] According to some embodiments of the present application, the second software layer 220 includes: a main secondary monitoring module 221, used to perform secondary diagnosis and control of the main power supply channel; a backup secondary monitoring module 222, used to perform secondary diagnosis and control of the backup power supply channel; and a fault mode processing module 223, used to perform fault mode processing.

[0101] Specifically, corresponding thresholds or judgment conditions can be set based on the secondary diagnosis, and when the parameter data of each power supply channel obtained meets the preset conditions, it is determined that the corresponding power supply channel has a corresponding secondary fault. For example, the secondary diagnosis can include secondary overcurrent diagnosis, secondary overvoltage diagnosis, secondary overtemperature diagnosis, etc.

[0102] The second software layer 220 performs secondary diagnosis on the main power supply channel through the main secondary monitoring module 221, and when it is determined that the corresponding main power supply channel has a secondary fault, it executes a corresponding control strategy based on the existing secondary fault type, such as controlling the corresponding main power supply channel to disconnect, limit current, etc.

[0103] The second software layer 220 performs secondary diagnosis on the backup power supply channel through the backup secondary monitoring module 222, and when it is determined that the corresponding backup power supply channel has a secondary fault, it executes a corresponding control strategy based on the type of secondary fault in the backup power supply channel, such as controlling the corresponding backup power supply channel to disconnect, limit current, etc.

[0104] The fault mode processing module 223 receives the secondary fault signals output by the primary secondary monitoring module 221 and the backup secondary monitoring module 222 and processes the secondary fault signals to determine the corresponding fault mode.

[0105] In accordance with the independence requirements after the decomposition of functional safety redundancy, this embodiment deploys the functions of secondary diagnosis and control of the main power supply channel and the functions of secondary diagnosis and control of the backup power supply channel in two different software modules, namely the main secondary monitoring module 221 and the backup secondary monitoring module 222, and then processes the fault signals determined based on the main secondary monitoring module 221 and the backup secondary monitoring module 222 through the fault mode processing module 223 to determine the corresponding fault mode.

[0106] According to some embodiments of the present application, the main secondary monitoring module 221 is used to perform secondary diagnosis on the main power supply channel to obtain a secondary fault signal, and perform fault protection control on the main power supply channel. The backup secondary monitoring module 222 is used to perform secondary diagnosis on the backup power supply channel to obtain a secondary fault signal, and perform fault protection control on the backup power supply channel. The fault mode processing module 223 is used to arbitrate the secondary fault signal to obtain a fault mode signal, and send the fault mode signal to the external communication bus of the intelligent power distribution controller through the first software layer 210. Among them, the secondary diagnosis includes one or more of secondary overcurrent diagnosis, secondary overvoltage diagnosis, secondary undervoltage diagnosis, secondary overtemperature diagnosis, power switch stuck diagnosis and current acquisition unit self-test diagnosis.

[0107] Specifically, the secondary overcurrent diagnosis can be implemented based on the preset second overcurrent threshold, the secondary overvoltage diagnosis can be implemented based on the preset second overvoltage threshold, the secondary undervoltage diagnosis can be implemented based on the preset second undervoltage threshold, the secondary overtemperature diagnosis can be implemented based on the preset second overtemperature threshold, the power switch stuck diagnosis can be judged based on the state of the power switch and the stuck time, and the current acquisition unit self-test diagnosis can be judged based on the working state of the current sampling unit. It should be noted that the secondary diagnosis thresholds or secondary diagnosis conditions for different power supply channels can be different, and can be specifically limited according to actual needs.

[0108] The main secondary monitoring module 221 performs secondary diagnosis on the main power supply channel to obtain a corresponding secondary fault signal, and performs corresponding fault protection control on the main power supply channel, for example, controlling the main power supply channel to be disconnected, and controlling the corresponding backup power supply channel to be turned on, so as to continue to supply power to the corresponding first-level load through the backup power supply channel. The backup secondary monitoring module 222 performs secondary diagnosis on the backup power supply channel to obtain a corresponding secondary fault signal, and performs fault protection control on the backup power supply channel, for example, controlling the backup power supply channel to be disconnected.

[0109] The fault mode processing module 223 arbitrates the secondary fault signals obtained by the main secondary monitoring module 221 and the backup secondary monitoring module 222, and then outputs the corresponding fault mode signal, and processes the fault mode signal through the communication management module 212 of the first software layer 210 and sends it to the external communication bus, that is, the primary fault signal and the fault mode signal determined based on the secondary fault signal are sent to the external communication bus through the communication management module 212. For example, when the intelligent power distribution controller is applied to the low-voltage power supply of the vehicle, the communication management module 212 can output the fault mode signal to the CAN bus of the vehicle, and output it to other controllers of the vehicle such as the central controller based on the CAN bus, and other controllers of the vehicle execute corresponding fault control measures based on the received fault mode signal, such as reducing the vehicle speed, to ensure driving safety.

[0110] According to some embodiments of the present application, Figure 3 and Figure 4 As shown, each power supply channel includes a power supply switch 150 and an electronic fuse 160. The electronic fuse 160 is used to output a secondary overcurrent signal and control the corresponding power supply switch 150 to disconnect when the secondary overcurrent of the corresponding power supply channel occurs, and to output a secondary overcurrent recovery signal when the secondary overcurrent of the corresponding power supply channel is restored.

[0111] The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: receive the secondary overcurrent signal of the corresponding power supply channel; when receiving the secondary overcurrent signal of the corresponding power supply channel, output the secondary overcurrent fault signal, and send a power cut-off signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to disconnect; after a first preset delay time, obtain the power supply recovery number of the corresponding power supply channel, and when the power supply recovery number is less than the preset recovery number and the secondary overcurrent recovery signal of the corresponding power supply channel is received, send a power connection signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to close for power recovery.

[0112] The power switch 150 may be connected in series in the corresponding power supply channel, and the corresponding power supply channel may be controlled by controlling the power switch 150. Specifically, when the power switch 150 connected in series with a certain power supply channel is closed, the power supply channel is in a conducting state, and the corresponding load may be powered through the power supply channel; when the power switch 150 connected in series with a certain power supply channel is disconnected, the power supply channel is in a cut-off state, and the power supply channel stops supplying power.

[0113] A fuse is an electrical component used to protect a circuit from damage by electric current. Its working principle is to control the current flowing through the fuse. When the current exceeds the rated current of the fuse, the fuse will melt and cut off the circuit, thereby protecting the circuit and equipment from damage by the current. Fuses include many types, such as liquid fuses, gas fuses, electronic fuses, etc. Among them, the electronic fuse 160 uses electronic components, such as transistors or switches, to control the switching state of the circuit. In this embodiment, the rated current can be set based on the secondary overcurrent diagnosis requirements.

[0114] During operation, the electronic fuse 160 samples the current of the corresponding power supply channel, and when a secondary overcurrent occurs in the corresponding power supply channel, outputs a secondary overcurrent signal to the corresponding secondary monitoring module, and disconnects the corresponding power switch 150. For example, when the electronic fuse 160 set on the main power supply channel determines that a secondary overcurrent occurs, it outputs a secondary overcurrent signal to the main secondary monitoring module 221, and controls the power switch 150 on the corresponding main power supply channel to disconnect, so that the main power supply channel with the secondary overcurrent stops supplying power; when the electronic fuse 160 set on the backup power supply channel determines that a secondary overcurrent occurs, it outputs a secondary overcurrent signal to the backup secondary monitoring module 222, and controls the corresponding power switch 150 to disconnect, so that the backup power supply channel with the secondary overcurrent stops supplying power. On the other hand, when the corresponding power supply channel recovers from the secondary overcurrent, the electronic fuse 160 outputs a secondary overcurrent recovery signal to the main secondary monitoring module 221 and the backup secondary monitoring module 222. Among them, the secondary overcurrent recovery can be determined based on the received signal of the electronic fuse 160, or can be determined based on the current sampling value, which is not limited here.

[0115] The main secondary monitoring module 221 and the backup secondary monitoring module 222 receive the secondary overcurrent signal corresponding to the main power supply channel and the secondary overcurrent signal corresponding to the backup power supply channel respectively, determine that the corresponding power supply channel has a secondary overcurrent based on the secondary overcurrent signal, output a secondary overcurrent fault signal to the fault mode processing module based on the received secondary overcurrent signal, and control the power switch 150 of the corresponding power supply channel to disconnect. It can be understood that before the main secondary monitoring module 221 and the backup secondary monitoring module 222 control the corresponding power switch 150, the power switch 150 has been controlled to disconnect by the electronic fuse 160.

[0116] After the power switch 150 disconnection time reaches the first preset time, the power supply recovery times of the corresponding power supply channel are obtained. If the power supply recovery times are less than the preset recovery times, and the secondary overcurrent recovery signal of the corresponding power supply channel is received, the main secondary monitoring module 221 and the backup secondary monitoring module 222 send a power supply connection signal to the electronic fuse 160 of the corresponding power supply channel, and the electronic fuse 160 controls the power switch 150 of the corresponding power supply channel to close based on the received power supply connection signal, so that the power supply channel is restored to power. Otherwise, the power switch 150 is kept disconnected.

[0117] As a specific embodiment of the present application, the overcurrent protection control of the main secondary monitoring module 221 and the backup secondary monitoring module 222 can be as follows: Figure 5 The following steps are shown:

[0118] S101, control the secondary overcurrent closing and recovery times timer to be cleared, and control the enabling signal of the electronic fuse to be set, and control the corresponding power supply switch to be closed.

[0119] S102, determine whether the secondary overcurrent fault signal is set. Wherein, the setting is 1. When the secondary overcurrent fault signal is set to 1, the corresponding main secondary monitoring module 221 and the backup secondary monitoring module 222 receive the secondary overcurrent signal, and determine that the corresponding power supply channel has a secondary overcurrent fault, and then execute step S103; if not, the main secondary monitoring module 221 and the backup secondary monitoring module 222 do not receive the secondary overcurrent signal, and the power supply channel does not have a secondary overcurrent, then execute step S102.

[0120] S103, outputting a secondary overcurrent fault signal to the fault mode processing module, and controlling the disconnection of the power supply switch corresponding to the electronic fuse.

[0121] S104, the over-current disconnection time timer counts up.

[0122] S105, determining whether the overcurrent disconnection time reaches the first preset time t1. If yes, executing step 106; if no, executing step S104.

[0123] S106, obtaining the power supply recovery times of the corresponding power supply channel.

[0124] S107, determine whether the power supply recovery times are less than the preset recovery times N, and whether the secondary overcurrent recovery signal of the corresponding power supply channel is received. If yes, execute step S109; if not, execute step S108.

[0125] S108, maintain the current state.

[0126] S109, sending a power supply connection signal to the electronic fuse of the corresponding power supply channel to control the power supply switch of the corresponding power supply channel to close. Execute step S102.

[0127] It should be noted that the above-mentioned overcurrent protection control process corresponds to the power supply switch and the power supply channel. The parameters in the overcurrent protection control can be set based on parameters such as different power supply switch types, power supply loads or power supply requirements of the power supply channel, and are not limited here.

[0128] According to some embodiments of the present application, referring to Figure 3 As shown, each power supply channel includes a power supply switch 150 and an electronic fuse 160. The electronic fuse 160 is used to output a secondary overvoltage signal and control the corresponding power supply switch 150 to disconnect when the secondary overvoltage of the corresponding power supply channel occurs, and to output a secondary overvoltage recovery signal when the secondary overvoltage of the corresponding power supply channel is recovered.

[0129] The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: receive the secondary overvoltage signal of the corresponding power supply channel; when receiving the secondary overvoltage signal of the corresponding power supply channel, output the secondary overvoltage fault signal, and send a power cut-off signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to disconnect; receive the secondary overvoltage recovery signal of the corresponding power supply channel; when receiving the secondary overvoltage recovery signal of the corresponding power supply channel, send a power connection signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to close for power recovery.

[0130] The power switch 150 may be connected in series in the corresponding power supply channel, and the corresponding power supply channel may be controlled by controlling the power switch 150. Specifically, when the power switch 150 connected in series with a certain power supply channel is closed, the power supply channel is in the on state, and the corresponding load may be powered through the power supply channel; when the power switch 150 connected in series with a certain power supply channel is disconnected, the power supply channel is in the off state, and the power supply channel stops supplying power to the corresponding load.

[0131] When the sampled voltage of the corresponding power supply channel exceeds the voltage specified value, the electronic fuse 160 controls the corresponding power supply switch to be disconnected to control the power supply channel to stop supplying power. In this embodiment, the voltage specified value can be set based on the secondary overvoltage diagnosis requirement. On the one hand, the electronic fuse 160 can output a secondary overvoltage signal to the corresponding secondary monitoring module when a secondary overvoltage occurs in the corresponding power supply channel, and disconnect the corresponding power switch 150 at the same time. For example, when the electronic fuse 160 set on the main power supply channel determines that a secondary overvoltage occurs, it outputs a secondary overvoltage signal to the main secondary monitoring module 221, and controls the power switch 150 on the corresponding main power supply channel to be disconnected, so that the main power supply channel with the secondary overvoltage stops supplying power; when the electronic fuse 160 set on the backup power supply channel determines that a secondary overvoltage occurs, it outputs a secondary overvoltage signal to the backup secondary monitoring module 222, and controls the corresponding power switch 150 to be disconnected, so that the backup power supply channel with the secondary overvoltage stops supplying power. On the other hand, when the corresponding power supply channel recovers from the secondary overvoltage, the electronic fuse 160 outputs a secondary overvoltage recovery signal to the main secondary monitoring module 221 and the backup secondary monitoring module 222. The electronic fuse 160 may determine that the corresponding power supply channel recovers from the secondary overvoltage based on the received signal, or determine that the corresponding power supply channel recovers from the secondary overvoltage based on voltage sampling, which is not limited here.

[0132] Specifically, the main secondary monitoring module 221 and the backup secondary monitoring module 222 generate corresponding secondary overvoltage fault signals based on the received secondary overvoltage signals, and control the power switch 150 of the corresponding power supply channel to be disconnected, and control the power switch 150 of the corresponding power supply channel to be closed based on the secondary overvoltage recovery signal to restore power supply. The control process of the main secondary monitoring module 221 and the backup secondary monitoring module 222 for secondary overvoltage can be as follows: Figure 6 As shown, the following steps are included:

[0133] S201, set the overvoltage fault signal. The setting to 1 is used to indicate the initialization operation of the overvoltage monitoring of the main secondary monitoring module 221 and the backup secondary monitoring module 222. When the main secondary monitoring module 221 and the backup secondary monitoring module 222 receive the secondary overvoltage signal of the corresponding power supply channel, step S202 is executed; when the main secondary monitoring module 221 and the backup secondary monitoring module 222 receive the secondary overvoltage recovery signal of the corresponding power supply channel, step S204 is executed.

[0134] S202, output a secondary overvoltage fault signal.

[0135] S203, sending a power cutoff signal to the electronic fuse of the corresponding power supply channel to reset the enable signal of the electronic fuse to control the power switch of the corresponding power supply channel to be disconnected.

[0136] S204, determining whether the overvoltage fault of the corresponding power supply channel is repaired.

[0137] S205 , sending a power supply connection signal to the electronic fuse of the corresponding power supply channel to set the enable signal of the electronic fuse to control the power supply switch of the corresponding power supply channel to close.

[0138] It should be noted that before the main secondary monitoring module 221 and the backup secondary monitoring module 222 send the power cut-off signal based on the secondary overvoltage signal to control the corresponding power switch 150 to disconnect, the power switch 150 has been disconnected by the electronic fuse 160. The main secondary monitoring module 221 and the backup secondary monitoring module 222 send the power cut-off signal again, so that the electronic fuse 160 can control the disconnection of the power switch 150 again based on the power cut-off signal, thereby further improving the control stability of the power cut-off.

[0139] According to some embodiments of the present application, each power supply channel includes a power switch 150 and an electronic fuse 160, and the electronic fuse 160 is used to obtain the actual switch state of the corresponding power switch 150. The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: receive the actual switch state of the corresponding power switch 150; when the actual switch state is different from the expected switch state, accumulate the stuck fault time of the corresponding power switch 150, and when the accumulated stuck fault time reaches a first preset value, output a power switch stuck fault signal; when the actual switch state is the same as the expected switch state, decrement the stuck fault time of the corresponding power switch 150, and when the accumulated stuck fault time reaches a second preset value, determine that the corresponding power switch is stuck and recovered.

[0140] Specifically, the power switch 150 is connected in series in the corresponding power supply channel, and the corresponding power supply channel is controlled by controlling the power switch 150. The electronic fuse 160 detects the actual switch state of the corresponding power switch 150.

[0141] When the power switch 150 of the power supply channel is stuck, the intelligent power distribution controller cannot correctly control the power supply to the load, violating the functional safety requirements. Therefore, the stuck state of the power switch 150 must be diagnosed and the staff must be informed of the fault in a timely manner to perform maintenance operations to avoid hazards.

[0142] For this purpose, the present application proposes a control process for a stuck fault of a power switch, see Figure 7 As shown, the control process may include the following steps:

[0143] S301 , obtaining the actual switch state of the corresponding power switch. During operation, the electronic fuse obtains the actual switch state of the corresponding power switch and sends it to the corresponding main secondary monitoring module 221 and backup secondary monitoring module 222 .

[0144] S302, determine whether the actual switch state of the corresponding power switch is the same as the expected switch state. If yes, execute step S303; if not, execute step S306.

[0145] S303, determine whether the stuck fault time reaches the second preset value t2. If yes, execute step S304; if no, execute step S305.

[0146] S304, determining whether the corresponding power switch is stuck and recovered. Execute step S301.

[0147] S305, the stuck fault time is reduced by 1. Execute step S301.

[0148] S306, determine whether the stuck fault time reaches the first preset value t1. If yes, execute step S307; if not, execute step S308.

[0149] S307, determining that a stuck fault occurs in the power switch, and outputting a stuck fault signal of the power switch. Execute step S301.

[0150] S308, the stuck fault time is increased by 1. Execute step S301.

[0151] This embodiment diagnoses the stuck fault of the power switch based on the actual working state of the power switch 150 and the expected switch state, so that when the power switch 150 of the power supply channel has a stuck fault, the staff is promptly informed of the fault so that maintenance operations can be performed.

[0152] According to some embodiments of the present application, each power supply channel includes an electronic fuse 160, and the electronic fuse 160 includes a current acquisition unit for collecting the current of the corresponding power supply channel. The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: send a current acquisition self-test instruction to the electronic fuse 160 of the corresponding power supply channel, so that the electronic fuse 160 of the corresponding power supply channel performs a self-test on its own current acquisition unit and outputs the sampling resistor voltage difference of the current acquisition unit; receive the sampling resistor voltage difference of the corresponding power supply channel; when the sampling resistor voltage difference does not reach the preset voltage difference threshold, output the current acquisition unit self-test fault signal; when the sampling resistor voltage difference reaches the preset voltage difference threshold, determine that the current acquisition unit self-test fault is recovered.

[0153] Specifically, the electronic fuse 160 has a current acquisition unit, and the electronic fuse 160 acquires the current of the power supply channel through the current acquisition unit. When it is determined that the power supply channel has an overcurrent based on the acquired current, an overcurrent fault signal is issued and the corresponding power supply switch 150 is disconnected. If the current acquisition unit of the electronic fuse 160 fails, that is, the electronic fuse 160 cannot detect the overcurrent in time, then when the corresponding power supply channel has an overcurrent, the intelligent power distribution controller cannot disconnect the corresponding power supply switch 150 in time, resulting in the intelligent power distribution controller being unable to work normally, and the power supply of each power supply channel being uncontrolled, causing harm.

[0154] Therefore, the present application diagnoses the current acquisition unit and issues a fault alarm in time, wherein the electronic fuse 160 has a current unit self-checking function, and the current acquisition self-checking instruction sent by the main secondary monitoring module 221 and the backup secondary monitoring module 222 to the corresponding electronic fuse 160 can timely detect the current acquisition unit failure of the electronic fuse 160. As a specific embodiment of the present application, the current acquisition unit self-checking function of the main secondary monitoring module 221 and the backup secondary monitoring module 222 can be realized as follows Figure 8 As shown, the following steps are included:

[0155] S401, the secondary monitoring module (the main secondary monitoring module 221, the backup secondary monitoring module 222) sends a current collection self-test instruction to the electronic fuse of the corresponding power supply channel.

[0156] S402, the electronic fuse performs a self-test process on its own current acquisition unit based on the received current acquisition self-test instruction, and outputs the sampling resistance voltage difference obtained by the self-test to the corresponding secondary monitoring module.

[0157] S403, the secondary monitoring module determines whether the sampling resistor voltage difference reaches a preset voltage difference threshold. If yes, execute step S404; if not, execute step S405.

[0158] S404, determining that the current sampling unit has a self-detection fault, and outputting a current sampling unit self-detection fault signal.

[0159] S405, determining that the current acquisition unit self-test fault is recovered.

[0160] According to some embodiments of the present application, the functional safety level of the main secondary monitoring module 221 and the backup secondary monitoring module 222 is greater than or equal to ASILB, and the functional safety level of the failure mode processing module is ASILD.

[0161] Specifically, the present application adopts the idea of ​​redundant decomposition, and divides the power supply control function into two functional modules with a level greater than or equal to ASILB, namely, the main secondary monitoring module 221 and the backup secondary monitoring module 222. For example, the functional safety level of the main secondary monitoring module 221 and the backup secondary monitoring module 222 can be ASILB, ASILC, ASILD, etc. When the functional safety level of the main secondary monitoring module 221 and the backup secondary monitoring module 222 is level B, the functional safety requirements of ASILD can be achieved under the redundancy of the main power supply channel and the backup power supply channel.

[0162] This embodiment adopts the idea of ​​redundant decomposition, by dividing the power supply control function into two ASIL B (D) level functional modules to respectively implement the secondary diagnostic function for the main power supply channel and the backup power supply channel, so that the power supply of the first level load by the intelligent power distribution controller meets the ASIL D level safety requirements.

[0163] Therefore, the second software layer 220 of the present application realizes the function of the application layer with a safety level above ASIL B level, and the application layer includes two major types of modules: the first type is the power supply control function directly derived from the functional safety requirements (power supply to the outside when there is no fault, and power off in time when there is a fault); the second type is the safety mechanism for components that affect the power supply control function after a fault occurs (such as the stuck diagnosis of the power switch and the self-test of the current acquisition unit). Specifically, the second software layer 220 may include the following functions: overcurrent and overvoltage protection function of the main power supply channel, stuck diagnosis of the power switch of the main power supply channel, self-test function of the current acquisition unit of the main power supply channel, overcurrent and overvoltage protection function of the backup power supply channel, stuck diagnosis of the power switch of the backup safety channel, and self-test function of the current acquisition unit of the backup safety channel. Further, according to the independence requirements after the functional safety redundancy decomposition, the relevant control and diagnosis functions of the main power supply channel and the control and diagnosis of the backup power supply channel are deployed in two different software modules.

[0164] According to some embodiments of the present application, the third software layer 230 includes: a system module 231 for performing hardware monitoring on the controller; and a driver module 232 for driving and controlling each power supply channel.

[0165] Specifically, the third software layer 230 is a related module of the underlying software BSW (Basic Software), which is divided into two types of modules: the AutoSar standard module, namely the system module 231, and the driver module 232. Among them, the system module 231 provides the intelligent power distribution controller with basic operating system, watchdog monitoring, communication management, mode management and other functions, while the driver module 232 is used to receive the relevant instructions sent by the application layer (i.e., the layer where the first software layer 210 and the second software layer 220 are located) to control the electronic fuse 160.

[0166] According to some embodiments of the present application, the intelligent power distribution controller also includes a safety power chip 170, and the system module 231 is used to: receive a watchdog seed of the safety power chip 170; the watchdog seed includes a target control instruction of a target power supply channel, and the target power supply channel is at least one of a main power supply channel and a backup power supply channel; send the watchdog seed to the second software layer 220, so that the main secondary monitoring module 221 and the backup secondary monitoring module 222 of the second software layer 220 generate a drive control instruction for the target power supply channel based on the target control instruction, and send it to the drive module 232, so that the drive module 232 generates a watchdog response signal; receive the watchdog response signal, and send the watchdog response signal to the safety power chip 170, so that the safety power chip 170 determines whether the controller is normal based on the watchdog response signal.

[0167] Specifically, the target control instruction of the target power supply channel refers to a control instruction for the electronic fuse of the target power supply channel, which is used to control the closing and opening of the electronic switch 150 corresponding to the electronic fuse 160 of the target power supply channel.

[0168] The third software layer 230 monitors the running sequence and running time of the software modules (main secondary monitoring module 221 and backup secondary monitoring module 222) in the second software layer 220 by combining with the safety power chip 170. When the relevant software modules fail to run in the correct sequence and time, the safety power chip 170 forces the backup power supply channel to supply power, and the power supply of the backup power supply channel is no longer controlled by the controller.

[0169] The specific program flow monitoring route is as follows: Figure 4 As shown by the dotted line in the middle, first, the safety power chip 170 sends out a target control instruction watchdog seed including a main power supply channel and a backup power supply channel, the system module 231 receives the watchdog seed, and then abstracts its watchdog seed as Wdg through the microcontroller abstraction layer inside the system module 231, and then abstracts it as WdgIf through the ECU abstraction layer, and finally converts it into WdgM by the service layer, and sends it to the main secondary monitoring module 221 and the backup secondary monitoring module 222 of the second software layer 220. The main secondary monitoring module 221 and the backup secondary monitoring module 222 generate a drive control instruction for the target power supply channel based on the received WdgM, and send it to the drive module 232. The drive module 232 generates a watchdog response signal based on the drive control instruction, and the watchdog response signal is sent to the safety power chip 170 through the system module 231.

[0170] If the controller 130 executes the relevant software modules in the correct operating sequence within the specified time, the correct watchdog response signal will be returned to the safety power chip 170. If the relevant software modules do not run correctly within the specified time, the correct watchdog response signal cannot be returned. Therefore, the safety power chip 170 can determine whether the controller 130 is normal according to the received watchdog response signal. When it is determined that the hardware of the controller 130 is normal, the controller 130 continues to perform power supply control; when it is determined that the hardware of the controller 130 is abnormal, the safety power chip 170 controls the fault pin to be pulled high, and the vehicle system enters the limp mode, that is, the electronic fuse 160 is controlled by the safety power chip 170.

[0171] According to some embodiments of the present application, the functional safety level of the system module 231 and the driver module 232 is ASIL D.

[0172] This embodiment implements a question-and-answer watchdog mechanism for logic and time independence diagnosis based on the system module 231 and the driver module 232 of the ASIL D functional safety level, monitors hardware failures at the ECU and microcontroller levels, and simultaneously receives the enable signal of the electronic fuse sent by the safety power chip 170 to control the closing and opening of the electronic switch 150 corresponding to the electronic fuse 160.

[0173] In summary, the safety monitoring system of the intelligent power distribution controller of the present application analyzes the functional safety requirements and non-functional safety requirements of the intelligent power distribution controller, modularly designs the application layer software functions of the intelligent power distribution controller, deploys the first-level diagnosis that does not affect the power supply control in the first software layer, deploys the second-level diagnosis and power supply-related safety mechanisms related to power supply control in the second software layer, and deploys the hardware monitoring function of the controller in the third software layer, so that the power supply of the intelligent power distribution controller to the load can easily meet the target functional safety level requirements.

[0174] Corresponding to the above embodiments, the present application also proposes a controller.

[0175] like Fig. 9 As shown, the controller 130 in the present application includes the safety monitoring system 200 of the above-mentioned intelligent power distribution controller.

[0176] Corresponding to the above embodiments, the present application also proposes an intelligent power distribution controller.

[0177] like Fig.10 As shown, the intelligent power distribution controller 100 in the present application includes the above-mentioned security monitoring system 200 of the intelligent power distribution controller, or, as shown in FIG. Fig.11 As shown, the intelligent power distribution controller 100 in the present application includes the above-mentioned controller 130 .

[0178] Corresponding to the above embodiments, the present application also proposes a vehicle.

[0179] like Fig.12 As shown, in the present application, the vehicle 1000 includes the safety monitoring system 200 of the above-mentioned intelligent power distribution controller, or, as Fig.13 As shown, the vehicle 1000 in the present application includes the above-mentioned controller 130, or, as Fig.14 As shown, the vehicle 1000 in the present application includes the above-mentioned intelligent power distribution controller 100.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and they should all be included in the scope of the claims and specification of the present application. In particular, as long as there is no structural conflict, the various technical features mentioned in the various embodiments can be combined in any way. The present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions that fall within the scope of the claims.

Claims

1. A safety monitoring system for an intelligent power distribution controller, It is characterized in that The intelligent power distribution controller includes a main power supply channel for supplying power to a first level load and a second level load, a backup power supply channel for supplying power to the first level load, and a controller for monitoring the main power supply channel and the backup power supply channel, the safety monitoring system is applied to the controller, and the safety monitoring system includes: The first software layer is used to perform primary diagnosis on each power supply channel and to manage communications; The second software layer is used to perform secondary diagnosis and control of each power supply channel and perform fault mode processing; The third software layer is used to perform hardware monitoring on the controller.

2. The security monitoring system according to claim 1, It is characterized in that The first software layer includes: The primary diagnosis module is used to perform primary diagnosis on each power supply channel; The communication management module is used for communication management.

3. The security monitoring system according to claim 2, It is characterized in that The primary diagnosis module is used to perform primary diagnosis on each power supply channel to obtain a primary fault signal; The communication management module is used to process the first-level fault signal and send the processed first-level fault signal to the external communication bus of the intelligent power distribution controller; wherein the first-level diagnosis includes one or more of first-level overcurrent diagnosis, first-level overvoltage diagnosis, first-level undervoltage diagnosis and first-level overtemperature diagnosis.

4. The security monitoring system according to claim 2 or 3, It is characterized in that The functional safety level of the primary diagnostic module and the communication management module is QM under the ISO26262 standard.

5. The security monitoring system according to claim 1, It is characterized in that The second software layer includes: A main secondary monitoring module, used for performing secondary diagnosis and control on the main power supply channel; A backup secondary monitoring module, used for performing secondary diagnosis and control on the backup power supply channel; The failure mode processing module is used for performing failure mode processing.

6. The security monitoring system according to claim 5, It is characterized in that The main secondary monitoring module is used to perform secondary diagnosis on the main power supply channel to obtain a secondary fault signal, and perform fault protection control on the main power supply channel; The backup secondary monitoring module is used to perform secondary diagnosis on the backup power supply channel to obtain a secondary fault signal, and perform fault protection control on the backup power supply channel; The fault mode processing module is used to arbitrate the secondary fault signal to obtain a fault mode signal, and send the fault mode signal to the external communication bus of the intelligent power distribution controller through the first software layer; wherein the secondary diagnosis includes one or more of secondary overcurrent diagnosis, secondary overvoltage diagnosis, secondary undervoltage diagnosis, secondary overtemperature diagnosis, power switch stuck diagnosis and current acquisition unit self-test diagnosis.

7. The security monitoring system according to claim 6, It is characterized in that Each power supply channel includes a power supply switch and an electronic fuse. The electronic fuse is used to output a secondary overcurrent signal and control the corresponding power supply switch to disconnect when the secondary overcurrent of the corresponding power supply channel occurs, and output a secondary overcurrent recovery signal when the secondary overcurrent of the corresponding power supply channel is restored. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: Receive a secondary overcurrent signal of a corresponding power supply channel; When receiving the secondary overcurrent signal of the corresponding power supply channel, outputting the secondary overcurrent fault signal, and sending the power supply cut-off signal to the electronic fuse of the corresponding power supply channel to control the power supply switch of the corresponding power supply channel to be disconnected; After a first preset delay time, the power supply recovery times of the corresponding power supply channel are obtained, and when the power supply recovery times are less than the preset recovery times and the secondary overcurrent recovery signal of the corresponding power supply channel is received, a power supply connection signal is sent to the electronic fuse of the corresponding power supply channel to control the power supply switch of the corresponding power supply channel to close for power recovery.

8. The security monitoring system according to claim 6, It is characterized in that Each power supply channel includes a power switch and an electronic fuse. The electronic fuse is used to output a secondary overvoltage signal and control the corresponding power switch to disconnect when the secondary overvoltage of the corresponding power supply channel is over, and output a secondary overvoltage recovery signal when the secondary overvoltage of the corresponding power supply channel is restored. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: receiving a secondary overvoltage signal of a corresponding power supply channel; When receiving the secondary overvoltage signal of the corresponding power supply channel, outputting the secondary overvoltage fault signal, and sending the power supply cut-off signal to the electronic fuse of the corresponding power supply channel to control the power supply switch of the corresponding power supply channel to be disconnected; Receive a secondary overvoltage recovery signal of a corresponding power supply channel; When the secondary overvoltage recovery signal of the corresponding power supply channel is received, a power supply connection signal is sent to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to close and restore power supply.

9. The security monitoring system according to claim 6, It is characterized in that Each power supply channel includes a power supply switch and an electronic fuse, wherein the electronic fuse is used to obtain the actual switch state of the corresponding power supply switch, and the main secondary monitoring module and the backup secondary monitoring module are respectively used to: Receiving the actual switch state of the corresponding power switch; When the actual switch state is different from the expected switch state, accumulating the stuck fault time of the corresponding power switch, and outputting a stuck fault signal of the power switch when the accumulated stuck fault time reaches a first preset value; When the actual switch state is the same as the expected switch state, the stuck fault time of the corresponding power switch is cumulatively decremented, and when the subtracted stuck fault time reaches a second preset value, it is determined that the stuck state of the corresponding power switch is recovered.

10. The security monitoring system according to claim 6, It is characterized in that Each power supply channel includes an electronic fuse, and the electronic fuse includes a current acquisition unit for collecting the current of the corresponding power supply channel. The main secondary monitoring module and the backup secondary monitoring module are respectively used for: Sending a current collection self-test instruction to the electronic fuse of the corresponding power supply channel, so that the electronic fuse of the corresponding power supply channel performs a self-test on its own current collection unit and outputs a sampling resistor voltage difference of the current collection unit; Receive the sampling resistor voltage difference of the corresponding power supply channel; When the sampling resistor voltage difference does not reach a preset voltage difference threshold, a current acquisition unit self-test fault signal is output; When the sampling resistor voltage difference reaches the preset voltage difference threshold, it is determined that the current acquisition unit self-test fault is recovered.

11. The security monitoring system according to any one of claims 5 to 10, It is characterized in that The functional safety level of the main secondary monitoring module and the backup secondary monitoring module is greater than or equal to ASILB under the ISO26262 standard, and the functional safety level of the failure mode processing module is ASILD under the ISO26262 standard.

12. The security monitoring system according to claim 5, It is characterized in that The third software layer includes: A system module, used for performing hardware monitoring on the controller; The driving module is used to drive and control each power supply channel.

13. The security monitoring system according to claim 12, It is characterized in that The intelligent power distribution controller also includes a safety power chip, and the system module is used for: Receive a watchdog seed of the safety power chip; the watchdog seed includes a target control instruction of a target power supply channel, and the target power supply channel is at least one of the main power supply channel and the backup power supply channel; Sending the watchdog seed to the second software layer, so that the main secondary monitoring module and the backup secondary monitoring module of the second software layer generate the drive control instruction of the target power supply channel based on the target control instruction, and send it to the drive module, so that the drive module generates a watchdog response signal; The watchdog response signal is received, and the watchdog response signal is sent to the safety power chip, so that the safety power chip determines whether the controller is normal based on the watchdog response signal.

14. The security monitoring system according to claim 12 or 13, It is characterized in that The functional safety level of the system module and the drive module is ASIL D under the ISO26262 standard.

15. The security monitoring system according to claim 1, It is characterized in that The first level of load is a safe load, and the second level of load is a non-safe load.

16. A controller, It is characterized in that A safety monitoring system comprising an intelligent power distribution controller according to any one of claims 1-15.

17. An intelligent power distribution controller, It is characterized in that Comprising a safety monitoring system of an intelligent power distribution controller according to any one of claims 1-15, or a controller according to claim 16.

18. A vehicle, It is characterized in that It comprises a safety monitoring system of an intelligent power distribution controller according to any one of claims 1 to 15, or a controller according to claim 16, or an intelligent power distribution controller according to claim 17.

Images