Control device, vehicle, and power supply method for control device

Abstract

The invention provides a control device, a vehicle and a power-on method of the control device. The control device comprises a control unit, a processing unit and more than one peripheral in communication connection with the processing unit, the power supply system comprises a primary power supply module, a secondary power supply module and a power supply control unit; wherein the primary power supply module is configured to supply power to the power supply control unit and the secondary power supply module in response to a first enable signal of the control unit; the power control unit is configured to: supply power to the processing unit in response to a second enable signal of the control unit; and the secondary power supply module is configured to supply power to the peripheral equipment in response to a third enable signal of the control unit.

Description

Technical Field

[0001] The present disclosure relates to the field of control technologies, and particularly to a control device, a vehicle, and a power supply method for the control device. Background Art

[0002] Under the need of the development of electronization and intelligence, control devices are provided in most systems to complete specific functions. In some control devices, a processing unit and peripherals are provided, and the processing unit has gradually evolved from a distributed architecture to a centralized architecture driven by a powerful System on Chip (SoC). How to provide reliable power supply for the power-consuming units of the control device has become an urgent problem to be solved. Summary of the Invention

[0003] In view of this, the present disclosure provides a control device, a vehicle, and a power supply method for the control device, so as to achieve reliable power supply for the control device.

[0004] According to a first aspect of the present disclosure, a control device is provided, including:

[0005] A control unit;

[0006] A processing unit;

[0007] One or more peripherals communicatively connected to the processing unit; and

[0008] A power supply system, including a primary power module, a secondary power module, and a power control unit,

[0009] Wherein,

[0010] The primary power module is configured to: supply power to the power control unit and the secondary power module in response to a first enable signal of the control unit;

[0011] The power control unit is configured to: supply power to the processing unit in response to a second enable signal of the control unit;

[0012] The secondary power module is configured to: supply power to the peripherals in response to a third enable signal of the control unit.

[0013] According to a second aspect of the present disclosure, a control device is provided, including:

[0014] A control unit;

[0015] A processing unit;

[0016] A power management unit, configured to: supply power to a control unit and perform a power-on check; in response to a successful power-on check, send a notification to the control unit, where the power-on check includes: checking the power supply output of the power management unit to the control unit and the status of the control unit;

[0017] A control unit, configured to: at least partially in response to the notification from the power management unit, send an enable signal to a power supply unit;

[0018] A power supply unit, configured to: in response to the enable signal, supply power to the processing unit.

[0019] According to a third aspect of the present disclosure, there is provided a control device, including:

[0020] A processing unit;

[0021] A control unit;

[0022] A power supply monitoring unit,

[0023] A power supply unit for supplying power to the processing unit;

[0024] The control unit is configured to:

[0025] Write monitoring configuration information into the power supply monitoring unit to start the power-on check of the power supply monitoring unit,

[0026] In response to a successful power-on check, control the power supply unit to supply power to the processing unit.

[0027] According to a fourth aspect of the present disclosure, there is provided a vehicle, where the vehicle includes at least one control device according to any one of the first to third aspects above.

[0028] According to a fifth aspect of the present disclosure, there is provided a power supply (power-on) method for a control device, where the control device includes a control unit, a processing unit, and more than one peripheral device and a power supply system, and the power supply system includes a primary power module, a secondary power module, and a power control unit. Wherein, the power supply method includes:

[0029] The primary power module supplies power to the power control unit and the secondary power module in response to a first enable signal from the control unit;

[0030] The power control unit supplies power to the processing unit in response to a second enable signal from the control unit;

[0031] The secondary power module supplies power to the more than one peripheral device in response to a third enable signal from the control unit.

[0032] According to a sixth aspect of the present disclosure, a method for powering on a control device is provided, where the control device includes: a control unit, a processing unit, a power management unit, a control unit, and a power supply unit.

[0033] The method includes:

[0034] The power management unit powers on the control unit and performs a power-on check, where the power-on check includes: checking the power supply output of the power management unit to the control unit and the status of the control unit.

[0035] The power management unit sends a notification to the control unit in response to a successful power-on check.

[0036] The control unit, at least in part in response to the notification from the power management unit, controls the power supply unit to power on the processing unit.

[0037] According to a seventh aspect of the present disclosure, a method for powering on a control device is provided. The control device includes a processing unit, a control unit, a power supply monitoring unit, and a power supply unit.

[0038] The control unit writes monitoring configuration information to the power supply monitoring unit to initiate a power-on check of the power supply monitoring unit.

[0039] The power supply monitoring unit controls the power supply unit to power on the processing unit in response to a successful power-on check.

[0040] It can be seen from the above technical solutions that the technical solutions provided by the present disclosure disclose the following technical effects:

[0041] 1) The present disclosure provides a two-stage power supply scheme for the control device. The primary power supply module and the secondary power supply module are respectively independently enabled and controlled by the control unit. By setting the power control unit and the secondary power supply module to supply power to the processing unit and one or more peripheral devices (hereinafter referred to as peripherals) respectively, reasonable power supply to the control device is achieved. Thereby ensuring reliable power supply to the power-consuming units of the control device and enhancing the safety performance of the control device.

[0042] 2) The present disclosure can, through the power management unit's check of its own power supply output and the power supply of the control unit, ensure that the control unit enters the normal working state only when the power supply output of the power management unit and the status of the control unit are normal, thereby ensuring the normal operation of the control unit. Thereby ensuring reliable power supply to the power-consuming units of the control device and enhancing the safety performance of the control device.

[0043] 3) The present disclosure performs a power-on check on the power supply monitoring unit for monitoring the power supply of the processing unit. After the power-on check is successful, the processing unit is powered on, thereby ensuring the reliable operation of the processing unit. This ensures the reliable power supply of the power-consuming units of the control device and enhances the safety performance of the control device.

[0044] Of course, it is not necessary to achieve all the above-mentioned advantages simultaneously when implementing the technical solutions provided by the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings required to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present disclosure. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0046] Figure 1 Schematic diagram of the control device provided by an embodiment of the present disclosure;

[0047] Figure 2 Schematic diagram of the control device provided by another embodiment of the present disclosure;

[0048] Figure 3 Flowchart of the power supply method provided by an embodiment of the present disclosure;

[0049] Figure 4 Flowchart of the power supply method provided by an embodiment of the present disclosure;

[0050] Figure 5 Schematic diagram of the vehicle provided by an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present disclosure with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some embodiments of the present disclosure, rather than all embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present disclosure.

[0052] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments, and are not intended to limit the present disclosure. The singular forms "a", "the" and "said" used in the embodiments of the present disclosure and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0053] It should be understood that the term "and / or" used herein is merely a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. Additionally, the character " / " in this text generally represents an "or" relationship between the associated objects before and after.

[0054] Depending on the context, the word "if" as used herein can be interpreted as "when" or "while" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if determined" or "if detecting (stated condition or event)" can be interpreted as "when determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)".

[0055] Figure 1 FIG. is a schematic structural diagram of a control device 100 provided for an embodiment of the present application. The control device 100 can be Figure 5 an example of the control device in the computing system 550. As Figure 1 shown, the control device 100 can include: a processing unit 50, a control unit 60, more than one peripheral 80 communicatively connected to the processing unit 50, and a power supply system.

[0056] It should be noted that Figure 1 the unidirectional arrow connection lines in represent the power supply, monitoring, or control paths, and the bidirectional arrow connection lines represent the communication links.

[0057] The control device 100 may further include one or more algorithm modules (such as perception, prediction, positioning, planning, control, etc. algorithm modules). These algorithm modules may, for example, constitute an autonomous driving control unit. Some or all of the functions of the autonomous driving control unit can be implemented by program code instructions residing in the memory ( Figure 1 not shown) and executed by the processing unit 50.

[0058] The processing unit 50 can receive sensor data from, for example, Figure 5 the sensor system 544 shown, and the processing unit 50 can execute algorithm modules (such as the algorithm modules of the autonomous driving control unit) to generate control instructions and send them to, for example, Figure 5The control system 546 shown is used to control various components or units in the control system 546. For example, the processing unit 50 can send control instructions to the steering unit, power control unit, braking unit, etc. in the control system 546 to control the steering, acceleration, and braking of the vehicle respectively, so as to achieve autonomous driving without human intervention or only with limited human intervention. The processing unit 50 usually has multiple sub-units, such as a central processing unit CPU, a graphics processing unit GPU, a digital signal processor DSP, a video processing unit VPU, a SOC functional safety core, a memory (such as DDR, RAM, ROM, EEPROM, or flash memory), and one or more of the interfaces for connecting the processing unit 50 to other units. The processing unit 50 may also include a bus for data access and communication among the various sub-units in the processing unit 50.

[0059] The processing unit 50 can communicate and connect with the peripherals 80 (also called processing unit peripherals) through its interface. The peripherals 80 can include, for example, one or more of an Ethernet switch, a WIFI module, a Bluetooth module, a serializer, a deserializer, an embedded multimedia card (EMMC), a double data rate synchronous dynamic random access memory (DDR SDRAM, simply called DDR), a global navigation satellite system (GNSS) module, an inertial measurement unit (IMU), etc. It should be noted that although Figure 1 shows that the peripherals 80 include three peripherals (i.e., peripheral 1, peripheral 2, and peripheral 3), those skilled in the art can connect, and the peripherals 80 can include more or fewer peripherals.

[0060] An example of the processing unit 50 is a SoC (System on Chip). Correspondingly, the peripherals 80 are called SoC peripherals.

[0061] The control unit 60 is used to execute various controls and monitoring. An example of the control unit 60 is an MCU (micro control unit). The control unit 60 can, for example, monitor various data received by the processing unit 50 (such as sensor data), monitor various control instructions issued by the processing unit 50 (such as control instructions sent to the peripherals 80 or the vehicle control system 546), monitor the communication status of each component of the control device (such as the processing unit 50), and can also monitor whether some components in the control device are abnormal. The control unit 60 can also monitor and / or control each module in the power supply system, and can perform enable control on some modules in the power supply system.

[0062] During the process that the control unit 60 monitors the data received by the processing unit 50 (such as sensor data) and the control instructions issued, when it is found that a sensor fails or the processing unit 50 has an abnormality, it will enter the minimum safety risk condition. For example, it controls the autonomous driving control unit to perform function degradation, or execute a safe stop, etc.

[0063] The control unit 60 usually has multiple sub-units, including one or more of a central processing unit CPU, a counter, a timer, a memory (such as DDR, RAM, ROM, EEPROM, or flash memory), and an interface for connecting the control unit 60 to other units. The control unit 60 may also include a bus for controlling data access and communication among the various sub-units in the control unit 60. The control unit 60 can be communicatively connected to control unit peripherals, and the control unit peripherals can include, for example, one or more of an Ethernet switch, a WIFI module, a Bluetooth module, a serializer, a deserializer, an embedded multimedia card (EMMC), a double data rate synchronous dynamic random access memory (DDR SDRAM, simply referred to as DDR), a read-only memory (ROM), a global navigation satellite system (GNSS) module, an inertial measurement unit (IMU), a controller area network (CAN) transceiver, etc.

[0064] The control unit 60 can also configure, monitor, and / or control each unit or module of the power supply system to avoid failures of the power-consuming units of the control device 100 (such as the processing unit 50, the control unit 60, and / or the peripheral 80), the issuance of incorrect control instructions, or the transmission of abnormal data due to abnormal power supply.

[0065] An example of the power supply of the control device 100 is the vehicle's generator or battery. That is to say, the control device 100 can be powered by the vehicle's generator or battery. When the vehicle engine is in operation, the engine drives the generator to convert mechanical energy from the engine into electrical energy. In one implementation, the generator is electrically connected to the battery to store the generated electrical energy in the battery, and the battery is electrically connected to the control device to further supply the electrical energy in the battery to the control device. In one implementation, the generator is electrically connected to the control device, so that the generator directly (without passing through the battery) supplies electrical energy to the control device.

[0066] The power supply system of the control device 100 is used to connect to a power supply. The power supply system receives the power supply input (also known as the power input) from the power supply, converts it, and provides the converted electrical energy to the power-consuming units of the control device 100 to meet the requirements of each power-consuming unit in the control device 100 for the input voltage. For example, the power supply system can convert the voltage of the power supply into the voltage required for the operation of the power-consuming unit, and can ensure that the voltage provided to the power-consuming unit is stable within a small voltage range when the voltage of the power supply fluctuates within a large range. That is to say, the power supply system not only has the function of voltage conversion, but also has the function of voltage stabilization, and can provide a stable voltage for the power-consuming units.

[0067] The power supply system may include multiple power conversion modules, such as the power supply unit 14. The power supply unit 14 may include a primary power module 10 and / or a power control unit 40. The power supply system may also include a power management unit 20 and a secondary power module 30 and other power conversion modules.

[0068] The power supply unit 14 is configured to supply power to the secondary power module 30 and the processing unit 50 in response to the enable signal of the control unit 60. Specifically, the primary power module 10 of the power supply unit 14 is configured to supply power to the power control unit 40 and the secondary power module 30 in response to the enable signal of the control unit 60 (also referred to as the first enable signal for distinction).

[0069] As Figure 1 shown, the power supply provides the power supply input of the control device 100. The primary power module 10 converts the voltage of the power supply input and provides the converted voltage to other units. For example, the primary power module 10 can provide the converted voltage to the secondary power module 30 and the power control unit 40, thereby supplying power to the secondary power module 30 and the power control unit 40.

[0070] The primary power module 10 also has the function of voltage stabilization, can output a stable voltage, and can adjust the voltage when the power supply voltage fluctuates within a large range, so as to ensure that the output voltage is stable within a small voltage range.

[0071] The primary power module 10 is under the enable control of the control unit 60. When the primary power module 10 receives the enable signal (i.e., the first enable signal) of the control unit 60, it supplies power to the power control unit 40 and the secondary power module 30.

[0072] The power control unit 40 is configured to supply power to the processing unit 50. The input of the power control unit 40 can be connected to the primary power module, and its output is connected to the processing unit 50.

[0073] The power control unit 40 has a voltage conversion function, which converts the voltage provided or output by the primary power module 10 into the voltage required for the operation of the processing unit 50. The magnitudes and timings of the voltages required for the operation of different sub-units of the processing unit 50 are usually different. Thus, the power control unit 40 outputs voltages with different magnitudes and timings to different sub-units of the processing unit 50. The different voltages output by the power control unit 40 are also referred to as the power supply sequence or power sequence output by the power control unit 40. An example of the power control unit 40 is a multi-phase power controller.

[0074] The power control unit 40 also has a voltage stabilizing function and can output a stable voltage. When the voltage output by the primary power module 10 fluctuates within a large range, it can adjust the voltage to ensure that the voltage provided to the processing unit 50 is stable within a small voltage range.

[0075] The power control unit 40 is under the enabling control of the control unit 60. When the power control unit 40 receives the enabling signal from the control unit 60 (also referred to as the second enabling signal for distinction), it supplies power to the processing unit 50.

[0076] The input of the secondary power module 30 can be connected to the primary power module, and its output is connected to the peripheral device 80 (i.e., the peripheral device of the processing unit 50). The secondary power module 30 has a voltage conversion function, which converts the voltage provided or output by the primary power module 10 into the voltage required for the operation of the peripheral device 80. The voltages required for the operation of different peripheral devices 80 are usually different. Thus, the secondary power module 30 outputs different voltages to different peripheral devices 80. The different voltages output by the secondary power module 30 are also referred to as the power supply sequence or power sequence output by the secondary power module 30.

[0077] The secondary power module 30 also has a voltage stabilizing function and can output a stable voltage. When the voltage output by the primary power module 10 fluctuates within a large range, it can adjust the voltage to ensure that the output voltage is stable within a small voltage range.

[0078] The secondary power module 30 is under the enabling control of the control unit 60. When the secondary power module 30 receives the enabling signal from the control unit 60 (also referred to as the third enabling signal for distinction), it supplies power to the peripheral device 80.

[0079] Generally, the voltage of the power supply for the control device 100 is much larger than the voltages required for the operation of the peripheral device 80 and the processing unit 50. The voltage of the power supply is converted multiple times by the primary power module 10 and the secondary power module 30 (as well as the power control unit 40) and then provided to the peripheral device 80 and the processing unit 50. By using multiple power conversion modules for two-stage power supply (the primary power module 10 is the first stage, and the secondary power module 30 and the power control unit 40 are the second stage), the difference between the input and output voltages of each stage can be prevented from being too large, and the voltage finally provided to the peripheral device 80 and the processing unit 50 has good stability.

[0080] It can be seen that the embodiment of the present disclosure provides a two-stage power supply scheme for the control device, and each power conversion module in each stage is independently enabled and controlled by the control unit 60, so as to achieve reasonable power supply for the control device and improve the safety performance of the control device.

[0081] The power management unit 20 is used to supply power to the control unit 60. The input of the power management unit 20 can be connected to the power supply, and its output is connected to the control unit 60. The power management unit 20 has a voltage conversion function, which converts the voltage provided by the power supply (i.e., the voltage of the power supply input) into the voltage required for the operation of the control unit 60, so as to supply power to the control unit 60. While the power management unit 20 supplies power to the control unit 60, it can also supply power to the peripherals of the control unit 60. The voltage magnitudes and timings required for the operation of different sub-units of the control unit 60 and the peripherals of the control unit 60 are usually different. In this way, the power control unit 40 outputs voltages with different magnitudes and timings to different sub-units of the control unit 60 and the peripherals of the control unit 60, and the different voltages output by the power management unit 20 are also referred to as the power supply sequence or power sequence output by the power management unit 20.

[0082] The power management unit 20 converts the voltage of the power supply and provides the converted voltage to the control unit 60. For example, the power management unit 20 can convert the voltage of the power supply into the voltage required for the operation of the control unit 60, and the power management unit 20 can ensure that the voltage provided to the control unit 60 is stable within a small voltage range when the voltage of the power supply fluctuates within a large range. The power management unit 20 can be a PMIC (Power Management IC), such as a programmable multi-power rail PMIC that meets the functional safety ASIL D.

[0083] The power management unit 20 also has a voltage stabilizing function and can output a stable voltage. When the voltage of the power supply fluctuates within a large range, it can adjust the voltage to ensure that the output voltage is stable within a small voltage range.

[0084] The control device 100 may further include a switch for connecting to a power supply ( Figure 1 not shown in the figure). The switch is connected between the power supply and the primary power module 10 and the power management unit 20. When the switch is turned on, the power supply can supply power to the primary power module 10 and the power management unit 20.

[0085] When the control device 100 starts up (for example, the control device 100 can be started by turning on the switch, and this process is also called power-on of the control device 100), for safety reasons, each unit in the power supply system of the control device 100 will perform relevant inspections or self-checks. After each unit in the power supply system passes the inspection or self-check, the power supply system will supply power to the power-consuming units of the control device 100.

[0086] Correspondingly, the power management unit 20 is configured to: in response to receiving a power supply input, perform a power-on check according to the monitoring configuration information; in response to a successful power-on check, send a notification to the control unit 60.

[0087] During the startup of the control device 100, once the power management unit 20 receives a power supply input from the power supply (i.e., the power management unit 20 is powered on), the power management unit 20 starts to supply power to the control unit 60 and performs a power-on check. The content of the power-on check of the power management unit 20 may include but is not limited to: the power supply output of the power management unit 20 (the power supply output of the power management unit 20 is used to supply power to the control unit 60) and / or the state of the control unit 60.

[0088] The inspection of the power supply output of the power management unit 20 is mainly to ensure the reliable power supply of the control unit 60. The inspection of the power supply output of the power management unit 20 may include but is not limited to the inspection of the timing sequence of the power supply output of the power management unit 20, the voltage inspection, the current inspection, and the inspection of the power supply output of the power management unit 20 may also include checking whether there is a short circuit in the power supply output of the power management unit 20.

[0089] The inspection of the timing sequence of the power supply output of the power management unit 20 can be judged according to the preset timing requirements. If the preset timing requirements are not met, it is considered that the power supply output of the power management unit 20 is abnormal. The inspection of the voltage of the power supply output of the power management unit 20 can be judged according to the preset overvoltage threshold and undervoltage threshold to determine whether overvoltage or undervoltage occurs. If overvoltage or undervoltage occurs and lasts for a preset time, it can be determined that the power supply output of the power management unit 20 is abnormal. The inspection of the current of the power supply output of the power management unit 20 can be judged according to the preset overcurrent threshold to determine whether overcurrent occurs. If overcurrent occurs and lasts for a preset time, it can be determined that the power supply output of the power management unit 20 is abnormal.

[0090] The power management unit 20's check of the status of the control unit 60 includes the power management unit 20 checking whether the status of the control unit 60 is abnormal. The power management unit 20's check of the status of the control unit 60 may include checking whether the status of the signals of the control unit 60 is abnormal. For example, checking whether the status of the reset signal of the control unit 60 is abnormal, checking whether the status of the enable signal of the control unit 60 for controlling the power conversion module (such as the primary power module 10, the secondary power module 30, and / or the power control unit 40) is abnormal, checking whether the status of the control signal of the control unit 60 for controlling the switch (the switch for controlling the connection between the device 100 and the power supply) is abnormal, checking whether the output status of the safety status signal of the safety management module in the control unit 60 is abnormal (that is, checking whether the safety management module outputs a safety status signal). If the safety management module outputs a safety status signal, it indicates that the control unit is in a safe state (that is, the status of the control unit is abnormal). If the status of the control unit is normal, the safety management module does not output a safety status signal. If any of the above signals of the control unit 60 is abnormal, the power management unit 20 determines that the status of the control unit 60 is abnormal.

[0091] The above timing requirements, overvoltage thresholds, undervoltage thresholds, overcurrent thresholds, which statuses (or which signals) of the control unit 60 to check, etc. constitute the monitoring configuration information (also called the first monitoring configuration information for distinction), and the first monitoring configuration information can be determined according to experience and pre-configured in the power management unit 20. For example, it can be pre-burned into the power management unit 20 through a programming tool.

[0092] As described above, the status of the control unit 60 to be checked includes one or more of the following: the status of the reset signal of the control unit 60, the status of the enable signal of the control unit 60, the status of the control signal of the control unit 60 for controlling the switch, the output status of the safety status signal of the safety management module. If each item in the status of the control unit 60 to be checked is normal, then the status of the control unit 60 is normal. As long as one item in the status of the control unit 60 to be checked is abnormal, then the status of the control unit 60 is abnormal.

[0093] If the power supply output of the power management unit 20 is normal and the status of the control unit 60 is normal, the power-on check of the power management unit 20 is successful. If the power-on check is successful, the power management unit 20 sends a notification (i.e., releases a reset notification) to the control unit 60, causing the control unit 60 to enter the normal operating state from the reset state (i.e., causing the control unit 60 to release the reset, at which time the control unit 60 can normally issue an enable signal to the power conversion module), and at the same time, the power management unit 20 continuously monitors the power supply output of the power management unit 20. The control unit 60 is in the reset state before receiving the reset release notification from the power management unit 20. When in the reset state, although the control unit 60 can be powered by the control unit 60, it does not execute some functions, such as not issuing an enable signal to the power conversion module (such as the primary power module 10, the secondary power module 30, and the power control unit 40).

[0094] If the power supply output of the power management unit 20 is abnormal or the status of the control unit 60 is abnormal, the power-on check of the power management unit 20 fails. Once the power management unit 20 determines that the power-on check fails, the power management unit 20 determines not to send a reset release notification to the control unit 60, and the control unit 60 remains in the reset state. Then the power management unit 20 remains in the standby state. The power management unit 20 can re-perform the power-on check in the standby state.

[0095] The power management unit 20 can also be configured to continuously monitor the power supply status of the control unit 60 (i.e., continuously monitor the power supply output of the power management unit 20). If the power supply status (or power supply output) is abnormal, it notifies the control unit 60 to enter the safe state. That is to say, after the power-on check of the power management unit 20 is successful, during the subsequent power supply process for the control unit 60 (such as during the operation period after the control device 100 is started), it monitors its own power supply output according to the monitoring configuration information. If a power supply abnormality is detected, it triggers a safety mechanism, that is, notifies (such as through an interrupt signal and / or a safety failure signal) the control unit 60 to enter the safe state. At the same time, the power management unit 20 saves the status information of its power supply output in the register. After receiving the notification from the power management unit 20, the control unit 60 can control the primary power module 10 or the power control unit 40 to stop the power supply output to cut off the power supply to the processing unit 50. After the control unit 60 enters the safe state, it will be in the reset state, and at the same time, multiple or all control signals of the control unit are in the non-enabled state (the MCU peripherals controlled by these control signals are in the non-operating state). At this time, the safety management module of the control unit 60 outputs a safety status signal.

[0096] For example, if the power management unit 20 monitors abnormal power supply, it sends an interrupt signal to the control unit 60 (for example, to the security management module of the control unit 60). After receiving the interrupt signal, the control unit 60 aborts the ongoing operation, reads the registers of the power management unit 20 through the communication interface used by the control unit 60 to connect to the power management unit 20, and queries the status information saved by the power management unit 20 in the registers. At the same time, the power management unit 20 sends a fail-safe signal through the above communication interface, triggering the control unit 60 to enter the safe state, thus meeting the overall safety design requirements of the control device. The communication interface used by the control unit 60 to connect to the power management unit 20 is, for example, I2C (Inter-Integrated Circuit) or SPI (Serial Peripheral Interface).

[0097] As described above, the inspection and monitoring of the power supply output of the power management unit 20 can include the inspection of the timing, voltage, current, short circuit, etc. of the power supply output of the power management unit 20. Therefore, the status information saved by the power management unit 20 in the registers can include, for example, the timing, voltage value, current value, short circuit status, etc. of the power supply output of the power management unit 20.

[0098] In some embodiments, if the power management unit 20 monitors abnormal power supply output, the power management unit 20 stops supplying power to the control unit 60. That is to say, after the power management unit 20 passes the power-on inspection, during the subsequent power supply process to the control unit 60, if it monitors abnormal power supply input, it will stop supplying power to the control unit 60. Alternatively, the power management unit 20 restarts first, and if the power management unit 20 still monitors abnormal power supply output, it stops supplying power to the control unit 60.

[0099] In some embodiments, the power management unit 20 can also continuously monitor the power supply input of the power supply during the startup period and / or the working period of the control device 100 (for example, after the power management unit 20 passes the power-on inspection, during the subsequent power supply process to the control unit 60). That is, the power management unit 20 can also be configured to monitor the power supply input of the power supply. If the power supply input is abnormal, it notifies the control unit 60 to perform abnormal processing, and at the same time sends the abnormal information of the power supply input to the control unit 60. The abnormal processing of the control unit 60 can include the control unit 60 entering the safe state and saving the abnormal information of the power supply input. The abnormal processing of the control unit 60 can also include controlling the primary power module 10 or the power control unit 40 to stop the power supply output to cut off the power supply to the processing unit 50.

[0100] The control unit 60 is configured to send an enable signal (such as a first enable signal) to the corresponding power conversion module (such as the primary power module 10) at least in response to a notification from the power management unit 20 (such as a release reset notification). To control the system security of the device, the control unit 60 may also perform a power-on self-check (i.e., self-test) on itself before sending the enable signal after receiving the notification from the power management unit 20. Specifically, during the startup of the control device 100, after the control unit 60 receives the release reset notification from the power management unit 20, the control unit 60 enters the normal working state from the reset state (the control unit 60 releases the reset), and the control unit 60 starts the self-test.

[0101] The self-test of the control unit 60 includes checking whether the state of the control unit 60 is abnormal. The check of the state of the control unit 60 may include at least one of the following: checking whether the state of the enable signal for the control unit 60 to control the power conversion module (such as the primary power module 10, the secondary power module 30, and / or the power control unit 40) is abnormal, checking whether the state of the control signal of the control unit 60 (such as the control signal for controlling the switch connecting the control device 100 to the power supply) is abnormal, checking whether the output state of the security status signal of the security management module in the control unit 60 is abnormal (i.e., checking whether the security management module outputs a security status signal), whether the state of the clock signal of the control unit 60 is abnormal, whether the watchdog state of the control unit 60 is abnormal, whether the state of the memory (such as the random access memory RAM) of the control unit 60 is abnormal, and whether the state of the logic circuit of the control unit 60 is abnormal. If the security management module outputs a security status signal, it indicates that the control unit is in a secure state (i.e., the control unit state is abnormal). If the control unit state is normal, the security management module does not output a security status signal.

[0102] Thus, the state of the control unit 60 to be self-tested includes one or more of the following: the state of the enable signal of the control unit 60, the state of the control signal of the control unit 60, the output state of the security status signal of the security management module, the state of the clock signal, the watchdog state, the state of the memory (such as the random access memory RAM), and the state of the logic circuit. If each item in the state of the control unit 60 to be self-tested is normal, the state of the control unit 60 is normal. As long as one item in the state of the control unit 60 to be self-tested is abnormal, the state of the control unit 60 is abnormal.

[0103] If the state of the control unit 60 is normal, the self-test of the control unit 60 is successful. If the state of the control unit 60 is abnormal, the self-test of the control unit 60 fails. If the self-test of the control unit 60 fails, it will enter the secure state.

[0104] After the self-check of the control unit 60 is successful, parameters (i.e., the monitoring configuration information of the primary power supply module 10) are set for the primary power supply module 10, such as overvoltage threshold, undervoltage threshold, overcurrent threshold, and then an enabling signal (i.e., the first enabling signal) is sent to the primary power supply module 10. After receiving the enabling signal, the primary power supply module 10 starts to supply power to the power control unit 40 (and the secondary power supply module 30).

[0105] The control unit 60 checks the power supply output of the primary power supply module 10 (the power supply output of the primary power supply module 10 is used to supply power to the power control unit 40) (i.e., performs a power-on check on the primary power supply module 10). The check of the power supply output of the primary power supply module 10 may include, but is not limited to, checking the output voltage, current, etc. of the primary power supply module 10. The check of the output voltage of the primary power supply module 10 can determine whether overvoltage or undervoltage conditions occur based on the overvoltage threshold and undervoltage threshold preset by the control unit 60 for the primary power supply module 10. If overvoltage or undervoltage occurs and lasts for a preset duration, it can be determined that the power supply output of the primary power supply module 10 is abnormal. The check of the output current of the primary power supply module 10 can determine whether an overcurrent condition occurs based on the overcurrent threshold preset by the control unit 60 for the primary power supply module 10. If overcurrent occurs and lasts for a preset duration, it can be determined that the power supply output of the primary power supply module 10 is abnormal.

[0106] If the power supply output of the primary power supply module 10 is normal, the control unit 60 sets parameters (i.e., the monitoring configuration information of the power control unit 40), such as overvoltage threshold, undervoltage threshold, overcurrent threshold, for the power control unit 40, and then sends the set monitoring configuration information to the power control unit 40.

[0107] If the power supply output of the primary power supply module 10 is abnormal, the control unit 60 performs abnormal handling, that is, the control unit 60 enters the safe state and simultaneously saves the abnormal information of the power supply output of the primary power supply module 10. The abnormal information of the primary power supply module 10 saved by the control unit 60 may include, for example, the voltage value and / or current value of the power supply output of the primary power supply module 10. The abnormal handling of the control unit 60 may also include the control unit 60 controlling the primary power supply module 10 to restart and performing a power-on check on the primary power supply module 10 again.

[0108] In some embodiments, in addition to performing a power-on check on the power supply output of the primary power module 10 during the startup of the control device 100, the control unit 60 may also continuously monitor the power supply output of the primary power module 10 during the startup of the control device 100 and / or during the operation of the control device 100 (e.g., during the power supply output after the power-on check of the primary power module 10 is successful). That is, the control unit 60 may also be configured to: monitor the power supply output of the primary power module 10 to the power control unit 40, and if the power supply output is abnormal, perform abnormal processing. For example, the control unit 60 enters a safe state and simultaneously saves the abnormal information of the power supply output of the primary power module 10. The abnormal processing of the control unit 60 may also include the control unit 60 controlling the primary power module 10 to restart.

[0109] In some embodiments, the primary power module 10 may also continuously monitor the power supply input of the power supply during the startup of the control device 100 and / or during the operation of the control device 100 (e.g., during the subsequent power supply process to the secondary power module 30 and the power control unit 40 after the power-on check of the primary power module 10 is successful). That is, the primary power module 10 may be configured to: monitor the power supply input of the power supply, and if the power supply input of the power supply is abnormal, notify the control unit 60 to perform abnormal processing and simultaneously send the abnormal information of the power supply input to the control unit 60. The abnormal processing of the control unit 60 may include the control unit 60 entering a safe state and simultaneously saving the abnormal information of the power supply input. The abnormal processing of the control unit 60 may also include controlling the primary power module 10 or the power control unit 40 to stop the power supply output to cut off the power supply to the processing unit 50.

[0110] In some embodiments, the control unit 60 may be configured to: write the monitoring configuration information of the power control unit 40 and simultaneously start the self-check of the power control unit 40 (i.e., the power-on check of the power control unit 40 by itself). That is, during the startup of the control device 100, if the control unit 60 determines that the power supply output of the primary power module 10 is normal, the control unit 60 sends the configuration information set for the power control unit 40 to the power control unit 40 to write the configuration information into the power control unit 40 (e.g., write it into the register of the power control unit 40). The power control unit 40 performs a self-check according to the monitoring configuration information written into the power control unit 40 by the control unit 60. The monitoring configuration information written by the control unit 60 into the power control unit 40 includes one or more of clock timing requirements, power supply timing requirements, overvoltage thresholds, undervoltage thresholds, overcurrent thresholds, and temperature thresholds.

[0111] The self-check performed by the power control unit 40 may include checking the status of the power control unit 40, and the status of the power control unit 40 includes but is not limited to at least one of the operating voltage (i.e., the voltage of the input power supply), the operating current (i.e., the current of the input power supply), the operating temperature, and the internal system clock of the power control unit 40. After the self-check of the power control unit 40 is successful (i.e., the status of the power control unit 40 is normal), the control unit 60 will send an enable signal to the power control unit 40 to enable the power control unit 40 to output a power supply sequence to the processing unit 50.

[0112] The power control unit 40 may check the internal system clock according to the clock timing requirements in the monitoring configuration information. If the internal system clock does not meet the clock timing requirements, the status of the power control unit 40 is considered abnormal. The power control unit 40 may check the operating voltage according to the overvoltage threshold and undervoltage threshold in the monitoring configuration information to determine whether overvoltage or undervoltage conditions occur. If overvoltage or undervoltage occurs and lasts for a preset duration, the status of the power control unit 40 can be determined to be abnormal. The power control unit 40 may check the operating current according to the overcurrent threshold in the monitoring configuration information to determine whether an overcurrent condition occurs. If overcurrent occurs and lasts for a preset duration, the status of the power control unit 40 can be determined to be abnormal. The power control unit 40 may check the temperature according to the temperature threshold in the monitoring configuration information to determine whether the temperature of the power control unit 40 is too high. If the temperature of the power control unit 40 is too high and lasts for a preset duration, the status of the power control unit 40 can be determined to be abnormal.

[0113] If the self-check of the power control unit 40 fails (i.e., the state of the power control unit 40 is abnormal), the power control unit 40 can notify the control unit 60 to perform exception handling, and at the same time send the exception information of the power control unit 40 to the control unit 60. The exception handling of the control unit 60 can include the control unit 60 entering the safe state and saving the exception information of the power control unit 40. The exception handling of the control unit 60 can also include the control unit 60 controlling the power control unit 40 to restart and perform self-check again. In some embodiments, in addition to performing self-check during the startup of the control device 100, the power control unit 40 can also continuously monitor the state of the power control unit 40 during the startup of the control device 100 and / or during the operation of the control device 100 (for example, after the power control unit 40 supplies power to the processing unit 50), according to the monitoring configuration information written by the control unit 60 to the power control unit 40. The states of the power control unit 40 to be monitored can include but are not limited to: power supply timing, output voltage, output current, temperature, etc. If the state of the power control unit 40 is abnormal, the power control unit 40 can send a notification (such as an interrupt signal) to the control unit 60 to notify the control unit 60 to perform exception handling, and at the same time send the exception information of the power control unit 40 to the control unit 60. The exception handling of the control unit 60 can include the control unit 60 entering the safe state and saving the exception information of the power control unit 40. The exception handling of the control unit 60 can also include the control unit 60 controlling the power control unit 40 to restart. The exception handling of the control unit 60 can also include the control unit 60 controlling the primary power module 10 or the power control unit 40 to stop power supply output to cut off the power supply to the processing unit 50.

[0114] The power control unit 40 can check the power supply timing according to the power supply timing requirements in the monitoring configuration information. If the preset power supply timing requirements are not met, the state of the power control unit 40 is considered abnormal. The checks of the output voltage, output current, and temperature by the power control unit 40 during monitoring and the checks of the output voltage, output current, and temperature by the power control unit 40 during self-check can be the same.

[0115] In some embodiments, the power supply system can further include a power supply monitoring unit 70. The control unit 60 can be configured to: determine the monitoring configuration information of the power supply monitoring unit 70, send the monitoring configuration information to the power supply monitoring unit 70, and start the power-on check of the power supply monitoring unit 70; in response to the successful power-on check of the power supply monitoring unit 70, notify the power control unit 40 to supply power to the processing unit 50; in response to the failure of the power-on check of the power supply monitoring unit 70, perform exception handling.

[0116] During the startup of the control device 100, if the control unit 60 determines that the self-check of the power supply control unit 40 is successful, the control unit 60 notifies the power supply control unit 40 to output a power supply sequence to the processing unit 50 (for example, sending an enable signal to the power supply control unit 40), and then the control unit 60 sets monitoring configuration information for the power supply monitoring unit 70, such as the power supply timing requirements, overvoltage threshold, undervoltage threshold, and / or overcurrent threshold of the processing unit 50. The control unit 60 sends the monitoring configuration information to the power supply monitoring unit 70 to write the configuration information into the power supply monitoring unit 70 (for example, writing it into the register of the power supply monitoring unit 70). At the same time, the control unit 60 performs a power-on check on the power supply monitoring unit 70.

[0117] The control unit 60 can determine the monitoring configuration information according to the power supply requirements of each sub-unit in the processing unit 50. For example, the control unit 60 can calculate the thresholds of the monitored quantities (such as overvoltage threshold, undervoltage threshold, and / or overcurrent threshold) in the monitoring configuration information according to the power supply requirements of each sub-unit in the processing unit 50. In one example, the control unit 60 can determine the overvoltage threshold for the maximum voltage allowed for each power supply path of the processing unit 50 (each power supply path is provided by a power rail of the power supply control unit 40) and the allowed voltage accuracy (i.e., voltage static error). The control unit 60 will determine the undervoltage threshold for the minimum voltage allowed for each power supply path in the power supply control unit 40, the allowed voltage accuracy, and / or the allowed maximum transient voltage drop (the maximum transient voltage drop is related to the possible maximum current of the power supply path and the related voltage loss).

[0118] After setting the monitoring configuration information, the control unit 60 will first generate pseudo-monitoring configuration information different from the monitoring configuration information according to the monitoring configuration information. For example, the control unit 60 can modify the values of one or more parameters in the monitoring configuration information to obtain the pseudo-monitoring configuration information, and send the pseudo-monitoring configuration information to the power supply monitoring unit 70 to perform a power-on check on the power supply monitoring unit 70. For example, the control unit 60 can lower the overvoltage threshold in the monitoring configuration information so that it is lower than the voltage output by the power supply control unit 40 to obtain an overvoltage pseudo-threshold. For another example, the control unit 60 can increase the undervoltage threshold in the monitoring configuration information so that it is higher than the voltage output by the power supply control unit 40 to obtain an undervoltage pseudo-threshold.

[0119] The control unit 60 can provide pseudo-monitoring configuration information to the power supply monitoring unit 70 and determine whether the power-on check of the power supply monitoring unit 70 is successful according to the feedback received from the power supply monitoring unit 70. Specifically, the control unit 60 receives the feedback from the power supply monitoring unit 70 and judges whether the feedback of the power supply monitoring unit 70 meets the expectation. If it meets the expectation, the power-on check of the power supply monitoring unit 70 is successful; otherwise, the power-on check of the power supply monitoring unit 70 fails. For example, if the pseudo-monitoring configuration information includes an overvoltage pseudo-threshold lower than the output voltage of the power control unit 40, the power supply monitoring unit 70 will detect that the power supply output of the power control unit 40 is higher than the overvoltage pseudo-threshold. It is expected that the power supply monitoring unit 70 sends a notification (such as an interrupt signal) to the control unit 60 to notify the control unit 60 to perform exception handling. However, in this case, if the power supply monitoring unit 70 does not send a notification to the control unit 60 to notify the control unit 60 to perform exception handling, or the internal register of the power supply monitoring unit 70 does not characterize the overvoltage or undervoltage state caused by the pseudo-threshold setting, it is considered that the power-on check of the power supply monitoring unit 70 by the control unit 60 fails.

[0120] After the power-on check of the power supply monitoring unit 70 is successful, the power supply monitoring unit 70 monitors the power supply output of the power control unit 40 (the power supply output of the power control unit 40 is used to supply power to the processing unit 50) according to the monitoring configuration information written by the control unit 60 into the power supply monitoring unit 70.

[0121] If the power-on check of the power supply monitoring unit 70 fails, the control unit 60 performs exception handling. The exception handling of the control unit 60 can include the control unit 60 entering the safe state and simultaneously saving the relevant information (i.e., exception information) of the power-on check failure of the power supply monitoring unit 70. The exception handling of the control unit 60 can also include the control unit 60 controlling the power supply monitoring unit 70 to restart and performing the power-on check of the power supply monitoring unit 70 again.

[0122] The power supply monitoring unit 70 can also, during the startup of the control device 100 and / or during the operation of the control device 100 (for example, after the power control unit 40 supplies power to the processing unit 50), continuously monitor the power supply output of the power control unit 40 (the power supply output of the power control unit 40 is used to supply power to the processing unit 50) according to the monitoring configuration information written by the control unit 60 into the power supply monitoring unit 70. If the power supply output is abnormal, it notifies the control unit 60 to perform exception handling.

[0123] The monitoring of the power supply output of the power supply control unit 40 by the power supply monitoring unit 70 may include, but is not limited to, the inspection of the timing, voltage, and current of each power supply in the power supply output of the power supply control unit 40. If any power supply output of the power supply control unit 40 is abnormal, the power supply monitoring unit 70 may send a notification (such as an interrupt signal) to the control unit 60 to notify the control unit 60 to perform abnormal processing, and at the same time send the abnormal information of the power supply output of the power supply control unit 40 to the control unit 60.

[0124] The abnormal processing of the control unit 60 may include the control unit 60 entering the safe state and saving the abnormal information of the power supply output of the power supply control unit 40 at the same time. The abnormal processing of the control unit 60 may also include the control unit 60 controlling the power supply control unit 40 to restart. The abnormal processing of the control unit 60 may also include the control unit 60 controlling the primary power module 10 or the power supply control unit 40 to stop the power supply output to cut off the power supply to the processing unit 50.

[0125] The inspection of the power supply timing of each power supply by the power supply monitoring unit 70 can be judged according to the power supply timing requirements in the monitoring configuration information. If the power supply timing of any power supply does not meet the preset power supply timing requirements, it is considered that the power supply output of the power supply control unit 40 is abnormal. The inspection of the output voltage of each power supply by the power supply monitoring unit 70 can judge whether overvoltage or undervoltage conditions occur according to the overvoltage threshold and undervoltage threshold in the monitoring configuration information. If overvoltage or undervoltage occurs in any power supply and lasts for a preset time, it can be determined that the power supply output of the power supply control unit 40 is abnormal. The inspection of the output current of each power supply by the power supply monitoring unit 70 can judge whether an overcurrent condition occurs according to the overcurrent threshold in the monitoring configuration information. If overcurrent occurs in any power supply and lasts for a preset time, it can be determined that the power supply output of the power supply control unit 40 is abnormal.

[0126] As described above, the power supply output from the power supply control unit 40 to the processing unit 50 is actually a multi-channel power supply for different sub-units of the processing unit 50. Each channel is used to supply power to one or more sub-units of the processing unit 50, and the timing of each power supply needs to meet the requirements of the processing unit 50. Therefore, in addition to monitoring the voltage, current, etc. of each power supply output from the power supply control unit 40 for overvoltage, undervoltage, overcurrent, etc., the power supply monitoring unit 70 can also monitor the timing of each power supply output, so as to implement a more refined monitoring scheme. If it is monitored that the power supply output from the power supply control unit 40 to the processing unit 50 is abnormal, the control unit 60 can be notified to perform abnormal processing through the communication link between the power supply monitoring unit 70 and the control unit 60.

[0127] The power supply monitoring unit 40 monitors its own power supply output, and the power supply monitoring unit 70 monitors the power supply output of the power control unit 40. In this way, multiple monitoring of the power supply output of the power control unit 40 can better ensure the normal power supply of the processing unit 50.

[0128] When the control unit 60 notifies the power control unit 40 to output a power supply sequence to the processing unit 50, it also notifies the secondary power supply module 30 (for example, sends an enable signal to the secondary power supply module 30) to supply power to the peripheral device 80. After receiving the enable signal, the secondary power supply module 30 starts to supply power to the peripheral device 80.

[0129] In some embodiments, after the primary power supply module 10 starts to supply power upon receiving the enable signal, or after the control unit 60 successfully performs a power-on check on the power supply monitoring unit 70, or after the power control unit 40 starts to supply power upon receiving the enable signal, it notifies the secondary power supply module 30 (for example, sends an enable signal to the secondary power supply module 30) to supply power to the peripheral device 80. After receiving the enable signal, the secondary power supply module 30 starts to supply power to the peripheral device 80.

[0130] The control unit 60 can set parameters for the secondary power supply module 30 (i.e., the monitoring configuration information of the secondary power supply module 30), such as power supply timing, overvoltage threshold, undervoltage threshold, and overcurrent threshold. During the period when the secondary power supply module supplies power to the peripheral device 80, the control unit 60 continuously monitors the power supply output of the secondary power supply module 30 (the power supply output of the secondary power supply module 30 is used to supply power to the peripheral device 80) according to the monitoring configuration information set for the secondary power supply module 30. The monitoring of the power supply output of the secondary power supply module 30 can include but is not limited to checking the timing, voltage, and current of each power supply in the power supply output of the secondary power supply module 30. The inspection of the output voltage of each power supply of the secondary power supply module 30 can determine whether overvoltage or undervoltage occurs based on the overvoltage threshold and undervoltage threshold preset by the control unit 60 for the secondary power supply module 30. If overvoltage or undervoltage occurs in any power supply and persists for a preset duration, it can be determined that the power supply output of the secondary power supply module 30 is abnormal. The inspection of the output current of each power supply of the secondary power supply module 30 can determine whether overcurrent occurs based on the overcurrent threshold preset by the control unit 60 for the secondary power supply module 30. If overcurrent occurs in any power supply and persists for a preset duration, it can be determined that the power supply output of the secondary power supply module 30 is abnormal. The inspection of the power supply timing of each power supply of the secondary power supply module 30 can be judged according to the power supply timing requirements in the monitoring configuration information. If any power supply does not meet the preset power supply timing requirements, it is considered that the power supply output of the secondary power supply module 30 is abnormal.

[0131] If the power supply output of the secondary power supply module 30 is abnormal, the control unit 60 will perform abnormal handling, that is, the control unit 60 enters the safe state, and at the same time saves the abnormal information of the power supply output of the secondary power supply module 30. The abnormal information of the secondary power supply module 30 saved by the control unit 60 may include, for example, the voltage value and / or current value of the power supply output of the secondary power supply module 30. The abnormal handling of the control unit 60 may further include the control unit 60 controlling the secondary power supply module 30 to restart. The abnormal handling of the control unit 60 may further include the control unit 60 controlling the primary power supply module 10 or the power supply control unit 40 to stop the power supply output to cut off the power supply to the processing unit 50.

[0132] Different peripherals 80 have different timing requirements for voltage. Each path of the secondary power supply module 30 is used to supply power to one or more peripherals, and the timing of each path of power supply needs to meet the requirements of the corresponding peripheral. Therefore, in addition to monitoring overvoltage, undervoltage, overcurrent, etc. of the voltage, current, etc. of each path of power supply output by the secondary power supply module 30, the control unit 60 can also monitor the timing of each path of power supply output, so as to implement a more refined monitoring scheme.

[0133] In the embodiments of the present disclosure, it may be set that the above-mentioned control unit 60, processing unit 50, power supply control unit 40, power management unit 20, and power supply monitoring unit 70 respectively meet the preset ASIL levels. The classification of ASIL (Automotive Safety Integrity Level) includes four levels: ASIL A, ASIL B, ASIL C, and ASIL D, and the four levels increase in sequence from A to D. The ASIL level is determined according to three indicators: severity, exposure, and controllability. As one possible implementation method, the above-mentioned power supply control unit 40 and processing unit 50 meet ASIL B, and the above-mentioned power management unit 20, control unit 60, and power supply monitoring unit 70 meet ASIL D.

[0134] According to the control device of the embodiments of the present disclosure, units that meet the requirements of functional safety design (power supply control unit 40, power management unit 20, and power supply monitoring unit 70) are used to monitor the power-consuming units (such as control unit 60, processing unit 50). The monitored parameters can be flexibly configured by the control unit 60 according to requirements, faults (i.e., abnormalities) can be diagnosed, and corresponding safety mechanisms can be executed. The control unit 60 itself is also designed with a corresponding self-check mechanism, which further improves the safety and reliability of the control device. The control device according to the embodiments of the present disclosure has a power management and monitoring mechanism that meets the requirements of functional safety design.

[0135] The above refers to Figure 1 The control device 100 according to the exemplary embodiments of the present disclosure has been described. Those skilled in the art can understand that the control device 100 may includeFigure 1 Other components not shown in [the figure]. In some embodiments, the control device may include fewer components than [in the figure], such as Figure 1 in [the figure], for example Figure 2 FIG. 200 shows a control device 200 according to another exemplary embodiment of the present disclosure. The control device 200 is substantially the same as the control device 100, except that the control device 200 does not include Figure 1 the secondary power management module 30 and the peripherals 80 in [the figure]. It should be noted that Figure 1 and Figure 2 the same reference numerals in [the figure] represent the same components.

[0136] Figure 3 FIG. [X] shows a flowchart of a power supply (power-on) method 300 for a control device (such as Figure 1 the control device 100 shown in [the figure] or Figure 2 the control device 200 shown in [the figure]) according to an exemplary embodiment of the present disclosure. The power supply method may include:

[0137] In step 301, the primary power module 10 supplies power to the first power supply unit 40 and the secondary power management module 30 in response to a first enable signal from the control unit 60;

[0138] In step 302, the first power supply unit 40 supplies power to the processing unit 50 in response to a second enable signal from the control unit 60;

[0139] In step 303, the secondary power management module 30 supplies power to the peripherals 80 in response to a third enable signal from the control unit 60.

[0140] In some embodiments, the method 300 further includes: The power management unit 20 supplies power to the control unit 60 in response to receiving a power input, and performs a power-on check based on the monitored configuration information; in response to a successful power-on check, the power management unit 20 sends a notification to the control unit 60.

[0141] In some embodiments, the method 300 further includes: The power management unit 20 monitors the power supply status of the control unit 60. If the power supply status is abnormal, the power management unit 20 notifies the control unit 60 to enter a safe state.

[0142] In some embodiments, when the power management unit performs a power-on check, it includes: The power management unit 20 checks the reset signal and the enable signal of the control unit 60, and the power supply output of the power management unit 20.

[0143] In some embodiments, after a successful power-on check by the power management unit, the power management unit sends a notification to the control unit 60 to cause the control unit 60 to enter the normal operating state from the reset state, that is, to release the reset of the control unit 60.

[0144] In some embodiments, method 300 further includes: the control unit 60 performs a power-on check on the power supply output of the primary power module 10.

[0145] In some embodiments, method 300 further includes: the control unit 60 writes monitoring configuration information to the power control unit 40 to initiate a power-on check of the power control unit 40 (i.e., self-check of the power control unit 40).

[0146] In some embodiments, method 300 further includes: after the self-check of the power control unit is successful, the control unit 60 writes monitoring configuration information to the power supply monitoring unit to perform a power-on check on the power supply monitoring unit.

[0147] In some embodiments, method 300 further includes: the control unit 60 notifies the power control unit 40 to supply power to the processing unit 50 in response to a successful power-on check of the power supply monitoring unit 70; in response to a failed power-on check of the power supply monitoring unit 70, an exception handling is performed.

[0148] In some embodiments, method 300 further includes: after the power control unit supplies power to the processing unit, the power supply monitoring unit 70 monitors the power supply output of the power control unit to the processing unit according to the monitoring configuration information written by the control unit to the power supply monitoring unit.

[0149] In some embodiments, method 300 further includes: the control unit 60 monitors the power supply status of the secondary power module 30 to one or more peripherals 80, and if the power supply status is abnormal, an exception handling is performed.

[0150] Figure 4 A flowchart of the power-on process for a control device provided by an embodiment of the present application (such as Figure 1 the control device 100 shown or Figure 2 the control device 200 shown).

[0151] When the control device starts up, for safety reasons, each unit in the power supply system of the control device and some power-consuming units will perform relevant checks or self-checks.

[0152] As Figure 4 shown, the power-on process of the control device includes turning on the switch of the control device to start powering on the control device. Then, in step 401, the power management unit responds to receiving a power supply input. The power management unit performs a power-on check according to the monitoring configuration information. If the power-on check is successful, step 403 is executed; otherwise, step 402 is executed. The power management unit also supplies power to the control unit in response to receiving a power supply input.

[0153] In step 402, the power management unit remains in a standby state. Then the process proceeds to step 401, and the power management unit continues to perform a power-on check according to the monitoring configuration information.

[0154] In step 403, the power management unit notifies the control unit to enter the normal operating state, causing the control unit to release the reset.

[0155] In step 404, the control unit starts self-checking. If the self-check is successful, step 406 is executed; if the self-check fails, step 405 is executed.

[0156] In step 405, the control unit enters the safe state.

[0157] In step 406, the control unit sets the monitoring configuration information for the primary power module and sends an enabling signal to the primary power module.

[0158] In step 407, the primary power module supplies power to the power control unit in response to the enabling signal.

[0159] In step 408, the control unit performs a power-on check on the power output of the primary power module. If the power output of the primary power module is normal, step 410 is executed; if the power output of the primary power module is abnormal, step 409 is executed.

[0160] In step 409, the control unit performs exception handling.

[0161] In step 410, the control unit writes the monitoring configuration information into the power control unit.

[0162] In step 411, the power control unit performs self-checking. If the self-check fails, step 412 is executed; if the self-check is successful, step 413 is executed.

[0163] In step 412, the control unit performs exception handling.

[0164] In step 413, the power control unit supplies power to the processing unit.

[0165] In step 414, the control unit sets the monitoring configuration information for the power supply monitoring unit.

[0166] In step 415, the control unit performs a power-on check on the power supply monitoring unit. If the power-on check fails, step 416 is executed; if the power-on check is successful, step 417 is executed.

[0167] In step 416, the control unit performs exception handling.

[0168] In step 417, the power supply monitoring unit monitors the power output of the power control unit. If an abnormality is detected, step 418 is executed; otherwise, the power supply monitoring unit continuously monitors the power output of the power control unit.

[0169] In step 418, the control unit performs exception handling.

[0170] In some embodiments, after the primary power module 10 receives an enable signal and starts power supply, or after the power-on check of the power supply monitoring unit 70 by the control unit 60 is successful, or after the power control unit 40 receives an enable signal and starts power supply, the control unit 60 sets parameters for the secondary power module 30 (i.e., the monitoring configuration information of the secondary power module 30), such as power supply timing, overvoltage threshold, undervoltage threshold, and overcurrent threshold, and then sends an enable signal to the secondary power module 30. After receiving the enable signal, the secondary power module 30 starts to supply power to the peripheral device 80.

[0171] Figure 5 is a schematic diagram of an exemplary vehicle 510. Although Figure 5 the vehicle 510 is illustrated as a truck, those skilled in the art can understand that the vehicle 510 can also be any vehicle or transportation means such as a sedan, motorcycle, bus, recreational vehicle, amusement park vehicle, tram, golf cart, train, trolleybus, etc.

[0172] The vehicle 510 can include various vehicle systems, such as a drive system 542, a sensor system 544, a control system 546, a computing system 550, and a communication system 552. The vehicle 510 can include more or fewer systems, and each system can include multiple units. Further, each system and unit of the vehicle 510 can be interconnected. For example, the computing system 550 can communicate data with one or more units of the drive system 542, the sensor system 544, the control system 546, and the communication system 552.

[0173] The vehicle 510 can include an autonomous driving (which can also be referred to as driverless) system, so as to be able to operate in an autonomous driving mode completely or partially. In this sense, the vehicle 510 is also called an autonomous vehicle. In the autonomous driving mode, the vehicle 510 can control itself (or the vehicle is controlled by the autonomous driving system). For example, the vehicle 510 can determine the current state of the vehicle and the current state of the environment in which the vehicle is located, determine the predicted behavior of at least one other vehicle in the environment, determine the trust level corresponding to the possibility that the at least one other vehicle performs the predicted behavior, and control the vehicle 510 itself based on the determined information. When in the autonomous driving mode, the vehicle 510 can operate without human interaction. The autonomous driving system of the vehicle 510 can include, for example, the sensor system 544 and the computing system 550.

[0174] The drive system 542 can include multiple operable components (or units) that provide kinetic energy for the vehicle 510. In one embodiment, the drive system 542 can include an engine or a motor, wheels, a transmission, an electronic system, and power (or a power source).

[0175] The sensor system 544 may include one or more sensors for sensing condition information of the vehicle 510 and surrounding environment information in various driving environments. The sensor system 544 may include one or more of an inertial measurement unit (IMU), a global navigation satellite system (GNSS) transceiver (such as a global positioning system (GPS) transceiver), a radio detection and ranging device (RADAR), a light detection and ranging system (LIDAR), an acoustic sensor, an ultrasonic sensor, and an image capture device (such as a camera). One or more sensors of the sensor system 544 may be individually or collectively driven to update the position, orientation, or both of one or more sensors.

[0176] The control system 546 is used to control the operation of the vehicle 510 and its components (or units). Accordingly, the control system 546 may include various units, such as a steering unit, a power control unit, a braking unit, and a navigation unit. The steering unit may be a mechanical combination for adjusting the forward direction of the vehicle 510. The steering unit may include, for example, a steering motor that turns the steering wheel of the vehicle by manipulating a steering mechanism including a steering shaft and a steering gear for steering operation. The power control unit may be used to control the operating speed of the engine and thus control the speed of the vehicle 510. The power control unit may include, for example, an engine actuator for changing the operating state of the vehicle's engine. An example of the engine is an internal combustion engine with a throttle for adjusting the intake air volume. In this case, the engine actuator may include a throttle actuator for changing the opening of the throttle. By controlling the engine actuator, the driving force of the vehicle can be controlled to change the acceleration state. The braking unit may include a mechanical combination for decelerating the vehicle 510. The braking unit may use friction in a standard manner to decelerate the vehicle. The braking unit may include a brake actuator that can adjust the friction between the brake pads of the vehicle and the brake disc fixed to the wheel to generate a braking torque to impede the movement of the vehicle. The navigation unit may be any system for determining a driving path or route for the vehicle 510. The navigation unit may also dynamically update the driving path during the travel of the vehicle 510.

[0177] The communication system 552 may include one or more communication devices to provide a way for the vehicle 510 to communicate with one or more devices or other surrounding vehicles. In an exemplary embodiment, each communication device of the communication system 552 may communicate directly or through a communication network with one or more devices. The communication system 552 may be, for example, a wireless communication system. For example, the communication devices of the communication system may use 3G cellular communication (such as CDMA, EVDO, GSM / GPRS) or 4G cellular communication (such as WiMAX or LTE), and may also use 5G cellular communication. The communication system may communicate with a wireless local area network (WLAN) (for example, using ).

[0178] The computing system 550 may include one or more control devices for controlling some or all of the functions of the vehicle 510. The control devices may include, for example, servers, personal computers (PCs), electronic control units ECU (such as domain controllers), etc. The control device includes at least one processing unit and at least one control unit not shown in the figure. The processing unit and the control unit execute processing instructions (i.e., machine-executable instructions) stored in a non-volatile computer-readable medium (such as a data storage device or a memory). In some embodiments, the memory may contain processing instructions (such as program logic) executed by the processor to implement various functions of the vehicle 510. The control device may include an autonomous driving control unit. The autonomous driving control unit may be composed of one or more algorithm modules for identifying, evaluating, and avoiding or crossing potential obstacles in the environment where the vehicle 510 is located. Generally, the autonomous driving control unit may be used to control the vehicle 510 in the absence of a driver, or to provide assistance for the driver to control the vehicle. In some embodiments, the autonomous driving control unit is used to combine data from sensors, such as data from a GPS transceiver, radar data, LIDAR data, camera data, and data from other vehicle systems, to determine the driving path or trajectory of the vehicle 510. The autonomous driving control unit may be activated to enable the vehicle 510 to be driven in an autonomous driving mode.

[0179] Although Figure 5 the autonomous driving control unit is shown as being separate from the processing unit and the memory, it should be understood that in some embodiments, some or all of the functions of the autonomous driving control unit may be implemented using program code instructions residing in one or more memories (or data storage devices) and executed by one or more processors, and the autonomous driving control unit may use the same processor and / or memory (or data storage device) in some cases.

[0180] The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve the desired results. Additionally, the processes depicted in the drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0181] Each embodiment in this specification is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments.

[0182] It should be noted that the "first", "second", etc. limitations involved in this disclosure do not have limitations in terms of size, order, quantity, etc., and are only used to distinguish by name. For example, the "first enable signal" and the "second enable signal" are used to distinguish two enable signals by name. Another example is that the "first monitoring configuration information", "second monitoring configuration information", "third monitoring configuration information", etc. are used to distinguish different monitoring configuration information, and so on. Similar expressions in subsequent embodiments will not be elaborated one by one.

[0183] The above provides a detailed introduction to the technical solutions provided by this disclosure. Specific examples are used herein to elaborate on the principles and implementation manners of this disclosure. The description of the above embodiments is only used to help understand the method and its core idea of this disclosure; at the same time, for those of ordinary skill in the art, based on the idea of this disclosure, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to this disclosure.

[0184] The above is only a preferred embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent replacements, etc. made within the spirit and principles of this disclosure shall be included within the protection scope of this disclosure.

Claims

1. A control device, comprising: A control unit; A processing unit; One or more peripherals communicatively connected to the processing unit; And A power supply system, including a primary power module, a secondary power module, and a power control unit, Wherein, The primary power module is configured to: supply power to the power control unit and the secondary power module in response to a first enable signal of the control unit; The power control unit is configured to: supply power to the processing unit in response to a second enable signal of the control unit; The secondary power module is configured to: supply power to the peripherals in response to a third enable signal of the control unit.

2. The control device according to claim 1, wherein, The power supply system further includes: a power management unit; The power management unit is configured to: perform a power-on check according to monitoring configuration information; and send a notification to the control unit in response to a successful power-on check; The control unit is configured to: send the first enable signal to the primary power module in response to the notification from the power management unit.

3. The control device according to claim 2, wherein, The power management unit is further configured to; monitor the power supply output to the control unit, and if the power supply output is abnormal, notify the control unit to enter a safe state.

4. The control device according to claim 2, wherein, Performing a power-on check according to monitoring configuration information includes: The power management unit checks whether the power supply output to the control unit, the reset signal of the control unit, and the enable signal of the control unit are normal. The enable signal of the control unit includes the first enable signal, the second enable signal, and the third enable signal.

5. The control device according to claim 1, wherein, The control unit is further configured to: write monitoring configuration information of the power control unit to initiate self-check of the power control unit; The power control unit is configured to: perform self-check according to the monitoring configuration information written by the control unit to the power control unit.

6. The control device according to any one of claims 1 to 5, characterized in that, The power control unit includes a multiphase power controller, and supplying power to the processing unit includes outputting a power supply sequence to the processing unit.

7. The control device according to claim 5, wherein, The power supply system further includes a power supply monitoring unit, The control unit is further configured to: write monitoring configuration information of the power supply monitoring unit in response to a successful self-check of the power control unit to perform a power-on check on the power supply monitoring unit.

8. The control device according to claim 7, wherein, The control unit is further configured to: Send a second enable signal to the power control unit in response to a successful power-on check of the power supply monitoring unit, so that the power control unit supplies power to the processing unit, The power supply monitoring unit is configured to: monitor the power supply output of the power control unit to the processing unit according to the monitoring configuration information written by the control unit to the power supply monitoring unit after the power control unit supplies power to the processing unit.

9. The control device according to claim 1, wherein, The primary power module is used to convert the voltage of the power supply input to the control device and output the converted voltage to supply the secondary power module and the power control unit; The secondary power module is used to convert the voltage output by the primary power module and provide the converted voltage to the peripherals; The power control unit is used to convert the voltage output by the primary power module and provide the converted voltage to the processing unit.

10. The control device according to claim 1, wherein, the primary power supply module has a voltage conversion function, and the power supply output of the primary power supply module is respectively provided to the peripheral device and the processing unit through different power supply paths with voltage conversion functions, and the peripheral device and the processing unit are communicatively connected, one of the power supply paths includes the secondary power supply module for converting the voltage output by the primary power supply module and providing the converted voltage to the peripheral device; the other of the power supply paths includes the power supply control unit for converting the voltage output by the primary power supply module and providing the converted voltage to the processing unit.

11. A control device, comprising: a control unit; a processing unit; a power management unit configured to: supply power to the control unit and perform a power-on check; in response to a successful power-on check, send a notification to the control unit, and the power-on check includes: checking the power supply output of the power management unit to the control unit and the state of the control unit; a control unit configured to: at least partially in response to the notification of the power management unit, send an enable signal to the power supply unit; a power supply unit configured to: in response to the enable signal, supply power to the processing unit.

12. The control device according to claim 11, wherein, The power-on check includes: the power management unit checks whether the power supply output to the control unit, the reset signal of the control unit, and the enable signal of the control unit are normal.

13. The control device according to claim 11, wherein, the power supply unit includes a primary power supply module, and the enable signal includes a first enable signal, a control unit configured to: in response to the notification of the power management unit, send a first enable signal to the primary power supply module.

14. The control device according to claim 13, further comprising: a power supply monitoring unit, wherein the power supply unit further includes a power supply control unit, and the enable signal further includes a second enable signal, the control unit is further configured to: write monitoring configuration information to the power supply monitoring unit to initiate a power-on check of the power supply monitoring unit; in response to a successful power-on check of the power supply monitoring unit, send a second enable signal to the power supply control unit.

15. The control device according to claim 14, Among them, the primary power supply module is configured to: in response to the first enable signal of the control unit, supply power to the power supply control unit; the power supply control unit is configured to: in response to the second enable signal of the control unit, supply power to the processing unit.

16. A control device, comprising: a processing unit; a control unit; a power supply monitoring unit, a power supply unit for supplying power to the processing unit; the control unit is configured to: write monitoring configuration information to the power supply monitoring unit to initiate a power-on check of the power supply monitoring unit; in response to a successful power-on check, control the power supply unit to supply power to the processing unit.

17. A vehicle, the vehicle includes at least one control device according to any one of claims 1 to 16.

18. A power supply method for a control device, the control device includes a control unit, a processing unit, one or more peripherals, and a power supply system, the power supply system includes a primary power module, a secondary power module, and a power control unit, The power supply method includes: The primary power module supplies power to the power control unit and the secondary power module in response to a first enable signal from the control unit; The power control unit supplies power to the processing unit in response to a second enable signal from the control unit; The secondary power module supplies power to the one or more peripherals in response to a third enable signal from the control unit.

19. A power supply method for a control device, the control device comprising: Control unit, processing unit, power management unit, control unit, and power supply unit, The method includes: The power management unit supplies power to the control unit and performs a power-on check, and the power-on check includes: checking the power supply output of the power management unit to the control unit and the status of the control unit; The power management unit sends a notification to the control unit in response to a successful power-on check; The control unit controls the power supply unit to supply power to the processing unit at least partially in response to the notification from the power management unit.

20. The method according to claim 19, wherein, The control device further includes: a power supply monitoring unit, The method further includes: The control unit writes monitoring configuration information to the power supply monitoring unit to initiate a power-on check of the power supply monitoring unit, Wherein, the control unit controls the power supply unit to supply power to the processing unit at least partially in response to the notification from the power management unit includes: The control unit controls the power supply unit to supply power to the processing unit in response to the notification from the power management unit and a successful power-on check of the power supply monitoring unit.

21. The method according to claim 20, wherein the power supply unit includes a primary power module and a power control unit, Among them, The control unit controls the power supply unit to supply power to the processing unit in response to the notification from the power management unit and a successful power-on check of the power supply monitoring unit includes: The control unit controls the primary power module to supply power to the power control unit in response to the notification from the power management unit; The control unit controls the power control unit to supply power to the processing unit in response to a successful power-on check of the power supply monitoring unit.

22. A power supply method for a control device, the control device includes a processing unit, a control unit, a power supply monitoring unit, and a power supply unit; The method includes: The control unit writes monitoring configuration information to the power supply monitoring unit to initiate a power-on check of the power supply monitoring unit; The control unit controls the power supply unit to supply power to the processing unit in response to a successful power-on check.

Images