Function security detection chip and function security detection system

Abstract

The invention discloses a function security detection chip and a function security detection system. The function safety detection chip comprises a timer output module and an input and output monitor; the timer output module generates a PWM signal in real time and sends the PWM signal to the input / output monitor and the gate driver, the gate driver drives and controls the switching device according to the PWM signal, the PWM signal generates a monitor signal in real time through the gate driver and the switching device, and the switching device feeds back the monitor signal to the input / output monitor; the input / output monitor comprises a counter, an overflow value of the counter is configured by a register, and the counter is used for setting preset time; and the input and output monitor compares the PWM signal with the monitor signal in real time, and gives an alarm if the PWM signal and the monitor signal do not reach the same state after a preset time. According to the invention, one GPIO (General Purpose Input / Output) is saved, the participation of a CPU (Central Processing Unit) is not needed, the periodic load of the CPU is not needed, the BOM cost is reduced, and the software overhead

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of automotive electronic chip functional safety, and in particular, to a functional safety detection chip and a functional safety detection system. Background Art

[0002] For automotive control chips, it is generally considered that the difficulty lies not only in achieving the industry-standard performance of analog or digital circuits, but also in applications that can truly solve user pain points. For example, reducing the BOM cost, reducing software overhead, automatically achieving a higher functional safety coverage rate, and so on.

[0003] The existing Input and Output Monitor (IOM) is a classic functional safety module used to detect whether the PWM signals sent by the MCU, the gate drive, and the monitor signals fed back by the power driver are correct. The implementation method is as follows: The edge trigger comparison of the signal starts. If the corresponding edge of the detection signal does not appear within the specified time, an alarm is issued.

[0004] The classic motor control output has a total of 8 phases, and the duty cycle of the PWM output varies between 0 and 100%. If the PWM signal outputs PWM waves with a duty cycle of 0% or 100% in multiple cycles, it means that the output PWM has not changed. In this case, the IOM does not receive the start comparison signal. If the monitor signal to be detected and fed back happens to change for some reason, such as being shorted to the power supply, no alarm will be generated. Figure 1 It is a classic connection method of an existing IOM. For details, see Figure 1 . For functional safety detection, this is unacceptable. The method adopted by the prior art is as follows: When using the IOM module, another GPIO pin is needed to collect the change of the monitored feedback signal. If it is predicted that the duty cycle is not 0, the IOM automatically compares; if it is predicted that the duty cycle is 0, the software checks whether the input of the GPIO pin remains unchanged, otherwise an alarm is issued.

[0005] However, this method requires an additional GPIO pin and causes difficulties in PCB routing. More importantly, functional safety detection is not fully automatic in hardware, but requires periodic intervention by the user software, which not only cannot guarantee real-time performance but also increases the CPU load. With the progress of technology, the frequency of high-voltage SiC or GaN MOSFETs has increased to 500 kHz and above, and software real-time periodic detection and judgment can basically not be achieved. Summary of the Invention

[0006] The present invention provides a functional safety detection chip and a functional safety detection system, which perform real-time control in all hardware, do not require software intervention, save one GPIO, do not require the participation of a CPU, and at the same time do not require the periodic load of the CPU, reducing the BOM cost and reducing the software overhead.

[0007] According to one aspect of the present invention, there is provided a functional safety detection chip, the functional safety detection chip comprising: a timer output module and an input / output monitor;

[0008] The timer output module is connected to the input / output monitor and the gate driver, the gate driver is connected to the switching device, the timer output module is used to generate a PWM signal in real time and send it to the input / output monitor and the gate driver, the gate driver is used to drive and control the switching device according to the PWM signal, the PWM signal passes through the gate driver and the switching device to generate a monitor signal in real time, and the switching device is used to feedback the monitor signal to the input / output monitor;

[0009] The input / output monitor includes a counter, the overflow value of the counter is configured by a register, and the counter is used to set a preset time;

[0010] The input / output monitor is connected to the switching device, and the input / output monitor is used to compare the PWM signal and the monitor signal in real time. If the PWM signal and the monitor signal do not reach the same state after the preset time, an alarm is issued.

[0011] Optionally, the input / output monitor is further used to perform an exclusive OR operation on the PWM signal and the monitor signal and output a result signal, and the result signal is used to open a new event window.

[0012] Optionally, before the counter overflows, if the result signal does not return to zero, an alarm is issued.

[0013] Optionally, the duty cycle range of the PWM signal is 0%-100%.

[0014] Optionally, the monitor signal includes a phase voltage signal.

[0015] Optionally, the PWM signal is a pulse frequency modulation signal or a space vector pulse width modulation signal.

[0016] Optionally, the functional safety detection chip includes at least one of a microcontroller, a DSP, and an FPGA.

[0017] According to another aspect of the present invention, there is provided a functional safety detection system, which includes the functional safety detection chip, the gate driver and the switching device described in any one of the above aspects;

[0018] The functional safety detection chip is connected to the gate driver, the gate driver is connected to the switching device, and the switching device is connected to the functional safety detection chip.

[0019] Optionally, the functional safety detection system is a motor control system or a vehicle-mounted charger system.

[0020] The technical solution of the embodiment of the present invention proposes a new enhanced IOM module, which can detect PWM waves from 0% to 100% without additional GPIO pins and hardware, thereby completing functional safety detection; full-hardware real-time control, without software intervention, saves 1 GPIO and does not cause difficulties in PCB routing; and does not require CPU participation, and at the same time does not require periodic loading of the CPU, reducing the BOM cost and reducing software overhead. In summary, the present invention solves the problem that the prior art does not perform functional safety detection fully automatically by hardware, requires periodic intervention of user software, cannot guarantee real-time performance, increases the load of the CPU, increases the CPU occupancy rate, and requires additional pins.

[0021] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present invention, nor is it used to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. Description of the Drawings

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0023] Figure 1 is a classic connection method of an existing IOM;

[0024] Figure 2 is a schematic structural diagram of a functional safety detection chip provided according to an embodiment of the present invention;

[0025] Figure 3 is a schematic waveform diagram when a functional safety detection chip provided according to an embodiment of the present invention is working. Detailed Embodiments

[0026] To enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned accompanying drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0028] With the popularization of automotive functional safety, key automotive applications such as motor control and in-vehicle charger systems need to meet functional safety standards. The main failure is the physical damage of the PWM wave sent by the control system on the GPIO pins, PCB traces, gate drive, and high-voltage MOSFET (or IGBT) side. Therefore, the prior art introduces an IOM module to detect this failure. This module cannot check the case where the duty cycle of the PWM wave is 0% or 100%. The reason is that the event window for comparison can only be opened by the PWM signal and cannot be opened by the MONITOR signal. In the case of 0% or 100% duty cycle, since the event window is not opened, if the MONITOR signal jumps due to an error (such as short circuit to power or MOSFET breakdown), the inconsistency between the PWM signal and the MONITOR signal will not alarm.

[0029] In view of the above defects, the embodiments of the present invention provide a functional safety detection chip. Figure 2 It is a schematic structural diagram of a functional safety detection chip provided according to the embodiments of the present invention. Refer to Figure 2, the functional safety detection chip includes: a timer output module 10 and an input / output monitor 20; the timer output module 10 is connected to the input / output monitor 20 and the gate driver, the gate driver is connected to the switching device, the timer output module 10 is used to generate a PWM signal in real time and send it to the input / output monitor 20 and the gate driver, the gate driver is used to drive and control the switching device according to the PWM signal, the PWM signal generates a monitor signal in real time through the gate driver and the switching device, and the switching device is used to feedback the monitor signal to the input / output monitor 20; the input / output monitor 20 includes a counter, the overflow value of the counter is configured by a register, and the counter is used to set a preset time; the input / output monitor 20 is connected to the switching device, and the input / output monitor 20 is used to compare the PWM signal and the monitor signal in real time. If the PWM signal and the monitor signal do not reach the same state after the preset time, an alarm is generated.

[0030] Specifically, the functional safety detection is part of the safety function of automotive motor control. The input / output monitor 20 provides a new function for the functional safety detection chip. The new function requires a circuit within 1000 gates and will not affect the cost. It can be used for both automotive motor control and power supply, as well as automotive chassis control.

[0031] Optionally, the duty cycle range of the PWM signal is 0% - 100%. The functional safety detection chip only needs 1 pin to detect the feedback signal and can detect any waveform with a duty cycle within 0% to 100% (inclusive). Optionally, the monitor signal includes a phase voltage signal.

[0032] The timer output module (Timer Output Module, TOM) 10 generates a PWM signal in real time and sends it to the input / output monitor 20 and the gate driver, and the gate driver controls the automotive motor through the switching device. The switching device can be a high-voltage MOSFET, a high-voltage IGBT, a high-voltage SiC, or a GaN MOSFET. With the progress of technology, the frequency of the high-voltage SiC or GaN MOSFET has increased to 500 kHz and above, and it is basically impossible to achieve software real-time cycle detection and judgment.

[0033] The embodiment of the present invention proposes an enhanced IOM module. The input / output monitor 20 is an enhanced IOM module, enabling the detection of the PWM wave to automatically complete the functional safety detection in hardware even when the duty cycle of the PWM signal is 0% or 100%. The input / output monitor 20 adds additional new event windows and counters. In order to detect the cases where the duty cycle is 0% or 100% simultaneously, another counter is introduced. Based on the original IOM module, a new counter is added. The counter counts with the system clock or another time, the overflow value of the counter is configured by a register, and the counter is used to set a preset time.

[0034] The input / output monitor 20 compares in real time the PWM signal sent by the timer output module 10 with the MONITOR signal fed back after passing through the system loop (gate driver, high-voltage switching device). If the PWM signal and the MONITOR signal do not reach the same state after a specified preset time (considering system delay), an alarm is issued. In the case of 0% or 100% duty cycle, if the MONITOR signal jumps due to an error (such as short circuit to the power supply or breakdown of the high-voltage MOSFET), the inconsistency between the PWM signal and the MONITOR signal will trigger an alarm.

[0035] The technical solution of the embodiment of the present invention proposes a new enhanced IOM module, which can detect PWM waves from 0% to 100% without additional GPIO pins and hardware, thus completing functional safety detection; full-hardware real-time control, without software intervention, saving 1 GPIO and not causing difficulties in PCB routing; and without CPU participation, and without periodic CPU load, reducing the BOM cost and software overhead. In summary, the present invention solves the problem of the prior art that functional safety detection is not fully automatic by hardware and requires periodic intervention of user software, which not only cannot guarantee real-time performance but also increases the CPU load, resulting in an increase in CPU occupancy rate and requiring additional pins.

[0036] Continue to refer to Figure 2 , optionally, the input / output monitor 20 is further configured to perform an exclusive OR operation on the PWM signal and the monitor signal and output a result signal, and the result signal is used to open a new event window.

[0037] Continue to refer to Figure 2 , optionally, before the counter overflows, if the result signal does not return to zero, an alarm is issued.

[0038] Specifically, the input / output monitor 20 performs an exclusive OR operation on the PWM signal and the monitor (MONITOR) signal to obtain the result PWM (XOR) MONITOR signal. The rising edge of the PWM (XOR) MONITOR signal opens a new event window EVENTWINDOW2. Before the counter overflows, if the PWM (XOR) MONITOR signal does not return to zero, that is, considering system delay, the PWM signal and the detected MONITOR signal must be consistent, otherwise an alarm is issued. This function can be configured by the user to be enabled or disabled. If the output PWM signal and the feedback MONITOR signal are still different, an alarm is issued.

[0039] Figure 3 is a waveform diagram showing the operation of a functional safety detection chip according to an embodiment of the present invention. Specifically, refer to Figure 3 , from Figure 3It can be seen that: under normal circumstances, the PWM signal is consistent with the feedback MONITOR signal and there is no alarm. When an abnormality occurs, the PWM signal is inconsistent with the feedback MONITOR signal, and an alarm is triggered. After a period of time, if the MONITOR signal becomes abnormal due to an error (for example, shorted to the power supply or the high-voltage MOSFET is broken down), there is no alarm in the prior art after the MONITOR signal goes wrong. Because there is no rising edge of the PWM signal to open the event window EVENT WINDOW, only the PWM signal can open (pull low) the event window EVENT WINDOW, and the MONITOR signal cannot open it.

[0040] In view of the above defects, in combination with Figure 2 , the input-output monitor 20 adds an additional new event window and counter. The input-output monitor 20 performs an exclusive OR operation on the PWM signal and the monitor (MONITOR) signal to obtain the PWM(XOR)MONITOR signal. The rising edge of the PWM(XOR)MONITOR signal can open the new event window EVENT WINDOW2. If the MONITOR signal becomes abnormal due to an error (for example, shorted to the power supply or the high-voltage MOSFET is broken down) at this time, an alarm is triggered, automatically achieving a higher functional safety coverage rate. By adding the signals in the bottom two columns, PWM detection with 0% and 100% duty cycles is achieved. This new function can be turned off or on separately. This function is relatively independent and can be defaulted to off without affecting the existing system.

[0041] Optionally, the PWM signal is a pulse frequency modulation signal or a space vector pulse width modulation signal.

[0042] Specifically, the PWM (Pulse Width Modulation) signal can be generally understood to include a pulse frequency modulation signal (Pulse Frequency Modulation, PFM), a space vector pulse width modulation signal (Space Vector PulseWidth Modulation, SVPWM), etc.

[0043] Optionally, the functional safety detection chip includes at least one of a single-chip microcomputer, a DSP, and an FPGA.

[0044] An embodiment of the present invention also provides a functional safety detection system, which includes the functional safety detection chip provided in any embodiment of the present invention, a gate driver, and a switching device;

[0045] The functional safety detection chip is connected to the gate driver, the gate driver is connected to the switching device, and the switching device is connected to the functional safety detection chip.

[0046] Since the functional safety detection system includes the functional safety detection chip provided by any embodiment of the present invention, the beneficial effects of the above functional safety detection system and the functional safety detection chip are the same and will not be elaborated here.

[0047] Optionally, the functional safety detection system is a motor control system or a vehicle charger system.

[0048] Specifically, the functional safety detection system is used for the functional safety detection of the motor control system and can also be used for the all-hardware functional safety detection on the high-frequency digital power control system, such as the vehicle charger system.

[0049] The above specific embodiments do not constitute a limitation on the protection scope of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A functional safety detection chip, characterized in that, Comprising: A timer output module and an input / output monitor; The timer output module is connected to the input / output monitor and the gate driver, the gate driver is connected to the switching device, the timer output module is used to generate a PWM signal in real time and send it to the input / output monitor and the gate driver, the gate driver is used to drive and control the switching device according to the PWM signal, the PWM signal generates a monitor signal in real time through the gate driver and the switching device, and the switching device is used to feedback the monitor signal to the input / output monitor; The input / output monitor includes a counter, the overflow value of the counter is configured by a register, and the counter is used to set a preset time; The input / output monitor is connected to the switching device, and the input / output monitor is used to compare the PWM signal and the monitor signal in real time. If the PWM signal and the monitor signal do not reach the same state after the preset time, an alarm is given.

2. The functional safety detection chip according to claim 1, wherein The input / output monitor is also used to perform an exclusive OR operation on the PWM signal and the monitor signal and output a result signal, and the result signal is used to open a new event window.

3. The functional safety detection chip according to claim 2, wherein Before the counter overflows, if the result signal does not return to zero, an alarm is given.

4. The functional safety detection chip according to claim 1, wherein The duty cycle range of the PWM signal is 0%-100%.

5. The functional safety detection chip according to claim 1, wherein The monitor signal includes a phase voltage signal.

6. The functional safety detection chip according to claim 1, characterized in that, The PWM signal is a pulse frequency modulation signal or a space vector pulse width modulation signal.

7. The functional safety detection chip according to claim 1, characterized in that, The functional safety detection chip includes at least one of a microcontroller, a DSP, and an FPGA.

8. A functional safety detection system, characterized in that, Comprising the functional safety detection chip according to any one of claims 1-7, a gate driver, and a switching device; The functional safety detection chip is connected to the gate driver, the gate driver is connected to the switching device, and the switching device is connected to the functional safety detection chip.

9. The functional safety detection system according to claim 8, wherein The functional safety detection system is a motor control system or a vehicle-mounted charger system.

Images