Undervoltage protection system for power management

Abstract

The invention relates to an under-voltage protection system for power management. An apparatus for selectively deactivating a non-critical load in the event of a power supply undervoltage is provided. Two independent turn-off paths that perform voltage monitoring in parallel are configured. The outputs of the paths are combined to generate a signal to override the load drive control signal with respect to a load with low criticality in the event of an undervoltage across either or each path. Fast response time and low error rate are achieved in a cost effective device.

Description

Technical Field

[0001] The present disclosure relates to undervoltage protection, and more particularly to power management performed by cutting off non-safety-critical loads in response to detecting an undervoltage condition. The present disclosure also relates to routines for testing a vehicle's power management scheme. In addition, the present disclosure relates to automotive electronic control units and software for implementing the above methods. Background Art

[0002] Many modern vehicles comply with ISO 26262 (an international standard for functional safety defined by the International Organization for Standardization (ISO)). Functional safety is defined in ISO 26262 as "freedom from unreasonable risk due to hazards caused by the malfunctioning behavior of an electrical or electronic system". ISO 26262 defines a series of Automotive Safety Integrity Levels (ASILs), which classify the safety requirements for specific automotive components as compliant with ISO 26262. ASIL D represents the most stringent set of requirements applied to safety-critical components such as airbags or brakes. ASIL A is the lowest functional safety rating and is applicable to components such as heating and cooling or rear lights. An additional "Quality Management" (QM) level ASIL(QM) is applied to components with no safety requirements, such as radios or USB connections.

[0003] The electrical configuration of an automotive system can be implemented in many different topologies to power and control vehicle components. An example of a commonly used topology is a domain-based partitioned and decentralized topology based on a network of electronic control units (ECUs), where each ECU can control one or more components grouped by function or physical location within the vehicle. Since automotive components are associated with functional safety requirements defined by different ASILs, a particular ECU may have a mixed criticality if it controls both safety-critical and non-safety-critical loads.

[0004] The supply voltage applied to an ECU affects the extent to which the ECU's loads can be powered. The supply voltage of an ECU comes from the vehicle's electrical system, which can include multiple interconnected energy sources such as a battery. In the event of a failure of one of these energy sources, or if a large load is connected to the energy source, it may cause a voltage drop in the combined supply voltage.

[0005] If the supply voltage drops in this way, referred to here as "undervoltage", a critical power situation may occur unless non-critical loads are cut off. If non-critical loads are not cut off, the load on the power supply does not decrease, and there may be insufficient or unstable voltage available to power critical loads, resulting in the loss of critical vehicle functions.

[0006] In view of the above, it is necessary to reduce the total load on the vehicle power supply in the case of undervoltage in order to maintain critical vehicle functions and to be able to meet the specific ASIL requirements defined by ISO 26262. Summary of the Invention

[0007] According to a first aspect, there is provided an apparatus for controlling the power supply to a plurality of loads, the apparatus comprising: a first voltage monitor for monitoring a supply voltage; a second voltage monitor for monitoring the supply voltage; a control circuit for controlling a load driver to selectively drive the plurality of loads, wherein the control circuit is configured to control the load driver to disconnect one or more predetermined loads from the supply voltage if any one of the first voltage monitor or the second voltage monitor determines an undervoltage condition; wherein the first voltage monitor and the second voltage monitor are connected in parallel to the supply voltage.

[0008] In this way, a fast and cost-effective solution is provided for implementing a mechanism for maintaining safety-critical loads in the event of a sudden drop in one or more voltage domains of a vehicle power supply. The best failure-in-time (FIT) rate is achieved by using two voltage-independent voltage monitoring paths.

[0009] In an embodiment, the first voltage monitor includes an operational amplifier configured to compare the supply voltage with a threshold voltage. The operational amplifier has a fast response time and is capable of quickly generating a change in the output state when the supply voltage drops below the threshold voltage.

[0010] In an embodiment, the first voltage monitor is a first operational amplifier having a non-inverting input receiving a first threshold voltage and an inverting input receiving the supply voltage, and the second voltage monitor is a second operational amplifier having a non-inverting input receiving the supply voltage and an inverting input receiving a second threshold voltage. In this way, the two voltage monitors are configured differently to diversify the voltage monitoring function of the apparatus. This reduces interference between the two voltage monitoring signal paths and reduces system errors.

[0011] In an embodiment, the second voltage monitor is a reset generator. In this way, the combination of the operational amplifier and the voltage monitor further diversifies the decomposition of the voltage monitoring function and further reduces interference.

[0012] In an embodiment, the first voltage monitor and the second voltage monitor are arranged to output corresponding first and second logic signals having a first state if an undervoltage condition is detected, and corresponding first and second logic signals having a second state if an undervoltage condition is not detected, wherein the control circuit is configured to perform a logical OR operation on the first and second signals, and the first and second states are such that if either the first voltage monitor or the second voltage monitor detects an undervoltage condition, a control signal is provided to the load driver to disconnect one or more predetermined loads from the supply voltage. In this way, even if only one voltage monitor detects an undervoltage condition, safety-critical loads can be turned off.

[0013] In an embodiment, the control signal includes one or more override signals that override corresponding control signals provided from an electronic control unit to the load driver to control corresponding ones of the one or more loads, the one or more override signals overriding the corresponding control signals for the predetermined loads. Thus, the electronic control unit does not need to be reprogrammed or generate new control signals in response to an undervoltage condition. Instead, the load driver will respond differently to the original control signals, resulting in a faster response time.

[0014] In an embodiment, one or more of the predetermined loads have a functional safety requirement below a threshold critical level. The threshold can be set by configuration of a threshold voltage and the arrangement of critical and non-critical loads in the load driver, thereby achieving an overall functional safety of at least ASIL B. This functional safety level is based on the maximum functional safety level of the non-critical loads to be deactivated and corresponds to the minimum functional safety level of the critical loads to be retained.

[0015] In an embodiment, the device further includes means for setting one or more threshold voltages that define an undervoltage condition. The threshold voltages can be easily set and adjusted by resistor selection in a voltage divider circuit.

[0016] In an embodiment, the first voltage monitor is arranged to determine an undervoltage condition when the supply voltage is less than a first threshold voltage, and the second voltage monitor is arranged to determine an undervoltage condition when the supply voltage is less than a second threshold voltage different from the first voltage. In this way, race conditions due to the presence of two different voltage monitoring paths are avoided.

[0017] In an embodiment, the control circuit is configured to disconnect one or more predetermined loads from a first voltage monitor or a second voltage monitor that detects a supply voltage below 6.5V within a response time of 100 μs. This is in accordance with the reaction time of VDA450, which defines the power supply requirements compliant with ISO 26262. Such a response time is not possible with a microcontroller alone.

[0018] In an embodiment, the device further includes storage means for recording one or more instances of an undervoltage condition. Thereby, diagnostic information can be obtained by an electronic control unit to identify the cause or long-term behavior pattern of the undervoltage condition.

[0019] In an embodiment, the storage means is a latch circuit. Such a circuit enables a better fast data acquisition time than can be achieved using a controller, and thus reduces the number of undervoltages that would otherwise be missed by such a controller.

[0020] According to a second aspect, there is provided a vehicle system, the vehicle system comprising: a plurality of automotive system components defining respective multiple loads; an electronic control unit for controlling the plurality of automotive system components; a power supply for supplying a supply voltage to the electronic control unit; a load driver controlled by the electronic control unit for driving the multiple loads; and a device as described above for controlling the load driver to disconnect a predetermined load of the multiple loads from the supply voltage when an undervoltage condition in the supply voltage is determined by either or each of the first voltage monitor or the second voltage monitor.

[0021] In an embodiment, the electronic control unit is arranged to control the operation of the first voltage monitor and the second voltage monitor. This enables avoiding unnecessarily tracking transient supply voltages after a voltage monitoring function reset.

[0022] In an embodiment, the electronic control unit is arranged to provide one or more first test signals to the first voltage monitor and one or more second test signals to the second voltage monitor to simulate one or more undervoltage conditions, and to compare the operation of the control circuit with a predetermined operation to verify the disconnection of one or more predetermined loads in response to the simulated one or more undervoltage conditions. In this way, a self-test function is provided such that the vehicle can verify the operation of its undervoltage detection capability. Description of the Drawings

[0023] Exemplary embodiments will now be described with reference to the drawings, in which:

[0024] Figure 1 A schematic representation of a circuit according to a first embodiment is shown; and

[0025] Figure 2 Shows a schematic representation of a circuit according to a second embodiment. Detailed implementation

[0026] Figure 1 Shows a schematic representation of the arrangement of the power control device 10 according to the first embodiment. The power control device 10 is used in an automotive system, where the load driver 20 supplies power to automotive components (such as a lighting system, an air conditioning system, and an entertainment system) according to commands from the controller. The controller 21 is an electronic control unit such as a microcontroller. The power control device 10 is configured to be installed in the main power distribution box or fuse box of the automotive system.

[0027] Power is obtained from a plurality of power sources 22-1, 22-2, 22-n, such as a battery, a generator, a DC-DC converter, etc. The power sources 22-1…22-n are combined using an ORing configuration 23 implemented as a diode or a transistor so as to isolate them from each other while achieving power redundancy to ensure that the system can continue to operate correctly in the event of any individual power source failure. Each power source 22-1…n serves as a voltage source, and its power supply voltage is monitored by the controller 21.

[0028] The output of the power source ORing operation 23 is the internal power supply voltage V_internal, which is the basis for the power supply voltage of the load driver 20. V_internal is a voltage protected by the power control device 10 of the first embodiment against voltage drops. V_internal is supplied to the power management integrated circuit (PMIC) 24, and the PMIC 24 applies any of a variety of power management functions to V_internal (such as voltage regulation or DC-DC conversion) so that the voltage supplied to the load driver 20 by the controller 21 receiving the output of the PMIC 24 is suitable for the load to be driven. In normal operation, V_internal is sufficient to supply power to the safety-critical load 25 (also referred to herein as the 'critical load') and the non-safety-critical load 26 (also referred to herein as the 'non-critical load').

[0029] The power control device 10 according to the first embodiment includes a first voltage monitor 11 and a second voltage monitor 12. The first voltage monitor 11 and the second voltage monitor 12 are connected in parallel to V_internal, as Figure 1As shown. In the first embodiment, each of the first voltage monitor 11 and the second voltage monitor 12 includes an operational amplifier (op-amp), which is enabled or disabled by the controller 21 through corresponding enable signals. The function of each operational amplifier 11, 12 is to compare V_internal with a third voltage. If V_internal drops below the threshold voltage, then each operational amplifier 11, 12 will detect this undervoltage event and change its output state.

[0030] The outputs of the two operational amplifiers 11, 12 are logically combined in such a way that if either or each of the two operational amplifiers 11, 12 detects an undervoltage in V_internal, a control signal V_control is provided to the load driver 20. In the embodiment, the logical combination is an OR operation. The control signal V_control effectively rewrites the signal output from the controller 21 to the load driver 20 in such a way that non-critical loads 26 are turned off or deactivated. In this way, it can be ensured that there is sufficient power supply voltage to keep the critical system functions running.

[0031] In the first embodiment, the logical combination of the output states of the operational amplifiers 11, 12 causes a binary signal to be applied to the load driver 20, which can be understood as an override instruction, or a no-override or pass-through instruction. For such a system, the non-critical loads 26 to be deactivated are recognized by the load driver 20 as a set of predetermined loads, and in response to the control signal V_control output from the power control device 10, the operation of the predetermined loads is deactivated by zeroing the corresponding drive outputs from the load driver 20, or retained by maintaining the drive signals specified by the load driver 20 for normal operation. The state of the predetermined loads can be modified by configuring the load driver 20 accordingly.

[0032] In particular, the load driver 20 is configured to specify a set of one or more non-critical loads 26, which are deactivated when an undervoltage condition is detected. An example of a non-critical load 26 is a heated seat system, the function of which is not essential for the safety of the vehicle. Other examples are high-side drivers, low-side drivers, eFuses, and H-bridges. The set of loads is configured according to specific requirements, and in the first embodiment of the present invention, if loads rated ASIL A or ASIL QM are automatically turned off when an undervoltage in V_internal is detected, a functional safety of ASIL B level or higher can be achieved.

[0033] The voltage monitoring function of the power control device 10 is decomposed into two independent signal paths, introducing the diversity required by the ISO 26262 standard in the specific mechanism for detecting under-voltage in V_internal. This reduces or eliminates system failures such as interference between the two voltage monitoring paths or soft errors that may affect voltage monitoring. Therefore, the failure in time (FIT) rate of the power control device 10 can be reduced. In the first embodiment, diversity is achieved by configuring the first operational amplifier 11 to receive V_internal at its non-inverting input (representing the positive input comparator), and configuring the second operational amplifier 12 to receive V_internal at its inverting input (representing the negative input comparator). Thus, the two operational amplifiers 11, 12 generate inverted output signals relative to each other, and their specific operating modes are different from each other.

[0034] The inverting input to the first operational amplifier 11 and the non-inverting input to the second operational amplifier 12 are threshold voltages provided from a voltage source. A controllable voltage source, a voltage divider, resistor selection, or any other suitable voltage control technique can be used to control the threshold voltage. The threshold voltages provided to each of the operational amplifiers 11, 12 represent substantially the same under-voltage detection threshold. However, it may be beneficial to use different threshold voltages for each of the operational amplifiers 11, 12 in an embodiment. Different threshold voltages can be obtained by applying different voltage divider configurations to the reference voltages of the two different voltage monitoring paths. The advantage of using different threshold voltages is to avoid a race condition in which incorrect control may be briefly applied to the load driver 20 due to differences in the signal propagation paths of the logical combinations of signals reaching the output ends of these paths through the two voltage monitors for control signal generation. The threshold voltages should be different enough to establish diversity in the voltage monitoring channels, but close enough together so as not to introduce a delay in the under-voltage detection in the voltage monitoring path with the lower threshold. It should be understood that the specific threshold voltages will depend on the supply voltage, the operational amplifiers and latch circuits (slew rate, response time) used, etc., and can be selected accordingly by those skilled in the art.

[0035] In the first embodiment, a latch circuit 13 is arranged in the first voltage monitoring path between the output of the first operational amplifier 11 and the load driver 20. The latch circuit 13 is not necessary for turning off the non-critical load 26, but it enables the controller 21 to check the input stage and the output stage to evaluate the reason for deactivating one or more loads and to ensure that there are no errors before normal operation is restored.

[0036] In the first embodiment, the latch circuit 13 operates according to the principle of a set-reset (SR) latch. The reset signal is provided by the controller 21, and the set signal is provided by the output state of the first operational amplifier 11. The controller 21 is capable of activating the reset signal so as to ready the latch circuit 13 to monitor for undervoltage events. The advantage of this mechanism is that it is not necessary to wait for a controller clock cycle to complete before an undervoltage event is detected, because once the set signal changes, the latch circuit 13 will capture the event based on the response time of the first operational amplifier 11. In the absence of the latch circuit 13, any diagnostic operations would be performed directly by the controller 21, and thus detectable state changes would be limited by the clock speed of the controller 21.

[0037] An example of a behavior that can be determined by the controller 21 based on logic states is the stability of V_internal based on the number of operational amplifier output state changes that occur within a predetermined time period. According to such a diagnosis, a warning message can be displayed to the vehicle user on the control panel or dashboard, warning the user of a system fault in the vehicle's electrical system or battery.

[0038] The presence of the latch circuit 13 introduces a distinction between a first signal path and a second signal path such that, by setting the threshold voltage of the first operational amplifier 11 to be higher than the threshold voltage of the second operational amplifier 12, if V_internal drops from a level above the first threshold voltage level to below the second voltage level, the first operational amplifier 11 will detect the undervoltage before the second operational amplifier 12 does. The difference between the threshold voltages can be relatively small such that the delay introduced by the presence of the latch circuit is compensated for by the timing between undervoltage detections in each path.

[0039] The use of the two operational amplifiers 11, 12 enables a response to a drop of V_internal below the threshold to occur within 100 μs. This is a rapid response to a sudden drop in V_internal and is significantly faster than the response that could be obtained if non-critical loads 26 were to be disabled by the microcontroller. For example, the response time is limited by the loop time of the microcontroller's operating system and the time required for analog-to-digital conversion to perform mathematical operations. This level of response time meets the specifications set out in standards such as VDA450.

[0040] From the above, it can be understood that a fast response time and a low error rate are achieved in a cost-effective device based on the simplicity and speed of the components used.

[0041] Many modifications can be made to the power control device 10 of the first embodiment.

[0042] First, as described above, advantages are obtained by decomposing the voltage monitoring function into different monitoring paths. In addition to differentiating the operational amplifiers in each voltage monitoring path by their inverting or non-inverting configurations, two different types (models, configurations, manufacturers) of operational amplifiers can be utilized in an embodiment. In an embodiment, one of the operational amplifiers is replaced by a different voltage monitoring component, such as a reset generator (e.g., TPS 3808 generator or the like). Generally, components with the fastest possible response time are optimal. Increasing the level of diversity between channels will enable reduction of interference between channels.

[0043] Second, the latch circuit 13 can be constructed using any suitable logic configuration that can track a state sequence from which an undervoltage condition can be identified, and it is not necessary for the latch circuit 13 to be based on SR logic. In an embodiment, the latch circuit 13 is completely omitted.

[0044] Figure 2 The power control device 30 of the second embodiment is shown. Based on the use of two operational amplifiers 31, 32 and a latch circuit 33, the operating principle of the power control device 30 is similar to that Figure 1 described in the reference. In the second embodiment, the latch circuit 33 is known in the art as a 7473 dual J-K flip-flop, but this is for illustrative purposes only, and any suitable latch circuit 33 can be used.

[0045] Figure 2 It is shown that the supply voltage V_internal is divided by a voltage divider into threshold levels suitable for monitoring at each of the operational amplifiers 31, 32, taking into account the electrical characteristics of the operational amplifiers 31, 32 in terms of gain, input impedance, supply voltage, etc. In Figure 2 the embodiment, a portion of V_internal is input to each of the operational amplifiers 31, 32 as the voltage to be monitored via the ratios R4 / [R3 + R4] and R8 / [R7 + R8]. The first operational amplifier 31 acquires the monitored voltage at its inverting input, while the second operational amplifier 32 acquires the monitored voltage at its non-inverting input.

[0046] The threshold voltage is applied to the non-inverting input of the first operational amplifier 31 and the inverting input of the second operational amplifier 32. Additionally, as Figure 2 shown, a voltage divider device based on resistors R1, R2, R5, and R6 is used. The use of the voltage divider facilitates adjustment of the undervoltage threshold by changing the values of the resistors.

[0047] The specific value of each resistor depends on the applied voltage domain and the desired response time.

[0048] The power control device 30 of the second embodiment is used in combination with a test process by which a vehicle can automatically simulate a plurality of conditions based on its influence on the voltages monitored by operational amplifiers 31, 32 and determine whether the corresponding power control operations are correctly performed. This is achieved based on the configuration of control signals (MCU-CHECK_PATH1 and MCU-CHECK_PATH2) respectively provided from a controller (not shown) to the bases of bipolar transistors Q3 and Q2.

[0049] Each of MCU-CHECK_PATH1 and MCU-CHECK_PATH2 controls the voltage to be monitored by short-circuiting the corresponding monitoring terminals of operational amplifiers 31, 32 to ground. When MCU-CHECK_PATH1 is high, Q3 is turned on, which pulls down the voltage of the inverting input of the first operational amplifier 31 to ground. When MCU-CHECK_PATH1 is low, Q3 is turned off, and the voltage of the inverting input remains at the divided voltage part of V_internal. Similarly, when MCU-CHECK_PATH2 is high, Q2 is turned on, and the non-inverting input of the second operational amplifier 32 is pulled to ground. When MCU-CHECK_PATH2 is low, Q2 is turned off, and the voltage of the non-inverting input remains at the divided voltage part of V_internal.

[0050] If the second operational amplifier 32 detects an under-voltage such that the voltage on the non-inverting input is less than the threshold voltage and the voltage on the inverting input, then the digital transistor DQ1 is turned off when the output of the second operational amplifier 32 is low. In this case, due to the nature of the path through R11, R10, R9, R5, and R6 and the threshold voltage source V_ref between R5 and R9, the base voltage of the transistor Q4 is high, regardless of the output of the latch circuit 33. If Q4 is turned on, then V_control is low because it is pulled to ground via the emitter of Q4, and the non-critical load is deactivated.

[0051] Conversely, if the second operational amplifier 32 does not detect an under-voltage condition, then DQ1 is turned on, and the base voltage of Q4 depends on the output of the latch circuit 33. If the output of the latch circuit 33 is high, then since the first operational amplifier 31 detects an under-voltage, the base of Q4 is high, and V_control is low, thereby deactivating the non-critical load. If the output of the latch circuit 33 is low, then in the absence of an under-voltage detected by the first operational amplifier 31, Q4 is turned off and V_control is high. Therefore, if either of the operational amplifiers 31, 32 detects an under-voltage, then V_control is low.

[0052] In Figure 2In the illustrated embodiment, transistors DQ1, DQ2, and DQ3 are digital transistors. In digital transistors, the switching threshold can be controlled by selecting the base-emitter resistor, and the current of the transistor can be controlled by the base resistor. Transistor Q4 is not a digital transistor and is thus voltage-controlled, having a fast switching speed.

[0053] Table 1 shows an example of the applied test scenarios.

[0054]

[0055] Table 1: BIST Process in Parking Mode

[0056] By transitioning the corresponding MCU-CHECK_PATH signal from low to high and enabling operational amplifiers 31 and 32 via an enable signal from a controller (not shown), it is possible to simulate an undervoltage on the monitored input to determine that V_control is as expected. In this way, the controller can bypass V_internal to test whether the voltage monitoring path is operational.

[0057] The output of the vehicle power supply can also be tested by deactivating operational amplifiers 31 and 32 and the MCU-CHECK_PATH signal to establish the conditions required for testing. The controller measures the voltage in a manner similar to that Figure 1 shown. Finally, the reset of the latch circuit 33 is tested by applying a reset signal, and operational amplifiers 31 and 32 are enabled without applying the MCU-CHECK_PATH signal to determine whether this results in the expected change in V_control.

[0058] The tests listed in Table 1 are suitable for performance when the vehicle is in the parking mode as part of a built-in self-test (BIST) operation. If the BIST is passed, a positive voltage on V_control is interpreted as indicating normal behavior as described above. No override is applied to the load driver 20, but the undervoltage detection can be considered 'armed'. Conversely, if V_control is low, it is determined that V_internal has dropped due to an overload condition. As described above, the load driver 20 deactivates a predetermined load detected by the controller. The controller re-initializes the voltage monitoring system. The re-initialization is performed by disabling the operational amplifier, resetting the latch circuit, and then re-enabling the operational amplifier. The period during which the operational amplifier is inactive is useful for allowing system transients to pass.

[0059] The controller can also detect a specific voltage of the power supply after detecting an undervoltage in V_internal, in order to identify specific and persistent problems or obstacles for re-initializing the voltage monitoring. This can protect the energy source or the wiring harness, where continuous operation may cause damage to the battery or any system component. In the case where full operation cannot be restored, a warning message is generated to be displayed on the control panel or the dashboard, so that the user of the vehicle can perform repairs.

[0060] In combination with Figure 2 the self-test operation described can be implemented in Figure 1 an embodiment of a vehicle system according to an embodiment of the present disclosure, which includes a plurality of automotive system components defining a corresponding plurality of loads, an electronic control unit for controlling the plurality of automotive system components, a power supply for supplying a power supply voltage to the electronic control unit, a load driver, and a power control device of an embodiment of the present disclosure. The electronic control unit corresponds to, for example, Figure 1 the controller 21 shown, which generates an MCU-CHECK_PATH signal and an operational amplifier enable circuit. The vehicle system can interface with other control systems of the vehicle, and the controller can interface with one or more controllers of the vehicle.

[0061] The test program is configured according to a series of computer-executable instructions to be executed by the controller, so as to control the sequence and level of the enable signal and the MCU-CHECK_PATH signal provided to the operational amplifier. The computer-executable instructions can be periodically updated and downloaded by the vehicle to reconfigure the test process.

[0062] In addition, the modifications to the above first embodiment can also be applied to the second embodiment. The specific operational amplifier configuration can be changed, and the operational amplifier can be replaced with a reset generator, etc.

[0063] It should be understood that the above embodiments are shown for illustrative purposes only. In fact, the embodiments can be applied to many different configurations, and the detailed embodiments are straightforward for those skilled in the art to implement according to the teachings presented in the present disclosure. The power control device is configured according to system requirements, defines the sensitivity to undervoltage, and takes into account the number and nature of the loads to be provided and the allowable voltage drop in V_internal, for which non-critical loads can be retained so that non-critical loads are not unnecessarily deactivated.

Claims

1. An apparatus for controlling the power supply to a plurality of loads, the apparatus comprising: A first voltage monitor for monitoring a supply voltage; A second voltage monitor for monitoring the supply voltage; And A control circuit for controlling a load driver to selectively drive the plurality of loads, Wherein the control circuit is configured to: if either the first voltage monitor or the second voltage monitor determines an undervoltage condition, control the load driver to disconnect one or more predetermined loads of the plurality of loads from the supply voltage, and Wherein the first voltage monitor and the second voltage monitor are connected in parallel to the supply voltage.

2. The device according to claim 1, wherein, The first voltage monitor includes an operational amplifier configured to compare the supply voltage with a threshold voltage.

3. The apparatus according to claim 2, wherein: The first voltage monitor is a first operational amplifier having a non-inverting input receiving a first threshold voltage and an inverting input receiving the supply voltage, and The second voltage monitor is a second operational amplifier having a non-inverting input receiving the supply voltage and an inverting input receiving a second threshold voltage.

4. The device according to claim 2, wherein The second voltage monitor is a reset generator.

5. The apparatus according to any one of claims 1 to 4, wherein The first voltage monitor and the second voltage monitor are arranged to output respective first and second logic signals having a first state in the event of detecting an undervoltage condition, and respective first and second logic signals having a second state in the event of not detecting an undervoltage condition, wherein the control circuit is configured to perform a logical OR operation on the first and second logic signals, and the first and second states are such that in the event of either the first voltage monitor or the second voltage monitor detecting an undervoltage condition, a control signal is provided to the load driver to disconnect one or more predetermined loads from the supply voltage.

6. The device according to any one of claims 1 to 5, wherein The control signal includes one or more override signals that override respective control signals provided from an electronic control unit to the load driver to control respective ones of the one or more loads, the one or more override signals overriding the respective control signals for the predetermined loads.

7. The device according to any one of claims 1 to 6, wherein The one or more predetermined loads have functional safety requirements below a threshold critical level.

8. The apparatus according to any one of claims 1 to 7, the apparatus comprising means for setting one or more threshold voltages defining an undervoltage condition.

9. The apparatus according to any one of claims 1 to 8, wherein The first voltage monitor is arranged to determine an undervoltage condition when the supply voltage is less than a first threshold voltage, and the second voltage monitor is arranged to determine an undervoltage condition when the supply voltage is less than a second threshold voltage different from the first threshold voltage.

10. The device according to claim 8 or 9, wherein, The control circuit is configured to disconnect the one or more predetermined loads from the first voltage monitor or the second voltage monitor that detects an undervoltage condition within a response time of 100 μs.

11. The apparatus according to any one of claims 1 to 10, the apparatus comprising storage means for recording one or more instances of an undervoltage condition.

12. The device according to claim 11, wherein, The storage means is a latch circuit.

13. A vehicle system, the vehicle system comprising: a plurality of automotive system components defining a corresponding plurality of loads; an electronic control unit for controlling the plurality of automotive system components; a power supply for supplying a supply voltage to the electronic control unit; a load driver controlled by the electronic control unit, the load driver for driving the plurality of loads; and the apparatus according to any one of claims 1 to 12, the apparatus for controlling the load driver to disconnect a predetermined load among the plurality of loads from the supply voltage when any one of the first voltage monitor or the second voltage monitor or each voltage monitor determines an undervoltage condition in the supply voltage.

14. The vehicle system according to claim 13, wherein, The electronic control unit is arranged to control the operation of the first voltage monitor and the second voltage monitor.

15. The vehicle system according to claim 14, wherein, The electronic control unit is arranged to provide one or more first test signals to the first voltage monitor and one or more second test signals to the second voltage monitor to simulate one or more undervoltage conditions and compare the operation of the control circuit with a predetermined operation to verify the disconnection of the one or more predetermined loads in response to the simulated one or more undervoltage conditions.

Images