Vehicle power distribution control circuit and control method based on double-MCU redundancy control

Abstract

The invention provides a vehicle power distribution control circuit and control method based on double-MCU redundancy control, the vehicle power distribution control circuit comprises a double-MCU module, the double-MCU module comprises a first controller and a second controller, the first controller and the second controller communicate with each other through an SPI interface and can reset each other through a reset circuit, and the double-MCU module outputs a plurality of control signals; the power supply module comprises a first power supply and a second power supply which are connected with the double-MCU module; the logic circuit module comprises a plurality of gate circuits, a plurality of RS triggers and a plurality of high-side switches, and the plurality of control signals output a plurality of driving signals through the high-side switches; and the execution module comprises an IGN1 relay, an IGN2 relay and an ACC relay, and the execution module receives the driving signals to control on-off of power supplies of all gears of the vehicle. The technical problems that in an existing single-MCU control mode, once a single MCU breaks down, power distribution is out of control, and even serious safety accidents such as vehicle flameout are caused are solved.

Description

Technical Field

[0001] This invention relates to the field of vehicle electronic control technology, and more specifically, to a vehicle power distribution control circuit based on dual MCU redundant control and a control method for the vehicle power distribution control circuit. Background Technology

[0002] Currently, the power on / off and power distribution of traditional vehicles are usually controlled directly by a mechanical key ignition lock. With the development of technology and the upgrading of vehicle configuration, the traditional mechanical ignition lock has been gradually replaced by one-button start technology, and the power distribution function of the ignition lock has also been replaced by the one-button start controller.

[0003] However, most common one-button start controllers currently use a single MCU to directly control power distribution. With the rapid increase in the adoption of intelligent cockpits and assisted / autonomous driving systems in vehicles, the electrification level of vehicles is also rapidly increasing. New electronic control modules such as battery management modules (BMS), vehicle control modules (VCU), vehicle networking modules (T-box), body domain controllers, and cockpit domain controllers are beginning to be widely used in new models. As the number of electrical devices in the vehicle increases, the vehicle's demand for power stability and reliability is also rapidly increasing.

[0004] However, the relevant technologies have at least one of the following problems: In the existing single MCU control method, once the single MCU fails, it will directly lead to uncontrolled power distribution, and even cause serious safety accidents such as vehicle stalling. Summary of the Invention

[0005] This invention addresses the technical problem in existing single-MCU control methods where a single MCU failure can directly lead to uncontrolled power distribution and even serious safety accidents such as vehicle stalling.

[0006] To address the aforementioned problems, this invention provides a vehicle power distribution control circuit based on dual MCU redundant control, comprising: a dual MCU module, which includes a first controller and a second controller, which communicate via an SPI interface and can be mutually reset via a reset circuit, and the dual MCU module outputs multiple control signals; a power supply module, which includes a first power supply and a second power supply connected to the first and second controllers; a logic circuit module, which includes multiple gate circuits, multiple RS flip-flops, and multiple high-side switches, and the multiple control signals output multiple drive signals through the high-side switches; and an execution module, which includes an IGN1 relay, an IGN2 relay, and an ACC relay, and the execution module receives drive signals to control the on / off state of the vehicle's power supply at each gear position; wherein the control signals include: a first gear on signal and a first gear off signal, a second gear on signal and a second gear off signal, an MCU control signal, and an ACC gear on signal.

[0007] Compared with existing technologies, the technical effects achieved by this solution are as follows: the first and second controllers communicate in real time via SPI serial port, exchanging control signals, fault status and other information. At the same time, they reset each other through a reset circuit, ensuring that if one MCU fails, the other MCU can trigger its restart; the power module provides stable and redundant power supply for the dual MCU modules; this invention achieves "no failure even with a single line fault" through dual MCU redundancy, dual power supply, and logic-execution hierarchical control, improving the reliability and stability of vehicle power distribution and meeting the safety requirements of new energy vehicles and high-level autonomous vehicles.

[0008] In one embodiment of the present invention, a first controller outputs six control signals: IGN1_ON1, IGN1_OFF1, IGN2_ON1, IGN2_OFF1, MCU1_CTRL, and ACC_ON1; a second controller outputs six control signals: IGN1_ON2, IGN1_OFF2, IGN2_ON2, IGN2_OFF2, MCU2_CTRL, and ACC_ON2. The logic circuit module includes: a first RS flip-flop, which receives IGN1_ON1, IGN1_OFF1, IGN2_OFF1, and ACC_ON1. The first RS flip-flop receives IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL, and MCU2_CTRL, and its output is connected to the IGN1 relay; the second RS flip-flop receives IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL, and MCU2_CTRL, and its output is connected to the IGN2 relay; the fifth AND gate receives ACC_ON1 and ACC_ON2, and its output is connected to the ACC relay.

[0009] Compared with existing technologies, the technical effects achieved by this technical solution are as follows: This invention realizes "one dedicated logic unit per gear", the control signal and gear position are precisely matched, the latching characteristics of the RS flip-flop can stably maintain the gear position power supply state, avoid the power supply "false disconnection" after startup, and the fifth AND gate simplifies the ACC gear position control logic while ensuring dual MCU redundancy verification.

[0010] In one embodiment of the present invention, the logic circuit module further includes: a first AND gate, which receives IGN1_ON1 and IGN1_ON2, and the output of the first AND gate serves as the set signal of the first RS flip-flop; a second AND gate, which receives IGN1_OFF1 and IGN1_OFF2; a third AND gate, which receives IGN2_ON1 and IGN2_ON2, and the output of the third AND gate serves as the set signal of the second RS flip-flop; a fourth AND gate, which receives IGN2_OFF1 and IGN2_OFF2; a first OR gate, which receives MCU1_CTRL and MCU2_CTRL; a sixth AND gate, which receives the output of the first OR gate and a start button signal; a second OR gate, which receives the output of the second AND gate and the output of the sixth AND gate, and the output of the second OR gate serves as the reset signal of the first RS flip-flop; and a third OR gate, which receives the output of the fourth AND gate and the output of the sixth AND gate, and the output of the third OR gate serves as the reset signal of the second RS flip-flop.

[0011] Compared with the prior art, the technical effects achieved by adopting this technical solution are as follows: The vehicle power distribution control circuit of this application is built in a pure hardware manner, consisting of AND gates, OR gates and RS flip-flops. The circuit is simple, low in cost and highly reliable. It can control the ACC power and ON power of the whole vehicle (including IGN1 and IGN2), and can also realize the function of emergency shutdown when the MCU fails.

[0012] In one embodiment of the present invention, the logic circuit module further includes: a first high-side switch and a second high-side switch, the input terminals of the first high-side switch and the second high-side switch being connected to the output terminal of a first RS flip-flop, and the output terminals of the first high-side switch and the second high-side switch being connected in parallel to an IGN1 relay; a third high-side switch, the input terminal of the third high-side switch being connected to the output terminal of a second RS flip-flop, and the output terminal of the third high-side switch being connected to an IGN2 relay; and a fourth high-side switch, the input terminal of the fourth high-side switch being connected to the output terminal of a fifth AND gate, and the output terminal of the fourth high-side switch being connected to an ACC relay.

[0013] Compared with the existing technology, the technical effects achieved by adopting this technical solution are as follows: the first high-side switch and the second high-side switch are connected in parallel. Even if one of the high-side switches fails, the other high-side switch can still receive the signal of the first RS trigger and output the drive voltage to trigger the IGN1 relay, ensuring that the power supply of the IGN1 position is not interrupted; the logic circuit module outputs 3 drive signals, which are output by multiple HSDs respectively, to directly drive 3 relays: IGN1 relay K1, IGN2 relay K2, and ACC relay K3 to distribute power to the whole vehicle.

[0014] In one embodiment of the present invention, the power module further includes: a first power chip and a second power chip. The first power supply and the second power supply are connected in parallel and are respectively connected to the first power chip and the second power chip. The first power chip is connected to the first controller and the second power chip is connected to the second controller.

[0015] Compared with existing technologies, the technical effects achieved by adopting this technical solution are as follows: This invention uses an LDO chip to regulate voltage, avoiding the impact of vehicle power fluctuations on MCU operation; the dual power supply chips supply power to the dual MCUs respectively, and the failure of a single power supply chip does not affect the other MCU, thus improving power supply redundancy.

[0016] In one embodiment of the present invention, the reset circuit includes: a first reset AND gate, the input of which is connected to a first power supply chip and a second controller, and the output of which is connected to the first controller; and a second reset AND gate, the input of which is connected to the second power supply chip and the first controller, and the output of which is connected to the second controller.

[0017] Compared with existing technologies, the technical effects achieved by this technical solution are as follows: This invention realizes an automatic mechanism for "normal MCU to reset faulty MCU" without manual intervention, thus improving fault recovery efficiency; the OR gate circuit ensures that the reset signal is not lost, thereby improving the reset success rate.

[0018] In one embodiment of the present invention, the vehicle power distribution control circuit further includes: a detection module, one end of which is connected to a second power supply, the other end of which is grounded, and the detection module includes a first resistor and a second resistor connected in series, and a first controller is connected between the first resistor and the second resistor.

[0019] Compared with existing technologies, the technical effects achieved by this technical solution are as follows: This invention monitors the power supply voltage in real time and detects undervoltage / overvoltage faults in advance; pure hardware voltage divider sampling results in low cost and fast response.

[0020] On the other hand, embodiments of the present invention also provide a control method for a vehicle power distribution control circuit. The control method is applied to a vehicle power distribution control circuit based on dual MCU redundant control as in the first embodiment, including: when the vehicle power distribution control circuit meets the start-up conditions, controlling the IGN1 relay, IGN2 relay, and ACC relay to be in the ON state, the vehicle starts and starts timing; after the timing reaches a preset time, maintaining the ON state of the IGN1 relay, IGN2 relay, and ACC relay; detecting the working state of the vehicle power distribution control circuit, the working state including: fault state and normal state; when the vehicle power distribution control circuit is in the fault state, the normal controller restarts the fault controller through a reset operation, and at the same time, the engine can be forcibly shut down through the start button; when the vehicle power distribution control circuit is in the normal state, if the power-down conditions are met and the start button is valid, all MCU control signals become high level, controlling the IGN1 relay and IGN2 relay to disconnect, and the vehicle is powered down.

[0021] Compared with existing technologies, the technical effects achieved by adopting this technical solution are as follows: the invention uses dual MCU synchronous control during startup to ensure reliable relay connection; in normal state, the power supply is maintained by RS trigger latch to avoid the influence of signal fluctuations; in case of failure, automatic reset and forced shutdown provide strong emergency response capabilities; and the power-off conditions are clearly defined to avoid accidental power-off.

[0022] In one embodiment of the present invention, the control method further includes: when the vehicle power distribution control circuit meets the start-up conditions, both the first gear start signal and the second gear start signal are at a high level, and both the first gear stop signal and the second gear stop signal are at a low level; after the timer reaches a preset time, the first gear start signal and the second gear start signal become at a low level, and the first gear stop signal and the second gear stop signal remain at a low level.

[0023] Compared with existing technologies, the technical effects achieved by this solution are as follows: The core function of this signal change logic is to prevent the relay from disconnecting after the start button is released, and to achieve "one-time start and continuous maintenance" through RS trigger latching, thereby improving start reliability; the power supply is stable after start-up, eliminating the need to continuously press the start button, which is in line with user operating habits.

[0024] In one embodiment of the present invention, when the vehicle power distribution control circuit is in a fault state, the normal controller restarts the faulty controller through a reset operation. At the same time, the engine can be forcibly shut down by the start button. This includes: if the first controller fails, the second controller restarts the first controller through a reset operation; if the second controller fails, the first controller restarts the second controller through a reset operation.

[0025] Compared with existing technologies, the technical effects achieved by this technical solution are as follows: This invention automates fault reset without manual intervention, has high recovery efficiency, and provides continuous power supply during the reset process, without affecting the normal operation of the vehicle.

[0026] By adopting the technical solution of the present invention, the following technical effects can be achieved: (1) This invention achieves “no failure in the event of a single line failure” by using dual MCU redundancy, dual power supply, and logic-execution hierarchical control, thereby improving the reliability and stability of vehicle power distribution and meeting the safety requirements of new energy vehicles and high-level autonomous vehicles. (2) The vehicle power distribution control circuit of this application is built in pure hardware and consists of AND gate, OR gate and RS flip-flop. The circuit is simple, low cost and high reliability. It can control the ACC power and ON power of the whole vehicle (including IGN1 and IGN2). It can also realize the function of emergency shutdown when the MCU fails. (3) The present invention uses LDO chip to regulate voltage, so as to avoid the impact of vehicle power fluctuation on MCU operation; the dual power supply chips supply power to the dual MCUs respectively, and the failure of a single power supply chip does not affect the other MCU, thus improving power supply redundancy. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Figure 1 This is a circuit diagram of a vehicle power distribution control circuit based on dual MCU redundancy control provided in Embodiment 1 of the present invention. Figure 2 for Figure 1 The circuit schematic of the vehicle power distribution control circuit based on dual MCU redundancy control when it is in the startup state; Figure 3 for Figure 1 The circuit diagram of the vehicle power distribution control circuit based on dual MCU redundancy control in normal state; Figure 4 for Figure 1 The circuit schematic of the vehicle power distribution control circuit based on dual MCU redundancy control when it is in a fault state; Figure 5 This is a detailed flowchart of a control method for a vehicle power distribution control circuit provided in Embodiment 2 of the present invention. Detailed Implementation

[0028] To make the above-mentioned objectives, features, and advantages of the present invention more apparent and understandable, the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Example 1 See Figure 1 This is a vehicle power distribution control circuit based on dual MCU redundancy control provided in the first embodiment of the present invention, combined with... Figures 2-4 The vehicle power distribution control circuit includes: a dual MCU module, a power module, a logic circuit module, and an execution module. The dual MCU module includes a first controller and a second controller, which communicate via an SPI interface and can be reset to each other via a reset circuit. The dual MCU module outputs multiple control signals. The power module includes a first power supply and a second power supply connected to the first and second controllers. The logic circuit module includes multiple gate circuits, multiple RS flip-flops, and multiple high-side switches. Multiple control signals are output as multiple drive signals through the high-side switches. The execution module includes an IGN1 relay, an IGN2 relay, and an ACC relay. The execution module receives drive signals to control the on / off state of the vehicle's power supply at each gear position. The control signals include: a first gear on signal and a first gear off signal, a second gear on signal and a second gear off signal, an MCU control signal, and an ACC gear on signal.

[0030] In one specific embodiment, the dual MCU module includes a first controller (MCU1) and a second controller (MCU2). The two communicate in real-time via SPI (Serial Peripheral Interface) to exchange control signals, fault status, and other information. Simultaneously, a reset circuit enables mutual reset, ensuring that if one MCU fails, the other MCU can trigger its restart. The dual MCU module outputs multiple control signals, covering the on / off and status control of the gear power supply, specifically including: first gear (IGN1) on signal, first gear off signal, second gear (IGN2) on signal, second gear off signal, MCU control signals, and ACC gear on signal. The power supply module provides stable and redundant power to the dual MCU module, including a first power supply (e.g., vehicle constant power KL30-1) and a second power supply (e.g., vehicle constant power KL30-2). The two power supplies are connected in parallel to ensure that if one power supply fails, the other can continue to supply power to the system, avoiding control failure due to power interruption. The logic circuit module, acting as the "processing center" for control signals, includes multiple gate circuits (AND gates, OR gates), multiple RS flip-flops, and multiple high-side switches (HSDs). Control signals output from the dual MCU modules are first input to the gate circuits for logical judgment, then latched by the RS flip-flops, and finally amplified by the high-side switches, outputting drive signals to the execution module. The execution module, acting as the "execution terminal" for power distribution, includes IGN1 relays, IGN2 relays, and ACC relays. K1 is the IGN1 relay, K2 is the IGN2 relay, and K3 is the ACC relay. Each relay corresponds to the vehicle's IGN1, IGN2, and ACC power positions, respectively. After receiving the drive signals from the logic circuit module, it controls the power supply to the corresponding power position through the opening and closing of the relay contacts, thus distributing power to the vehicle's electrical equipment. This invention, through dual MCU redundancy, dual power supply, and logic-execution hierarchical control, achieves "no failure in the event of a single-line fault," improving the reliability and stability of vehicle power distribution and meeting the safety requirements of new energy vehicles and advanced autonomous vehicles.

[0031] Furthermore, the first controller outputs six control signals: IGN1_ON1, IGN1_OFF1, IGN2_ON1, IGN2_OFF1, MCU1_CTRL, and ACC_ON1; the second controller outputs six control signals: IGN1_ON2, IGN1_OFF2, IGN2_ON2, IGN2_OFF2, MCU2_CTRL, and ACC_ON2. The logic circuit module includes: a first RS flip-flop and a second RS flip-flop. The first RS flip-flop receives IGN1_ON1, IGN1_OFF1, IGN1_ON2, IGN1_OFF2, MCU1_CTRL, and MCU2_CTRL, and its output is connected to the IGN1 relay; the second RS flip-flop receives IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL, and MCU2_CTRL, and its output is connected to the IGN2 relay; and a fifth AND gate receives ACC_ON1 and ACC_ON2, and its output is connected to the ACC relay.

[0032] Specifically, the first gear on signals include: IGN1_ON1 and IGN1_ON2; the first gear off signals include: IGN1_OFF1 and IGN1_OFF2; the second gear on signals include: IGN2_ON1 and IGN2_ON2; the second gear off signals include: IGN2_OFF1 and IGN2_OFF2; the MCU control signals include: MCU1_CTRL and MCU2_CTRL; and the ACC gear on signals include: ACC_ON1 and ACC_ON2.

[0033] U13 is the first RS flip-flop, U15 is the second RS flip-flop, and U20 is the fifth AND gate. The first RS flip-flop is dedicated to processing the IGN1 gear signal, receiving six signals: IGN1_ON1, IGN1_OFF1, IGN1_ON2, IGN1_OFF2, MCU1_CTRL, and MCU2_CTRL. It latches the power supply state of the IGN1 gear through "set-reset" logic, and its output is directly connected to the IGN1 relay to control its on / off state. The second RS flip-flop is dedicated to processing the IGN2 gear signal, receiving six signals: IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL, and MCU2_CTRL. Similarly, it latches the power supply state of the IGN2 gear, and its output is connected to the IGN2 relay. The fifth AND gate is dedicated to processing the ACC gear signal, receiving only two signals: ACC_ON1 and ACC_ON2 (the ACC gear does not require complex reset logic; it only needs to be turned on by outputting an enable signal from both the first and second controllers), and its output is connected to the ACC relay. This invention achieves "one dedicated logic unit per gear", ensuring precise matching between control signals and gear positions. The latching characteristics of the RS flip-flop can stably maintain the power supply state of the gear position, avoiding "false power interruption" after startup. The fifth AND gate simplifies the ACC gear control logic while ensuring dual MCU redundancy verification.

[0034] Furthermore, the logic circuit module also includes: a first AND gate, which receives IGN1_ON1 and IGN1_ON2, and its output serves as the set signal for the first RS flip-flop; a second AND gate, which receives IGN1_OFF1 and IGN1_OFF2; a third AND gate, which receives IGN2_ON1 and IGN2_ON2, and its output serves as the set signal for the second RS flip-flop; a fourth AND gate, which receives IGN2_OFF1 and IGN2_OFF2; a first OR gate, which receives MCU1_CTRL and MCU2_CTRL; a sixth AND gate, which receives the output of the first OR gate and the start button signal; a second OR gate, which receives the output of the second AND gate and the output of the sixth AND gate, and its output serves as the reset signal for the first RS flip-flop; and a third OR gate, which receives the output of the fourth AND gate and the output of the sixth AND gate, and its output serves as the reset signal for the second RS flip-flop.

[0035] Specifically, the inputs of the first AND gate U7 are connected to IGN1_ON1 and IGN1_ON2. Only when both of the first gear activation signals are high, the first AND gate U7 outputs a high level, which serves as the "set signal" (S signal) of the first RS flip-flop, triggering the IGN1 relay to turn on. The inputs of the third AND gate U9 are connected to IGN2_ON1 and IGN2_ON2. Similarly, only when both of the second gear activation signals are high, the third AND gate U9 outputs a high level, which serves as the "set signal" of the second RS flip-flop, triggering the IGN2 relay to turn on.

[0036] The inputs of the second AND gate U8 are connected to IGN1_OFF1 and IGN1_OFF2. The second AND gate U8 outputs a high level only when both of the first-gear off signals are high. The inputs of the fourth AND gate U10 are connected to IGN2_OFF1 and IGN2_OFF2. Similarly, the fourth AND gate U10 outputs a high level only when both of the second-gear off signals are high. The inputs of the first OR gate U11 are connected to MCU1_CTRL and MCU2_CTRL. The first OR gate U11 outputs a high level when either MCU outputs a control signal (high level, such as in a fault state or power-down state). The input of the sixth AND gate U12 is connected to the output of the first OR gate U11 and the start button signal (start button signal). The SSB button is high when pressed. The sixth AND gate U12 outputs a high level only when there is an MCU control signal and the start button is pressed. The input of the second OR gate U14 is connected to the output of the second AND gate U8 and the output of the sixth AND gate U12. When either input is high, the second OR gate U14 outputs a high level, serving as the reset signal (R signal) for the first RS flip-flop, triggering the IGN1 relay to open. The input of the third OR gate U16 is connected to the output of the fourth AND gate U10 and the output of the sixth AND gate U12. Similarly, when either input is high, the third OR gate U16 outputs a high level, serving as the reset signal for the second RS flip-flop, triggering the IGN2 relay to open. In this invention, the set signal requires "double confirmation" from both MCUs to avoid false triggering by a single MCU. The reset signal covers two scenarios: "active shutdown" (dual MCU output shutdown signal) and "emergency shutdown" (pressing the start button during fault / power-down), improving emergency control capabilities. The gate circuit collaborative logic ensures an uninterrupted signal link and unique and accurate triggering conditions.

[0037] The vehicle power distribution control circuit of this application is built in pure hardware and consists of AND gates, OR gates and RS flip-flops. The circuit is simple, low in cost and highly reliable. It can control the ACC power and ON power of the whole vehicle (including IGN1 and IGN2), and can also realize the function of emergency shutdown in case of MCU failure.

[0038] Furthermore, the logic circuit module also includes: a first high-side switch, a second high-side switch, a third high-side switch, and a fourth high-side switch. The inputs of the first and second high-side switches are connected to the outputs of the first RS flip-flop, and the outputs of the first and second high-side switches are connected in parallel to the IGN1 relay. The input of the third high-side switch is connected to the output of the second RS flip-flop, and the output of the third high-side switch is connected to the IGN2 relay. The input of the fourth high-side switch is connected to the output of the fifth AND gate, and the output of the fourth high-side switch is connected to the ACC relay.

[0039] Specifically, the first high-side switch U17 and the second high-side switch U18 are connected in parallel, and their input terminals are connected to the output terminal of the first RS flip-flop U13. The output terminals are connected in parallel and then connected to the IGN1 relay. U17 and U18 drive the IGN1 relay K1 in parallel. The output of K1, after passing through the fuse F1, becomes the vehicle's IGN1 signal, which is responsible for providing power and control signals to the vehicle's IGN1 electrical components. This invention uses a redundant design: even if one of the high-side switches fails (such as an open circuit fault), the other high-side switch can still receive the signal from the first RS flip-flop and output a drive voltage to trigger the IGN1 relay, ensuring that the power supply to the IGN1 position is not interrupted.

[0040] The input of the third high-side switch U19 is connected to the output of the second RS flip-flop, and the output is directly connected to the IGN2 relay. U19 drives the IGN2 relay K2, and the output of K2, after passing through the fuse F2, becomes the vehicle's IGN2 signal, which is responsible for providing power and control signals to the vehicle's IGN2 electrical appliances. The IGN2 gear electrical equipment (such as VCU) has high requirements for power supply stability but relatively low current demand. A single high-side switch can meet the drive requirements, while avoiding cross-interference with other gear drive signals.

[0041] The input of the fourth high-side switch U21 is connected to the output of the fifth AND gate U20. The output is directly connected to the ACC relay. The output of U21 controls the ACC relay K3. The output of K3, after passing through fuse F3, becomes the ACC signal for the entire vehicle, responsible for providing power and control signals to the ACC electrical components of the vehicle. The ACC-position electrical equipment (such as the vehicle's infotainment system) has low power, and the fourth high-side switch U21 can provide stable drive. Furthermore, the "dual MCU verification" of the fifth AND gate U20 ensures signal reliability. The logic circuit module outputs three drive signals, which are output by multiple HSDs and directly drive three relays: IGN1 relay K1, IGN2 relay K2, and ACC relay K3, for power distribution to the entire vehicle.

[0042] Furthermore, the power module also includes a first power chip and a second power chip. The first power supply and the second power supply are connected in parallel and are respectively connected to the first power chip and the second power chip. The first power chip is connected to the first controller and the second power chip is connected to the second controller.

[0043] Specifically, to ensure stable operating voltage for both MCUs and prevent control signal anomalies caused by power fluctuations, a voltage regulator chip is added to the power module, constructing a redundant power supply architecture of "dual power supply + dual voltage regulator": U1 is the first power chip LDO1, and U4 is the second power chip LDO2. The first power supply KL30-1 and the second power supply KL30-2 are first connected in parallel through diodes (to prevent reverse power flow), and then connected to the input terminals of the first power chip LDO1 and the second power chip LDO2 respectively. The first power chip LDO1 outputs a stable voltage (e.g., 3.3V) to power the first controller MCU1, and the second power chip LDO2 outputs the same stable voltage to power the second controller MCU2. This invention uses LDO chip voltage regulation to prevent vehicle power fluctuations from affecting MCU operation; the dual power chips supply power to both MCUs respectively, so a failure of one power chip does not affect the other MCU, improving power supply redundancy; the diode parallel design prevents reverse power flow between the two power supplies, protecting the power supply.

[0044] Furthermore, the reset circuit includes: a first reset AND gate and a second reset AND gate, the input of the first reset AND gate is connected to the first power supply chip and the second controller, and the output of the first reset AND gate is connected to the first controller; the input of the second reset AND gate is connected to the second power supply chip and the first controller, and the output of the second reset AND gate is connected to the second controller.

[0045] Specifically, the input of the first reset AND gate U2 is connected to the output of the first power supply chip LDO1 and the reset output pin of the second controller MCU2, respectively, and the output is connected to the reset input pin of the first controller MCU1. When the first power supply chip LDO1 outputs abnormally (e.g., voltage < 3V) or the second controller MCU2 detects a fault in the first controller MCU1, if either condition is met, the first reset AND gate U2 outputs a reset signal, triggering the first controller MCU1 to restart. The input of the second reset AND gate U5 is connected to the output of the second power supply chip LDO2 and the reset output pin of the first controller MCU1, respectively; the output is connected to the reset input pin of the second controller MCU2. When the second power supply chip LDO2 outputs abnormally or the first controller MCU1 detects a fault in the second controller MCU2, if either condition is met, the second reset AND gate U5 outputs a reset signal, triggering the second controller MCU2 to restart. This invention implements an automatic mechanism for "normal MCU resetting faulty MCU" without manual intervention, improving fault recovery efficiency; the reset conditions cover "power supply abnormality" and "MCU fault," proactively avoiding potential risks.

[0046] Furthermore, the vehicle power distribution control circuit also includes a detection module, one end of which is connected to the second power supply, and the other end of which is grounded. The detection module includes a first resistor and a second resistor connected in series, and a first controller is connected between the first resistor and the second resistor.

[0047] Specifically, one end of the detection module is connected to the second power supply KL30-2, and the other end is grounded; the series connection node of the first resistor R1 and the second resistor R2 is connected to the A / D sampling pin of the first controller MCU1; this invention monitors the power supply voltage in real time and detects undervoltage / overvoltage faults in advance; pure hardware voltage divider sampling is low in cost and fast in response (sampling period ≤100ms); in case of abnormality, power switching is triggered to avoid damage to the MCU or relay due to power supply abnormality.

[0048] Preferably, the voltage division ratio of the first resistor and the second resistor is set to 10:1 (e.g., R1=10kΩ, R2=1kΩ). After the second power supply voltage (Vin) is divided, the A / D sampling voltage (Vsam) = Vin×(R2 / (R1+R2)). The first controller calculates the actual value of Vin. When Vin<9V (undervoltage) or Vin>16V (overvoltage) is detected, the first controller MCU1 notifies the second controller MCU2 via SPI to trigger a power abnormality warning and switch to single power supply from the first power supply KL30-1.

[0049]

Example 2

[0050] In one specific embodiment, step S100 is start control. Specifically, after the start button SSB switch is active high, when the vehicle meets the start conditions (e.g., the gear is in P gear and the brake signal is valid), the start conditions are considered met, and the vehicle can start. After start-up, the status of each signal within a preset time is as follows: Figure 2 As shown: The first controller and the second controller synchronously output control signals: IGN1_ON1 and IGN1_ON2, IGN2_ON1 and IGN2_ON2, ACC_ON1 and ACC_ON2 are all high level (1), IGN1_OFF1 and IGN1_OFF2, IGN2_OFF1 and IGN2_OFF2, MCU1_CTRL and MCU2_CTRL are all low level (0); After receiving the control signals, the logic circuit module triggers the first RS flip-flop and the second RS flip-flop to be set, and the fifth AND gate outputs a high level, thereby driving the IGN1 relay, IGN2 relay and ACC relay to be turned on, and the vehicle starts; at the same time, the dual MCUs start timing.

[0051] Step S200 maintains the normal state. When the timer reaches the preset time, the dual MCU modules adjust the control signals, and the status of each signal is as follows: Figure 3 As shown: IGN1_ON1 and IGN1_ON2, IGN2_ON1 and IGN2_ON2 change from high level to low level, IGN1_OFF1 and IGN1_OFF2, IGN2_OFF1 and IGN2_OFF2 remain at low level, and ACC_ON1 and ACC_ON2 remain at high level. At this time, the first RS flip-flop and the second RS flip-flop remain in the set state due to their latching characteristics. The fifth AND gate remains at high level because ACC_ON1 and ACC_ON2 remain at high level (or is adjusted to low level as needed and then maintained by other logic). The IGN1 relay, IGN2 relay and ACC relay remain connected, maintaining the power supply of each gear of the vehicle is effective, and the vehicle enters the normal operating state. That is to say, even if the start button is invalid and all MCU outputs are 0, the start circuit can continue to maintain the power distribution state of the whole vehicle unchanged, and IGN1, IGN2, ACC, etc. remain in the effective state.

[0052] Step S300 is the working status detection. During normal operation, the first controller and the second controller exchange "heartbeat signals" in real time through the SPI interface (such as sending a status frame once every 100ms) to detect each other's working status. If the heartbeat signal is not received for 3 consecutive times or the signal is abnormal, the corresponding MCU is determined to be faulty and the circuit enters the fault state. If the heartbeat signal is normal, the normal state is maintained.

[0053] Step S410 is fault handling. When the circuit is in a fault state, the status of each signal is as follows: Figure 4As shown: ① The normal controller (e.g., the second controller is normal, the first controller is faulty) outputs the MCU control signal (MCU2_CTRL) at a high level, and the faulty controller (first controller) outputs all control signals of the first controller at a low level due to the fault; ② The normal controller (second controller) outputs a reset signal through the reset circuit (e.g., the first reset AND gate) to restart the faulty controller (first controller); ③ If forced shutdown is required (e.g., the fault cannot be recovered), press the start button (SSB), the sixth AND gate receives "the first OR gate outputs a high level" and "the start button outputs a high level", outputs a high level, triggers the first and second RS flip-flops to reset, IGN1 relay and IGN2 relay are disconnected, and the vehicle is turned off.

[0054] Step S420 is the power-down control. When the vehicle is in normal condition and the power-down conditions are met (the vehicle is parked and the gear is in P), if the start button is valid at this time, pressing the start button (SSB) will cause the first and second controllers to synchronously output MCU1_CTRL and MCU2_CTRL to a high level. The first OR gate will output 1, and the two input signals of the sixth AND gate will both be at a high level (1), so the output will be at a high level (1). The outputs of the second OR gate and the third OR gate will change from 0 to 1, triggering the first and second RS flip-flops to reset, and the IGN1 relay and IGN2 relay will be disconnected. At the same time, the dual MCUs output the ACC gear opening signal to a low level, the fifth AND gate outputs a low level, the ACC relay is disconnected, the vehicle is completely powered down, and it waits for power-on again.

[0055] Existing control methods suffer from problems such as power failure after startup, lack of emergency handling for faults, and chaotic power-down logic. This invention features dual MCU synchronous control during startup to ensure reliable relay connection; in normal conditions, power is maintained by RS trigger latch to avoid the influence of signal fluctuations; in case of a fault, automatic reset and forced shutdown provide strong emergency response capabilities; and the power-down conditions are clearly defined to avoid accidental power-down.

[0056] Preferably, the preset time is 50ms.

[0057] Furthermore, control methods also include: When the vehicle power distribution control circuit meets the start-up conditions, both the first gear start signal and the second gear start signal are high level, and both the first gear stop signal and the second gear stop signal are low level. After the preset time is reached, the first gear on signal and the second gear on signal go low, while the first gear off signal and the second gear off signal remain low.

[0058] Specifically, when the startup conditions are met, the dual MCU modules output a "high start signal and low stop signal," ensuring that the AND gates (first, third, and fifth AND gates) of the logic circuit module output a high level, triggering the relay to quickly turn on (response time ≤ 50ms). After the preset time is reached, the "start signal goes low and the stop signal remains low." At this time, the RS flip-flop, due to the lack of a reset signal after being set, still maintains a high output level, and the relay remains on. The core function of this signal change logic is to prevent the "start signal from disappearing and causing the relay to disconnect" after the start button is released. By latching the signal through the RS flip-flop, "one-time startup and continuous maintenance" is achieved, improving startup reliability. After startup, the power supply is stable, eliminating the need to continuously press the start button, which conforms to user operating habits.

[0059] Furthermore, step S410 includes: If the first controller fails, the second controller will restart the first controller through a reset operation; If the second controller fails, the first controller will restart the second controller through a reset operation.

[0060] Specifically, for example, after the second controller detects a fault in the first controller, it immediately outputs a reset control signal to the first reset AND gate. The first reset AND gate outputs a reset signal to the first controller, triggering the first controller to restart. After restarting, the second controller verifies the status of the first controller through SPI serial communication. If it returns to normal, it synchronously adjusts the control signal to the normal state. If the restart fails, the second controller maintains MCU2_CTRL at a high level, waiting for a forced shutdown command. This invention automates fault reset without manual intervention, has high recovery efficiency, and provides continuous power supply during the reset process, without affecting the normal operation of the vehicle.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vehicle power distribution control circuit based on dual MCU redundant control, characterized in that, The vehicle power distribution control circuit includes: A dual MCU module, comprising a first controller and a second controller, which communicate via an SPI interface and can be reset to each other via a reset circuit, and the dual MCU module outputs multiple control signals; The power module includes: a first power supply and a second power supply connected to the first controller and the second controller; The logic circuit module includes multiple gate circuits, multiple RS flip-flops, and multiple high-side switches, and the multiple control signals output multiple drive signals through the high-side switches; An execution module, comprising an IGN1 relay, an IGN2 relay, and an ACC relay, wherein the execution module receives the drive signal to control the on / off state of the power supply for each gear position of the vehicle; The control signals include: a first gear on signal and a first gear off signal, a second gear on signal and a second gear off signal, an MCU control signal, and an ACC gear on signal.

2. The vehicle power distribution control circuit according to claim 1, characterized in that, The first controller outputs six control signals: IGN1_ON1, IGN1_OFF1, IGN2_ON1, IGN2_OFF1, MCU1_CTRL, and ACC_ON1. The second controller outputs six control signals: IGN1_ON2, IGN1_OFF2, IGN2_ON2, IGN2_OFF2, MCU2_CTRL, and ACC_ON2. The logic circuit module includes: A first RS flip-flop receives IGN1_ON1, IGN1_OFF1, IGN1_ON2, IGN1_OFF2, MCU1_CTRL and MCU2_CTRL, and the output of the first RS flip-flop is connected to the IGN1 relay. The second RS flip-flop receives IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL and MCU2_CTRL, and the output of the second RS flip-flop is connected to the IGN2 relay. The fifth AND gate receives ACC_ON1 and ACC_ON2, and its output is connected to the ACC relay.

3. The vehicle power distribution control circuit according to claim 2, characterized in that, The logic circuit module further includes: The first AND gate receives IGN1_ON1 and IGN1_ON2, and the output of the first AND gate serves as the set signal for the first RS flip-flop. The second AND gate receives IGN1_OFF1 and IGN1_OFF2; The third AND gate receives IGN2_ON1 and IGN2_ON2, and the output of the third AND gate serves as the set signal for the second RS flip-flop. A fourth AND gate, which receives IGN2_OFF1 and IGN2_OFF2; A first OR gate, which receives MCU1_CTRL and MCU2_CTRL; A sixth AND gate, wherein the sixth AND gate receives the output of the first OR gate and a start button signal; The second OR gate receives the output of the second AND gate and the output of the sixth AND gate, and the output of the second OR gate serves as the reset signal for the first RS flip-flop; The third OR gate receives the outputs of the fourth AND gate and the sixth AND gate, and the output of the third OR gate serves as the reset signal for the second RS flip-flop.

4. The vehicle power distribution control circuit according to any one of claims 2 or 3, characterized in that, The logic circuit module further includes: A first high-side switch and a second high-side switch, the input terminals of the first high-side switch and the second high-side switch are connected to the output terminal of the first RS flip-flop, and the output terminals of the first high-side switch and the second high-side switch are connected in parallel to the IGN1 relay; The third high-side switch has its input terminal connected to the output terminal of the second RS flip-flop, and its output terminal connected to the IGN2 relay. The fourth high-side switch has its input terminal connected to the output terminal of the fifth AND gate, and its output terminal connected to the ACC relay.

5. The vehicle power distribution control circuit according to any one of claims 1-3, characterized in that, The power module also includes: A first power supply chip and a second power supply chip are connected in parallel and then connected to the first power supply chip and the second power supply chip, respectively. The first power supply chip is connected to the first controller and the second power supply chip is connected to the second controller.

6. The vehicle power distribution control circuit according to claim 5, characterized in that, The reset circuit includes: A first reset AND gate, the input of which is connected to the first power chip and the second controller, and the output of which is connected to the first controller; The second reset AND gate has its input connected to the second power chip and the first controller, and its output connected to the second controller.

7. The vehicle power distribution control circuit according to claim 5, characterized in that, The vehicle power distribution control circuit also includes: The detection module has one end connected to the second power supply and the other end grounded. The detection module includes a first resistor and a second resistor connected in series, and the first controller is connected between the first resistor and the second resistor.

8. A control method for a vehicle power distribution control circuit, characterized in that, The control method is applied to the vehicle power distribution control circuit based on dual MCU redundancy control as described in any one of claims 1-7, and the control method includes: When the vehicle power distribution control circuit meets the start-up conditions, it controls the IGN1 relay, IGN2 relay and ACC relay to be in the ON state, the vehicle starts and the timing begins; After the preset time is reached, the IGN1 relay, the IGN2 relay, and the ACC relay remain connected. The operating status of the vehicle power distribution control circuit is detected, including: fault status and normal status; When the vehicle power distribution control circuit is in the fault state, the normal controller restarts the fault controller through a reset operation, and at the same time, the engine can be forcibly shut down by pressing the start button; When the vehicle power distribution control circuit is in the normal state, if the power-off condition is met and the start button is valid, the MCU control signals all become high level, controlling the IGN1 relay and IGN2 relay to disconnect, and the vehicle is powered off.

9. The control method according to claim 8, characterized in that, The control method further includes: When the vehicle power distribution control circuit meets the start-up conditions, both the first gear start signal and the second gear start signal are high level, and both the first gear stop signal and the second gear stop signal are low level. After the preset time is reached, the first gear activation signal and the second gear activation signal become low, while the first gear deactivation signal and the second gear deactivation signal remain low.

10. The control method according to claim 8, characterized in that, When the vehicle power distribution control circuit is in the fault state, the normal controller restarts the fault controller through a reset operation. Simultaneously, forced engine shutdown can be achieved via the start button, including: If the first controller fails, the second controller restarts the first controller through a reset operation; If the second controller fails, the first controller restarts the second controller through a reset operation.

Images