Vehicle power distribution control circuit and control method based on dual-microcontroller unit redundancy control

Abstract

The application provides a vehicle power distribution control circuit and control method based on double MCU redundancy control, the vehicle power distribution control circuit comprises: a double MCU module, the double MCU module comprises a first controller and a second controller, both of which communicate through an SPI interface and can reset each other through a reset circuit, and the double MCU module outputs a plurality of control signals; a power module, the power module comprises: a first power supply and a second power supply connected to the double MCU module; a logic circuit module, the logic circuit module comprises a plurality of gate circuits, a plurality of RS flip-flops and a plurality of high-side switches, a plurality of control signals output a plurality of drive signals through the high-side switches; and an execution module, the execution module comprises an IGN1 relay, an IGN2 relay and an ACC relay, and the execution module receives the drive signals to control the on-off of the power supply of each gear of the vehicle. The application solves the technical problem that in the existing single MCU control mode, once the single MCU fails, the power distribution will be out of control, and even serious safety accidents such as vehicle stall will be caused.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicle electronic control, in particular to a vehicle power distribution control circuit based on double MCU redundant control and a control method of the vehicle power distribution control circuit. BACKGROUND

[0002] At present, the whole vehicle power-on and power-off and power distribution of the traditional vehicle are usually directly controlled by a mechanical key ignition lock. With the development of technology and the upgrading of vehicle configuration, the traditional mechanical ignition lock is gradually replaced by a one-key start technology, and the power distribution function of the ignition lock is also replaced by a one-key start controller.

[0003] However, the one-key start controller commonly used at present usually directly controls the power distribution through a single MCU. With the rapid increase in the mounting rate of vehicle intelligent cockpit and auxiliary / automatic driving systems, the electrification level of vehicles is also rapidly increasing, and new electric control modules such as battery management module (BMS), vehicle control module (VCU), vehicle networking module (T-box), body domain controller, and cockpit domain controller are beginning to be widely used in new vehicle models. While the number of whole vehicle electrical equipment is increasing, the demand for power stability and reliability of vehicles is also rapidly increasing.

[0004] However, the related art has at least one of the following problems: in the existing single MCU control mode, once the single MCU fails, the power distribution will be out of control, and even serious safety accidents such as vehicle engine stall will occur. SUMMARY

[0005] The present application solves the technical problem that in the existing single MCU control mode, once the single MCU fails, the power distribution will be out of control, and even serious safety accidents such as vehicle engine stall will occur.

[0006] To solve the above problems, the present application provides a vehicle power distribution control circuit based on double MCU redundant control, which comprises: a double MCU module, the double MCU module comprising a first controller and a second controller, both of which communicate through an SPI interface and can reset each other through a reset circuit, and the double MCU module outputs a plurality of control signals; a power module, the power module comprising: a first power supply and a second power supply connected to the first controller and the second controller; a logic circuit module, the logic circuit module comprising a plurality of gate circuits, a plurality of RS flip-flops and a plurality of high-side switches, a plurality of control signals outputting a plurality of driving signals through the high-side switches; an execution module, the execution module comprising an IGN1 relay, an IGN2 relay and an ACC relay, and the execution module receives the driving signals to control the on-off of the power of each gear of the vehicle; wherein the control signals comprise: a first gear on signal and a first gear off signal, a second gear on signal and a second gear off signal, a MCU control signal and an ACC gear on signal.

[0007] Compared with the prior art, the technical effects reached by adopting the technical scheme are as follows: the first controller and the second controller perform real-time communication through an SPI serial port, and information such as interactive control signals and fault states is exchanged, and mutual reset is realized through a reset circuit, so that when any MCU fails, the other MCU can trigger the restart of the failed MCU; the power module provides stable redundant power supply for the dual-MCU module; the application realizes "single-line fault non-failure" through dual-MCU redundancy, dual-power supply, and logic-execution hierarchical control, improves the reliability and stability of vehicle power distribution, and meets the safety requirements of new energy vehicles and high-level automatic driving vehicles.

[0008] In one example of the application, the first controller outputs six control signals IGN1_ON1, IGN1_OFF1, IGN2_ON1, IGN2_OFF1, MCU1_CTRL and ACC_ON1, the second controller outputs six control signals IGN1_ON2, IGN1_OFF2, IGN2_ON2, IGN2_OFF2, MCU2_CTRL and ACC_ON2, and the logic circuit module comprises: a first RS flip-flop, which receives IGN1_ON1, IGN1_OFF1, IGN1_ON2, IGN1_OFF2, MCU1_CTRL and MCU2_CTRL, and the output end of the first RS flip-flop is connected to the IGN1 relay; a second RS flip-flop, which receives IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL and MCU2_CTRL, and the output end of the second RS flip-flop is connected to the IGN2 relay; and a fifth AND gate, which receives ACC_ON1 and ACC_ON2, and the output end of the fifth AND gate is connected to the ACC relay.

[0009] Compared with the prior art, the technical effects reached by adopting the technical scheme are as follows: the application realizes "one gear one dedicated logic unit", the control signals are accurately matched with the gears, the latching characteristics of the RS flip-flop can stably maintain the gear power supply state, the "false break" of the power supply after starting is avoided, and the fifth AND gate simplifies the ACC gear control logic while ensuring dual-MCU redundancy verification.

[0010] In an example of the present application, the logic circuit module further comprises: a first AND gate receiving IGN1_ON1 and IGN1_ON2, and the output of the first AND gate serving as a set signal of the first RS flip-flop; a second AND gate receiving IGN1_OFF1 and IGN1_OFF2; a third AND gate receiving IGN2_ON1 and IGN2_ON2, and the output of the third AND gate serving as a set signal of the second RS flip-flop; a fourth AND gate receiving IGN2_OFF1 and IGN2_OFF2; a first OR gate receiving MCU1_CTRL and MCU2_CTRL; a sixth AND gate receiving the output of the first OR gate and a start button signal; a second OR gate receiving the output of the second AND gate and the output of the sixth AND gate, and the output of the second OR gate serving as a reset signal of the first RS flip-flop; and a third OR gate receiving the output of the fourth AND gate and the output of the sixth AND gate, and the output of the third OR gate serving as a reset signal of the second RS flip-flop.

[0011] Compared with the prior art, the technical effects achieved by adopting the technical scheme are: the vehicle power distribution control circuit of the present application is built in a pure hardware mode and is composed of AND gates, OR gates and RS flip-flops, the circuit is simple, the cost is low, the reliability is high, the ACC power and the ON gear power (including IGN1 and IGN2) of the whole vehicle can be controlled, and the function of emergency shutdown in the case of MCU failure can also be realized.

[0012] In an example of the present application, the logic circuit module further comprises: a first high-side switch and a second high-side switch, the input ends of the first high-side switch and the second high-side switch being connected to the output end of the first RS flip-flop, and the output ends of the first high-side switch and the second high-side switch being connected in parallel to the IGN1 relay; a third high-side switch, the input end of the third high-side switch being connected to the output end of the second RS flip-flop, and the output end of the third high-side switch being connected to the IGN2 relay; and a fourth high-side switch, the input end of the fourth high-side switch being connected to the output end of the fifth AND gate, and the output end of the fourth high-side switch being connected to the ACC relay.

[0013] Compared with the prior art, the technical effects achieved by adopting the technical scheme are: the first high-side switch and the second high-side switch are connected in parallel, even if one of the high-side switches fails, the other high-side switch can still receive the signal of the first RS flip-flop and output a driving voltage to trigger the IGN1 relay, ensuring that the power supply of the IGN1 gear is not interrupted; the logic circuit module outputs three driving signals, which are output by a plurality of HSDs and directly drive three relays: the IGN1 relay K1, the IGN2 relay K2 and the ACC relay K3 to perform power distribution for the whole vehicle.

[0014] In one example of the present application, the power module further comprises: a first power chip and a second power chip, the first power supply and the second power supply are connected to the first power chip and the second power chip respectively after being connected in parallel, and the first power chip is connected to the first controller and the second power chip is connected to the second controller.

[0015] Compared with the prior art, the technical effects achieved by adopting the technical scheme are: the present application avoids the influence of vehicle power fluctuation on MCU work through LDO chip voltage stabilization; the dual power supply chips supply power to the dual MCUs respectively, and single power supply chip failure does not affect the other MCU, and the power supply redundancy is improved.

[0016] In one example of the present application, the reset circuit comprises: a first reset AND gate, the input end of the first reset AND gate being connected to the first power chip and the second controller, and the output end of the first reset AND gate being connected to the first controller; and a second reset AND gate, the input end of the second reset AND gate being connected to the second power chip and the first controller, and the output end of the second reset AND gate being connected to the second controller.

[0017] Compared with the prior art, the technical effects achieved by adopting the technical scheme are: the present application realizes the automatic mechanism of "normal MCU reset fault MCU", without manual intervention, and the fault recovery efficiency is improved; and the OR gate circuit ensures that the reset signal is not lost, and the reset success rate is improved.

[0018] In one example of the present application, the vehicle power distribution control circuit further comprises: a detection module, one end of the detection module being connected to the second power supply, and the other end of the detection module being grounded, and the detection module comprising a first resistor and a second resistor connected in series, and the first controller being connected between the first resistor and the second resistor.

[0019] Compared with the prior art, the technical effects achieved by adopting the technical scheme are: the present application monitors the power supply voltage in real time, and discovers the under-voltage / over-voltage fault in advance; and the pure hardware voltage division sampling is low in cost and fast in response.

[0020] In another aspect, the embodiment of the present application also provides a control method of a vehicle power distribution control circuit. The control method is applied to the vehicle power distribution control circuit based on the dual-MCU redundant control as in the first embodiment, and includes: when the vehicle power distribution control circuit meets a starting condition, controlling the IGN1 relay, the IGN2 relay and the ACC relay to be in an on state, starting the vehicle and starting timing; after the timing reaches a preset time, maintaining the on state of the IGN1 relay, the IGN2 relay and the ACC relay; detecting a working state of the vehicle power distribution control circuit, the working state including: a fault state and a normal state; when the vehicle power distribution control circuit is in the fault state, restarting the fault controller by the reset operation of the normal controller, and forcibly shutting down the vehicle through the starting button; when the vehicle power distribution control circuit is in the normal state, if the power-off condition is met and the starting button is valid, the MCU control signals all become high level, the IGN1 relay and the IGN2 relay are controlled to be disconnected, and the vehicle is powered off.

[0021] Compared with the prior art, the technical effects achieved by adopting the technical scheme are: the dual-MCU synchronous control at starting ensures the reliable on of the relay; the power supply is maintained through the RS flip-flop latch in the normal state to avoid the influence of signal fluctuation; the automatic reset and forced shutdown in the fault state have strong emergency capability; and the power-off condition is clear to avoid false power-off.

[0022] In an example of the present application, the control method further includes: when the vehicle power distribution control circuit meets the starting condition, the first gear on signal and the second gear on signal are both high level, and the first gear off signal and the second gear off signal are both low level; after the timing reaches the preset time, the first gear on signal and the second gear on signal become low level, and the first gear off signal and the second gear off signal maintain low level.

[0023] Compared with the prior art, the technical effects achieved by adopting the technical scheme are: the core role of the signal change logic is to avoid the disconnection of the relay caused by the disappearance of the on signal after the starting button is released, to realize the one-time starting and continuous maintenance through the RS flip-flop latch, and to improve the starting reliability; and the power supply state is stable after starting, without the need for continuously pressing the starting button, which meets the user operation habit.

[0024] In an example of the present application, when the vehicle power distribution control circuit is in the fault state, the normal controller restarts the fault controller through the reset operation, and forcibly shuts down the vehicle through the starting button, including: if the first controller fails, the second controller restarts the first controller through the reset operation; and if the second controller fails, the first controller restarts the second controller through the reset operation.

[0025] Compared with the prior art, the technical effects achieved by adopting the technical scheme are as follows: the application realizes fault reset automation, does not need manual intervention, has high recovery efficiency, and the power supply is continuously supplied during the reset process, and does not affect the normal operation of the vehicle.

[0026] After adopting the technical scheme of the application, the following technical effects can be achieved:

[0027] (1) The application realizes "single line fault non-failure" through double MCU redundancy, double power supply, and logic-execution hierarchical control, improves the reliability and stability of vehicle power distribution, and meets the safety requirements of new energy vehicles and high-level automatic driving vehicles;

[0028] (2) The vehicle power distribution control circuit of the application is built in a pure hardware mode and is composed of AND gates, OR gates and RS flip-flops, and has simple circuit, low cost and high reliability, and can control the ACC power and ON gear power (including IGN1 and IGN2) of the vehicle, and can also realize the function of emergency shutdown when the MCU fails;

[0029] (3) The application avoids the influence of vehicle power fluctuation on the work of the MCU through LDO chip voltage stabilization, and improves the power supply redundancy by supplying power to the double MCUs through double power supply chips, so that the failure of a single power supply chip does not affect the other MCU. BRIEF DESCRIPTION OF DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings;

[0031] Figure 1 A circuit principle diagram of a vehicle power distribution control circuit based on double MCU redundancy control is provided for the first embodiment of the application;

[0032] Figure 2 For Figure 1 A circuit principle diagram of a vehicle power distribution control circuit based on double MCU redundancy control in the starting state is provided for the first embodiment of the application;

[0033] Figure 3 For Figure 1 A circuit principle diagram of a vehicle power distribution control circuit based on double MCU redundancy control in the normal state is provided for the first embodiment of the application;

[0034] Figure 4 For Figure 1 A circuit principle diagram of a vehicle power distribution control circuit based on double MCU redundancy control in the fault state is provided for the first embodiment of the application;

[0035] Figure 5 A detailed flow chart of a control method of a vehicle power distribution control circuit according to the second embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the above objectives, features and advantages of the present application more apparent, clear and easy to understand, the technical solutions in the embodiments of the present application are described clearly and completely. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0037] Embodiment One

[0038] Reference is made to Figure 1 , which is a vehicle power distribution control circuit based on dual MCU redundancy control according to the first embodiment of the present application, in combination with Figures 2-4 , the vehicle power distribution control circuit comprises a dual MCU module, a power module, a logic circuit module and an execution module. The dual MCU module comprises a first controller and a second controller, which communicate through an SPI interface and can reset each other through a reset circuit, and the dual MCU module outputs a plurality of control signals. The power module comprises a first power supply and a second power supply connected to the first controller and the second controller. The logic circuit module comprises a plurality of gate circuits, a plurality of RS flip-flops and a plurality of high-side switches, and the plurality of control signals output a plurality of drive signals through the high-side switches. The execution module comprises an IGN1 relay, an IGN2 relay and an ACC relay, and the execution module receives the drive signals to control the on-off of the power of each gear of the vehicle. The control signals comprise a first gear on signal and a first gear off signal, a second gear on signal and a second gear off signal, an MCU control signal and an ACC gear on signal.

[0039] In a specific embodiment, the dual MCU module includes a first controller (MCU1) and a second controller (MCU2), both of which communicate in real time through SPI (serial peripheral interface) to exchange control signals, fault states and other information; at the same time, mutual reset is realized through a reset circuit to ensure that when any MCU fails, the other MCU can trigger its restart. The dual MCU module outputs multiple control signals, covering the opening, closing and state control of the gear power supply, specifically including: a first gear (IGN1) opening signal, a first gear closing signal, a second gear (IGN2) opening signal, a second gear closing signal, an MCU control signal, and an ACC gear opening signal. The power supply module provides stable redundant power supply for the dual MCU module, including a first power supply (such as vehicle constant power KL30-1) and a second power supply (such as vehicle constant power KL30-2), both of which are connected in parallel to the circuit to ensure that when a single power supply fails, the other power supply can continue to supply power to the system, avoiding control failure caused by power interruption. The logic circuit module serves as the "processing center" of the control signals, including multiple gate circuits (AND gate, OR gate), multiple RS flip-flops and multiple high-side switches (HSD). The control signals output by the dual MCU module are first input to the gate circuit for logical judgment, then latched by the RS flip-flop, and finally amplified and driven by the high-side switch to output the driving signals to the execution module. The execution module serves as the "execution terminal" of the power distribution, including IGN1 relay, IGN2 relay and ACC relay, K1 is the IGN1 relay, K2 is the IGN2 relay, and K3 is the ACC relay. Each relay corresponds to the IGN1, IGN2 and ACC gear power supply of the vehicle, respectively, receives the driving signals output by the logic circuit module, and controls the power supply or not of the corresponding gear power supply through the on-off control of the relay contact, thereby realizing the power distribution of the vehicle electrical equipment. Through dual MCU redundancy, dual power supply, and logic-execution layered control, the present application realizes "single-line failure without failure", improves the reliability and stability of vehicle power distribution, and meets the safety requirements of new energy vehicles and high-level autonomous vehicles.

[0040] Further, the first controller outputs six control signals IGN1_ON1, IGN1_OFF1, IGN2_ON1, IGN2_OFF1, MCU1_CTRL and ACC_ON1, the second controller outputs six control signals IGN1_ON2, IGN1_OFF2, IGN2_ON2, IGN2_OFF2, MCU2_CTRL and ACC_ON2, and the logic circuit module comprises: a first RS flip-flop and a second RS flip-flop, the first RS flip-flop receives IGN1_ON1, IGN1_OFF1, IGN1_ON2, IGN1_OFF2, MCU1_CTRL and MCU2_CTRL, and the output end of the first RS flip-flop is connected with the IGN1 relay; the second RS flip-flop receives IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL and MCU2_CTRL, and the output end of the second RS flip-flop is connected with the IGN2 relay; and a fifth AND gate, the fifth AND gate receives ACC_ON1 and ACC_ON2, and the output end of the fifth AND gate is connected with the ACC relay.

[0041] Specifically, the first gear opening signal comprises IGN1_ON1 and IGN1_ON2, the first gear closing signal comprises IGN1_OFF1 and IGN1_OFF2, the second gear opening signal comprises IGN2_ON1 and IGN2_ON2, the second gear closing signal comprises IGN2_OFF1 and IGN2_OFF2, the MCU control signal comprises MCU1_CTRL and MCU2_CTRL, and the ACC gear opening signal comprises ACC_ON1 and ACC_ON2.

[0042] U13 is a first RS flip-flop, U15 is a second RS flip-flop, and U20 is a fifth AND gate; the first RS flip-flop is specially used for processing the IGN1 gear signal and receives IGN1_ON1, IGN1_OFF1, IGN1_ON2, IGN1_OFF2, MCU1_CTRL and MCU2_CTRL, a total of 6 signals, and locks the power supply state of the IGN1 gear through the'set-reset' logic, and the output end is directly connected to the IGN1 relay to control the on-off thereof; the second RS flip-flop is specially used for processing the IGN2 gear signal and receives IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL and MCU2_CTRL, a total of 6 signals, and locks the power supply state of the IGN2 gear in the same manner, and the output end is connected to the IGN2 relay; and the fifth AND gate is specially used for processing the ACC gear signal and only receives ACC_ON1 and ACC_ON2, a total of two signals (the ACC gear does not need complex reset logic, and only needs to output the start signal by the first controller and the second controller to be connected), and the output end is connected to the ACC relay.

[0043] Further, the logic circuit module further comprises: a first AND gate, which receives IGN1_ON1 and IGN1_ON2, and the output of the first AND gate is used as the set signal of the first RS flip-flop; a second AND gate, which receives IGN1_OFF1 and IGN1_OFF2; a third AND gate, which receives IGN2_ON1 and IGN2_ON2, and the output of the third AND gate is used as the set signal of the second RS flip-flop; a fourth AND gate, which receives IGN2_OFF1 and IGN2_OFF2; a first OR gate, which receives MCU1_CTRL and MCU2_CTRL; a sixth AND gate, which receives the output of the first OR gate and the start button signal; a second OR gate, which receives the output of the second AND gate and the output of the sixth AND gate, and the output of the second OR gate is used as the reset signal of the first RS flip-flop; and a third OR gate, which receives the output of the fourth AND gate and the output of the sixth AND gate, and the output of the third OR gate is used as the reset signal of the second RS flip-flop.

[0044] Specifically, the input end of the first AND gate U7 is connected with IGN1_ON1 and IGN1_ON2, and only when the first gear opening signals are both high, the first AND gate U7 outputs a high level as a "set signal" (S signal) of the first RS flip-flop to trigger the IGN1 relay to be turned on.

[0045] The input end of the second AND gate U8 is connected with IGN1_OFF1 and IGN1_OFF2, and only when the first gear closing signals are both high, the second AND gate U8 outputs a high level; the input end of the fourth AND gate U10 is connected with IGN2_OFF1 and IGN2_OFF2, and only when the second gear closing signals are both high, the fourth AND gate U10 outputs a high level; the input end of the first OR gate U11 is connected with MCU1_CTRL and MCU2_CTRL, and when any MCU outputs a control signal (high level, such as a fault state or a power-off state), the first OR gate U11 outputs a high level; the input end of the sixth AND gate U12 is connected with the output of the first OR gate U11 and a start button signal (high level when the start button SSB is pressed), and only when there is a "MCU control signal" and the "start button is pressed", the sixth AND gate U12 outputs a high level; the input end of the second OR gate U14 is connected with the output of the second AND gate U8 and the output of the sixth AND gate U12, and when any input end is high, the second OR gate U14 outputs a high level as a "reset signal" (R signal) of the first RS flip-flop to trigger the IGN1 relay to be turned off; the input end of the third OR gate U16 is connected with the output of the fourth AND gate U10 and the output of the sixth AND gate U12, and only when any input end is high, the third OR gate U16 outputs a high level as a "reset signal" of the second RS flip-flop to trigger the IGN2 relay to be turned off. In the application, the set signal needs to be "double confirmed" by the double MCUs to avoid false triggering by a single MCU; the reset signal covers two scenarios of "active closing" (double MCU output closing signal) and "emergency closing" (pressing the start button when the MCU is in fault / power-off state) to improve the emergency control capability; the gate circuit cooperates with the logic to ensure that there is no breakpoint in the signal link and the triggering condition is unique and accurate.

[0046] The vehicle power distribution control circuit of the application is built in a pure hardware mode and is composed of AND gates, OR gates and RS flip-flops, and has the advantages of simple circuit, low cost and high reliability, and can control the ACC power and the ON gear power (including IGN1 and IGN2) of the whole vehicle, and can also realize the function of emergency shutdown when the MCU is in fault.

[0047] Further, the logic circuit module further comprises: a first high-side switch and a second high-side switch, a third high-side switch and a fourth high-side switch, the input end of the first high-side switch and the second high-side switch is connected with the output end of the first RS flip-flop, and the output end of the first high-side switch and the second high-side switch is connected with the IGN1 relay in parallel; the input end of the third high-side switch is connected with the output end of the second RS flip-flop, and the output end of the third high-side switch is connected with the IGN2 relay; the input end of the fourth high-side switch is connected with the output end of the fifth AND gate, and the output end of the fourth high-side switch is connected with the ACC relay.

[0048] Specifically, the first high-side switch U17 and the second high-side switch U18 are connected in parallel, the input end is commonly connected with the output end of the first RS flip-flop U13, and the output end is connected with the IGN1 relay in parallel, the U17 and the U18 drive the IGN1 relay K1 in parallel, the output of the K1 is the whole vehicle IGN1 signal after the fuse F1, and the whole vehicle IGN1 signal is responsible for providing power supply and control signal for the IGN1 electric appliance of the whole vehicle; through the redundant design, even if one of the high-side switches fails (such as open circuit failure), the other high-side switch can still receive the signal of the first RS flip-flop, output a driving voltage to trigger the IGN1 relay, and ensure that the power supply of the IGN1 gear is not interrupted.

[0049] The input end of the third high-side switch U19 is connected with the output end of the second RS flip-flop, and the output end is directly connected with the IGN2 relay, the U19 drives the IGN2 relay K2, and the output of the K2 is the whole vehicle IGN2 signal after the fuse F2, and the whole vehicle IGN2 signal is responsible for providing power supply and control signal for the IGN2 electric appliance of the whole vehicle; the IGN2 gear electric device (such as VCU) has high requirement on power supply stability but relatively low current demand, and a single high-side switch can meet the driving demand, and cross interference with other gear driving signals is avoided.

[0050] The input end of the fourth high-side switch U21 is connected with the output end of the fifth AND gate U20, and the output end is directly connected with the ACC relay, the output of the U21 controls the ACC relay K3, and the output of the K3 is the whole vehicle ACC signal after the fuse F3, and the whole vehicle ACC signal is responsible for providing power supply and control signal for the ACC electric appliance of the whole vehicle; the power of the ACC gear electric device (such as the car machine) is low, the fourth high-side switch U21 can provide stable driving, and the “double MCU verification” of the fifth AND gate U20 has ensured the signal reliability. The logic circuit module outputs three driving signals, which are output by a plurality of HSD, and directly drive three relays: the IGN1 relay K1, the IGN2 relay K2 and the ACC relay K3 to distribute power supply for the whole vehicle.

[0051] Further, the power module further comprises: a first power chip and a second power chip, the first power supply and the second power supply are connected with the first power chip and the second power chip respectively after being connected in parallel, and the first power chip is connected with the first controller and the second power chip is connected with the second controller.

[0052] Specifically, in order to ensure the stable working voltage of the double MCUs and avoid abnormal control signals caused by power fluctuation, a voltage stabilizing chip is added to the power module to build a redundant power supply architecture of "double power supply + double voltage stabilizing": U1 is a first power chip LDO1, U4 is a second power chip LDO2, the first power supply KL30-1 and the second power supply KL30-2 are connected in parallel through a diode (to prevent power backflow) and then connected to the input terminals of the first power chip LDO1 and the second power chip LDO2 respectively; the first power chip LDO1 outputs a stable voltage (such as 3.3V) to supply power to the first controller MCU1, and the second power chip LDO2 outputs the same stable voltage to supply power to the second controller MCU2. The application stabilizes the voltage through the LDO chip to avoid the influence of vehicle power fluctuation on the working of the MCU; the double power chips supply power to the double MCUs respectively, and the failure of a single power chip does not affect the other MCU, so that the power supply redundancy is improved; the diode parallel design prevents backflow between the double power supplies and protects the power supply.

[0053] Further, the reset circuit comprises: a first reset AND gate and a second reset AND gate, the input terminals of the first reset AND gate are connected with the first power chip and the second controller, the output terminal of the first reset AND gate is connected with the first controller; the input terminals of the second reset AND gate are connected with the second power chip and the first controller, and the output terminal of the second reset AND gate is connected with the second controller.

[0054] Specifically, the input terminals of the first reset AND gate U2 are respectively connected with the output terminal of the first power chip LDO1 and the reset output pin of the second controller MCU2, and the output terminal is connected with the reset input pin of the first controller MCU1: when the output of the first power chip LDO1 is abnormal (such as voltage <3V) or the second controller MCU2 detects the failure of the first controller MCU1, either condition is met, the first reset AND gate U2 outputs a reset signal to trigger the first controller MCU1 to restart; the input terminals of the second reset AND gate U5 are respectively connected with the output terminal of the second power chip LDO2 and the reset output pin of the first controller MCU1; and the output terminal is connected with the reset input pin of the second controller MCU2: when the output of the second power chip LDO2 is abnormal or the first controller MCU1 detects the failure of the second controller MCU2, either condition is met, the second reset AND gate U5 outputs a reset signal to trigger the second controller MCU2 to restart. The application realizes the automatic mechanism of "normal MCU reset failure MCU" without manual intervention, and improves the fault recovery efficiency; the reset conditions cover "power abnormality" and "MCU failure", and potential risks are avoided in advance.

[0055] Further, the vehicle power distribution control circuit further comprises a detection module, one end of the detection module is connected to the second power supply, the other end of the detection module is grounded, and the detection module comprises a first resistor and a second resistor connected in series, and the first controller is connected between the first resistor and the second resistor.

[0056] Specifically, one end of the detection module is connected to the second power supply KL30-2, and the other end is grounded; the node of the first resistor R1 and the second resistor R2 is connected to the A / D sampling pin of the first controller MCU1; the application can monitor the power supply voltage in real time, and can detect the under-voltage / over-voltage fault in advance; the pure hardware voltage division sampling has low cost and fast response (sampling period ≤100 ms); the power supply switching is triggered in an abnormal state to avoid abnormal damage of the MCU or the relay.

[0057] Preferably, the voltage division ratio of the first resistor and the second resistor is set to 10:1 (for example, R1=10kΩ and R2=1kΩ), the A / D sampling voltage (Vsam) =Vin×(R2 / (R1+R2)) after the voltage division of the second power supply voltage (Vin), and the first controller can calculate and reverse the actual value of Vin; when Vin<9V (under-voltage) or Vin>16V (over-voltage) is detected, the first controller MCU1 informs the second controller MCU2 through SPI, triggers the power supply abnormal warning, and switches to the first power supply KL30-1 single power supply.

[0058]

Embodiment Two

[0059] Referring to Figure 5 The embodiment also provides a control method of a vehicle power distribution control circuit, which is applied to the vehicle power distribution control circuit based on double MCU redundancy control as in the first embodiment, and the control method comprises the following steps.

[0060] Step S100: When the vehicle power distribution control circuit meets the starting condition, the IGN1 relay, the IGN2 relay and the ACC relay are controlled to be in the on state, the vehicle is started and starts timing;

[0061] Step S200: After the timing reaches the preset time, the on state of the IGN1 relay, the IGN2 relay and the ACC relay is maintained;

[0062] Step S300: The working state of the vehicle power distribution control circuit is detected, and the working state includes a fault state and a normal state;

[0063] Step S410: When the vehicle power distribution control circuit is in the fault state, the normal controller restarts the fault controller through the reset operation, and at the same time, the forced engine stop can be realized through the start button;

[0064] Step S420: When the vehicle power distribution control circuit is in the normal state, if the power-down condition is met and the start button is valid, the MCU control signals are all high, the IGN1 relay and the IGN2 relay are controlled to be disconnected, and the vehicle is powered down.

[0065] In one embodiment, step S100 is a start control. In detail, after the start button SSB switch is high and valid, when the vehicle meets the start condition (such as the gear is in P, and the brake signal is valid), it is considered that the start condition is met, and the vehicle can be started. The signal state within the preset time after starting is as shown in Table 1: Figure 2 The first controller and the second controller synchronously output control signals: IGN1_ON1 and IGN1_ON2, IGN2_ON1 and IGN2_ON2, ACC_ON1 and ACC_ON2 are all high (1), IGN1_OFF1 and IGN1_OFF2, IGN2_OFF1 and IGN2_OFF2, MCU1_CTRL and MCU2_CTRL are all low (0). After the logic circuit module receives the control signals, the first RS flip-flop and the second RS flip-flop are triggered to be set, the fifth AND gate outputs a high level, and then drives the IGN1 relay, the IGN2 relay and the ACC relay to be connected, and the vehicle is started. At the same time, the dual MCUs start timing.

[0066] Step S200 is a normal state maintenance. When the timing reaches the preset time, the dual MCU module adjusts the control signals, and the signal state is as shown in Table 2: Figure 3 IGN1_ON1 and IGN1_ON2, IGN2_ON1 and IGN2_ON2 change from high level to low level, IGN1_OFF1 and IGN1_OFF2, IGN2_OFF1 and IGN2_OFF2 maintain low level, and ACC_ON1 and ACC_ON2 maintain high level. At this time, the first RS flip-flop and the second RS flip-flop remain in the set state due to the latch characteristic, and the fifth AND gate remains connected due to the high level of ACC_ON1 and ACC_ON2 (or is adjusted to low level and maintained through other logic according to requirements). IGN1 relay, IGN2 relay and ACC relay are continuously connected, the power of each gear of the vehicle is maintained, and the vehicle enters a normal running state. That is, even if the start button is invalid and the MCU output is all 0, the start circuit can continue to maintain the power distribution state of the whole vehicle unchanged, and IGN1, IGN2, ACC and the like remain in the valid state.

[0067] Step S300 is working state detection. In the normal operation process, the first controller and the second controller interact with each other through the SPI interface to detect the working state of the other party in real time (for example, a state frame is sent every 100 ms); if the heart signal is not received for 3 times continuously or the signal is abnormal, it is determined that the corresponding MCU is faulty, and the circuit enters a fault state; if the heart signal is normal, the normal state is maintained.

[0068] Step S410 is fault processing. When the circuit is in a fault state, the signal state is as shown in the following table: Figure 4 The normal controller (for example, the second controller is normal, and the first controller is faulty) outputs the MCU control signal (MCU2_CTRL) as a high level, and the faulty controller (the first controller) outputs all the control signals of the first controller as a low level due to the fault; the normal controller (the second controller) outputs a reset signal through the reset circuit (for example, the first reset AND gate) to restart the faulty controller (the first controller); if forced shutdown (for example, the fault cannot be recovered) is needed, the start button (SSB) is pressed, the sixth AND gate receives the high level output of the first OR gate and the high level of the start button, outputs a high level, triggers the first and second RS flip-flops to reset, the IGN1 relay and the IGN2 relay are disconnected, and the vehicle is shut down.

[0069] Step S420 is power-down control. When the vehicle is in a normal state and the power-down condition (the vehicle has stopped and the gear is in the P gear) is met, if the start button is valid at this time, the start button (SSB) is pressed, the first controller and the second controller synchronously output MCU1_CTRL and MCU2_CTRL as high levels, the first OR gate outputs 1, the two input signals of the sixth AND gate are both high levels 1, and then the output is a high level 1, the output of the second OR gate and the third OR gate changes from 0 to 1, and the first and second RS flip-flops are triggered to reset, and the IGN1 relay and the IGN2 relay are disconnected; at the same time, the double-MCU outputs the ACC gear opening signal as a low level, the fifth AND gate outputs a low level, the ACC relay is disconnected, the vehicle is completely powered down, and waits for power-up again.

[0070] The existing control method cannot maintain the power supply after starting, has no emergency handling for faults, and has chaotic power-down logic; the present application synchronously controls the double-MCU during starting to ensure that the relay can be reliably turned on; the power supply is maintained through the RS flip-flop latch in the normal state to avoid the influence of signal fluctuation; the automatic reset and forced shutdown during the fault have strong emergency capabilities; the power-down condition is clear to avoid false power-down.

[0071] Preferably, the preferred value of the preset time is 50 ms.

[0072] Further, the control method further comprises:

[0073] When the vehicle power distribution control circuit meets the starting condition, the first gear opening signal and the second gear opening signal are both high level, and the first gear closing signal and the second gear closing signal are both low level.

[0074] After the timing reaches the preset time, the first gear opening signal and the second gear opening signal become low level, and the first gear closing signal and the second gear closing signal maintain low level.

[0075] Specifically, when the starting condition is met, the double MCU module outputs "opening signal high and closing signal low", ensuring that the AND gate (first AND gate, third AND gate and fifth AND gate) of the logic circuit module outputs high level, triggering the relay to quickly turn on (response time ≤ 50 ms); after the timing reaches the preset time, the "opening signal becomes low and the closing signal maintains low", at this time, the RS trigger still maintains output high level due to "no reset signal after setting", and the relay is continuously turned on; the core role of the signal change logic is to avoid the "opening signal disappearing leading to the relay being turned off" after the starting button is released, and to realize "one-time starting and continuous maintenance" through the RS trigger latch, thereby improving the starting reliability; after starting, the power supply state is stable, and there is no need to continuously press the starting button, which meets the user operation habit.

[0076] Further, the step S410 comprises:

[0077] If the first controller fails, the second controller restarts the first controller through a reset operation;

[0078] If the second controller fails, the first controller restarts the second controller through a reset operation.

[0079] Specifically, for example, after the second controller detects that the first controller fails, it immediately outputs a reset control signal to the first reset AND gate, and the first reset AND gate outputs a reset signal to the first controller, triggering the first controller to restart; after restarting, the second controller verifies the state of the first controller through SPI serial communication, and if it returns to normal, it synchronously adjusts the control signal to the normal state; if the restart fails, the second controller maintains MCU2_CTRL as high level and waits for a forced shutdown instruction; the present application realizes fault reset automation without manual intervention, has high recovery efficiency, and the power supply is continuously supplied during the reset process, without affecting the normal operation of the vehicle.

[0080] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A vehicle power distribution control circuit based on dual MCU redundancy control, characterized by, The vehicle power distribution control circuit comprises: a double MCU module comprising a first controller and a second controller, which communicate through an SPI interface and can reset each other through a reset circuit, and output a plurality of control signals; a power module comprising a first power supply and a second power supply connected to the first controller and the second controller; a logic circuit module comprising a plurality of gate circuits, a plurality of RS flip-flops and a plurality of high-side switches, a plurality of the control signals output a plurality of drive signals through the high-side switches; an execution module comprising an IGN1 relay, an IGN2 relay and an ACC relay, and receiving the drive signals to control the on-off of power supply of each gear of the vehicle; wherein the control signals comprise a first-gear-on signal and a first-gear-off signal, a second-gear-on signal and a second-gear-off signal, an MCU control signal and an ACC-gear-on signal; the first controller outputs six control signals of IGN1_ON1, IGN1_OFF1, IGN2_ON1, IGN2_OFF1, MCU1_CTRL and ACC_ON1, the second controller outputs six control signals of IGN1_ON2, IGN1_OFF2, IGN2_ON2, IGN2_OFF2, MCU2_CTRL and ACC_ON2, and the logic circuit module comprises: a first RS flip-flop receiving IGN1_ON1, IGN1_OFF1, IGN1_ON2, IGN1_OFF2, MCU1_CTRL and MCU2_CTRL, and the output end of the first RS flip-flop being connected to the IGN1 relay; a second RS flip-flop receiving IGN2_ON1, IGN2_OFF1, IGN2_ON2, IGN2_OFF2, MCU1_CTRL and MCU2_CTRL, and the output end of the second RS flip-flop being connected to the IGN2 relay; a fifth AND gate receiving ACC_ON1 and ACC_ON2, and the output end of the fifth AND gate being connected to the ACC relay; a first AND gate receiving IGN1_ON1 and IGN1_ON2, and the output of the first AND gate being used as the set signal of the first RS flip-flop; a second AND gate receiving IGN1_OFF1 and IGN1_OFF2; a third AND gate receiving IGN2_ON1 and IGN2_ON2, and the output of the third AND gate being used as the set signal of the second RS flip-flop; a fourth AND gate receiving IGN2_OFF1 and IGN2_OFF2; a first OR gate receiving MCU1_CTRL and MCU2_CTRL; a sixth AND gate receiving the output of the first OR gate and a start button signal; a second OR gate, an output of the second OR gate receiving an output of the second AND gate and an output of the sixth AND gate, and the output of the second OR gate being a reset signal of the first RS flip-flop; a third OR gate, an output of the third OR gate receiving an output of the fourth AND gate and an output of the sixth AND gate, and the output of the third OR gate being a reset signal of the second RS flip-flop; a first high-side switch and a second high-side switch, an input end of the first high-side switch and an input end of the second high-side switch being connected to an output end of the first RS flip-flop, and an output end of the first high-side switch and an output end of the second high-side switch being connected to the IGN1 relay in parallel; a third high-side switch, an input end of the third high-side switch being connected to an output end of the second RS flip-flop, and an output end of the third high-side switch being connected to the IGN2 relay; a fourth high-side switch, an input end of the fourth high-side switch being connected to an output end of the fifth AND gate, and an output end of the fourth high-side switch being connected to the ACC relay.

2. The vehicle power distribution control circuit of claim 1, wherein The power supply module further comprises: a first power supply chip and a second power supply chip, the first power supply chip and the second power supply chip being connected to the first controller and the second controller respectively after being connected in parallel.

3. The vehicle power distribution control circuit of claim 2, wherein, The reset circuit comprises: a first reset AND gate, an input end of the first reset AND gate being connected to the first power supply chip and the second controller, and an output end of the first reset AND gate being connected to the first controller; a second reset AND gate, an input end of the second reset AND gate being connected to the second power supply chip and the first controller, and an output end of the second reset AND gate being connected to the second controller.

4. The vehicle power distribution control circuit of claim 2, wherein The vehicle power distribution control circuit further comprises: a detection module, one end of the detection module being connected to the second power supply, the other end of the detection module being grounded, and the detection module comprising a first resistor and a second resistor connected in series, and the first controller being connected between the first resistor and the second resistor.

5. A control method of a vehicle power distribution control circuit, characterized by, The control method is applied to the vehicle power distribution control circuit based on dual-MCU redundant control as claimed in any one of claims 1-4, and the control method comprises: when the vehicle power distribution control circuit meets a starting condition, controlling the IGN1 relay, the IGN2 relay and the ACC relay to be in an on state, starting the vehicle and starting timing; after the timing reaches a preset time, maintaining the on state of the IGN1 relay, the IGN2 relay and the ACC relay; detecting a working state of the vehicle power distribution control circuit, the working state comprising a fault state and a normal state; when the vehicle power distribution control circuit is in the fault state, the normal controller restarts the fault controller through a reset operation, and a forced engine stop can be realized through a starting button. When the vehicle power distribution control circuit is in the normal state, if the power-off condition is met and the start button is valid, the MCU control signals are all high, controlling the IGN1 relay and the IGN2 relay to be disconnected, and the vehicle is powered off.

6. The control method according to claim 5, characterized by The control method further comprises: When the vehicle power distribution control circuit meets the start condition, the first-gear-on signal and the second-gear-on signal are both high, and the first-gear-off signal and the second-gear-off signal are both low. After the timing reaches the preset time, the first-gear-on signal and the second-gear-on signal become low, and the first-gear-off signal and the second-gear-off signal remain low.

7. The control method according to claim 5, wherein, when the vehicle power distribution control circuit is in the fault state, the normal controller restarts the fault controller through a reset operation, and at the same time, forced engine shutdown can be realized through the start button, and the forced engine shutdown comprises: If the first controller fails, the second controller restarts the first controller through a reset operation; If the second controller fails, the first controller restarts the second controller through a reset operation. ​

Images