Anti-interference DCDC power supply protection method and system

Abstract

The invention discloses an anti-interference DCDC power supply protection method and system, relates to the technical field of power electronic control, and is used for solving the problem of poor anti-interference protection of a DCDC power supply. A closed-loop control mechanism integrating sampling anti-interference, fault judgment, tentative verification, hierarchical protection and parameter self-tuning is constructed, in the aspect of interference suppression, four-end Kelvin connection and independent sensing are adopted, a blank time and fragment screening strategy is matched, the sampling stability is improved, and in the aspect of fault recognition, the fault recognition efficiency is improved on the basis of a Boolean rule chain. Effective event judgment is achieved, interference false alarm is verified through current limiting or frequency turn-back in the tentative stage, false triggering is avoided, state machine hierarchical control is adopted in protection response, smooth migration and rapid isolation are achieved, soft start with pre-bias recognition and back-off stepped retry are introduced in the recovery process, and the recovery efficiency is improved. And on-line small-step self-tuning and rollback are carried out on key control parameters, so that the anti-interference performance, the control precision and the long-term stability of the DCDC power supply are effectively improved.

Description

Technical Field

[0001] This invention relates to the field of power electronic control technology, and more specifically, to an anti-interference DC-DC power supply protection method and system. Background Technology

[0002] In the field of high-performance power management systems, DC-DC converters are widely used in communication equipment, industrial control power supplies, new energy vehicles, and aerospace electronics. Their core task is to efficiently convert the input DC voltage into the target output voltage. However, with the increase in system integration and the increasing complexity of the electromagnetic interference environment, DC-DC power supplies face transient anomalies caused by factors such as load changes, electromagnetic interference, controller hysteresis, or thermal drift during operation. These anomalies often have characteristics such as short trigger time, large amplitude, and unstable features, which can easily trigger overcurrent or overvoltage protection mechanisms, leading to output interruption, system reset, or equipment malfunction.

[0003] Existing DC-DC protection methods lack anti-interference analysis of signal fluctuation trends and judgment segments. Especially in complex interference scenarios, it is difficult to distinguish between real faults and false alarms, resulting in frequent protection actions and power supply instability. At the same time, traditional solutions mostly adopt the method of directly shutting down the driver or restarting the whole machine after protection, lacking fine control over boundary conditions, system thermal state and recovery path, causing secondary risks such as energy surges, voltage backflash and drive overshoot. They usually use statically configured protection parameters and recovery processes, lacking the ability to mine historical event data and online adaptive capabilities, making it difficult to achieve accurate identification, flexible adjustment and closed-loop optimization, thus limiting the stability of the system in high interference environments. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, the following solution is proposed to solve the problem of poor anti-interference protection of DC-DC power supplies in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: An anti-interference DC-DC power supply protection method includes the following steps: A four-terminal Kelvin connection and an independent sensing ground loop are used in the current and voltage sampling link. The leading edge blank time is set and adjusted according to the rising trend of inductor current, duty cycle and device temperature. The running length segment is filtered for the input signal of comparator or analog-to-digital converter, and the sampling phase is locked to the current trough or output voltage stable region. Within the time window formed by adjacent switching cycles, the gate drive state, current slope, error amplifier output and output voltage ripple phase are time-aligned. Valid events are determined by Boolean rule chain, and the fault triggering condition is confirmed after the preset number of occurrences is reached. After the fault triggering conditions are confirmed, a trial current limiting or frequency foldback with limited amplitude and duration is executed. The output voltage and error amplifier output are monitored to see if they converge toward a stable direction. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. Based on the test results, the process transitions within the state machine consisting of the suppression stage, soft shutdown stage, and isolation stage, respectively executing current limiting foldback and duty cycle slope control, exiting energy transfer and output pre-discharge with a controlled slope, or prohibiting high-side drive disconnection from the front-end electronic switch, and recording event information. During the recovery phase, residual bias voltage at the output terminal is identified and a soft-start curve with pre-bias identification is selected. Retry is performed using a backoff ladder method. At the same time, based on event fingerprint records, online small-step self-tuning is performed on blank time, sampling phase, current limiting backoff upper and lower limits and soft turn-off slope within boundary constraints. If stability decreases, automatic rollback is performed.

[0006] Furthermore, the specific process of anti-interference sampling and fragment selection is as follows: Establish a four-terminal Kelvin connection and an independent sensing ground loop for the current sampling link and voltage sampling link; Set a blank time before activation, and set an upper and lower threshold. Perform run-length segment filtering on the input signal of the comparator or analog-to-digital converter. The minimum continuous time threshold and the maximum occlusion duration threshold of the segment are given by the parameter table. The sampling phase is locked to the current trough or the output voltage stable region, and a phase lock flag is generated and written into the event fingerprint record.

[0007] Furthermore, the specific process for adjusting the frontier blank time is as follows: Real-time calculation of three state variables: inductor current rising trend, duty cycle, and device temperature; Retrieve the corresponding step value from the state mapping table and perform a single-step adjustment, keeping the step direction monotonic; When continuous adjustments reach boundary constraints, the current blank time remains unchanged. When the sampling phase deviates from the locked area, the sampling phase is restored first, and then the blank time adjustment continues.

[0008] Furthermore, within the time window formed by adjacent switching cycles, the gate drive state, current slope, error amplifier output, and output voltage ripple phase are time-aligned. Valid events are determined using a Boolean rule chain, and the fault triggering condition is confirmed after a preset number of occurrences is reached. The specific process is as follows: Within a time window formed by adjacent switching cycles, the gate drive state sequence, current slope sequence, error amplifier output change sequence, and output voltage ripple phase sequence are recorded synchronously. Construct three types of Boolean rule chains: sequence order, phase consistency, and duration. When a valid event satisfies the three types of Boolean rule chains and reaches a preset occurrence threshold, the fault triggering condition is confirmed. When a rule conflict exists, the event is marked as a review candidate and reviewed in the next time window, while the triggering path is blocked before the review.

[0009] Furthermore, after confirming the fault triggering conditions, a trial current limiting or frequency foldback with limited amplitude and duration is implemented. The output voltage and error amplifier output are monitored to see if they converge towards stability. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. Specific steps include: After the fault triggering conditions are confirmed, a trial current limiting or a trial switching frequency reversal is performed, with the trial amplitude not exceeding a preset amplitude threshold and the duration not exceeding a preset duration threshold. Within the test window, determine the direction of change of the output voltage and the output of the error amplifier. If the direction is consistent and tends to stabilize, it is determined to be a false alarm due to interference. If the direction is inconsistent or divergent, it is determined to be a real fault. When the temperature rise slope exceeds the preset temperature rise threshold or the input bus voltage surge exceeds the preset voltage threshold, the test should be terminated immediately and the protection level upgraded. The trial type, step size, duration, and decision result are written into the event fingerprint record.

[0010] Furthermore, the specific process of state machine transition is as follows: After the fault triggering condition is determined to be a real fault through reversibility testing, it enters the suppression stage. When a valid event does not disappear or the number of recurrences reaches a preset occurrence threshold within the observation sub-window, the process transitions from the suppression level to the soft shutdown level. After the soft shutdown stage is completed and energy transfer is exited with a controlled slope, it will migrate to the isolation stage when a valid event or bus health indicator becomes abnormal again in the observation sub-window. When the temperature rise slope exceeds the preset temperature rise threshold, it will directly migrate to the isolation level; a recording operation will be performed for each migration and the next window monitoring will be started.

[0011] Furthermore, based on the trial results, the process transitions within the state machine comprised of the suppression stage, soft shutdown stage, and isolation stage. This involves executing current limiting foldback and duty cycle slope control, exiting energy transfer and output pre-discharge with a controlled slope, or prohibiting high-side drive disconnection from the front-end electronic switch, and recording event information. The specific process is as follows: The suppression stage performs current limiting and turn-off, synchronous rectification early shutdown, and duty cycle slope control, ensuring that the disturbance budget does not exceed the preset upper limit. The soft-shutdown stage exits energy transfer at a controlled slope and performs pre-discharge at the output terminal. After the bus health indicator is restored, it enters the observation sub-window. The isolation level prevents high-side driving or disconnection of the front-end electronic switch and remains locked. All three levels generate protection records, recording the entry time, exit time, triggering conditions, and bus health indicators. If any action causes a decrease in stability, the current action is terminated and the protection level is moved up one level.

[0012] Furthermore, during the recovery phase, the residual bias voltage at the output terminal is identified, and a soft-start curve with pre-bias identification is selected. A backoff ladder approach is used for retrying, as detailed below: Before recovery, detect the residual bias voltage at the output terminal and select a soft-start curve with pre-bias recognition; Resumption and retry are arranged according to the retreat ladder, and the ladder interval is set by the parameter table and increases with the number of failures; During startup, the system continuously matches the warning chains of danger. If a match is found, the startup is paused and the system is rolled back one level. After startup, enter the observation sub-window. If there are no valid events and the bus health indicator is normal, exit the recovery process. The start-up curve, step count, and precursor matching results of the entire recovery phase are written into the event fingerprint record.

[0013] Furthermore, based on event fingerprint records, online small-step self-tuning is performed within boundary constraints on blank time, sampling phase, current limiting backoff upper and lower limits, and soft shutdown slope. If stability decreases, automatic rollback is performed. The specific process is as follows: Based on event fingerprint records, the trigger channel, segment duration, phase relationship, and probing response direction are statistically analyzed. When the proportion of false alarms exceeds the preset false alarm threshold during the observation period, the leading edge blank time is increased or the sampling phase is adjusted. When the suppression level does not converge within the observation sub-window, adjust the upper limit of current limiting backoff, the lower limit of current limiting backoff, or the soft shutdown slope. All adjustments are subject to boundary boxes and rollback conditions. If stability decreases after any adjustment, the system will roll back to the previous stable configuration.

[0014] An anti-interference DC-DC power supply protection system, used to implement the above-mentioned anti-interference DC-DC power supply protection method, includes: The link data acquisition module is used to set the leading edge blank time in the current and voltage sampling link by using a four-terminal Kelvin connection and an independent sensing ground loop, and to adjust the blank time according to the rising trend of inductor current, duty cycle and device temperature. It performs running length segment filtering on the input signal of comparator or analog-to-digital converter, and locks the sampling phase to the current trough or output voltage stable region. The fault trigger determination module is used to perform timing alignment of the gate drive state, current slope, error amplifier output and output voltage ripple phase within the time window formed by adjacent switching cycles, determine valid events through Boolean rule chain, and confirm the fault trigger condition after reaching a preset number of occurrences. The protection-limited module is used to perform trial current limiting or frequency foldback with limited amplitude and duration after the fault triggering conditions are confirmed. It monitors whether the output voltage and error amplifier output converge towards the stable direction. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. The state transition module is used to transition between the state machine consisting of the suppression stage, soft shutdown stage and isolation stage according to the test results, and respectively perform current limiting backoff and duty cycle slope control, exit energy transfer and output pre-discharge with controlled slope, or high-side drive prohibition and front-end electronic switch disconnection operation, and record event information. The output debugging module is used to identify the residual bias voltage at the output terminal during the recovery phase and select a soft-start curve with pre-bias identification. It retryes using a backoff ladder method. At the same time, based on the event fingerprint record, it performs online small-step self-tuning of blank time, sampling phase, current limiting backoff upper and lower limits and soft turn-off slope within the boundary constraints. If the stability decreases, it automatically rolls back.

[0015] The technical effects and advantages of the anti-interference DC-DC power supply protection method of the present invention are as follows: This invention achieves safe and stable operation of DC-DC power supplies in high-noise and transient disturbance environments by constructing a closed-loop control system integrating anti-interference sampling, event judgment, reversibility testing, hierarchical protection, and self-tuning recovery. The sampling link employs a four-terminal Kelvin connection and an independent sensing ground structure, combined with leading-edge blank time and running length segment filtering, effectively suppressing common-mode interference and glitches, improving the authenticity and timing consistency of current and voltage sampling. Through a short-time-window Boolean rule chain judgment mechanism, the gate drive state, current slope, error amplifier output, and voltage ripple phase are synchronously analyzed to ensure the accuracy of fault event identification and avoid false triggering. For confirmed faults, a trial current limiting and switching frequency foldback strategy with limited amplitude and duration is introduced to verify the anomaly type without affecting overall stability, thereby distinguishing between interference false alarms and real faults. Furthermore, a state machine composed of suppression stage, soft shutdown stage and isolation stage is used to realize hierarchical protection, enabling the controller to smoothly switch between maintaining power supply, slow energy release and rapid isolation, preventing energy backflow and device overstress. During the recovery phase, a soft start curve with pre-bias recognition and a backoff ladder retry mechanism are adopted. Combined with event fingerprint recording, online small-step self-tuning is performed to dynamically optimize the leading edge blank time, sampling phase, current limiting foldback upper and lower limits and soft shutdown slope, realizing self-learning and adaptive rollback of operating parameters, significantly improving the anti-interference, fault differentiation accuracy and long-term stability of DC-DC power supply in complex electromagnetic environments. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an anti-interference DC-DC power supply protection method according to the present invention.

[0017] Figure 2 This is a schematic diagram of the structure of an anti-interference DC-DC power supply protection system according to the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1: As Figure 1 As shown, an anti-interference DC-DC power supply protection method includes the following steps: A four-terminal Kelvin connection and an independent sensing ground loop are used in the current and voltage sampling link. The leading edge blank time is set and adjusted according to the rising trend of inductor current, duty cycle and device temperature. The running length segment is filtered for the input signal of comparator or analog-to-digital converter, and the sampling phase is locked to the current trough or output voltage stable region. Within the time window formed by adjacent switching cycles, the gate drive state, current slope, error amplifier output and output voltage ripple phase are time-aligned. Valid events are determined by Boolean rule chain, and the fault triggering condition is confirmed after the preset number of occurrences is reached. After the fault triggering conditions are confirmed, a trial current limiting or frequency foldback with limited amplitude and duration is executed. The output voltage and error amplifier output are monitored to see if they converge toward a stable direction. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. Based on the test results, the process transitions within the state machine consisting of the suppression stage, soft shutdown stage, and isolation stage, respectively executing current limiting foldback and duty cycle slope control, exiting energy transfer and output pre-discharge with a controlled slope, or prohibiting high-side drive disconnection from the front-end electronic switch, and recording event information. During the recovery phase, residual bias voltage at the output terminal is identified and a soft-start curve with pre-bias identification is selected. Retry is performed using a backoff ladder method. At the same time, based on event fingerprint records, online small-step self-tuning is performed on blank time, sampling phase, current limiting backoff upper and lower limits and soft turn-off slope within boundary constraints. If stability decreases, automatic rollback is performed.

[0020] Step 1: In the current and voltage sampling link, a four-terminal Kelvin connection and an independent sensing ground loop are used. A leading-edge blanking time is set, and the blanking time is adjusted according to the inductor current rising trend, duty cycle, and device temperature. Run-length segment filtering is performed on the comparator or analog-to-digital converter input signal, and the sampling phase is locked to the current trough or the stable output voltage region. Specific steps include: In terms of hardware connection and signal acquisition, the current sampling link adopts a four-terminal Kelvin connection and an independent sensing ground loop: the two ends of the current sampling resistor are respectively used as the high current terminals of the current sampling link, and two independent current sampling link sensing terminals are directly led to the input of the operational amplifier or comparator. The sensing terminals do not share the power return path. The voltage sampling link also adopts a two-stage voltage divider and buffer method to deploy two voltage sampling link sensing terminals, which are separated from the power ground to form an independent sensing ground loop; The switch drive controller has a built-in leading edge blank time gating, which masks the comparator input and analog-to-digital converter input at the beginning of each turn-on edge. The duration of the masking is determined by the leading edge blank time. Run-length segment filtering is implemented at the input of the comparator or analog-to-digital converter: Using one switching cycle as the analysis interval, the input signal is converted into two types of continuous segments, high and low, which are statistically analyzed. Segments with a length less than the minimum continuous time threshold are invalidated. The cumulative masking does not exceed the maximum masking duration threshold; if it does, further masking stops and the process directly proceeds to the subsequent criterion link to prevent information loss due to excessive masking. The sampling phase is fixed through sampling phase locking. For current signals, the sampling time is anchored at the point when the inductor current is approximately at its lowest, i.e., the current trough. For voltage signals, the sampling time is anchored to the period far from the switching edge and where the ripple change is minimal, i.e., the stable output voltage region. After completing phase locking, the controller generates a sampling phase lock flag and writes it into the event fingerprint record for use in runtime consistency verification.

[0021] Regarding the setting and adaptive adjustment of the leading edge blank time, the parameter table first provides the upper limit threshold of the leading edge blank time, the lower limit threshold of the leading edge blank time, the minimum continuous time threshold, the maximum occlusion duration threshold, and the sampling phase deviation tolerance.

[0022] During power-on initialization, the leading-edge blank time is set to an initial value between the upper and lower limits. The controller collects three state variables during each switching cycle: inductor current rise trend, duty cycle, and device temperature. The inductor current rise trend is described by taking current samples from two adjacent moments within the on-state interval, calculating their difference, and then dividing by the on-state duration. The duty cycle is obtained by recording the ratio of the high-level switching duration to the complete cycle time. The device temperature is obtained through digital readings from a temperature sensor or equivalent thermistor.

[0023] The correspondence between the three state variables and the leading-edge blank time step values ​​is pre-written into a state mapping table. Each cycle, the controller reads the discrete intervals of the three state variables, retrieves the corresponding leading-edge blank time step value from the mapping table, and performs only single-step adjustments to ensure the adjustment direction remains monotonic. When continuous adjustments reach the upper or lower threshold of the leading-edge blank time, the controller maintains the current value and suspends further increases or decreases until the state variables return to a safe range. If a sampling phase deviation exceeding the sampling phase deviation tolerance is detected during operation, the controller pauses further adjustments to the leading-edge blank time, prioritizes sampling phase lock recovery, and resumes single-step adjustments based on the state mapping table after a new sampling phase lock flag is generated. This avoids the superposition of phase drift and blank time changes leading to a decrease in sampling quality.

[0024] Regarding the implementation and parameter constraints of runtime segment selection, the controller performs segment statistics on the input signals of the comparator or analog-to-digital converter, specifically as follows: At the beginning of each switching cycle, a segment counter is started to record the duration of the first high or low level. If this duration does not reach the minimum continuous time threshold, the segment is marked as a short segment, and short segments do not directly enter the criterion processing. When multiple short segments occur consecutively, their masking time is accumulated. The accumulated value must not exceed the maximum masking duration threshold. Once the maximum masking duration threshold is reached or exceeded, the controller immediately stops continuing to mask, allowing subsequent signals to enter the criterion link to avoid excessive blanking. To ensure that this screening and the leading blank time do not mask each other, the controller cascades the leading blank time masking area and the running length segment screening masking area sequentially, prioritizing the leading blank time masking, and then entering the segment screening stage after it is completed. Within the same cycle, if the cumulative time of the aforementioned two types of occlusion approaches the upper limit allowed for the cycle, the controller will make a decision based on the maximum occlusion duration threshold to ensure that the limit is not exceeded.

[0025] After the screening is completed, the valid segments that meet the minimum continuous time threshold are sent to the subsequent Boolean rule chain for subsequent fault judgment. At the same time, the number of short segments in the current period, the cumulative occlusion time, and the flag indicating whether the upper limit has been reached are written into the event fingerprint record for use in self-tuning and diagnosis.

[0026] Regarding the establishment and maintenance of sampling phase lock, the controller performs a two-step locking process during the initialization phase: First, by detecting the periodic waveform of the current sampling signal, the interval with the minimum current in each cycle is identified as the current trough, and the current sampling trigger is set at the midpoint of this interval; if a voltage sampling path is used, then within one cycle of the output voltage, the interference area near the switching edge is excluded, and the interval with the smallest ripple change is selected as the stable output voltage region, and the voltage sampling trigger is set at the midpoint of this interval. The second step involves monitoring the relative position deviation between the trigger time and the reference interval over several consecutive cycles, comparing the deviation with the sampling phase deviation tolerance: if the deviation does not exceed the tolerance, the current trigger phase is maintained; if the deviation exceeds the tolerance, the trigger time is advanced or delayed by a fixed step size until it falls back to near the midpoint of the reference interval, and a new sampling phase lock flag is generated. When the timing drift is caused by changes in duty cycle or device temperature, the controller prioritizes the above phase correction, pausing the increase or decrease of the leading edge blank time during this period to avoid the adverse superposition of the two adjustment loops on the sampling quality. Once the sampling phase lock flag is restored, the leading edge blank time is adjusted step by step according to the state mapping table.

[0027] Through the above steps, current and voltage sampling are anchored to the current trough or the stable output voltage region in each cycle. Combined with the filtering of the leading edge blank time and running length segments, anti-interference stable sampling is achieved, providing reliable input for subsequent time window Boolean rule chain and fault identification.

[0028] Step 2: Within the time window formed by adjacent switching cycles, the gate drive state, current slope, error amplifier output, and output voltage ripple phase are time-aligned. A Boolean rule chain is used to determine valid events, and the fault trigger condition is confirmed after a preset number of occurrences is reached. Specific steps include: The controller constructs a time window based on adjacent switching cycles. The time window consists of at least two adjacent switching cycles, with an upper limit not exceeding the maximum number of cycles given in the parameter table. The reference moment for window opening is aligned with the sampling phase-locked flag, ensuring that the gate drive state sequence, current slope sequence, error amplifier output change sequence, and output voltage ripple phase sequence are aligned on the same time axis. The current slope sequence is obtained by subtracting two adjacent current samples within the conduction interval and dividing by the time interval between the two samples to describe its rate of change, resulting in a discrete marker indicating rising, falling, or approximately constant values. The error amplifier output change sequence is obtained by subtracting adjacent sample values ​​to obtain a discrete marker indicating increasing, decreasing, or approximately constant values. The output voltage ripple phase sequence is obtained by timing the relative order between the voltage ripple zero-crossing and the sampling phase-locked flag within one switching cycle, resulting in a discrete marker indicating in-direction, opposite-direction, or uncorrelated values.

[0029] The aligned four types of sequences form a time series record in each period, which accumulates to form multiple records in the time window, serving as the input to the Boolean rule chain.

[0030] The Boolean rule chain consists of a sequence rule chain, a phase consistency rule chain, and a duration rule chain. The sequence rule chain is used to verify causal order: for example, in determining overcurrent risk, after the gate drive state sequence turns on, the current slope sequence should rise briefly after turn-on, and the error amplifier output change sequence should increase in the subsequent sub-period. In determining overvoltage risk, if the output voltage ripple phase sequence is in the same direction and the error amplifier output change sequence decreases, the causal order is not satisfied, and the event is invalid. The phase consistency rule chain is used to verify the phase relationship between gating noise and the actual fault: using the sampling phase lock flag as a reference, if the output voltage ripple phase sequence is in the same direction and the current slope sequence is rising, but the gate drive state sequence is in the off period, then it is judged as phase inconsistency, and the event is invalid. The duration rule chain is used to verify stability: the effective segment length of the same rule within a switching cycle should not be less than the minimum continuous time threshold, and the number of consecutive hits must reach a preset occurrence threshold within the time window to be counted as a valid event.

[0031] For each hit, the controller writes the hit time, the hit rule chain type, and the relative phase of this hit into the event fingerprint record for subsequent review and self-tuning.

[0032] Within the time window, when a hit of one rule chain conflicts with a hit of another rule chain, the controller executes a verification mechanism and blocks the trigger path. Conflict determination includes two types of situations: one is inconsistency in causal sequence, i.e., the gate drive state sequence is marked as off while the current slope sequence is marked as rising, or the error amplifier output change sequence increases while the output voltage ripple phase sequence is marked as reversed; the other is phase offset exceeding the limit, i.e., the timing deviation relative to the sampling phase lock flag exceeds the phase offset tolerance given in the parameter table. In any of the following situations, the event is marked as a review candidate and is not counted in the valid event count for this window. The same spatial and temporal neighborhood is re-evaluated in the next time window. If the conflict is eliminated in two consecutive time windows and the same event satisfies the sequence rule chain, phase consistency rule chain, and duration rule chain, the count is restored and accumulated to the preset occurrence threshold. If the conflict persists in two consecutive time windows, the accumulated count of the event is cleared and the conflict type and timestamp are written into the event fingerprint record.

[0033] When the time window ends, the controller reads the cumulative result of valid events and compares it with the preset occurrence threshold. If the cumulative hit count of any event in the current time window reaches the preset occurrence threshold, the fault triggering condition is confirmed; if it does not reach the threshold, the fault is not triggered, and only the event fingerprint record is retained.

[0034] For example, the switching frequency is set to 400kHz, the time window is three adjacent switching cycles, the preset occurrence threshold is set to 3, and the minimum continuous time threshold is set to 0.2 microseconds. After the sampling phase lock flag is aligned, within cycle 1: the gate drive state is on at t=0; the current slope continuously increases from t=0 to 0.5 microseconds; the error amplifier output continuously increases from t=0.4 to 1.2 microseconds; the output voltage ripple phase is in the same direction as the error amplifier output. If this cycle satisfies the Boolean rule chain of sequence, phase consistency, and duration, it is counted as a hit. If the same pattern is repeated in cycles 2 and 3, and the pattern is hit 3 times in a row, the preset occurrence threshold of 3 times is reached, and the fault triggering condition is confirmed. If a rule conflict occurs in cycle 2 (e.g., the gate drive state is off while the current slope is rising, or the phase offset exceeds the phase offset tolerance), the event is marked as a review candidate and is not counted as a hit in this window. The event then proceeds to the next time window for review. Only when the conflict is eliminated and the three types of rule chains are satisfied again in two consecutive time windows will the cumulative count be restored.

[0035] Step 3: After confirming the fault triggering conditions, perform a trial current limiting or frequency foldback with limited amplitude and duration, and monitor whether the output voltage and error amplifier output converge towards stability. If abnormal temperature rise or bus backlash occurs, terminate the trial and upgrade the protection level. Specific steps include: After confirming the fault triggering conditions, the controller opens the probing sub-window and prioritizes selecting a single probing method based on the device configuration: one is probing current limiting, which lowers the peak current limiting loop by a step not exceeding a preset amplitude threshold while maintaining it within a preset duration threshold; the other is probing switching frequency foldback, which adjusts the switching frequency in the driver modulator by a step not exceeding a preset amplitude threshold while maintaining it within a preset duration threshold. To avoid uncertainties caused by the superposition of the two types of probing, only one type is allowed to be enabled within the same probing sub-window. The timestamps of the start and end of the probing, the selected probing type, and its step are written into the event fingerprint record.

[0036] Within the trial window, the controller uses the sampling phase lock flag as a time reference, while simultaneously monitoring the direction of change of the output voltage and the error amplifier output to determine whether it is converging towards a stable direction. Stable convergence of the output voltage means that the current output voltage is compared with the controller's internal output voltage target to obtain the absolute value of the output voltage deviation; and that this absolute value decreases successively across several consecutive sampling points within the trial window, without any abrupt reversals.

[0037] The stable directional convergence of the error amplifier output means that: comparing the current sample with the previous sample, if the previous sample was in the increasing direction, the current sample is unchanged or decreasing; if the previous sample was in the decreasing direction, the current sample is unchanged or increasing; thus forming a discrete marker where the direction of change no longer deviates from the target. When the output voltage deviation and the error amplifier output simultaneously satisfy the above-mentioned stable direction convergence criteria, it is determined that the direction is consistent and tending to be stable; if either one is not satisfied, or the two directions are opposite to each other, it is determined that the direction is inconsistent or divergent. At the end of the trial sub-window, the controller gives the trial conclusion based on the judgment: if the direction is consistent and tending to be stable, it is determined to be a false alarm; if the direction is inconsistent or divergent, it is determined to be a real fault. The trial conclusion, whether the corresponding criteria are satisfied, and the number of consecutively satisfied samples are written into the event fingerprint record.

[0038] The controller continuously calculates the temperature rise slope and input bus voltage overshoot within the probe sub-window and sets forced termination conditions. The method for obtaining the temperature rise slope is as follows: The system reads the current device temperature and the previous temperature sample reading, calculates the difference between the two, and divides the difference by the time interval between the two samples to obtain the temperature rise rate per unit time. When this rate exceeds the preset temperature rise threshold, the test is immediately terminated and the protection level is upgraded. The method for obtaining the input bus voltage overshoot is as follows: read the current input bus voltage and compare it with the reference voltage at the beginning of the same sub-window. If the increment of the current voltage above the reference voltage exceeds the preset voltage threshold, the test is immediately terminated and the protection level is upgraded. When forced termination occurs, the controller records the trigger threshold type, trigger time, and test step at that time as input for subsequent graded protection and controlled recovery.

[0039] When the trial sub-window ends without triggering a forced termination, the controller executes subsequent branches based on the trial conclusion: if it is determined to be a false alarm, the protection path is withdrawn, the control parameters before the fault are restored, and the fault trigger state of the event is cleared; if it is determined to be a real fault, the controller enters the suppression stage, soft shutdown stage, or isolation stage according to the state machine transition rules. The controller writes the trial type, step size, duration, output voltage deviation change sequence, error amplifier output change sequence, whether the stability direction convergence criterion is met, and the monitoring results of temperature rise slope and input bus voltage overshoot into the event fingerprint record for subsequent controlled recovery and online small-step self-tuning.

[0040] For example, the preset amplitude threshold is set to 10% of the rated peak current limit, the preset duration threshold is set to 150 microseconds, the preset temperature rise threshold is set to 2 degrees Celsius per second, and the preset voltage threshold is set to 1.5 volts above the input bus voltage. After the fault triggering condition is confirmed, the test sub-window is entered, and only one test mode is used: the peak current limit reference is reduced from 8 amps to 7.2 amps, the decrease is 10%, not exceeding the preset amplitude threshold, and it is kept within 100 microseconds not exceeding the preset duration threshold. Within these 100 microseconds, the absolute value of the output voltage deviation relative to the target is continuously sampled from 300 millivolts to 220 millivolts, then to 160 millivolts, and finally to 120 millivolts, and the error amplifier output changes from increasing to approximately constant / decreasing. The two satisfy the stable direction convergence criterion of consistent direction and stabilization. The test conclusion is judged as a false alarm, the protection path is withdrawn, and the fault triggering state is cleared. The test type, step amplitude, duration, and judgment result are written into the event fingerprint record. In contrast, if, during the same test, the output voltage deviation increases in the opposite direction from 300 mV to 340 mV, or if the temperature rise slope exceeds 2 degrees Celsius per second at any time, or if the input bus voltage overshoots the sub-window starting point by more than 1.5 volts, the test is immediately terminated and the protection level is upgraded to the suppression level or a higher level. At the same time, the trigger threshold type, trigger time, and current step are recorded for subsequent controlled recovery and backoff tiered scheduling.

[0041] Step 4: Based on the trial results, transition within the state machine comprised of the suppression stage, soft shutdown stage, and isolation stage. Perform current limiting foldback and duty cycle slope control, exit energy transfer and output pre-discharge with a controlled slope, or disable high-side drive to disconnect from the front-end electronic switch, and record event information. Specific steps include: Based on the trial results, the state machine transition is performed. After the trial current limiting or trial switching frequency foldback is completed and a real fault conclusion is given, the controller loads the event into the hierarchical protection state machine. The state set includes the suppression level, soft shutdown level, and isolation level. Each time any state is entered, the observation sub-window is immediately started. The duration of the observation sub-window is read from the parameter table. The number of recurrences of valid events is accumulated in the window and compared with the preset occurrence threshold. Regardless of the state, as long as the temperature rise slope exceeds the preset temperature rise threshold, the controller directly transitions to the isolation level. At the same time, the bus health flag is continuously monitored to determine whether to maintain or exit the current state. The bus health flag is generated by comprehensively considering the threshold criteria of input bus voltage overshoot, sag, and ripple limit, and is obtained according to the threshold in the parameter table.

[0042] All entry times, exit times, trigger conditions, status names, and key parameters, such as current limit reference, duty cycle change step, exit slope value, and pre-discharge duration, are written into the event fingerprint record.

[0043] The suppression stage is used to quickly mitigate risks while maintaining power supply. Upon entering the suppression stage, current limiting foldback is performed: the current limit reference is lowered in a single-step manner, with the single-step amplitude and lower limit derived from the parameter table; any reduction must not fall below this lower limit. Simultaneously, duty cycle slope control is performed. Limiting the maximum change in duty cycle between adjacent switching cycles allows inductor energy to adjust at a limited speed, preventing amplification of bus disturbances; synchronous rectification is turned off early to shorten the conduction time of the freewheeling channel and reduce the probability of spike re-triggering; if the valid event disappears within the current observation sub-window and the output recovers to near the target, the system returns to normal operation from the suppression stage and writes a suppression stage convergence mark in the event fingerprint record, based on the criterion that the output voltage deviation decreases successively without increasing in the opposite direction; if the valid event does not disappear, or the number of recurrences reaches the preset occurrence threshold, the system migrates to the soft shutdown stage; if the bus health indicator is abnormal, direct migration to the isolation stage is allowed to ensure upstream safety, for example, if the input bus voltage overshoot exceeds the overshoot threshold in the parameter table.

[0044] The soft-shutdown stage is used for a gentle exit from energy transfer and slow-release energy storage. After entering the soft-shutdown stage, energy transfer is exited at a controlled slope: The duty cycle is monotonically decreased towards zero in fixed steps over a continuous period until energy transfer stops; then, an output pre-discharge is performed. The energy stored at the output end is released to a safe level through a controlled path. The pre-discharge path can be a controlled active discharge branch or a permitted synchronous rectifier path. The pre-discharge duration and termination voltage threshold are read from the parameter table. After the pre-discharge is completed and the bus health indicator returns to normal, a new observation sub-window is started to confirm whether external interference is still present. If a valid event occurs again or the bus health indicator becomes abnormal again within this window, the process is migrated to the isolation level. If there is no valid event and the key indicators are stable, the process can be rolled back to the suppression level for limited power supply testing according to the strategy. Whether to roll back or not is determined by the rollback permission flag and the minimum cooling time in the parameter table.

[0045] The isolation stage is used to quickly cut off the energy path. Upon entering the isolation stage, high-side drive is immediately disabled to block the gate drive of the high-side power transistors. If the system has upstream control capabilities, the front-end electronic switch is simultaneously disconnected, physically isolating the input bus from the converter stage. The isolation remains locked and is only released under two conditions: first, after the controlled recovery process is completed and there are no valid events in the observation sub-window, and the bus health flag is normal; second, a reset command is received from the host computer or manual maintenance. Before releasing the isolation, the controller should first restore the low-voltage side operating sequence in a controlled manner to prevent simultaneous closing from causing an impact. During the isolation stage, data such as changes in the bus health indicator, isolation holding time, and number of recovery attempts are continuously recorded and written into the event fingerprint record; if a valid event is hit again in any recovery attempt or the temperature rise slope exceeds the preset temperature rise threshold, the recovery is immediately stopped and the isolation is maintained. Through the above-mentioned graded entry, clear migration conditions and constraint actions, power supply and interference suppression can be maintained as much as possible in the suppression stage, while the components can be gently unloaded and protected in the soft shutdown stage, and rapid damage prevention can be achieved in the isolation stage when necessary.

[0046] Step 5: During the recovery phase, identify the residual bias voltage at the output terminal and select a soft-start curve with pre-bias recognition. Retry is performed using a backoff ladder method. Simultaneously, based on event fingerprint records, online small-step self-tuning is performed within boundary constraints on blank time, sampling phase, current limiting backoff upper and lower limits, and soft turn-off slope. If stability decreases, automatic rollback is initiated. Specific steps include: Before entering the recovery phase, the controller reads the output voltage and compares it with the pre-bias identification threshold: if the output voltage is not lower than the pre-bias identification threshold, it is determined that there is residual bias voltage, and a soft-start curve with pre-bias identification is selected; if it is lower than the threshold, a regular soft-start curve is selected. The soft-start curve with pre-bias identification starts with the initial duty cycle of soft start, gradually increases the duty cycle according to the soft start step, and limits the duty cycle increment between any two adjacent cycles to not exceed the maximum slope of soft start; before each increase, the output current estimate is compared with the inrush current limit threshold. If the threshold is exceeded, the increase is paused until the current falls back. The entire soft start process uses the sampling phase lock flag as a timing reference to avoid triggering sampling in the interference range; the soft start curve type, the duty cycle target for each step, whether the inrush current limit threshold is hit, the corresponding timestamp and the bus health flag are written into the event fingerprint record. After the soft start is completed, the observation sub-window is entered. If there is no valid event in this window and the bus health flag is normal, the recovery process is exited; if a danger precursor chain is hit or the bus health flag is abnormal, the start is determined to be unstable.

[0047] It should be noted that the minimum step size is the minimum allowable adjustment increment in a single operation, given in the parameter table. The output current estimate is obtained by averaging the current sampling link over the period and calculated under the condition of sampling phase lock flag alignment.

[0048] When a recovery attempt fails, the controller performs a retry scheduling according to the backoff step parameter table. After the first failure, it waits for the initial backoff time and attempts a soft start again. If it fails again, the backoff step time is increased based on the previous waiting time. The waiting time must not exceed the maximum backoff time. When the maximum number of retries is reached, automatic recovery stops and the current protection state is maintained, awaiting intervention from the host computer or manual intervention. Before each retry, residual bias identification is re-executed to select a suitable soft start curve. During the soft start process, the hazard warning chain is continuously matched. Once a match is found, the current start is immediately stopped, the reason for the stop is recorded, and the next backoff step is initiated. Each retry records the retry sequence number, waiting time, soft start curve type, hazard warning chain matching result, and changes in bus health indicators, all of which are uniformly written into the event fingerprint record for subsequent diagnosis and strategy optimization.

[0049] After each recovery attempt (whether successful or not), the controller performs online small-step self-tuning based on the event fingerprint record, subject to boundary box and rollback conditions. The self-tuning follows the principles of single variable, minimum step size, and observation confirmation: when the event fingerprint record shows that the proportion of false alarms exceeds the preset false alarm threshold during the observation period, and the number of hits in short segments approaching the minimum continuous time threshold increases, only the minimum step size is increased for the leading edge blank time; when the suppression level does not converge within multiple observation sub-windows, only the minimum step size downwards for the current limiting backoff upper limit or upwards for the current limiting backoff lower limit is adjusted to expand the suppression range; when valid events still occur after soft shutdown and the bus health flag is normal, only the soft shutdown slope is increased by one minimum step size to shorten the exit time; when the event fingerprint record shows that the sampling phase deviation repeatedly approaches the sampling phase deviation tolerance, only the sampling phase is adjusted by one minimum step size and the sampling phase lock flag is regenerated. No parameter adjustment may exceed the upper and lower thresholds defined in the boundary box. After each adjustment, a new observation sub-window is immediately entered to verify stability. If a valid event occurs in this window, the temperature rise slope exceeds the preset temperature rise threshold, or the input bus voltage surge exceeds the preset voltage threshold, it is determined that the stability has decreased, triggering an automatic rollback to the previous stable configuration. The rollback flag, trigger condition, parameters before rollback, and parameters after rollback are written into the event fingerprint record.

[0050] In scenarios involving multi-phase parallel operation and spread spectrum activation, the controller performs coordinated constraints and compensation on the sampling phase. During multi-phase parallel operation, the sampling phase of each phase maintains a fixed relative relationship with its respective switching phase. Upon entering the recovery phase, the main controller broadcasts a suppression window, ensuring that each phase avoids misjudgments caused by phase collisions within the suppression window. If any phase adjusts its sampling phase through online small-step self-tuning, after updating the sampling phase lock flag, that phase publishes the new phase information and suppression window boundary to the other phases, allowing them to avoid instantaneous overlap of sampling phases without changing their own sampling phases. When spread spectrum is enabled, the controller initiates a phase-following mechanism within the sampling timer to synchronously compensate for minor jitter in the sampling trigger time with the switching frequency. Specifically, in each cycle, the offset of the current switching frequency relative to the nominal frequency is read, and this offset is converted into an equivalent advance or lag in the sampling trigger time. A one-time fine-tuning is then performed without exceeding the minimum step size to maintain the fixed relative relationship between the sampling phase and the switching phase, preventing it from being disrupted by spread spectrum. If this fine-tuning brings the sampling phase close to the sampling phase deviation tolerance, priority is given to maintaining the stability of the sampling phase and limiting the phase offset on the spread spectrum side to an acceptable range. The timestamps, phase values, suppression window boundaries, and start / stop records of all coordination and compensation operations are uniformly written into the event fingerprint record to support traceability during the recovery process.

[0051] It should be noted that the threshold information in this embodiment was set in advance by professionals and will not be explained in detail here. Some parameters in the embodiment may have the same English letters, but they are explained with different meanings when used, and will not be explained one by one here.

[0052] Example 2: An anti-interference DC-DC power supply protection system, such as Figure 2 As shown, it specifically includes: The link data acquisition module is used to set the leading edge blank time in the current and voltage sampling link by using a four-terminal Kelvin connection and an independent sensing ground loop, and to adjust the blank time according to the rising trend of inductor current, duty cycle and device temperature. It performs running length segment filtering on the input signal of comparator or analog-to-digital converter, and locks the sampling phase to the current trough or output voltage stable region. The fault trigger determination module is used to perform timing alignment of the gate drive state, current slope, error amplifier output and output voltage ripple phase within the time window formed by adjacent switching cycles, determine valid events through Boolean rule chain, and confirm the fault trigger condition after reaching a preset number of occurrences. The protection-limited module is used to perform trial current limiting or frequency foldback with limited amplitude and duration after the fault triggering conditions are confirmed. It monitors whether the output voltage and error amplifier output converge towards the stable direction. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. The state transition module is used to transition between the state machine consisting of the suppression stage, soft shutdown stage and isolation stage according to the test results, and respectively perform current limiting backoff and duty cycle slope control, exit energy transfer and output pre-discharge with controlled slope, or high-side drive prohibition and front-end electronic switch disconnection operation, and record event information. The output debugging module is used to identify the residual bias voltage at the output terminal during the recovery phase and select a soft-start curve with pre-bias identification. It retryes using a backoff ladder method. At the same time, based on the event fingerprint record, it performs online small-step self-tuning of blank time, sampling phase, current limiting backoff upper and lower limits and soft turn-off slope within the boundary constraints. If the stability decreases, it automatically rolls back.

[0053] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0054] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0055] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0056] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0057] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An anti-interference DC-DC power supply protection method, characterized in that: The specific steps include: A four-terminal Kelvin connection and an independent sensing ground loop are used in the current and voltage sampling link. The leading edge blank time is set and adjusted according to the rising trend of inductor current, duty cycle and device temperature. The running length segment is filtered for the input signal of comparator or analog-to-digital converter, and the sampling phase is locked to the current trough or output voltage stable region. Within the time window formed by adjacent switching cycles, the gate drive state, current slope, error amplifier output and output voltage ripple phase are time-aligned. Valid events are determined by Boolean rule chain, and the fault triggering condition is confirmed after the preset number of occurrences is reached. After the fault triggering conditions are confirmed, a trial current limiting or frequency foldback with limited amplitude and duration is executed. The output voltage and error amplifier output are monitored to see if they converge toward a stable direction. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. Based on the test results, the process transitions within the state machine consisting of the suppression stage, soft shutdown stage, and isolation stage, respectively executing current limiting foldback and duty cycle slope control, exiting energy transfer and output pre-discharge with a controlled slope, or prohibiting high-side drive disconnection from the front-end electronic switch, and recording event information. During the recovery phase, residual bias voltage at the output terminal is identified and a soft-start curve with pre-bias identification is selected. Retry is performed using a backoff ladder method. At the same time, based on event fingerprint records, online small-step self-tuning is performed on blank time, sampling phase, current limiting backoff upper and lower limits and soft turn-off slope within boundary constraints. If stability decreases, automatic rollback is performed.

2. The anti-interference type DC-DC power supply protection method according to claim 1, characterized in that: The specific process of interference-resistant sampling and fragment selection is as follows: Establish a four-terminal Kelvin connection and an independent sensing ground loop for the current sampling link and voltage sampling link; Set a blank time before activation, and set an upper and lower threshold. Perform run-length segment filtering on the input signal of the comparator or analog-to-digital converter. The minimum continuous time threshold and the maximum occlusion duration threshold of the segment are given by the parameter table. The sampling phase is locked to the current trough or the output voltage stable region, and a phase lock flag is generated and written into the event fingerprint record.

3. The anti-interference type DC-DC power supply protection method according to claim 2, characterized in that: The specific process for adjusting the leading edge blank time is as follows: Real-time calculation of three state variables: inductor current rising trend, duty cycle, and device temperature; Retrieve the corresponding step value from the state mapping table and perform a single-step adjustment, keeping the step direction monotonic; When continuous adjustments reach boundary constraints, the current blank time remains unchanged. When the sampling phase deviates from the locked area, the sampling phase is restored first, and then the blank time adjustment continues.

4. The anti-interference type DC-DC power supply protection method according to claim 1, characterized in that: Within a time window formed by adjacent switching cycles, the gate drive state, current slope, error amplifier output, and output voltage ripple phase are time-aligned. Valid events are determined using a Boolean rule chain, and fault triggering conditions are confirmed after a preset number of occurrences are reached. The specific process is as follows: Within a time window formed by adjacent switching cycles, the gate drive state sequence, current slope sequence, error amplifier output change sequence, and output voltage ripple phase sequence are recorded synchronously. Construct three types of Boolean rule chains: sequence order, phase consistency, and duration. When a valid event satisfies the three types of Boolean rule chains and reaches a preset occurrence threshold, the fault triggering condition is confirmed. When a rule conflict exists, the event is marked as a review candidate and reviewed in the next time window, while the triggering path is blocked before the review.

5. The anti-interference type DC-DC power supply protection method according to claim 1, characterized in that: After confirming the fault triggering conditions, a trial current limiting or frequency foldback with limited amplitude and duration is executed. The output voltage and error amplifier output are monitored to see if they converge toward stability. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. The specific steps include: After the fault triggering conditions are confirmed, a trial current limiting or a trial switching frequency reversal is performed, with the trial amplitude not exceeding a preset amplitude threshold and the duration not exceeding a preset duration threshold. Within the test window, determine the direction of change of the output voltage and the output of the error amplifier. If the direction is consistent and tends to stabilize, it is determined to be a false alarm due to interference. If the direction is inconsistent or divergent, it is determined to be a real fault. When the temperature rise slope exceeds the preset temperature rise threshold or the input bus voltage surge exceeds the preset voltage threshold, the test should be terminated immediately and the protection level upgraded. The trial type, step size, duration, and decision result are written into the event fingerprint record.

6. The anti-interference type DC-DC power supply protection method according to claim 5, characterized in that: The specific process of state machine transition is as follows: After the fault triggering condition is determined to be a real fault through reversibility testing, it enters the suppression stage. When a valid event does not disappear or the number of recurrences reaches a preset occurrence threshold within the observation sub-window, the process transitions from the suppression level to the soft shutdown level. After the soft shutdown stage is completed and energy transfer is exited with a controlled slope, it will migrate to the isolation stage when a valid event or bus health indicator becomes abnormal again in the observation sub-window. When the temperature rise slope exceeds the preset temperature rise threshold, it will directly migrate to the isolation level; a recording operation will be performed for each migration and the next window monitoring will be started.

7. The anti-interference type DC-DC power supply protection method according to claim 6, characterized in that: Based on the test results, the process transitions within the state machine comprised of the suppression stage, soft shutdown stage, and isolation stage. This involves executing current limiting foldback and duty cycle slope control, exiting energy transfer and output pre-discharge with a controlled slope, or high-side drive prohibition and disconnection from the front-end electronic switch, and recording event information. The specific process is as follows: The suppression stage performs current limiting and turn-off, synchronous rectification early shutdown, and duty cycle slope control, ensuring that the disturbance budget does not exceed the preset upper limit. The soft-shutdown stage exits energy transfer at a controlled slope and performs pre-discharge at the output terminal. After the bus health indicator is restored, it enters the observation sub-window. The isolation level prevents high-side driving or disconnection of the front-end electronic switch and remains locked. All three levels generate protection records, recording the entry time, exit time, triggering conditions, and bus health indicators. If any action causes a decrease in stability, the current action is terminated and the protection level is moved up one level.

8. The anti-interference type DC-DC power supply protection method according to claim 1, characterized in that: During the recovery phase, the residual bias voltage at the output terminal is identified, and a soft-start curve with pre-bias identification is selected. A backoff ladder approach is used for retrying, as detailed below: Before recovery, detect the residual bias voltage at the output terminal and select a soft-start curve with pre-bias recognition; Resumption and retry are arranged according to the retreat ladder, and the ladder interval is set by the parameter table and increases with the number of failures; During startup, the system continuously matches the warning chains of danger. If a match is found, the startup is paused and the system is rolled back one level. After startup, enter the observation sub-window. If there are no valid events and the bus health indicator is normal, exit the recovery process. The start-up curve, step count, and precursor matching results of the entire recovery phase are written into the event fingerprint record.

9. The anti-interference type DC-DC power supply protection method according to claim 1, characterized in that: Simultaneously, based on event fingerprint records, online small-step self-tuning is performed within boundary constraints on blank time, sampling phase, current limiting backoff upper and lower limits, and soft shutdown slope. If stability decreases, automatic rollback is initiated. The specific process is as follows: Based on event fingerprint records, the trigger channel, segment duration, phase relationship, and probing response direction are statistically analyzed. When the proportion of false alarms exceeds the preset false alarm threshold during the observation period, the leading edge blank time is increased or the sampling phase is adjusted. When the suppression level does not converge within the observation sub-window, adjust the upper limit of current limiting backoff, the lower limit of current limiting backoff, or the soft shutdown slope. All adjustments are subject to boundary boxes and rollback conditions. If stability decreases after any adjustment, the system will roll back to the previous stable configuration.

10. An anti-interference DC-DC power supply protection system, used to implement the anti-interference DC-DC power supply protection method according to any one of claims 1-9, characterized in that, include: The link data acquisition module is used to set the leading edge blank time in the current and voltage sampling link by using a four-terminal Kelvin connection and an independent sensing ground loop, and to adjust the blank time according to the rising trend of inductor current, duty cycle and device temperature. It performs running length segment filtering on the input signal of comparator or analog-to-digital converter, and locks the sampling phase to the current trough or output voltage stable region. The fault trigger determination module is used to perform timing alignment of the gate drive state, current slope, error amplifier output and output voltage ripple phase within the time window formed by adjacent switching cycles, determine valid events through Boolean rule chain, and confirm the fault trigger condition after reaching a preset number of occurrences. The protection-limited module is used to perform trial current limiting or frequency foldback with limited amplitude and duration after the fault triggering conditions are confirmed. It monitors whether the output voltage and error amplifier output converge towards the stable direction. If abnormal temperature rise or bus backlash occurs, the trial is terminated and the protection level is upgraded. The state transition module is used to transition between the state machine consisting of the suppression stage, soft shutdown stage and isolation stage according to the test results, and respectively perform current limiting backoff and duty cycle slope control, exit energy transfer and output pre-discharge with controlled slope, or high-side drive prohibition and front-end electronic switch disconnection operation, and record event information. The output debugging module is used to identify the residual bias voltage at the output terminal during the recovery phase and select a soft-start curve with pre-bias identification. It retryes using a backoff ladder method. At the same time, based on the event fingerprint record, it performs online small-step self-tuning of blank time, sampling phase, current limiting backoff upper and lower limits and soft turn-off slope within the boundary constraints. If the stability decreases, it automatically rolls back.

Images