Redundant power supply control method for new energy vehicles

Abstract

This invention discloses a redundant power supply control method for new energy vehicles, aiming to solve the problem that a single-path DC-DC power supply failure can easily lead to a complete vehicle power outage. Based on a hardware architecture of dual-path DC-DC, dual low-voltage lithium batteries, and dual intelligent power distribution boxes, this invention monitors the output status of the main DC-DC, the operating status of the main intelligent power distribution box, and the power supply status of critical loads in real time. When a fault is detected in the main power supply path, an isolation operation is immediately performed to disconnect the faulty path and activate the redundant DC-DC and redundant intelligent power distribution boxes to take over power supply for preset safe loads. By introducing a cross-monitoring and rapid switching mechanism for redundant paths, this invention achieves millisecond-level seamless switching of power supply failures, significantly improving the power supply reliability of safety-critical systems such as autonomous driving and ensuring driving safety.

Description

Technical Field

[0001] This invention relates to the field of electric control technology for new energy vehicles, and in particular to a redundant power supply control method for new energy vehicles to ensure power supply for autonomous driving and safety-critical systems. Background Technology

[0002] With the development of vehicle electrification and intelligence, especially the introduction of advanced autonomous driving technology, vehicles have placed unprecedentedly high demands on the reliability and functional safety of their power supply systems.

[0003] Traditional power supply solutions, whether using a single DC-DC converter and a single battery or a single DC-DC converter and dual batteries, suffer from a core bottleneck: the DC-DC converter itself is a single point of failure. Once the DC-DC converter fails, the vehicle can only rely on the battery for short-term power. Due to the limited battery capacity, it cannot support prolonged vehicle operation, especially in energy-intensive autonomous driving modes. The vehicle will quickly lose power or experience failures in safety systems such as steering and braking, leading to serious safety risks.

[0004] Although there are backup solutions in the industry that use dual batteries or complex power distribution networks, most of them fail to fundamentally solve the problems of seamless switching and accurate load isolation and reconstruction after a single point of failure in DC-DC converters. The switching process has excessively long power interruption time and cannot meet the requirements of high-level functional safety levels such as ASIL D. Summary of the Invention

[0005] In view of the above, the present invention aims to provide a redundant power supply control method for new energy vehicles, so as to overcome the defects in the prior art where the power supply reliability of the whole vehicle is insufficient due to the single point failure of DC-DC converter, and the inability to provide continuous and stable power supply for safety-critical systems.

[0006] The technical solution adopted in the invention is based on a dual-path hardware redundancy architecture, which uses a set of intelligent control logic to achieve real-time monitoring of the power supply path, accurate fault location, rapid isolation, and seamless takeover of the redundant path.

[0007] Specifically, this invention discloses a redundant power supply control method for new energy vehicles, applied to a redundant power supply system. The system includes two sets of power supply units that are structurally and functionally completely symmetrical: a first DC-DC converter, a second DC-DC converter, a first low-voltage lithium battery, a second low-voltage lithium battery, a first intelligent power distribution box, and a second intelligent power distribution box. Their connection relationship is as follows: the output terminal of the first DC-DC converter is connected to the input terminal of the first intelligent power distribution box, and the output terminal of the second DC-DC converter is connected to the input terminal of the second intelligent power distribution box; the first low-voltage lithium battery is connected to the battery port of the first intelligent power distribution box, and the second low-voltage lithium battery is connected to the battery port of the second intelligent power distribution box. The two intelligent power distribution boxes are responsible for supplying power to different groups of safe loads; for example, the first intelligent power distribution box supplies power to a first type of safe load, and the second intelligent power distribution box supplies power to a second type of safe load.

[0008] The core control method of this invention includes the following steps:

[0009] The system continuously acquires the first output voltage and first output current values ​​of the first DC-DC converter, as well as the second output voltage and second output current values ​​of the second DC-DC converter. Simultaneously, it acquires the first circuit status information of each first power supply circuit within the first intelligent power distribution box, and the second circuit status information of each second power supply circuit within the second intelligent power distribution box. This information is collected and reported in real time by the EFUSE and intelligent MOSFET driver chips within the intelligent power distribution box.

[0010] Based on the acquired operational data, the system determines whether a fault exists in the main power supply path, which typically consists of a first DC-DC converter and a first intelligent distribution box. The diagnostic logic does not rely on a single threshold judgment but employs a multi-dimensional fusion strategy. For example, if the first output voltage value is lower than a preset first voltage threshold (e.g., 11V) for a first preset time (e.g., 50ms), or the first output current value is higher than a first current threshold (e.g., overcurrent protection point) for a second preset time, then a preliminary judgment is made that the first DC-DC converter is faulty. Simultaneously, this is combined with overcurrent or short-circuit fault signals reported by the first intelligent distribution box regarding a critical power supply circuit. If both the DC-DC converter fault and the power distribution circuit fault conditions are met, then a final judgment is made that a serious fault has occurred in the main power supply path, requiring switching.

[0011] Once a fault is detected in the main power supply path, the system immediately generates a fault isolation signal. This signal is sent to the first DC-DC converter, instructing it to stop power output; and to the first intelligent power distribution box, instructing the first battery isolation switch connected in series with the first low-voltage lithium battery circuit to quickly disconnect, and instructing the first load power distribution switch connected in series with each of the first-class safety load circuits to disconnect, thereby physically isolating the entire faulty main power supply path from the vehicle's electrical network and preventing the fault from spreading.

[0012] Simultaneously with issuing the isolation signal, the system activates redundant power supply paths, including a second DC-DC converter and a second intelligent power distribution box. Based on a preset strategy and the current status of the second circuit, the second intelligent power distribution box closes the power supply circuit corresponding to the second type of safety loads, providing continuous and stable power to these loads via the second DC-DC converter or in conjunction with the second low-voltage lithium battery. Thus, power supply to critical safety loads is maintained, allowing the vehicle to continue driving safely or perform the limp-home function.

[0013] In at least one other possible implementation, the state of the second low-voltage lithium battery is checked before activating the redundant power supply path. Its state of charge (SOC) and health status are obtained, and the redundant power supply path is only confirmed to be fully activated if both the SOC value is above a charge threshold (e.g., SOC > 20%) and the health status value is above a health threshold (e.g., SOH > 80%), thus ensuring the reliability of the redundant path itself.

[0014] In at least one other possible implementation, in redundant power supply mode, the system continuously monitors the output voltage of the second DC-DC converter. If its output voltage is found to be lower than a second voltage threshold, it indicates that the second DC-DC converter may be overloaded or its performance may be degraded. At this time, a battery replenishment control signal is generated to control the second intelligent power distribution box to connect the second low-voltage lithium battery into the circuit, forming a dual-source power supply mode of DC-DC + battery, providing support for peak loads and ensuring power supply stability.

[0015] In addition, the present invention also includes a fault recovery mechanism: when the fault of the main power supply path is eliminated, the system receives a reset signal and first performs a pre-charge check on the main power supply path to prevent direct connection from causing an impact; after the check passes, the load power supply is smoothly switched from the redundant path back to the main path to achieve a disturbance-free recovery.

[0016] Compared to existing technologies, this invention eliminates the impact of a single-point DC-DC failure on the vehicle's power supply by employing a physically independent dual-path DC-DC converter and intelligent power distribution box design, combined with cross-monitoring and rapid isolation control methods. Based on the real-time status monitoring of the intelligent power distribution box and the cooperation of high-speed solid-state switches, fault isolation and redundant path activation can be completed within milliseconds, meeting the stringent power supply continuity requirements of high-functionality safety systems such as autonomous driving. Especially in redundant mode, it can intelligently coordinate the energy output of the DC-DC converter and battery, ensuring the power supply quality of critical loads and enabling automatic reconnection after fault recovery, thus improving the system's intelligence level and user experience. Attached Figure Description

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described below with reference to the accompanying drawings, wherein:

[0018] Figure 1 A flowchart illustrating the redundant power supply control method for new energy vehicles provided in an embodiment of the present invention. Detailed Implementation

[0019] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0020] Those skilled in the art will understand that the specific embodiments of the present invention are based on a hardware architecture, which mainly includes two completely independent power supply channels: channel A and channel B.

[0021] Channel A consists of a first DC-DC converter powered by a high-voltage power battery, a first low-voltage lithium battery (such as 12V Li-ion or lead-acid), and a first intelligent power distribution box (IDU-F). The first intelligent power distribution box integrates multiple intelligent electronic fuses and power MOSFET switches, which are connected to several Class I safety loads, such as intelligent forward-looking camera modules and left front wheel brake actuators.

[0022] Channel B consists of a second DC-DC converter powered by the same high-voltage power battery, a second low-voltage lithium battery, and a second intelligent power distribution box (IDU-R). The second intelligent power distribution box also integrates multiple intelligent electronic fuses and power MOSFET switches, which are connected to several Class II safety loads, such as intelligent rearview camera modules and right front wheel brake actuators.

[0023] The first and second types of loads here are functionally redundant backups for performing the same task (such as environmental perception and vehicle braking).

[0024] Under the above embodiments, the vehicle's core controller, such as a domain controller or a dedicated functional safety controller, executes the following control method, such as... Figure 1 As shown, it mainly includes:

[0025] Step S1: Obtain the first output voltage value and the first output current value of the first DC-DC converter, and the second output voltage value and the second output current value of the second DC-DC converter;

[0026] Step S2: Obtain the first circuit status information of each first power supply circuit in the first intelligent power distribution box, and the second circuit status information of each second power supply circuit in the second intelligent power distribution box;

[0027] Step S3: Based on the first output voltage value, the first output current value and the first circuit status information, determine whether there is a fault in a main power supply path. The main power supply path includes the first DC-DC converter and the first intelligent power distribution box.

[0028] Step S4: If a fault is determined in the main power supply path, a fault isolation signal is generated. The fault isolation signal is used to control the first DC-DC converter in the main power supply path to stop outputting and to disconnect the electrical connection between the first intelligent power distribution box and the first low-voltage lithium battery and the first type of safety load.

[0029] Step S5: In response to the generation of the fault isolation signal, activate a redundant power supply path, which includes a second DC-DC converter and a second smart distribution box, so that the second smart distribution box supplies power to the second type of safe load based on the second circuit status information.

[0030] Based on the above method implementation examples, a typical fault switching process example is provided here for implementation reference:

[0031] The core controller periodically receives data on the output voltage (14.2V) and current (60A) of the first DC-DC converter via CAN / CANFD or Ethernet, with a period of 10ms. It also receives data on the current (5A) and status (normal) of its power supply circuit 1 (connected to the front-view camera) from the first intelligent power distribution box. Simultaneously, it also receives data from the second channel, all of which are displayed as normal.

[0032] At a certain moment, due to internal aging, the output voltage of the first DC-DC converter suddenly dropped to 9V. The core controller detected that this voltage was lower than the preset first voltage threshold (10.5V) and remained there for 60ms (exceeding the first preset time of 50ms), initially determining that the first DC-DC converter had failed. Almost simultaneously, the first intelligent distribution box reported that the current in circuit 1 had abnormally increased to 50A, far exceeding the rated value, and triggered the overcurrent protection.

[0033] The core controller, considering both the DC-DC undervoltage and power distribution overcurrent events, confirms a serious fault in the main power supply path (channel A). It then generates a fault isolation signal, shutting down the enable terminal of the first DC-DC converter via a dedicated hardwired connection or communication command. Simultaneously, it instructs the first intelligent power distribution box to disconnect all MOSFETs connected to the load and battery. At the same time, the core controller sends an activation command to the second intelligent power distribution box, which quickly closes the power supply circuit to the second type of safety load (rearview camera, right front wheel brake, etc.).

[0034] The entire switching process was completed within 100ms. The vehicle's autonomous driving system detected the failure of the front-view camera, but the rear-view camera immediately took over the perception task. Although the left front wheel braking was affected, the right front wheel braking remained effective, and the vehicle was still able to maintain basic lateral and longitudinal control, safely driving away or parking on the side of the road.

[0035] Furthermore, based on the above method embodiments, an example of a battery replenishment process in redundancy mode is provided here for implementation reference:

[0036] After the redundant power supply path is activated, the vehicle enters limp mode. At this time, the second DC-DC converter supplies power to all connected Category 2 safety loads independently. If the driver performs emergency steering and braking at this time, the instantaneous power demand increases significantly, causing the output voltage of the second DC-DC converter to drop from 13.8V to 10.5V, below the set second voltage threshold (11.5V). The core controller detects this drop and immediately sends a battery replenishment control signal to the second intelligent power distribution box. Upon receiving the signal, the second intelligent power distribution box immediately closes its internal second battery isolation switch, connecting the second low-voltage lithium battery in parallel with the output of the second DC-DC converter. The battery provides instantaneous peak power, rapidly raising the bus voltage to above 12V, ensuring stable operation of the steering and braking systems. After the peak power subsides, the system can decide whether to disconnect the battery connection based on its strategy.

[0037] Finally, it can be added that, based on the above method embodiments, a fault recovery process example is provided here for implementation reference:

[0038] The vehicle returned to the repair shop, where technicians replaced the faulty first DC-DC converter. The fault codes were cleared using a diagnostic tool, and a system reset signal was sent. Upon receiving the reset signal, the core controller did not immediately switch the load back. Instead, it first controlled the first intelligent power distribution box to close the switch at its input terminal (connected to the first DC-DC converter) and pre-charged the first DC-DC converter to smooth the voltage of the capacitors inside the first intelligent power distribution box. After pre-charging, the core controller controlled the first intelligent power distribution box to gradually close the switches connected to the first type of safe loads, while simultaneously instructing the second intelligent power distribution box to disconnect the backup circuits of these loads accordingly. This achieved a smooth load transfer, and the system returned to normal dual-path operation.

[0039] In this invention, when directional terms are mentioned, they are relative concepts based on the embodiments. Furthermore, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0040] The above description of the structure, features, and effects of the present invention is based on the embodiments shown in the figures. However, the above are only preferred embodiments of the present invention. It should be noted that the technical features involved in the above embodiments and their preferred methods can be reasonably combined and matched by those skilled in the art to form a variety of equivalent solutions without departing from or changing the design concept and technical effects of the present invention. Therefore, the present invention is not limited to the scope of implementation shown in the figures. Any changes made in accordance with the concept of the present invention, or modifications to equivalent embodiments, that do not exceed the spirit covered by the specification and figures, should be within the protection scope of the present invention.

Claims

1. A redundant power supply control method for new energy vehicles, characterized in that, An application is made in a redundant power supply system, the system comprising: a first DC-DC converter, a second DC-DC converter, a first low-voltage lithium battery, a second low-voltage lithium battery, a first intelligent power distribution box, and a second intelligent power distribution box; wherein, the output terminal of the first DC-DC converter is connected to the input terminal of the first intelligent power distribution box, and the output terminal of the second DC-DC converter is connected to the input terminal of the second intelligent power distribution box; the first low-voltage lithium battery is connected to the battery port of the first intelligent power distribution box, and the second low-voltage lithium battery is connected to the battery port of the second intelligent power distribution box; the first intelligent power distribution box is provided with a first power supply circuit for supplying power to a first type of safe load, and the second intelligent power distribution box is provided with a second power supply circuit for supplying power to a second type of safe load; The control method specifically includes: Obtain the first output voltage value and the first output current value of the first DC-DC converter, and the second output voltage value and the second output current value of the second DC-DC converter; Obtain the first circuit status information of each first power supply circuit in the first smart power distribution box, and the second circuit status information of each second power supply circuit in the second smart power distribution box; Based on the first output voltage value, the first output current value and the first circuit status information, it is determined whether there is a fault in a main power supply path, wherein the main power supply path includes the first DC-DC converter and the first smart distribution box. If a fault is determined in the main power supply path, a fault isolation signal is generated. The fault isolation signal is used to control the first DC-DC converter in the main power supply path to stop outputting and to disconnect the electrical connection between the first smart power distribution box and the first low-voltage lithium battery and the first type of safety load. In response to the generation of the fault isolation signal, a redundant power supply path is activated, the redundant power supply path including the second DC-DC converter and the second smart distribution box, so that the second smart distribution box supplies power to the second type of safe load based on the second circuit status information.

2. The redundant power supply control method for new energy vehicles according to claim 1, characterized in that, The steps to determine if there is a fault in the main power supply path include: The first output voltage value is compared with a first voltage threshold, and the first output current value is compared with a first current threshold; If the first output voltage value is lower than the first voltage threshold and continues for a first preset time, or the first output current value is higher than the first current threshold and continues for a second preset time, then the first DC-DC converter is preliminarily determined to be faulty. Obtain the overcurrent or short-circuit fault signal reported by the first intelligent power distribution box regarding the first power supply circuit; If the first DC-DC converter is determined to be faulty and the overcurrent or short-circuit fault signal is obtained at the same time, then it is finally determined that there is a fault in the main power supply path.

3. The redundant power supply control method for new energy vehicles according to claim 1, characterized in that, The step of disconnecting the electrical connection between the first intelligent power distribution box and the first low-voltage lithium battery and the first type of safety load specifically includes: Send a first control command to the first intelligent power distribution box. The first control command is used to control the first battery isolation switch in the circuit connected in series with the first low-voltage lithium battery inside the first intelligent power distribution box to open, and to control the first load power distribution switch in the circuit connected in series with each of the first type of safety loads to open.

4. The redundant power supply control method for new energy vehicles according to claim 1, characterized in that, Before activating a redundant power supply path, the following is also included: Obtain the state of charge and state of health values ​​of the second low-voltage lithium battery; Determine whether the state of charge value is higher than a charge threshold and whether the health status value is higher than a health threshold; If all values ​​are higher than the corresponding threshold, then the redundant power supply path is confirmed to meet the activation conditions.

5. The redundant power supply control method for new energy vehicles according to claim 1, characterized in that, After the redundant power supply path is activated, it also includes: Continuously monitor the second output voltage value of the second DC-DC converter; If the second output voltage value is lower than a second voltage threshold, a battery replenishment control signal is generated. The battery replenishment control signal is used to control the second intelligent power distribution box to connect the second low-voltage lithium battery so that it can work with the second DC-DC converter to supply power to the second type of safe load.

6. The redundant power supply control method for new energy vehicles according to claim 1, characterized in that, The control method further includes: After the main power supply path fault is cleared, a system reset signal is received; Based on the system reset signal, a pre-charge check is performed on the main power supply path; If the pre-charge check passes, the main power supply path is reconnected, and the power supply for the second type of safety load is gradually switched back to the main power supply path without disturbance from the redundant power supply path.

7. The redundant power supply control method for new energy vehicles according to any one of claims 1 to 6, characterized in that, The first type of safety load and the second type of safety load are key actuators in the autonomous driving domain controller, steering system or braking system, and the first type of safety load and the second type of safety load are functionally identical and redundant load groups.

8. The redundant power supply control method for new energy vehicles according to any one of claims 1 to 6, characterized in that, The first circuit status information and the second circuit status information include the voltage, current, temperature of each power supply circuit, and the blown state of the corresponding electronic fuse or the on / off state of the power MOSFET.

Images