A functional safety-oriented fault-tolerant power supply system and control method for electric vehicles

Abstract

This invention discloses a fault-tolerant power supply system and control method for electric vehicles oriented towards functional safety, relating to the field of electric vehicle control technology. It includes: a state monitoring module; a failure determination module; a fault-tolerant switching module; a voltage monitoring module; and a graded unloading module. This invention introduces aging characteristic parameters such as AC internal resistance, reflecting the internal health state of the battery. It identifies failure trends and actively isolates faulty units before the battery's electrical performance is completely lost and the vehicle's safety functions are interrupted, while simultaneously connecting heterogeneous redundant power supplies with uncorrelated failure modes. This mechanism shifts the functional safety boundary from "fault tolerance" to "fault prediction," fundamentally avoiding the risk of instantaneous loss of core safety functions due to sudden failure of the front-end energy storage unit. Through the heterogeneous redundancy design of the first energy storage unit and the second power generation unit, their failure modes are physically uncorrelated, eliminating the systemic defect of the backup battery as a single point of failure in traditional dual-power architectures.

Description

Technical Field

[0001] This invention relates to the field of electric vehicle control technology, specifically to a fault-tolerant power supply system and control method for electric vehicles oriented towards functional safety. Background Technology

[0002] The evolution of electrical safety for light electric vehicles such as electric two-wheelers and three-wheelers shows a significant gap, and existing technical solutions all have systemic defects: First-generation technology (single wiring harness architecture): This technology is still widely used in many vehicle models. It uses a single power battery and supplies power to all electrical equipment, including controllers, lighting fixtures, and drive motors, through a thick wiring harness that runs through the vehicle's dashboard. This wiring harness is prone to insulation damage due to long-term vibration and wear, causing the positive power conductor to come into direct contact with the common negative conductor (or the vehicle body), creating a continuous high-current short circuit. This can lead to overheating, fire, or even explosion of the wiring harness. This constitutes a fundamental physical risk in the "energy transmission path."

[0003] Second-generation technology (dual-power isolation architecture): To eliminate the short-circuit risk of the first-generation technology, the industry proposed adding an independent backup battery at the front end. By physically isolating the high and low voltage networks, the risk of short circuits in the main power lines is fundamentally eliminated. However, while solving the physical connection risk, this solution relies on the absolute reliability of a single chemical energy storage unit (backup battery) for the power supply continuity of all safety functions. As a chemical device, this battery is subject to objective and unavoidable risks of cell performance degradation, internal connection deterioration, and even open circuits under long-term vehicle vibration, temperature changes, and natural aging conditions. Once this single front-end energy storage unit fails, all core safety functions such as lighting and warnings will instantly fail, causing the vehicle to lose its passive safety warning capabilities in the event of an accident or malfunction, posing a serious risk of secondary injury. This essentially constitutes a new, non-redundant single point of failure, becoming the core contradiction in achieving high-level functional safety under this architecture.

[0004] In response to this, this application proposes a fault-tolerant power supply system and control method for electric vehicles with functional safety in order to solve the above problems. Summary of the Invention

[0005] The purpose of this invention is to provide a fault-tolerant power supply system and control method for electric vehicles oriented towards functional safety, so as to solve the systemic defects in the prior art. The core objective of this invention is to shift from the traditional idea of ​​"preventing failures" to a fault-tolerant design paradigm that "allows component failures without affecting safety functions".

[0006] To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, this application provides a fault-tolerant power supply system for electric vehicles oriented towards functional safety, comprising: The status monitoring module is used to acquire aging characteristic parameters of the first energy storage unit that supplies power to the low-voltage safety network and obtain health status data. The failure determination module is used to compare the health status data with preset failure conditions to obtain a failure determination result. The fault-tolerant switching module is used to hard disconnect the first energy storage unit from the power supply circuit before the electrical performance of the first energy storage unit is completely lost when the failure determination result indicates that the first energy storage unit meets the failure conditions, and connect the second power generation unit to supply power to the low-voltage safety network, thereby obtaining switching execution data. The voltage monitoring module is used to collect the bus voltage of the low-voltage safety network and obtain voltage monitoring data during the period when the switching execution data indicates that the power is supplied by the second power generation unit; The graded unloading module is used to compare the voltage monitoring data with the maintenance threshold. When the voltage monitoring data is lower than the maintenance threshold, the graded unloading control is activated to disconnect non-core safety loads in sequence and obtain unloading execution data to prioritize the power supply of core safety loads.

[0007] Furthermore, the status monitoring module also includes: During the measurement window when the vehicle is stationary and the low-voltage safety network is under light load, an AC test current signal of a preset frequency is injected into the first energy storage unit. The terminal voltage response of the first energy storage unit under the excitation of the AC test current signal is measured, and the AC internal resistance value is calculated based on the AC test current signal and the terminal voltage response. The AC internal resistance value is used as the health status data.

[0008] Furthermore, the failure determination module further includes: The AC internal resistance value is compared with a preset internal resistance failure threshold, or the terminal voltage of the first energy storage unit is compared with a preset voltage failure threshold. When the AC internal resistance value is greater than or equal to the internal resistance failure threshold, or the terminal voltage is less than or equal to the voltage failure threshold, a failure determination result indicating that the first energy storage unit is about to fail is generated.

[0009] Furthermore, the fault-tolerant switching module includes: The first switch control unit is used to generate a first switch control signal to control the switching device connected to the first energy storage unit to disconnect, so that the loop current between the first energy storage unit and the low-voltage safety network is blocked to below the microampere level, and isolation status data is obtained. The second switch control unit is used to generate a second switch control signal to control the switching device connected to the second power generation unit, so as to connect the electrical energy generated by the second power generation unit to the low-voltage safety network and obtain redundant power supply status data.

[0010] Furthermore, the system also includes: The collaborative charging module includes: When the failure determination result indicates that the first energy storage unit does not meet the failure conditions, the terminal voltage of the first energy storage unit, the vehicle driving status, and the output voltage of the second power generation unit are obtained to obtain the collaborative charging condition data. When the collaborative charging condition data indicates that the terminal voltage is lower than the first charging threshold, the vehicle is in motion, and the output voltage is higher than the terminal voltage, a charging control command is generated to control the second power generation unit to charge the first energy storage unit with a limited current while supplying power to the low-voltage safety network.

[0011] Furthermore, the collaborative charging module also includes: When the terminal voltage of the first energy storage unit rises back to above the second charging threshold, a stop charging command is generated, wherein the second charging threshold is greater than the first charging threshold. The defined current is a trickle current of no more than 0.5A, or a current with a multiplier of 0.1C to 0.2C.

[0012] Furthermore, the tiered unloading module also includes: When the bus voltage is lower than the first voltage threshold and remains below the first preset time, a first-level unload instruction is generated, which is used to turn off the headlight high beam load. If the bus voltage is still lower than the maintenance threshold after the first-level unload instruction is generated, a second-level unload instruction is generated after a second preset time. The second-level unload instruction is used to turn off the speaker load. If the bus voltage is still lower than the maintenance threshold after the second-level unload command is generated, a third-level unload command is generated after a third preset time. The third-level unload command is used to shut down all non-core lighting loads, leaving only the hazard warning lights and the positioning module.

[0013] Furthermore, the system also includes a communication fault-tolerant module, which includes: Monitor the communication status of the battery management chip associated with the first energy storage unit to obtain communication link status data; When the communication link status data indicates a communication interruption and the vehicle speed is greater than zero, a conservative switching command is generated to directly connect the second power generation unit to supply power to the low-voltage safety network.

[0014] Furthermore, the system also includes a sleep / wake-up module, which includes: When the vehicle speed is detected to be zero and the bus voltage continues to drop below the cutoff voltage, a sleep command is generated. The sleep command is used to cut off all loads and retain only the low-power wake-up circuit. When an ignition signal or a charging access signal is detected by the low-power wake-up circuit, a wake-up command is generated to reactivate the first energy storage unit or the second power generation unit into the standard power supply mode.

[0015] Secondly, this application provides a control method for a fault-tolerant power supply system for electric vehicles oriented towards functional safety, employing the system described in the first aspect and performing the following steps: The aging characteristic parameters of the first energy storage unit that supplies power to the low-voltage safety network are obtained to obtain health status data; The health status data is compared with preset failure conditions to obtain a failure determination result; When the failure determination result indicates that the first energy storage unit meets the failure conditions, the first energy storage unit is hard disconnected from the power supply circuit before its electrical performance is completely lost, and the second power generation unit is connected to supply power to the low-voltage safety network. During the period when the power is supplied by the second power generation unit, the bus voltage of the low-voltage safety network is collected to obtain voltage monitoring data; The voltage monitoring data is compared with the maintenance threshold. When the voltage monitoring data is lower than the maintenance threshold, a graded unloading control is initiated to disconnect non-core safety loads in sequence, so as to prioritize the power supply to the core safety loads.

[0016] Compared with existing technologies, this invention provides a fault-tolerant power supply system and control method for electric vehicles oriented towards functional safety. By introducing aging characteristic parameters such as AC internal resistance, which reflect the internal health state of the battery, this invention identifies failure trends and proactively isolates faulty units before the battery's electrical performance is completely lost and the vehicle's safety functions are interrupted. Simultaneously, it seamlessly connects to heterogeneous redundant power supplies whose failure modes are unrelated. This mechanism shifts the functional safety boundary from "fault tolerance" to "fault prediction," fundamentally avoiding the risk of instantaneous loss of core safety functions due to sudden failure of the front-end energy storage unit. By employing a heterogeneous redundancy design between the first energy storage unit (chemical battery) and the second power generation unit (mechanical-to-electrical energy conversion device), the failure modes of the two units are physically independent, eliminating the systemic defect of the backup battery as a single point of failure in traditional dual-power architectures. Building upon this, a multi-level response mechanism of "normal-coordination-emergency-degradation-minimum safety" is further established. When redundant power supply capacity is insufficient, the system automatically performs tiered offloading, sequentially cutting off non-core loads and prioritizing the protection of core safety loads such as brake lights, turn signals, and hazard warning lights with limited power. This defense-in-depth system ensures that the vehicle still possesses basic passive safety warning capabilities under the most extreme operating conditions, achieving the ultimate goal of fail-safe safety. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 A block diagram of a fault-tolerant power supply system for electric vehicles oriented towards functional safety is provided in an embodiment of the present invention. Figure 2 This is a system overall architecture block diagram provided for embodiments of the present invention; Figure 3 A schematic diagram of a hybrid power supply device (hub generator) provided in an embodiment of the present invention; Figure 4 This is a general flowchart of the fault-tolerant control method provided in the embodiments of the present invention; Figure 5 This is a system operating mode state transition diagram provided in an embodiment of the present invention; Figure 6 This is a timing diagram of the hierarchical uninstallation procedure provided in an embodiment of the present invention; Figure 7 This is a hardware connection diagram provided for an embodiment of the present invention; Figure 8 A flowchart of a control method for a functionally safe fault-tolerant power supply system for electric vehicles is provided in an embodiment of the present invention. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0020] As attached Figure 1 As shown:

[0021] Example 1

[0022] A fault-tolerant power supply system for electric vehicles oriented towards functional safety includes: The status monitoring module is used to acquire aging characteristic parameters of the first energy storage unit that supplies power to the low-voltage safety network and obtain health status data. Specifically, the status monitoring module also includes: During the measurement window when the vehicle is stationary and the low-voltage safety network is under light load, an AC test current signal of a preset frequency is injected into the first energy storage unit. The terminal voltage response of the first energy storage unit under the excitation of the AC test current signal is measured, and the AC internal resistance value is calculated based on the AC test current signal and the terminal voltage response. The AC internal resistance value is used as the health status data. Furthermore, the condition monitoring module serves as the data acquisition front-end for the system to achieve predictive fault tolerance. The first energy storage unit refers to a chemical energy storage device that independently supplies power to the low-voltage safety network, typically a lithium iron phosphate battery or a lead-acid battery, acting as the main power source for the low-voltage network. Aging characteristic parameters are physical quantities that characterize the degree of health degradation within the energy storage unit. Unlike traditional instantaneous state quantities such as voltage and current, these parameters include, but are not limited to, AC internal resistance, impedance at characteristic frequency points of electrochemical impedance spectroscopy, or strain of the battery casing.

[0023] The condition monitoring module actively injects test excitation (such as 1kHz AC current) into the energy storage unit during a preset measurement window (such as when the vehicle is stationary and under light load) and measures its response, thereby calculating aging characteristic parameters reflecting its internal state. Health status data is the quantified result of these raw measurements after processing, used for subsequent failure determination.

[0024] The failure determination module is used to compare the health status data with preset failure conditions to obtain a failure determination result. Specifically, the failure determination module further includes: The AC internal resistance value is compared with a preset internal resistance failure threshold, or the terminal voltage of the first energy storage unit is compared with a preset voltage failure threshold. When the AC internal resistance value is greater than or equal to the internal resistance failure threshold, or the terminal voltage is less than or equal to the voltage failure threshold, a failure determination result characterizing the first energy storage unit is about to fail is generated. Furthermore, the failure determination module undertakes the core logical judgment function of transforming physical measurement data into decision-making basis. The preset failure conditions are a set of thresholds pre-calibrated based on the chemical system, nominal parameters, and functional safety targets of the first energy storage unit. They are not a single energy depletion threshold, but rather a multi-dimensional criterion covering the critical point of performance degradation.

[0025] For example, for a 12V lithium iron phosphate battery, an AC internal resistance ≥80mΩ or a terminal voltage ≤11.0V can be set as a failure condition. This module compares the health status data (such as the current AC internal resistance and terminal voltage) obtained from the status monitoring module with the above thresholds in real time.

[0026] The failure determination result does not only refer to the post-failure state of the energy storage unit being completely failed, but more importantly, it identifies the pre-failure critical state in which its performance has deteriorated to the point that it will be unable to reliably maintain the power supply to the core safe load, thereby providing a trigger signal for subsequent active fault-tolerant switching.

[0027] The fault-tolerant switching module is used to hard disconnect the first energy storage unit from the power supply circuit before the electrical performance of the first energy storage unit is completely lost when the failure determination result indicates that the first energy storage unit meets the failure conditions, and connect the second power generation unit to supply power to the low-voltage safety network, thereby obtaining switching execution data. Specifically, the fault-tolerant switching module includes: The first switch control unit is used to generate a first switch control signal to control the switching device connected to the first energy storage unit to disconnect, so that the loop current between the first energy storage unit and the low-voltage safety network is blocked to below the microampere level, and isolation status data is obtained. The second switch control unit is used to generate a second switch control signal, control the switching device connected to the second power generation unit to connect the electrical energy generated by the second power generation unit to the low-voltage safety network, and obtain redundant power supply status data. Furthermore, the fault-tolerant switching module is the actuator that enables the system to transition from a "fault tolerance" to a "fault prediction" paradigm. When the failure determination module outputs a result that meets the failure conditions, this module immediately initiates the switching process.

[0028] The critical time window of this invention is before the electrical performance is completely lost. This means that although the energy storage unit has experienced severe aging (such as a sharp increase in internal resistance), it still has residual electrical energy. The system utilizes this window period to perform seamless switching, avoiding the interruption of safety functions due to a complete power outage.

[0029] Hard disconnection refers to physically isolating the first energy storage unit from the power supply circuit by controlling power switching devices (such as MOSFETs, IGBTs, or relays), reducing the circuit current to below the microampere level, which is equivalent to disconnecting the wire.

[0030] The second power generation unit is a heterogeneous redundant power source whose failure mode is unrelated to that of the first energy storage unit, typically a hub generator or other mechanical-to-electrical energy conversion device. This module outputs switching execution data to record the switching status for subsequent modules to access.

[0031] The voltage monitoring module is used to collect the bus voltage of the low-voltage safety network and obtain voltage monitoring data during the period when the switching execution data indicates that the power is supplied by the second power generation unit; Furthermore, after the system enters emergency power supply mode, the voltage monitoring module undertakes the critical responsibility of real-time monitoring of power quality. The switching execution data provides contextual information about the current power supply mode. When this data indicates that the system has been taken over by the second power generation unit, the voltage monitoring module is activated and enters a high-frequency sampling state.

[0032] The bus voltage of a low-voltage safety network refers to the common bus voltage value that supplies power to core safety loads such as lighting, warning systems, and instruments. Its stability directly affects the normal operation of each safety function. This module continuously acquires this voltage value at millisecond intervals using a high-precision analog-to-digital converter to obtain voltage monitoring data.

[0033] This data not only reflects the power supply capacity of the second power generation unit under the current operating conditions, but also implies the total power consumption information on the load side, providing real-time and accurate input basis for the subsequent decision-making of the graded unloading module.

[0034] The graded unloading module is used to compare the voltage monitoring data with the maintenance threshold. When the voltage monitoring data is lower than the maintenance threshold, the graded unloading control is activated to disconnect non-core safety loads in sequence and obtain unloading execution data to prioritize the power supply of core safety loads. Specifically, the tiered unloading module also includes: When the bus voltage is lower than the first voltage threshold and remains below the first preset time, a first-level unload instruction is generated, which is used to turn off the headlight high beam load. If the bus voltage is still lower than the maintenance threshold after the first-level unload instruction is generated, a second-level unload instruction is generated after a second preset time. The second-level unload instruction is used to turn off the speaker load. After the second-level unload command is generated, if the bus voltage is still lower than the maintenance threshold, a third-level unload command is generated after a third preset time. The third-level unload command is used to shut down all non-core lighting loads, leaving only the hazard warning lights and the positioning module. Furthermore, the tiered offloading module is the last line of defense in the system's defense-in-depth system, ensuring that core safety functions are not interrupted under extreme operating conditions.

[0035] This module continuously acquires voltage monitoring data and dynamically compares it with a preset maintenance threshold (such as a bus voltage of 10.5V). When the voltage remains below this threshold, it indicates that the power supply capacity of the second power generation unit can no longer meet the current load demand.

[0036] At this point, the module initiates tiered unloading control, which sequentially disconnects "non-core safety loads" according to the importance of the load and the preset timing (e.g., first disconnecting the high beams of the headlights, then the horn, and finally the non-core lighting).

[0037] The "core safety loads" are those identified through functional safety analysis as essential for ensuring the safety of personnel and the vehicle in the event of a malfunction or accident. Examples include brake lights, turn signals, hazard warning lights, and positioning modules. The module ultimately outputs "unloading execution data," recording the execution status of unloading actions at each level. This ensures that, in the event of insufficient power supply, limited electrical energy is forcibly allocated to the most critical loads, achieving fail-safe safety.

[0038] Specifically, the system further includes: a collaborative charging module, the collaborative charging module comprising: When the failure determination result indicates that the first energy storage unit does not meet the failure conditions, the terminal voltage of the first energy storage unit, the vehicle driving status, and the output voltage of the second power generation unit are obtained to obtain the collaborative charging condition data. When the collaborative charging condition data indicates that the terminal voltage is lower than the first charging threshold, the vehicle is in motion, and the output voltage is higher than the terminal voltage, a charging control command is generated to control the second power generation unit to charge the first energy storage unit with a limited current while supplying power to the low-voltage safety network.

[0039] Specifically, the collaborative charging module also includes: When the terminal voltage of the first energy storage unit rises back to above the second charging threshold, a stop charging command is generated, wherein the second charging threshold is greater than the first charging threshold. The defined current is a trickle current of no more than 0.5A, or a current with a multiplier of 0.1C to 0.2C.

[0040] Specifically, the system further includes a communication fault-tolerant module, which includes: Monitor the communication status of the battery management chip associated with the first energy storage unit to obtain communication link status data; When the communication link status data indicates a communication interruption and the vehicle speed is greater than zero, a conservative switching command is generated to directly connect the second power generation unit to supply power to the low-voltage safety network.

[0041] Furthermore, the system also includes a sleep / wake-up module, which includes: When the vehicle speed is detected to be zero and the bus voltage continues to drop below the cutoff voltage, a sleep command is generated. The sleep command is used to cut off all loads and retain only the low-power wake-up circuit. When an ignition signal or a charging access signal is detected by the low-power wake-up circuit, a wake-up command is generated to reactivate the first energy storage unit or the second power generation unit into the standard power supply mode.

[0042] As can be seen from the above, this invention introduces aging characteristic parameters such as AC internal resistance, which reflect the internal health status of the battery, to identify failure trends and proactively isolate faulty units before the battery's electrical performance is completely lost and the vehicle's safety functions are interrupted. Simultaneously, it seamlessly connects to heterogeneous redundant power supplies whose failure modes are unrelated. This mechanism shifts the functional safety boundary from "fault tolerance" to "fault prediction," fundamentally avoiding the risk of instantaneous loss of core safety functions due to sudden failure of the front-end energy storage unit. By employing a heterogeneous redundancy design between the first energy storage unit (chemical battery) and the second power generation unit (mechanical-to-electrical energy conversion device), the failure modes of the two units are physically independent, eliminating the systemic defect of the backup battery as a single point of failure in traditional dual-power architectures. Building upon this, a multi-level response mechanism of "normal-coordination-emergency-degradation-minimum safety" is further established. When redundant power supply capacity is insufficient, the system automatically performs tiered offloading, sequentially cutting off non-core loads and prioritizing the protection of core safety loads such as brake lights, turn signals, and hazard warning lights with limited power. This defense-in-depth system ensures that the vehicle still possesses basic passive safety warning capabilities under the most extreme operating conditions, achieving the ultimate goal of fail-safe safety.

[0043] Example 2: Fault-tolerant power supply system for electric vehicles based on AC internal resistance prediction: like Figures 2-7 As shown, this embodiment provides a specific implementation of a fault-tolerant power supply system for functionally safe electric vehicles. The system architecture is as follows: Figure 1 As shown, its core lies in predictive failure determination by monitoring the AC internal resistance of the first energy storage unit, and proactively completing the redundancy switching and graded unloading of the power supply link before failure, so as to ensure that the core safety functions of the vehicle are not interrupted under any operating conditions.

[0044] 1. System hardware composition: In this embodiment, the electric vehicle power supply system includes an electrically isolated high-voltage drive network 100 and a low-voltage safety network 200. The high-voltage drive network 100 is powered by a 48V battery and is used to drive the hub motor. The low-voltage safety network 200 is an independent circuit with a nominal voltage of 12V, used to power the headlights, turn signals, taillights / brake lights, horn, instrument panel, and positioning module, wherein the headlights, turn signals, and taillights / brake lights are defined as core safety loads. The two networks exchange control signals and status information via a Bluetooth module to achieve fault domain isolation.

[0045] The hybrid power supply unit 300 connected to the low-voltage safety network 200 includes a first energy storage unit 301 and a second power generation unit 302. The first energy storage unit 301 is a lithium iron phosphate battery with a nominal voltage of 12V and a capacity of 6Ah. The second power generation unit 302 is a hub-type permanent magnet generator integrated into the front wheel. When the vehicle is moving, the generator is driven by the wheel. Its output terminal is connected in parallel with a set of 50F supercapacitors as a buffer energy storage unit to smooth out power fluctuations during low-speed driving and provide emergency power supply in case of instantaneous generator failure. The buffer energy storage unit can independently maintain the power supply of core safety loads (such as hazard warning lights and positioning modules) for at least 30 seconds under low-speed or stationary conditions such as vehicle start-up and waiting at traffic lights, ensuring uninterrupted power supply during the transition period before generator start-up.

[0046] The control and management device 400 uses an automotive-grade MCU (model: Infineon TC3xx series) as its core, integrates a battery management chip (model: ADI ADBMS1818) to measure battery voltage and AC internal resistance, and connects to a power switching matrix composed of MOSFETs to achieve hard cut-off and seamless switching of the power supply circuit.

[0047] 2. Implementation of the status monitoring module: The condition monitoring module performs monitoring tasks during the measurement window when the vehicle is stationary and the low-voltage safety network load current is less than 0.5A. The MCU injects a 1kHz AC test current signal with an amplitude of 50mA into the lithium iron phosphate battery through the battery management chip, and simultaneously measures the voltage response signal across the battery terminals. According to Ohm's law, the MCU calculates the battery's AC internal resistance value R_ac. Simultaneously, the MCU acquires the battery's terminal voltage V_bat through a voltage divider resistor network. The calculated AC internal resistance value R_ac and the terminal voltage V_bat are used together as health status data reflecting the battery's internal health state and stored in the MCU's RAM. The selection of the measurement window effectively avoids high-frequency PWM noise from the traction motor and vibration interference during vehicle operation, ensuring measurement accuracy.

[0048] 3. Implementation of the failure determination module: The failure determination module compares the acquired health status data with the failure condition thresholds pre-stored in the MCU's internal Flash memory. In this embodiment, for a 12V lithium iron phosphate battery, the preset failure conditions are: AC internal resistance R_ac ≥ 80mΩ, or terminal voltage V_bat ≤ 11.0V. When the AC internal resistance is greater than or equal to 80mΩ, it indicates that the aging phenomena such as sulfation of the battery's internal plates and shedding of active materials have become so severe that the battery is about to be unable to maintain normal output. When the terminal voltage drops below 11.0V, it indicates that the battery is nearly depleted. If either condition is met, the failure detection module generates a failure detection result, which is marked as "true," and triggers the subsequent fault-tolerant switching process. It is worth noting that this detection logic can be triggered before the battery's electrical performance is completely lost, thus achieving "predictive" failure identification.

[0049] 4. Implementation of the fault-tolerant switching module: When the failure determination result is "true", the fault-tolerant switching module immediately executes the switching operation. The MCU first outputs a high-level signal through its I / O port to the control terminal of the MOSFET switch connected to the first energy storage unit, turning off the MOSFET and reducing the loop current between the lithium iron phosphate battery and the low-voltage safety network to below 1μA, achieving a "hard cutoff" and ensuring complete isolation of the faulty unit from the system. Subsequently, after a 50μs interval, the MCU outputs a high-level signal to the control terminal of the MOSFET switch connected to the hub generator, turning on the MOSFET and connecting the power generated by the hub generator to the low-voltage safety network.

[0050] Thanks to the buffering effect of the supercapacitor, the bus voltage fluctuation during the switching process is less than 0.5V, achieving seamless power transfer of the core safety load. The MCU records the switching execution data (including the switching timestamp and the current power supply mode) in the EEPROM and illuminates the battery fault alarm light on the instrument panel.

[0051] 5. Implementation of the voltage monitoring module: After the system indicating that the execution data has been switched to be powered by the hub generator, the voltage monitoring module continuously acquires the bus voltage V_bus of the low-voltage safety network at a period of 100ms. This acquisition is completed by the MCU's built-in 12-bit ADC, and the sampled values ​​are stored in a register after digital filtering. The voltage monitoring module updates the voltage monitoring data in real time and compares it with the preset maintenance threshold of 10.5V, providing a decision-making basis for the graded unloading module.

[0052] 6. Implementation of the tiered unloading module: The graded unloading module acquires voltage monitoring data in real time. When V_bus remains below 10.5V for at least 2 seconds, the module determines that the current power supply capacity of the hub generator is insufficient to meet the full load demand and immediately initiates graded unloading control. After a 1-second delay, the MCU outputs a control signal through the I / O port to turn off the high beam load of the headlights and release approximately 15W of power. If V_bus is still below 10.5V after the high beams are turned off, the horn load will be turned off after a 3-second delay (i.e., a total delay of 4 seconds), releasing approximately 10W of power. If V_bus is still below 10.5V after the horn is turned off, then after a further delay of 5 seconds (i.e., a total delay of 9 seconds), all non-core lighting loads will be turned off, leaving only the hazard warning lights and positioning module powered, and the system will enter the minimum safety mode.

[0053] Throughout the entire tiered unloading process, the core safety loads such as brake lights, turn signals, hazard warning lights, and positioning modules are always prioritized for power supply by the MCU, ensuring that the vehicle still has basic passive safety warning capabilities under extreme conditions.

[0054] 7. System operating state transition: In this embodiment, the system automatically switches between multiple modes based on different operating conditions: Standard mode: When the battery is in good health, the lithium iron phosphate battery independently powers the low-voltage safety network.

[0055] Collaborative mode: When the battery is not faulty but the terminal voltage is lower than 12.0V, and the vehicle speed is greater than 5km / h, and the output voltage of the hub generator is higher than the battery voltage, the MCU controls the hub generator to supply main power, and at the same time, it trickles charge the battery with a limited current of 0.2C (i.e. 1.2A).

[0056] Emergency mode: When the failure detection module determines that the battery meets the failure conditions, the system forcibly disconnects the battery and the hub generator provides independent power.

[0057] Degradation mode: When the bus voltage is lower than the maintenance threshold during emergency power supply, a graded unloading is initiated, and the system enters a degraded operation state.

[0058] Minimal safety mode: The tiered unloading process proceeds to the final stage, retaining only the hazard warning lights and the positioning module.

[0059] 8. Communication fault tolerance and sleep / wake-up: To ensure system reliability, this embodiment also implements a communication fault-tolerance mechanism. If the MCU does not receive data from the battery management chip within 500ms, it is considered a communication failure. At this time, if the vehicle speed sensor detects a vehicle speed greater than zero, the system conservatively switches to emergency mode, powered by the hub generator. When the system enters the minimum safety mode, if it detects that the vehicle speed has returned to zero and the bus voltage continues to drop below the cutoff voltage of 9.0V, the MCU generates a sleep command, disconnects all loads, and retains only the low-power wake-up circuit to prevent deep battery over-discharge. When an ignition signal or charging connection is detected, the system reactivates and enters the standard power supply mode.

[0060] As can be seen from the above, this invention, by introducing AC internal resistance as an aging characteristic parameter, achieves predictive isolation and redundancy switching before the battery completely fails, fundamentally solving the safety hazard of the backup battery as a single point of failure in the traditional dual-power architecture. Simultaneously, through multi-level fault-tolerance mechanisms and graded offloading strategies, the system can still ensure the continuous operation of core safety functions even in the event of extreme power shortages, achieving a paradigm shift from "preventing failures" to "allowing component failures without affecting safety functions," and meeting the functional safety level requirements of ISO26262 ASIL-B and above.

[0061] like Figure 8 As shown, in one embodiment, this application provides a control method for a fault-tolerant power supply system for electric vehicles oriented towards functional safety, employing the system described in Embodiment 1, and performing the following steps: The aging characteristic parameters of the first energy storage unit that supplies power to the low-voltage safety network are obtained to obtain health status data; The health status data is compared with preset failure conditions to obtain a failure determination result; When the failure determination result indicates that the first energy storage unit meets the failure conditions, the first energy storage unit is hard disconnected from the power supply circuit before its electrical performance is completely lost, and the second power generation unit is connected to supply power to the low-voltage safety network. During the period when the power is supplied by the second power generation unit, the bus voltage of the low-voltage safety network is collected to obtain voltage monitoring data; The voltage monitoring data is compared with the maintenance threshold. When the voltage monitoring data is lower than the maintenance threshold, a graded unloading control is initiated to disconnect non-core safety loads in sequence, so as to prioritize the power supply to the core safety loads.

[0062] Its beneficial effects are the same as those of a fault-tolerant power supply system for electric vehicles oriented towards functional safety, and will not be elaborated here.

[0063] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A fault-tolerant power supply system for electric vehicles oriented towards functional safety, characterized in that, include: The status monitoring module is used to acquire aging characteristic parameters of the first energy storage unit that supplies power to the low-voltage safety network and obtain health status data. The failure determination module is used to compare the health status data with preset failure conditions to obtain a failure determination result. The fault-tolerant switching module is used to hard disconnect the first energy storage unit from the power supply circuit before the electrical performance of the first energy storage unit is completely lost when the failure determination result indicates that the first energy storage unit meets the failure conditions, and connect the second power generation unit to supply power to the low-voltage safety network, thereby obtaining switching execution data. The voltage monitoring module is used to collect the bus voltage of the low-voltage safety network and obtain voltage monitoring data during the period when the switching execution data indicates that the power is supplied by the second power generation unit; The graded unloading module is used to compare the voltage monitoring data with the maintenance threshold. When the voltage monitoring data is lower than the maintenance threshold, the graded unloading control is activated to disconnect non-core safety loads in sequence and obtain unloading execution data to prioritize the power supply of core safety loads.

2. The fault-tolerant power supply system for electric vehicles oriented towards functional safety according to claim 1, characterized in that, The status monitoring module also includes: During the measurement window when the vehicle is stationary and the low-voltage safety network is under light load, an AC test current signal of a preset frequency is injected into the first energy storage unit. The terminal voltage response of the first energy storage unit under the excitation of the AC test current signal is measured, and the AC internal resistance value is calculated based on the AC test current signal and the terminal voltage response. The AC internal resistance value is used as the health status data.

3. The fault-tolerant power supply system for electric vehicles oriented towards functional safety according to claim 2, characterized in that, The failure determination module includes: The AC internal resistance value is compared with a preset internal resistance failure threshold, or the terminal voltage of the first energy storage unit is compared with a preset voltage failure threshold. When the AC internal resistance value is greater than or equal to the internal resistance failure threshold, or the terminal voltage is less than or equal to the voltage failure threshold, a failure determination result indicating that the first energy storage unit is about to fail is generated.

4. The fault-tolerant power supply system for electric vehicles oriented towards functional safety according to claim 1, characterized in that, The fault-tolerant switching module includes: The first switch control unit is used to generate a first switch control signal to control the switching device connected to the first energy storage unit to disconnect, so that the loop current between the first energy storage unit and the low-voltage safety network is blocked to below the microampere level, and isolation status data is obtained. The second switch control unit is used to generate a second switch control signal to control the switching device connected to the second power generation unit, so as to connect the electrical energy generated by the second power generation unit to the low-voltage safety network and obtain redundant power supply status data.

5. A fault-tolerant power supply system for electric vehicles oriented towards functional safety according to any one of claims 1, characterized in that, The system also includes: The collaborative charging module includes: When the failure determination result indicates that the first energy storage unit does not meet the failure conditions, the terminal voltage of the first energy storage unit, the vehicle driving status, and the output voltage of the second power generation unit are obtained to obtain the collaborative charging condition data. When the collaborative charging condition data indicates that the terminal voltage is lower than the first charging threshold, the vehicle is in motion, and the output voltage is higher than the terminal voltage, a charging control command is generated to control the second power generation unit to charge the first energy storage unit with a limited current while supplying power to the low-voltage safety network.

6. A fault-tolerant power supply system for electric vehicles oriented towards functional safety according to claim 5, characterized in that, The collaborative charging module also includes: When the terminal voltage of the first energy storage unit rises back to above the second charging threshold, a stop charging command is generated, wherein the second charging threshold is greater than the first charging threshold. The defined current is a trickle current of no more than 0.5A, or a current with a multiplier of 0.1C to 0.2C.

7. A fault-tolerant power supply system for electric vehicles oriented towards functional safety according to claim 1, characterized in that, The tiered unloading module also includes: When the bus voltage is lower than the first voltage threshold and remains below the first preset time, a first-level unload instruction is generated, which is used to turn off the headlight high beam load. If the bus voltage is still lower than the maintenance threshold after the first-level unload instruction is generated, a second-level unload instruction is generated after a second preset time. The second-level unload instruction is used to turn off the speaker load. If the bus voltage is still lower than the maintenance threshold after the second-level unload command is generated, a third-level unload command is generated after a third preset time. The third-level unload command is used to shut down all non-core lighting loads, leaving only the hazard warning lights and the positioning module.

8. A fault-tolerant power supply system for electric vehicles oriented towards functional safety according to claim 1, characterized in that, The system also includes a communication fault-tolerant module, which includes: Monitor the communication status of the battery management chip associated with the first energy storage unit to obtain communication link status data; When the communication link status data indicates a communication interruption and the vehicle speed is greater than zero, a conservative switching command is generated to directly connect the second power generation unit to supply power to the low-voltage safety network.

9. A fault-tolerant power supply system for electric vehicles oriented towards functional safety according to claim 1, characterized in that, The system also includes a sleep / wake-up module, which includes: When the vehicle speed is detected to be zero and the bus voltage continues to drop below the cutoff voltage, a sleep command is generated. The sleep command is used to cut off all loads and retain only the low-power wake-up circuit. When an ignition signal or a charging access signal is detected by the low-power wake-up circuit, a wake-up command is generated to reactivate the first energy storage unit or the second power generation unit into the standard power supply mode.

10. A control method for a fault-tolerant power supply system for electric vehicles oriented towards functional safety, characterized in that, Using the system as described in any one of claims 1 to 9, the following steps are performed: The aging characteristic parameters of the first energy storage unit that supplies power to the low-voltage safety network are obtained to obtain health status data; The health status data is compared with preset failure conditions to obtain a failure determination result; When the failure determination result indicates that the first energy storage unit meets the failure conditions, the first energy storage unit is hard disconnected from the power supply circuit before its electrical performance is completely lost, and the second power generation unit is connected to supply power to the low-voltage safety network. During the period when the power is supplied by the second power generation unit, the bus voltage of the low-voltage safety network is collected to obtain voltage monitoring data; The voltage monitoring data is compared with the maintenance threshold. When the voltage monitoring data is lower than the maintenance threshold, a graded unloading control is initiated to disconnect non-core safety loads in sequence, so as to prioritize the power supply to the core safety loads.

Images