A power down protection system and method

Abstract

A power-off protection system and method, the power-off protection system comprises an energy storage unit, a core power supply domain, a first power converter and a comparator, the first power converter is connected to the core power supply domain through a first circuit, the comparator is connected to the first circuit, the core power supply domain comprises a microcontroller and a storage medium, the first power converter is used for converting the voltage generated by an external power supply into a first voltage and supplying power to the core power supply domain; the energy storage unit is used for supplying power to the core power supply domain when the voltage of the core power supply domain is lower than a protection threshold; the microcontroller is used for cutting off the first circuit and writing key running data in a random access memory into the storage medium in response to a power-off warning signal; the comparator is used for monitoring the terminal voltage of the energy storage unit, and turns on the first circuit when the terminal voltage decreases to a power-on reset threshold, so that the time of re-powering-on is limited to after the microcontroller completes resetting, and the microcontroller can be prevented from entering a locked state.

Description

Technical Field

[0001] The embodiments in this specification pertain to the field of circuit devices, and particularly relate to a power failure protection system and method. Background Technology

[0002] Embedded systems are widely used in drone flight control, vehicle event data loggers, industrial robot control, and other scenarios. These devices, which deploy embedded control systems, typically operate in environments with severe vibration and frequent power outages. For embedded systems, the typical power supply method involves an external DC power supply being stepped down by an internal power conversion circuit to provide operating voltage for core components such as the microcontroller and memory within the system.

[0003] To prevent the loss of critical data due to unexpected power outages, existing technologies typically employ methods such as increasing the filter capacitor or adding a small-capacity spare lithium battery. After a power outage, the remaining power of the energy storage element provides a brief period of power to the system, allowing critical operating data in the random access memory to be written to a non-volatile storage medium.

[0004] However, in existing technologies, if the external power supply is momentarily restored during the energy storage element's power supply, the microcontroller fails to receive a valid power-on reset pulse, and its circuit logic state is easily disrupted by voltage fluctuations, leading to a lock-up state. Therefore, even if the external power supply recovers normally, the embedded system cannot restart.

[0005] Therefore, this specification provides a power failure protection system and method to at least partially solve the above-mentioned problems. Summary of the Invention

[0006] The embodiments in this specification aim to provide a power failure protection system and method, including:

[0007] This specification provides a power-loss protection system in a first aspect. The power-loss protection system includes an energy storage unit, a core power supply domain, a first power converter, and a comparator. The first power converter is connected to the core power supply domain via a first circuit, and the comparator is connected to the first circuit. The core power supply domain includes a microcontroller and a storage medium.

[0008] The first power converter is used to convert the voltage generated by the external power supply into a first voltage and supply power to the core power supply domain;

[0009] The energy storage unit is used to supply power to the core power supply domain when the voltage of the core power supply domain is lower than the protection threshold.

[0010] The microcontroller is used to, in response to a power failure warning signal, disconnect the first circuit and write key operating data from the random access memory into the storage medium;

[0011] The comparator is used to monitor the terminal voltage of the energy storage unit and to turn on the first circuit when the terminal voltage drops to the power-on reset threshold.

[0012] A second aspect of this specification provides a power-loss protection method, the method relating to a power-loss protection system including an energy storage unit and a core power supply domain, the core power supply domain including a microcontroller and a storage medium, the energy storage unit being connected to the core power supply domain via a diode, and the energy storage unit being connected to an active discharge circuit, the method comprising:

[0013] After the energy storage unit supplies power to the core power supply domain, the microcontroller cuts off the first circuit and writes the key operating data in the random access memory into the storage medium. The energy storage unit supplies power to the core power supply domain when the voltage of the core power supply domain is lower than the protection threshold.

[0014] The comparator monitors the terminal voltage of the energy storage unit and turns on the first circuit when the terminal voltage drops to the power-on reset threshold.

[0015] A third aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in the second aspect.

[0016] The power-down protection scheme provided in this embodiment, through the competitive control of the comparator and the microcontroller, rigidly restricts the time of power-on (external power supply) to be completed after the microcontroller's control parameters have been reset. This can completely avoid the occurrence of power supply contradictions and thus prevent the microcontroller from entering a locked state due to failure to obtain a valid power-on reset pulse. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the power failure protection system in one embodiment of this specification; Figure 2 This is a schematic diagram of the working process of the power failure protection system in one embodiment of this specification when the external power supply is normal. Figure 3 This is a schematic diagram of the working process of the power failure protection system in one embodiment of this specification when the external power supply is turned off; Figure 4 This is a schematic diagram of the power failure protection system's operation after power failure and subsequent power restoration in one embodiment of this specification; Figure 5 This is a flowchart illustrating a power failure protection method in one embodiment of this specification. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0020] Figure 1 A schematic diagram of a power failure protection system according to one embodiment of this specification is shown. Figure 1 As shown, the power failure protection system can be divided into essential functional modules and supplementary functional modules. The essential functional modules include components indispensable to the power failure protection system, including an energy storage unit 110, a core power supply domain 120, a first power converter 210, a first circuit 220, and a comparator 260. The supplementary functional modules are auxiliary components added to the essential functional modules to improve system reliability, expand applicable scenarios, or optimize specific performance indicators. These include a power failure detector 230, a second power converter 240, a second circuit 250, and an active discharge circuit 130.

[0021] The following is a brief introduction to the necessary functional modules.

[0022] In the essential functional modules, the energy storage unit 110 and the core power supply domain 120 form a unidirectional power supply path through diode D2. The anode of diode D2 is connected to the positive terminal of the energy storage unit 110, and the cathode is connected to the power input terminal of the core power supply domain 120. This unidirectional connection structure can prevent the current in the core power supply domain 120 from flowing back into the energy storage unit 110 under normal operating conditions, avoiding abnormal charging of the energy storage unit 110 or unnecessary energy loss; at the same time, when the supply voltage of the core power supply domain 120 drops below the protection threshold, the energy storage unit 110 can provide backup power to the core power supply domain 120 through diode D2.

[0023] In engineering implementation, the energy storage unit 110 can employ energy storage components with large capacity and long charge-discharge cycle life, such as supercapacitors or lithium-ion capacitors. Supercapacitors offer advantages such as fast charge-discharge speed, low internal resistance, and stable temperature characteristics, making them suitable for scenarios requiring frequent short-term power outages. Lithium-ion capacitors, with energy density between traditional capacitors and batteries, can be used as an alternative in situations requiring longer backup time. It should be noted that the flight controller consumes a significant amount of power during operation, while coin cells typically have low output current and limited energy storage, potentially hindering log recording. Therefore, coin cells are not selected as the energy storage unit in this embodiment.

[0024] The core power supply domain 120 includes a microcontroller 121 and a storage medium 122, which can be connected to the same bus. The microcontroller 121, as the executor of the power-down protection process, is responsible for responding to power-down events, controlling data storage, and managing the active discharge circuit 130. The microcontroller 121 has random access memory for temporary storage of operating data. The storage medium 122 is used to receive and persistently store critical operating data transferred from the random access memory by the microcontroller 121. Typically, for embedded control systems deploying this power-down protection system, the microcontroller 121 can also serve as the core controller of the embedded control system.

[0025] In engineering implementation, the microcontroller 121 can be an embedded processor with low power mode, rich peripheral interfaces and sufficient SRAM capacity, such as an ARM Cortex-M series or RISC-V architecture MCU; the storage medium 122 can be a device with non-volatile storage characteristics such as SD card, eMMC, NOR Flash or EEPROM. The specific selection can be determined by relevant technical personnel in combination with the scenario requirements (data write rate, capacity requirements and interface compatibility, etc.).

[0026] The first power converter 210 is connected to the core power supply domain 120 via the first circuit 220, and is used to convert the higher voltage generated by the external power supply into a first voltage suitable for the operation of the core power supply domain 120. The voltage range of the external power supply may vary depending on the application scenario; for example, in a drone flight control system, it is typically a 5V to 12V DC input, while in an automotive event data recorder, it may face fluctuations in automotive power supply from 12V to 24V. The first power converter 210 needs to have sufficient input voltage range and output current capability to support the power consumption requirements of the core power supply domain 120 when operating at full power.

[0027] In engineering implementation, the first power converter 210 can be a low-dropout linear regulator or a switching DC-DC step-down chip. The LDO solution has low ripple and simple circuitry, making it suitable for powering digital circuits with high power quality requirements; the DC-DC solution has high efficiency and low heat generation, making it more suitable for applications with a large voltage difference between the external power supply and the core voltage.

[0028] The first circuit 220 serves as the power supply path between the first power converter 210 and the core power supply domain 120. Its on / off state determines whether an external power supply directly supplies power to the core power supply domain 120. In engineering implementation, the first circuit 220 can be composed of a PMOS transistor, an NMOS transistor, or a mechanical relay. PMOS transistors are a common implementation method because they have simple drive circuits, low on-resistance, and fast switching speed in high-side switching applications. NMOS transistors typically have even lower on-resistance but require an additional charge pump drive circuit to achieve high-side conduction. Mechanical relays have strong voltage withstand capability and extremely low conduction loss, but they have limitations in mechanical lifespan and significant switching delay, and are generally only used in high-power or special isolation applications.

[0029] Comparator 260 is connected to the first circuit 220 to monitor the terminal voltage of the energy storage unit 110 and outputs a control signal to turn on the first circuit 220 when the terminal voltage drops to the power-on reset threshold.

[0030] In engineering implementation, the comparator 260 can be built using a standalone comparator chip or an operational amplifier combined with a positive feedback resistor network. A standalone comparator chip offers fast response and low power consumption; the operational amplifier approach provides greater parameter adjustability, allowing for precise threshold setting based on specific application requirements.

[0031] The comparator 260 can utilize an independent backup power supply to provide its operating voltage. This independent backup power supply can employ energy storage components such as button batteries or small lithium batteries that can continuously provide a stable voltage after the main power supply fails.

[0032] The following is a brief introduction to the supplementary functional modules.

[0033] The power failure detector 230 is used to sample the voltage of the external power supply and generate a power failure warning signal based on the sampling results. The sampling point of the power failure detector 230 is set at the high-voltage end of the front stage, that is, the node before the external power supply is stepped down by the first power converter 210, rather than the low-voltage end of the core power supply domain 120.

[0034] In engineering implementation, the power failure detector 230 can be implemented using a voltage detection network and a comparator.

[0035] The second power converter 240 is connected to the non-core power supply domain via the second circuit 250. The non-core power supply domain includes non-core loads and energy storage unit 110. The second power converter 240 converts the voltage generated by the external power supply into a second voltage, supplying power to the non-core loads while providing charging current to the energy storage unit 110.

[0036] The value of the second voltage can be the same as the first voltage, or it can be set separately according to the actual needs of the non-core load. In some application scenarios, the voltage tolerance range of the non-core load is relatively wide, and the second voltage can be set slightly higher than the first voltage to improve charging efficiency. In other scenarios, in order to reduce system power consumption, the second voltage can also be set lower than the first voltage. In this case, the charging voltage of the energy storage unit 110 is reduced accordingly, and a trade-off needs to be made in conjunction with the capacity selection.

[0037] The on / off state of the second circuit 250 can be controlled by the microcontroller 121. Under normal operating conditions, the second circuit 250 is turned on, and the energy storage unit 110 is continuously charged; after a power failure event is detected, the second circuit 250 is turned off to prevent the energy of the energy storage unit 110 from being discharged in reverse to the power-off external power supply side through the second power converter 240.

[0038] In engineering implementation, the second circuit 250 is usually composed of a PMOS transistor and a current-limiting resistor. The current-limiting resistor is used to control the maximum charging current of the energy storage unit 110 and protect the PMOS transistor and the energy storage unit 110 itself.

[0039] The active discharge circuit 130 is directly connected to the energy storage unit 110 and is controlled by the general-purpose input / output signal output by the microcontroller 121. When the active discharge circuit 130 is off, it presents a high-impedance state, which does not affect the normal charging and discharging of the energy storage unit 110; when it is on, it provides a low-impedance discharge path to ground for the energy storage unit 110, so that the residual electrical energy in the energy storage unit 110 is released quickly in the form of a large current.

[0040] In engineering implementation, the active bleeder circuit 130 can be constructed using an opto-relay and a bleeder resistor. The advantages of the opto-relay are that it provides electrical isolation between the control end and the load end, has strong anti-interference capabilities, and its normally closed structure can maintain the bleeder path by default when the control signal fails, thus improving system safety.

[0041] It should be noted that in some implementations, the microcontroller 121 can control the output control signals of each component through the programmable pins in the microcontroller—General Purpose Input / Output (GPIO).

[0042] To further explain the workflow of the power failure protection system, this manual divides its operation into three stages: normal power supply, external power failure, and external power restoration. The workflow of each stage will be described below with reference to the accompanying drawings.

[0043] Figure 2 The operation of the power failure protection system is shown when the external power supply is normal.

[0044] like Figure 2 As shown, when the external power supply is normal, the first power converter 210 provides a first voltage to the core power supply domain 120 through the conducting first circuit 220. The microcontroller 121 and the storage medium 122 are in full-power operation, while the active discharge circuit 130 is in the off state. Therefore, the energy storage unit 110 neither supplies power to the core power supply domain 120 (the voltage of the energy storage unit 110 is lower than the voltage of the core power supply domain when the external power supply is normal) nor discharges through the active discharge circuit. The energy stored in the energy storage unit 110 does not release its charge when the external power supply is normal. It should be noted that the comparator 260 may have a power-on reset threshold. When the external power supply is normal, the comparator 260 monitors the terminal voltage of the energy storage unit 110. Since the terminal voltage of the energy storage unit 110 is usually higher than the power-on reset threshold, the comparator 260 will output a switching control signal to attempt to control the first circuit 220 to be cut off. Under this condition (the comparator 260 only has a single threshold), the microcontroller 121 can output a conduction control signal, which, through a dual diode OR gate logic circuit, controls the first circuit to be turned on (if either the microcontroller 121 or the comparator 260 outputs a conduction signal, the first circuit is turned on).

[0045] In some implementations, the energy storage unit 110 may be a rechargeable capacitor. This energy storage unit 110 can be connected in parallel with the core power supply domain 120 to the first power converter 210; alternatively, it can be connected via a second circuit 250 to a second power converter 240, which is connected in parallel with the first power converter to an external power source. Figure 1 (Only the case where the energy storage unit 110 is connected to the second power converter 240 is shown.) Thus, when the external power supply is normal, the energy storage unit 110 can enter a charging state. That is, this power-down protection system can repeatedly provide power-down protection for the deployed embedded control system without requiring any additional processing of the energy storage unit 110.

[0046] Furthermore, the second power converter 240 can also supply power to the non-core power supply domain via the activated second circuit 250. The non-core power supply domain may include non-core loads and energy storage unit 110. Thus, the power supply to the non-core power supply domain and the core power supply domain 120 is independent of each other. In emergency conditions (e.g., when the external power supply fails), different power supply strategies can be provided for the non-core power supply domain and the core power supply domain 120, concentrating the power of the energy storage unit 110 to supply the core power supply domain 120, ensuring the complete execution of the critical operational data writing process. The non-core loads are various circuit components unrelated to the writing of critical operational data, such as various sensors used in embedded control systems to ensure the execution of corresponding tasks (e.g., for an aircraft's embedded control system, speed sensors and gravity sensors can be non-core loads).

[0047] In some implementations, the power failure protection system also includes a power failure detector 230, which can be deployed between the external power supply and the first power converter 210 to sample the voltage of the external power supply at a fixed frequency. When the external power supply is supplying power normally, the sampled value is within the normal voltage range, and no warning action is triggered.

[0048] When the external power supply is lost due to various reasons such as loose connectors, aging wiring, or power supply equipment failure, the voltage of the external power supply drops. This triggers the working process of the power failure protection system when the external power supply is lost.

[0049] Figure 3 The operation of the power failure protection system when the external power supply is turned off is shown.

[0050] like Figure 3 As shown, when the external power supply is turned off, the output voltage of the first power converter 210 drops due to the influence of the external power supply. Correspondingly, the voltage of the core power supply domain 120 drops. The energy storage unit 110, which is connected to the core power supply domain 120 by a diode, generates a voltage difference with the core power supply domain 120 and begins to supply power to the core power supply domain 120. On the other hand, the microcontroller 121 detects that the drop in the output voltage of the first power converter 210 exceeds the protection threshold. It uses this (the drop in the output voltage of the first power converter 210 exceeds the protection threshold) as a power failure warning signal. In response to the power failure warning signal, it encapsulates the critical operating data in the random access memory and writes it into the storage medium 122.

[0051] The selection range of key operational data depends on the specific application scenario. In a drone flight control system, key operational data may include flight attitude angles, GPS coordinates, motor speeds, battery status, and the sequence of control commands before and after a fault occurs; in a vehicle-mounted event data recorder, key operational data may include vehicle speed, acceleration, braking status, steering angle, and sensor data before and after a collision.

[0052] It should be noted that if the power failure protection system also includes a power failure detector 230, the power failure warning signal can be generated by the power failure detector 230. Specifically, when the external power supply is turned off, the sampling value of the power failure detector 230 decreases accordingly. When the filtered voltage value drops to a preset warning threshold, the power failure detector 230 can generate a power failure warning signal and send it to the microcontroller 121. Thus, the microcontroller 121 can begin packaging and writing critical operating data packets from the random access memory to the storage medium 122 before the actual drop in the output voltage of the first power converter 210. The power failure detector 230 can provide the power failure protection system with an additional write time of several milliseconds to tens of milliseconds, reducing the capacity requirements of the energy storage unit 110.

[0053] The logic behind setting the warning threshold is explained here. The selection of the warning threshold is not a simple fixed percentage, but rather requires balancing two mutually constraining indicators: warning lead time and false trigger rate. If the warning threshold is set too high, even slight fluctuations in external power supply can trigger the power-off protection process, causing the system to frequently enter emergency mode and affecting normal business operations. If the warning threshold is set too low, there is insufficient time for subsequent data saving and proactive discharge operations, and the voltage of the core power supply domain 120 may collapse before the operations are completed. A feasible method is to set the warning threshold to 80% to 85% of the rated voltage of the external power supply, while introducing a sliding filter mechanism to smooth the sampled values, filtering out instantaneous drops with a duration shorter than the filtering window, thereby suppressing false triggers while ensuring sufficient lead time.

[0054] In some implementations, the microcontroller 121 can also perform a load stripping operation in response to a power failure warning signal. Specifically, the microcontroller 121 outputs a cutoff control signal to disconnect the first circuit 220 and the second circuit 250. The cutoff control signal of the first circuit 220 disconnects the power supply path between the first power converter 210 and the core power supply domain 120 (under this condition, the terminal voltage of the energy storage unit 110 is higher than the power-on reset threshold, and the comparator also outputs a cutoff control signal, thereby disconnecting the first circuit), preventing the energy of the energy storage unit 110 from being discharged in reverse to the power-off external power supply side through the first power converter 210; the disconnection of the second circuit 250 stops the charging process of the energy storage unit 110 and disconnects the non-core load from the power supply system, allowing the energy storage unit 110 to provide centralized power to the core power supply domain 120.

[0055] After the load stripping operation is completed, the power supply from the first power converter 210 is switched to unidirectional power supply from the energy storage unit 110 through diode D2. The microcontroller 121 enters a low-power emergency mode, shutting down the clock and power supply of non-essential peripherals.

[0056] When the microcontroller 121 receives the write completion confirmation from the storage medium 122, it indicates that the data write operation is complete. In response to the received write completion confirmation, the microcontroller 121 outputs a conduction control signal to turn on the switching element in the active discharge circuit 130. The energy storage unit 110 forms a low-resistance path with ground through the discharge resistor, and the residual charge is rapidly released with a large current.

[0057] During natural discharge, the energy of the energy storage unit 110 is slowly consumed mainly through its own equivalent series resistance and the leakage current of the external circuit, with the discharge current typically in the range of microamps to milliamps. Active discharge, however, uses a low-resistance discharge resistor to increase the discharge current to tens or even hundreds of milliamps, reducing the discharge time from tens of seconds in natural discharge to hundreds of milliseconds. Therefore, the discharge rate of active discharge is much higher than the natural discharge rate of the energy storage unit 110, allowing for a rapid voltage reduction. Consequently, the voltage of the core power supply domain 120 is reduced below the power-on reset threshold, enabling the power-down protection system to quickly regain the ability to supply power normally from the corresponding external power source after initiating the protection process.

[0058] It should be noted that if the discharge resistor value is too small, the discharge current will be too large, which may cause current surges to the switching elements and the energy storage unit 110 itself; if the value is too large, the discharge time will be prolonged, and the risk of the descent period cannot be effectively eliminated. In engineering practice, the corresponding discharge current can be controlled between tens of milliamps and hundreds of milliamps to balance the discharge speed and device safety.

[0059] In some implementations, after receiving a write completion confirmation from the storage medium 122, the microcontroller 121 can also perform a bus isolation operation, configuring the communication bus connected to the storage medium 122 into a high-impedance state. The communication bus may include clock lines, command lines, and data lines, etc.

[0060] The high-impedance configuration allows the bus pins to present high input impedance, outputting neither high nor low levels, thereby cutting off the bus level transmission path. Experiments in real-world scenarios show that during the subsequent active discharge of the energy storage unit 110 and the continuous voltage drop, the bus signal may generate unpredictable glitches due to power supply noise or pin leakage current. If the bus is still in a driving state at this time, these glitches may be misinterpreted by the storage medium 122 as valid clock or command signals, triggering unexpected erase or write operations and destroying the data just saved. By configuring the bus to a high-impedance state, even if voltage fluctuations occur, the signal amplitude on the pins is insufficient to be recognized as a valid logic level due to the lack of driving capability. This further reduces the probability of damage to the critical operating data protected by the power-down protection system in this embodiment.

[0061] In other implementations, besides the high-impedance configuration, bus pins can be pulled to a fixed level, for example, the clock and command lines can be pulled low, while the data lines can be pulled high or low according to specific protocol requirements. This pull-up configuration has stronger anti-interference capability compared to the high-impedance state, but it requires additional pull-up or pull-down resistors, and a continuous leakage current will be generated when there is a potential difference between the pin level and the fixed level, accelerating the energy consumption of the energy storage unit 110.

[0062] The terminal voltage of energy storage unit 110 continuously decreases during active discharge. Comparator 260, powered by an independent backup power supply, continuously monitors the terminal voltage of energy storage unit 110. When the terminal voltage drops to the power-on reset threshold, the output state of comparator 260 flips, and the output control signal turns on the first circuit 220. Thus, the power-down protection system enters the power-on process after power failure.

[0063] Figure 4 The process of the power failure protection system being powered on again after a power outage is shown.

[0064] like Figure 4 As shown, after comparator 260 turns on the first circuit 220, if the external power supply is restored, the first power converter 210 will correspondingly restore power and supply power to the core power supply domain 120. Since the microcontroller 121 has already gone through the process of voltage drop below the power-on reset threshold, the control parameters of the microcontroller 121 have been reset accordingly. After the external power supply is restored, the microcontroller 121 can undergo a complete voltage rise process from zero. Therefore, by rigidly limiting the time of power restoration (external power supply) to after the control parameters of the microcontroller 121 have been reset, the power supply contradiction problem can be completely avoided, thereby preventing the microcontroller from entering a locked state due to failure to obtain a valid power-on reset pulse. Thus, after ensuring power restoration, the power failure protection system can restart normally and resume operation.

[0065] It should be noted that when the external power supply is restored, the voltage of the core power supply domain 120 is provided by the first power converter 210. As a result, the voltage of the energy storage unit 110 is naturally lower than the voltage of the core power supply domain 120, and the diode D2 connecting the energy storage unit 110 and the core power supply domain 120 is also disconnected accordingly.

[0066] In some implementations, if the energy storage unit 110 is connected to the second circuit 250, after detecting that an external power supply is on, the microcontroller can output a conduction control signal to control the second circuit to conduct, restoring the power supply to the non-core load and the energy storage unit 110, and correspondingly controlling the switching element in the active discharge circuit 130 to cut off. Thus, the energy storage unit 110 continues to be charged, so that it can still be used for emergency power supply when the external power supply fails again.

[0067] Figure 5 This specification shows a flowchart illustrating a power failure protection method according to one embodiment. The method can be referred to... Figure 3 The working process of the illustrated power-down protection system when the external power supply is turned off is understood. The method relates to a power-down protection system, which includes an energy storage unit, a core power supply domain, a first power converter, and a comparator. The first power converter is connected to the core power supply domain via a first circuit. The first power converter is used to convert the voltage generated by the external power supply into a first voltage and supply power to the core power supply domain. The comparator is connected to the first circuit. The core power supply domain includes the microcontroller and the storage medium. The method includes:

[0068] Step S501: After the energy storage unit supplies power to the core power supply domain, the microcontroller cuts off the first circuit and writes the key operating data in the random access memory into the storage medium, wherein the energy storage unit supplies power to the core power supply domain when the voltage of the core power supply domain is lower than the protection threshold.

[0069] In some implementations, after the data writing operation is completed, the microcontroller turns on the active discharge circuit so that the energy storage unit can be discharged quickly through the active discharge circuit; in other implementations, natural discharge can be relied upon to slowly reduce the electrical energy stored in the energy storage unit (and the output voltage of the energy storage unit).

[0070] Specifically, the active discharge circuit includes a normally closed photorelay and a discharge resistor; in step S501, the microcontroller can control the photorelay to turn on so that the energy storage unit can discharge rapidly through the discharge resistor.

[0071] In some implementations, in step S501, the microcontroller may further configure the communication bus connected to the storage medium to a high-impedance state after completing the data writing operation.

[0072] Specifically, the power failure protection system further includes a power failure detector, which is used to detect the output voltage of the external power supply. Typically, the power failure detector is deployed between the external power supply and the first power converter. The power failure warning signal is generated by the power failure detector based on the sampling results of the voltage of the external power supply.

[0073] In some implementations, the power failure protection system further includes a second power converter, which is connected to a non-core power supply domain via a second circuit. The non-core power supply domain includes non-core loads and the energy storage unit. Before step S501, the microcontroller may respond to a power failure warning signal by disconnecting the second circuit to prevent the energy storage unit from supplying reverse power to the second power converter.

[0074] Step S503: The comparator monitors the terminal voltage of the energy storage unit and turns on the first circuit when the terminal voltage drops to the power-on reset threshold.

[0075] Specifically, the comparator is supplied with an operating voltage from an independent backup power supply and the voltage corresponding to the power-on reset threshold.

[0076] like Figure 5 The power-off protection method shown here rigidly restricts the time of power-on (external power supply) to after the control parameters of microcontroller 121 have been reset, which can completely avoid the occurrence of power supply contradiction problems and thus prevent microcontroller from entering a locked state due to failure to obtain a valid power-on reset pulse.

[0077] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0078] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0079] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0080] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0081] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0082] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0083] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0084] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0085] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0086] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0087] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0088] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0090] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0091] The above description is merely one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A power failure protection system, the power failure protection system comprising an energy storage unit, a core power supply domain, a first power converter, and a comparator, wherein the first power converter is connected to the core power supply domain via a first circuit, the comparator is connected to the first circuit, and the core power supply domain includes a microcontroller and a storage medium, wherein... The first power converter is used to convert the voltage generated by the external power supply into a first voltage and supply power to the core power supply domain; The energy storage unit is used to supply power to the core power supply domain when the voltage of the core power supply domain is lower than the protection threshold. The microcontroller is used to, in response to a power failure warning signal, disconnect the first circuit and write key operating data from the random access memory into the storage medium; The comparator is used to monitor the terminal voltage of the energy storage unit and to turn on the first circuit when the terminal voltage drops to the power-on reset threshold.

2. The power failure protection system as described in claim 1, wherein, The power failure protection system also includes a power failure detector. The power failure detector is used to sample the voltage of the external power supply and generate a power failure warning signal based on the sampling result.

3. The power failure protection system as described in claim 1, wherein, The power failure protection system also includes a second power converter, which is connected to a non-core power supply domain via a second circuit. The non-core power supply domain includes non-core loads and the energy storage unit. The second power converter is used to convert the voltage generated by the external power supply into a second voltage and supply power to the non-core power supply domain; The microcontroller is also configured to disconnect the second circuit in response to a power failure warning signal.

4. The power failure protection system as described in claim 1, wherein, The microcontroller is also configured to configure the communication bus connected to the storage medium to a high-impedance state after the data writing operation is completed.

5. The power failure protection system as described in claim 1, wherein, The power failure protection system also includes an active discharge circuit, which is connected to the energy storage unit; The microcontroller is also configured to, after completing the data writing operation, turn on the active discharge circuit so that the energy storage unit can be rapidly discharged through the active discharge circuit.

6. The power failure protection system as described in claim 5, wherein, The active discharge circuit includes a normally closed photorelay and a discharge resistor; The microcontroller is specifically used to control the photorelay to turn on, so that the energy storage unit can discharge rapidly through the discharge resistor.

7. The power failure protection system as described in claim 1, wherein, The energy storage unit is connected to the core power supply domain via a diode.

8. The power failure protection system as described in claim 1, wherein, The comparator is supplied with the voltage corresponding to the power-on reset threshold by an independent backup power supply.

9. The power failure protection system as described in claim 1, wherein, The power failure protection system is applied to the UAV flight control system.

10. A power-down protection method, the method relating to a power-down protection system, the power-down protection system comprising an energy storage unit, a core power supply domain, a first power converter, and a comparator, wherein the first power converter is connected to the core power supply domain via a first circuit, the comparator is connected to the first circuit, the core power supply domain comprising a microcontroller and a storage medium, the method comprising: After the energy storage unit supplies power to the core power supply domain, the microcontroller cuts off the first circuit and writes the key operating data in the random access memory into the storage medium. The energy storage unit supplies power to the core power supply domain when the voltage of the core power supply domain is lower than the protection threshold. The comparator monitors the terminal voltage of the energy storage unit and turns on the first circuit when the terminal voltage drops to the power-on reset threshold.

Images