Signal acquisition and safety protection system and method based on vehicle-mounted battery management system

Abstract

The application discloses a signal acquisition and safety protection system and method based on a vehicle-mounted battery management system, and the system comprises a multi-core main control chip, a high-voltage sampling chip and three redundant safety execution paths. The main control chip is provided with a first core, a second core and a third core serving as a lockstep core, and the first core and the third core constitute a built-in self-checking unit; the second core is responsible for high-voltage sampling communication and relay control. The high-voltage sampling chip is connected with the second core and the first core, a fault output port of the high-voltage sampling chip is connected with the first and second safety execution paths, and the first and second safety execution paths respectively trigger a protection circuit fuse and the first core to close a relay power supply; the third safety execution path monitors the main control chip fault by a power management chip and forcibly cuts off power. The method comprises the steps of system initialization, redundant current acquisition fusion and working condition adaptive high-voltage acquisition. The application significantly improves the reliability and fault tolerance capability of the vehicle-mounted battery management system in high-voltage signal acquisition and safety protection.

Description

Technical Field

[0001] This invention relates to the fields of electric vehicle electronics and energy storage embedded electronics, and in particular to a signal acquisition and safety protection system and method based on an on-board battery management system. Background Technology

[0002] With the rapid development of the new energy vehicle industry, the safety of power battery systems has become a core concern for vehicle safety. As the core control unit of the battery system, the battery management system (BMS) shoulders the critical functions of battery status monitoring, safety protection, and energy management, and its reliability directly affects the safe operation of the entire vehicle. Among the various functions of the BMS, signal acquisition and safety protection of the high-voltage circuit are particularly important because the high-voltage circuit directly carries the charging and discharging energy of the battery. If faults such as short circuits or overcurrents occur and are not dealt with in a timely and effective manner, they may lead to serious safety accidents such as battery thermal runaway or even fire and explosion.

[0003] Current battery management systems typically employ single-core or dual-core main control chips, using a single control core to perform multiple tasks such as battery cell signal acquisition, high-voltage circuit monitoring, relay control, and safety protection decisions. This centralized processing architecture has significant limitations. On the one hand, the load on a single core is too heavy, making it difficult to ensure both real-time performance and the processing accuracy of various functions. On the other hand, when the main control chip itself experiences a hardware failure, the entire battery management system loses its ability to monitor and protect the high-voltage circuit, posing a serious safety hazard. Although some high-end chips have begun to introduce lockstep core technology for core fault detection, existing solutions often only stop at the fault discovery level, lacking a complete safety execution mechanism to form a closed-loop protection system from fault detection to safety handling.

[0004] In terms of high-voltage circuit safety protection, traditional designs primarily rely on fuses as passive protection components, working in conjunction with relays to control the on / off state of the high-voltage circuit. However, a significant protection blind zone exists between fuses and relays. When the short-circuit current exceeds the relay's load-bearing capacity but has not yet reached the fuse's fast-blow threshold, the relay may experience contact sticking due to overload current, while the fuse fails to trip and disconnect the faulty circuit in time. This protection blind zone is particularly prominent under medium-level short-circuit current conditions, becoming a long-standing technical challenge for those skilled in the art. Furthermore, existing software protection mechanisms often depend on the normal operation of the main control chip. Once the main control chip fails due to software malfunction or hardware failure, the software protection function will also be lost, making reliable disconnection of the high-voltage circuit impossible.

[0005] In high-voltage signal acquisition, existing technologies typically employ a single current sensor for current monitoring. When the sensor drifts or fails, the system cannot detect this in time and take remedial measures, potentially leading to the failure of safety protection decisions based on erroneous current data. Furthermore, traditional voltage acquisition strategies use a fixed-period polling method, treating all sampling channels equally and failing to dynamically adjust the sampling frequency according to different operating conditions of the high-voltage circuit. This results in insufficient sampling frequency at critical voltage points under critical operating conditions, affecting the real-time performance and accuracy of functions such as relay sticking diagnosis and pre-charge detection. In addition, temperature compensation for current sensors usually uses fixed compensation coefficients or simplified lookup table methods, resulting in limited accuracy and making it difficult to guarantee the accuracy of current measurement across the entire temperature range.

[0006] In terms of production line calibration and parameter storage, existing solutions often store sensor calibration parameters in a single storage area. If the data in this area is damaged due to aging of the storage medium or accidental interference, the system will be unable to obtain accurate calibration parameters, which will affect the accuracy of current calculations and may even cause the system to malfunction. Furthermore, the calibration process lacks a robust verification and retransmission mechanism, failing to ensure the integrity and reliability of the written calibration parameters.

[0007] In summary, existing technologies have significant shortcomings in areas such as multi-core collaborative processing, redundant safety protection, adaptive data acquisition under operating conditions, high-precision temperature compensation, and reliable parameter storage. There is an urgent need for a battery management system solution that can achieve full-link redundant protection from signal perception to safe execution, so as to comprehensively improve the safety and reliability of vehicle battery systems under complex operating conditions. Summary of the Invention

[0008] To address the aforementioned shortcomings, this invention proposes a signal acquisition and safety protection system and method based on an on-board battery management system, which significantly improves the reliability and fault tolerance of the on-board battery management system in high-voltage signal acquisition and safety protection.

[0009] This invention provides the following technical solution: a signal acquisition and safety protection system based on an on-board battery management system, comprising: The main control chip is a multi-core chip, including a first core, a second core, and a third core that acts as a lockstep core for the first core. The first core and the third core are used to execute the same instructions and detect each other's results to form the built-in self-test and fault-tolerant unit of the main control chip. The first core is used to perform battery pack individual cell signal acquisition and power control, and run application algorithms. The second core communicates with the high-voltage sampling chip through the first serial peripheral interface to obtain the voltage and current signals of the high-voltage circuit, and configures the latch through the second serial peripheral interface to control the high-side drive circuit and the bottom-side drive circuit, thereby controlling the closing and opening of the relay in the high-voltage circuit. The high-voltage sampling chip is connected to the second core and the first core respectively. It is used to collect the voltage and current signals of the high-voltage circuit and has a fault output port. The high-voltage sampling chip is also used to output a level flip signal through the fault output port when a short circuit fault is detected in the high-voltage circuit. The first safe execution path includes a protection circuit connected to the fault output port, which is used to receive a level flip signal and directly trigger the fuse to disconnect the high-voltage circuit. The second safety execution path includes a relay loop power enable terminal connected to the first core. The first core is used to detect the level state of the fault output port during periodic tasks. When a level flip signal is detected, the relay loop power enable terminal is controlled to output a low level to turn off the relay loop power. The third safety execution path includes a power management chip connected to the main control chip. The power management chip is used to monitor the port signal fault status of the main control chip. When a serious fault is detected, it outputs a first signal to forcibly shut down the power supply to the relay circuit. The second core is also used to initialize and configure the high-voltage sampling chip after the system starts up, and periodically collect and calculate the high-voltage loop current signal in normal working mode, and send it to the first core through inter-core communication. The first core is also used to collect the current signal of the Hall current sensor, and to calibrate the multiple current signals, including the current signal collected by the high-voltage sampling chip and the current signal of the Hall current sensor, in order to determine the final high-voltage loop current value.

[0010] As an improvement, the second core is also used to dynamically configure the acquisition sequence of the high-voltage sampling channel according to different operating conditions of the high-voltage circuit in periodic tasks; When the main positive relay and the main negative relay are detected to be in the closed state, the first acquisition sequence is configured. The first acquisition sequence is based on the current calculation cycle, and the window period is set to three times the current calculation cycle, so that the temperature and voltage values ​​of the two current sensors are acquired three times within the window period. When no charging gun connection signal is detected, a second acquisition sequence is configured. The second acquisition sequence includes at least two acquisitions of the voltage at the back end of the main positive relay and the voltage at the back end of the main negative relay within a preset window period. When a charging gun connection signal is detected, a third acquisition sequence is configured. The third acquisition sequence includes at least two acquisitions of the voltage at the back end of the main positive relay, the voltage at the back end of the main negative relay, the voltage at the back end of the charging positive relay, and the voltage at the back end of the charging negative relay within a preset window period. The second core sequentially collects the voltage signals of each high-voltage sampling point according to the configured acquisition sequence. The high-voltage sampling points include at least the positive voltage of the battery pack, the voltage of the fuse, the voltage at the back end of the main positive relay, the voltage at the back end of the main negative relay, the voltage at the back end of the charging positive relay, the voltage at the back end of the charging negative relay, the temperature voltage of the first current sensor, and the temperature voltage of the second current sensor.

[0011] As an improvement, the high-voltage sampling chip is equipped with a first current sensor and a second current sensor with different sampling periods; the second core is configured as follows: The first AD conversion value of the first current sensor is read in the first cycle and stored in a circular queue. The length of the circular queue is N, where N is an integer greater than 1. The second current sensor's second AD conversion value is read in the second cycle and the corresponding second current value is calculated, where the second cycle is N times the first cycle; Based on the current range in which the second current value is located, different filtering methods are selected to process the first AD conversion value in the circular queue: When the second current value is in the first interval that characterizes the low current operating condition, the effective AD value of the first current sensor is determined by a representative value selection method based on sorting. When the second current value is in the second interval that characterizes non-small current operating conditions, the effective AD value of the first current sensor is determined by the extreme value removal averaging filter method.

[0012] As an improvement, the first core is specifically used for: Calculate the first error rate between the first current value and the second current value, the second error rate between the first current value and the third current value, and the third error rate between the second current value and the third current value; Based on the preset error rate threshold, the reliability of the first current value, the second current value, and the third current value is evaluated. Based on the credibility assessment process, the final high-voltage circuit current value is determined according to the following priority order: When the first error rate is less than or equal to the first threshold, it is determined that both the first current sensor and the second current sensor are reliable, and the fused value of the first current value and the second current value is taken as the high voltage circuit current value. When the first error rate is greater than the first threshold and the second error rate is less than or equal to the second threshold, the first current sensor is determined to be reliable and the third current sensor is partially reliable, and the first current value is taken as the high voltage circuit current value. When the first error rate is greater than the first threshold and the third error rate is less than or equal to the second threshold, the second current sensor is determined to be reliable and the third current sensor is partially reliable, and the second current value is used as the high-voltage circuit current value. When the first error rate, the second error rate, and the third error rate are all greater than their respective thresholds, it is determined that all three sensors are in a low confidence state, and the larger of the first current value and the second current value is taken as the high-voltage circuit current value.

[0013] As an improvement, the fault output port of the high-voltage sampling chip includes a first fault port and a second fault port. The first fault port and the second fault port are configured to have a preset logical complementary relationship during system initialization to form a redundant fault signal transmission channel for common cause failure protection. When the high-voltage sampling chip detects a short-circuit fault in the high-voltage circuit, the level of the first fault port flips from low to high, and the level of the second fault port flips from high to low, thereby triggering the first and second safety execution paths to perform corresponding protection actions.

[0014] As an improvement, the second core is also used for: Obtain the temperature and voltage values ​​from the first current sensor or the second current sensor; Based on a pre-stored temperature-voltage mapping table, the temperature and voltage values ​​are looked up and converted to obtain the corresponding temperature value. Use the temperature value to calculate the first current value or the second current value; The table lookup conversion includes: a temperature-voltage mapping table with 1 degree as the unit, from the minimum temperature to the maximum temperature, calibrating the temperature and voltage values ​​corresponding to each temperature point; determining the position number of the input voltage value in the mapping table through a binary lookup algorithm; calculating the compensation value using a linear proportional formula; rounding the compensation value; and finally calculating the actual temperature value from the position number and the compensation value.

[0015] As an improvement, the main control chip also includes a fault collection and control unit port, which constitutes the fault signal source of the third safe execution path, including a third fault port and a fourth fault port. The third fault port and the fourth fault port are configured to have a preset logical complementary relationship during system initialization, wherein the third fault port is configured to output a low level normally, and the fourth fault port is configured to output a high level normally. When the detection results of the first core and the third core are inconsistent, the main control chip determines that an internal hardware fault has been detected, and controls the level state of the third fault port to flip from low level to high level, and the level state of the fourth fault port to flip from high level to low level. The power management chip, as the execution unit of the third safety execution path, is configured to detect the level status of the third fault port and the fourth fault port in real time. When the third fault port is detected to be at a high level and the fourth fault port is at a low level and the duration exceeds the preset fault confirmation time, the first signal is output to the relay circuit power enable terminal to forcibly shut down the relay circuit power.

[0016] As an improvement, the system also includes a host computer that communicates with the second core. The host computer is used to acquire the calibration parameters of the first current sensor and the second current sensor during the production line calibration stage, and send them to the second core through the controller local area network bus. The calibration parameters include at least the resistivity, temperature coefficient and nonlinear compensation coefficient used to calculate the current value. The second core is also used to perform integrity verification on the received calibration parameters. Integrity verification includes cyclic redundancy check or cumulative check. If the verification passes, the calibration parameters are written to both the main memory block and the backup memory block of the internal non-volatile memory to form redundant storage. After the write operation is completed, a calibration success confirmation message is sent to the host computer. If the verification fails, a retransmission request is sent to the host computer, and the system waits to receive the calibration parameters again. The second core reads calibration parameters from the main memory block first when the system starts up. When the main memory block data verification fails, it automatically reads calibration parameters from the backup memory block for current calculation and writes the correct calibration parameters into the main memory block of the internal non-volatile memory.

[0017] The signal acquisition and safety protection method based on the vehicle battery management system, applied to any of the above-mentioned signal acquisition and safety protection systems based on the vehicle battery management system, includes the following steps: System initialization steps: In response to system power-on, the second core wakes up and performs a self-test on the high-voltage sampling chip, and reads and verifies the current sensor parameters from the memory to complete the system initialization configuration; The parallel security monitoring and data collection steps are executed periodically after the system enters normal operating mode, including: Redundant current acquisition and fusion sub-steps: The second core acquires the current signals from the first current sensor and the second current sensor at different cycles and converts them into the corresponding first current value and second current value. The first core acquires the current signal from the Hall current sensor and converts it into the third current value. The first core performs reliability assessment and data fusion based on the three current values ​​to determine the final high-voltage circuit current value for subsequent safety protection decisions. The multi-path redundancy security protection sub-steps include: First protection path: When the high-voltage sampling chip detects a short circuit fault in the high-voltage circuit, it outputs a level flip signal through its fault output port to trigger the protection circuit connected to the fault output port to disconnect the fuse and thus cut off the high-voltage circuit. Second protection path: The first core detects the level status of the fault output port during periodic tasks. When a level flip signal is detected, it controls the relay circuit power enable terminal to output a low level to shut down the relay circuit power. The third protection path: When the main control chip detects that the detection results of the first core and the third core are inconsistent, it outputs the corresponding port fault signal. The power management chip monitors the port signal fault status of the main control chip in real time, determines that the main control chip has an internal hardware fault based on the port fault status, and outputs the first signal to the relay circuit power enable terminal after the fault is confirmed, so as to forcibly shut down the relay circuit power. The adaptive high-voltage acquisition sub-step is as follows: The second core dynamically configures the acquisition sequence of the high-voltage sampling channel according to the opening and closing status and charging connection status of the relays in the high-voltage circuit, and sequentially acquires the voltage signals of multiple high-voltage sampling points according to the acquisition sequence.

[0018] As an improvement, the redundant current acquisition and fusion sub-step specifically includes: The second core reads the first AD conversion value of the first current sensor in the first cycle and stores it in a circular queue with a length of N, where N is an integer greater than 1. It then reads the second AD conversion value of the second current sensor in the second cycle and calculates the corresponding second current value. The second cycle is N times the length of the first cycle. The second core determines whether the second current value is in the first interval representing the low current operating condition: if yes, the first AD conversion value in the circular queue is sorted, and a representative value is selected as the effective AD value of the first current sensor based on the sorting result; if no, the first AD conversion value in the circular queue is subjected to extreme value removal and averaging filtering, and the calculated average value is used as the effective AD value of the first current sensor. After the second core calculates the corresponding first current value based on the effective AD value, it sends the first current value and the second current value to the first core through inter-core communication. The first core calculates the error rate between each pair of the first current value, the second current value, and the third current value from the Hall current sensor; Based on the relationship between the error rate and the preset threshold, the reliability of the first current value, the second current value, and the third current value is evaluated, and the final high-voltage circuit current value is determined according to the preset priority rules.

[0019] As an improvement, the adaptive high-voltage acquisition sub-step specifically includes: Detect the opening and closing status of the main positive relay and the main negative relay, as well as the connection status of the charging gun; Based on the detection results, select the corresponding acquisition sequence from a variety of pre-stored acquisition sequences for configuration; When the main positive relay and the main negative relay are detected to be in the closed state, the first acquisition sequence is configured. The first acquisition sequence is based on the current calculation cycle, and the window period is set to three times the current calculation cycle, so that the temperature and voltage values ​​of the two current sensors are acquired three times within the window period. When no charging gun connection signal is detected, a second acquisition sequence is configured. The second acquisition sequence performs at least two acquisitions of the voltage at the back end of the main positive relay and the voltage at the back end of the main negative relay within a preset window period. When a charging gun connection signal is detected, a third acquisition sequence is configured. The third acquisition sequence performs at least two acquisitions of the voltage at the back end of the main positive relay, the voltage at the back end of the main negative relay, the voltage at the back end of the charging positive relay, and the voltage at the back end of the charging negative relay within a preset window period. According to the configured acquisition sequence, the voltage signals of each high-voltage sampling point are acquired sequentially.

[0020] As an improvement, the parallel execution of the safety monitoring and data acquisition steps also includes a temperature calculation sub-step: The second core acquires the temperature and voltage values ​​of the current sensor collected in the adaptive high-voltage acquisition sub-step. Call the pre-stored temperature-voltage mapping table. The mapping table is in 1 degree units and calibrates the standard voltage value corresponding to each temperature point from the minimum temperature to the maximum temperature. The binary lookup table algorithm is used to locate two temperature points adjacent to the temperature and voltage values ​​in the mapping table, and to determine the voltage range and corresponding position number of the temperature and voltage values. The compensation value is calculated using a linear proportional formula based on the standard voltage and temperature values ​​corresponding to the two ends of the voltage range, and then rounded off. The final temperature value is calculated from the location number and the rounded compensation value; The temperature value is used to calculate the first current value or the second current value.

[0021] As an improvement, the method also includes a production line calibration step before the system initialization step: During the production line calibration stage, the host computer sends the calibration parameters of the first current sensor and the second current sensor to the second core through the controller local area network bus. The calibration parameters include at least the resistivity, temperature coefficient and nonlinear compensation coefficient. The second core performs integrity checks on the received calibration parameters. Integrity checks include cyclic redundancy check or cumulative sum check. If the verification passes, the calibration parameters are simultaneously written to the main memory block and backup memory block of the internal non-volatile memory to form redundant storage, and a calibration success confirmation message is sent to the host computer after the write operation is completed; if the verification fails, a retransmission request is sent to the host computer and the system waits to receive the calibration parameters again. In the system initialization process, the second core first reads the calibration parameters from the main storage block. When the main storage block data verification fails, it automatically reads the calibration parameters from the backup storage block for current calculation and writes the correct calibration parameters into the main storage block of the internal non-volatile memory.

[0022] Compared with the prior art, the advantages of the present invention are as follows: This invention constructs a highly reliable built-in self-testing and fault-tolerant unit through the lockstep core design of a multi-core main control chip. By utilizing the synchronous execution of instructions and mutual checking of results between the first and third cores, kernel-level hardware faults can be detected in real time, providing a basic safe computing environment for the entire system. On this basis, through the clear functional division of the first and second cores, the separation of safety-related functions and application algorithm processing is achieved. At the same time, the second core is independently responsible for the communication and relay control of the high-voltage sampling chip, effectively reducing the load pressure on a single core and improving the parallel processing efficiency of the system.

[0023] In terms of signal acquisition, this invention achieves efficient redundant acquisition of high-voltage circuit current signals by configuring a first current sensor and a second current sensor with different sampling periods and combining them with the dual-cycle reading mechanism of the second core. The second core intelligently selects either a representative value selection method based on sorting or an extreme value removal averaging filtering method to process the AD conversion value of the first current sensor according to the current range of the second current value calculated by the second current sensor. This effectively suppresses zero drift interference under low current conditions and smooths the filtering under non-low current conditions, significantly improving the accuracy and stability of current sampling.

[0024] In terms of data fusion and credibility assessment, the first core calculates the error rate between each pair of the three current values ​​and performs credibility assessment in combination with preset thresholds. It can make intelligent decisions according to priority rules when there are discrepancies in sensor data. This ensures high-precision fusion when most sensors are normal and also ensures that reliable high-voltage circuit current values ​​can still be output based on highly credible data or conservative strategies when some sensors fail. This achieves functional safety level decomposition at the current acquisition level.

[0025] In terms of safety protection, this invention innovatively constructs three independent and redundant safety execution paths: the first safety execution path directly triggers the protection circuit to disconnect the fuse through the fault output port of the high-voltage sampling chip, realizing hardware-level millisecond response to high-voltage circuit short-circuit faults; the second safety execution path provides programmable software-level protection by having the first core detect the level flip signal of the fault output port in periodic tasks and shut down the relay power supply by controlling the relay circuit power enable terminal; the third safety execution path has the power management chip monitoring the port signal fault status of the main control chip in real time. When the detection results of the first core and the third core are inconsistent, the relay circuit power supply is forcibly shut down after fault confirmation, forming the last line of defense against the failure of the main control chip itself. The coordinated work of these three paths completely solves the safety hazard of possible failure of a single protection mechanism, especially filling the protection blind spot between traditional fuses and relays under medium current short-circuit conditions.

[0026] In addition, the fault output port of the high-voltage sampling chip adopts a redundant fault signal transmission channel design with dual-port complementary levels, which can effectively prevent common-cause failure and ensure that the fault signal can still be reliably transmitted when a single port fails, further enhancing the triggering reliability of the first and second safe execution paths.

[0027] In terms of high-voltage signal acquisition, the second core can dynamically configure different high-voltage sampling channel acquisition sequences based on the opening and closing states of the main positive and negative relays and the connection status of the charging gun. When the main circuit is closed, it acquires the positive voltage of the battery pack and the temperature voltage of the current sensor in an alternating manner at high frequency. When the charging gun is not plugged in, it focuses on acquiring the voltage at the back end of the main positive and negative relays. When the charging gun is plugged in, it simultaneously takes into account the key voltage points of the main circuit and the charging circuit. This condition-adaptive acquisition strategy not only ensures the acquisition frequency of key voltage signals under key operating conditions, but also optimizes the allocation of sampling resources, providing timely and accurate voltage data for closed-loop current value calculation, relay adhesion diagnosis, and open circuit diagnosis.

[0028] In terms of temperature compensation, the second core, through a pre-stored temperature-voltage mapping table, combined with a binary lookup table algorithm and a linear interpolation algorithm, can efficiently and accurately convert the collected temperature and voltage values ​​into temperature values. After precision adjustment, these values ​​are used for current value calculation of the current sensor, effectively eliminating the influence of temperature changes on the accuracy of current measurement and further improving the accuracy of current value calculation in the high-voltage circuit.

[0029] Regarding production line calibration and data reliability, this invention sends calibration parameters, including resistivity, temperature coefficient, and nonlinear compensation coefficient, to the second core via a host computer during the production line calibration phase. After integrity verification, the parameters are simultaneously written to the main storage block and backup storage block of the internal non-volatile memory, forming redundant storage. If the verification fails, a retransmission is requested, ensuring the accurate writing of the calibration parameters. When the system starts, the second core prioritizes reading parameters from the main storage block. If the data verification of the main storage block fails, it automatically reads from the backup storage block. This mechanism effectively prevents system failure due to memory failure or data corruption, ensuring the accuracy and reliability of the calibration parameters used for current calculation throughout the entire lifecycle.

[0030] In summary, this invention constructs a full-link redundant protection system from signal perception to safe execution through a multi-core heterogeneous architecture, redundant current acquisition and intelligent fusion, three independent safe execution paths, adaptive high-voltage acquisition under operating conditions, high-precision temperature compensation, and a reliable production line calibration and storage mechanism. This significantly improves the reliability, accuracy, and fault tolerance of the vehicle battery management system in terms of high-voltage signal acquisition and safety protection, effectively preventing battery safety accidents caused by sensor failure, hardware failure, or software anomalies, and providing a higher level of functional safety assurance for the entire vehicle.

[0031] Attached image description (text in the attached image needs to be enlarged) The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Figure 1 This is a schematic diagram showing the connection of components in a signal acquisition and safety protection system based on an on-board battery management system. Figure 2 This is a block diagram of the electrical architecture of the high-voltage section. Detailed Implementation

[0032] like Figures 1 to 2 As shown, the signal acquisition and safety protection system based on the vehicle battery management system includes: The main control chip is a multi-core chip, including a first core, a second core, and a third core that acts as a lockstep core for the first core. The first core and the third core are used to execute the same instructions and detect each other's results to form the built-in self-test and fault-tolerant unit of the main control chip. The first core is used to perform battery pack individual cell signal acquisition and power control, and run application algorithms. The second core communicates with the high-voltage sampling chip through the first serial peripheral interface to obtain the voltage and current signals of the high-voltage circuit, and configures the latch through the second serial peripheral interface to control the high-side drive circuit and the bottom-side drive circuit, thereby controlling the closing and opening of the relay in the high-voltage circuit. The high-voltage sampling chip is connected to the second core and the first core respectively. It is used to collect the voltage and current signals of the high-voltage circuit and has a fault output port. The high-voltage sampling chip is also used to output a level flip signal through the fault output port when a short circuit fault is detected in the high-voltage circuit. The first safe execution path includes a protection circuit connected to the fault output port, which is used to receive a level flip signal and directly trigger the fuse to disconnect the high-voltage circuit. The second safety execution path includes a relay loop power enable terminal connected to the first core. The first core is used to detect the level state of the fault output port during periodic tasks. When a level flip signal is detected, the relay loop power enable terminal is controlled to output a low level to turn off the relay loop power. The third safety execution path includes a power management chip connected to the main control chip. The power management chip is used to monitor the port signal fault status of the main control chip. When a serious fault is detected, it outputs a first signal to forcibly shut down the power supply to the relay circuit. The second core is also used to initialize and configure the high-voltage sampling chip after the system starts up, and periodically collect and calculate the high-voltage loop current signal in normal working mode, and send it to the first core through inter-core communication. The first core is also used to collect the current signal of the Hall current sensor, and to calibrate the multiple current signals, including the current signal collected by the high-voltage sampling chip and the current signal of the Hall current sensor, in order to determine the final high-voltage loop current value.

[0033] The high-voltage sampling chip is equipped with a first current sensor and a second current sensor with different sampling periods; the second core is configured as follows: The first AD conversion value of the first current sensor is read in the first cycle and stored in a circular queue. The length of the circular queue is N, where N is an integer greater than 1. The second current sensor's second AD conversion value is read in the second cycle and the corresponding second current value is calculated, where the second cycle is N times the first cycle; Based on the current range in which the second current value is located, different filtering methods are selected to process the first AD conversion value in the circular queue: When the second current value is in the first interval that characterizes the low current operating condition, the effective AD value of the first current sensor is determined by a representative value selection method based on sorting. When the second current value is in the second interval that characterizes non-small current operating conditions, the effective AD value of the first current sensor is determined by the extreme value removal averaging filter method.

[0034] The first core is specifically used for: Calculate the first error rate between the first current value and the second current value, the second error rate between the first current value and the third current value, and the third error rate between the second current value and the third current value; Based on the preset error rate threshold, the reliability of the first current value, the second current value, and the third current value is evaluated. Based on the credibility assessment process, the final high-voltage circuit current value is determined according to the following priority order: When the first error rate is less than or equal to the first threshold, it is determined that both the first current sensor and the second current sensor are reliable, and the fused value of the first current value and the second current value is taken as the high voltage circuit current value. When the first error rate is greater than the first threshold and the second error rate is less than or equal to the second threshold, the first current sensor is determined to be reliable and the third current sensor is partially reliable, and the first current value is taken as the high voltage circuit current value. When the first error rate is greater than the first threshold and the third error rate is less than or equal to the second threshold, the second current sensor is determined to be reliable and the third current sensor is partially reliable, and the second current value is used as the high-voltage circuit current value. When the first error rate, the second error rate, and the third error rate are all greater than their respective thresholds, it is determined that all three sensors are in a low confidence state, and the larger of the first current value and the second current value is taken as the high-voltage circuit current value.

[0035] The fault output ports of the high-voltage sampling chip include a first fault port and a second fault port. The first fault port and the second fault port are configured to have a preset logical complementary relationship during system initialization to form a redundant fault signal transmission channel for common cause failure protection. When the high-voltage sampling chip detects a short-circuit fault in the high-voltage circuit, the level of the first fault port flips from low to high, and the level of the second fault port flips from high to low, thereby triggering the first and second safety execution paths to perform corresponding protection actions.

[0036] In the periodically executed high-voltage signal acquisition task, the second core first dynamically configures the acquisition sequence of the sampling channel according to the current operating conditions of the high-voltage circuit. Specifically, the second core detects the opening and closing states of the main positive relay and the main negative relay, as well as the connection status of the charging gun. When both the main positive relay and the main negative relay are detected to be in the closed state, a first acquisition sequence is configured. This sequence is based on the current calculation cycle, with a window period set to three times the current calculation cycle. This allows the temperature and voltage values ​​of the two current sensors (Shunt0 and Shunt1) to be acquired three times within this window period. Simultaneously, the positive voltage of the battery pack is acquired multiple times in an alternating manner, and temperature and voltage and other key channel acquisitions are inserted between two adjacent positive voltage acquisitions to ensure the real-time performance of current-temperature compensation and the accuracy of battery state-of-charge calculation. When no charging gun connection signal is detected, a second acquisition sequence is configured. This sequence includes at least two acquisitions of the voltages at the back ends of the main positive relay and the main negative relay within a preset window period for pre-discharge self-test. When a charging gun connection signal is detected, a third acquisition sequence is configured. This sequence includes at least two acquisitions of the voltages at the back ends of the main positive relay, the main negative relay, the charging positive relay, and the charging negative relay within a preset window period for pre-charging self-test. According to the configured acquisition sequence, the second core sequentially sends channel configuration commands to the high-voltage sampling chip through the first serial peripheral interface, reads the voltage conversion results of each channel, and thus obtains the voltage signals of high-voltage sampling points such as the positive terminal voltage of the battery pack, the fuse voltage, the voltage at the back end of the main positive relay, the voltage at the back end of the main negative relay, the voltage at the back end of the charging positive relay, the voltage at the back end of the charging negative relay, as well as the temperature voltage of the first current sensor and the temperature voltage of the second current sensor.

[0037] After acquiring the temperature and voltage values ​​from the current sensors, the second core immediately performs temperature compensation calculations. For each temperature sensor, the second core calls a pre-stored temperature-voltage mapping table. This mapping table uses 1 degree Celsius as a unit and calibrates the standard voltage values ​​corresponding to each temperature point from the minimum to the maximum temperature. A binary lookup table algorithm is used to determine the position number of the currently input temperature and voltage value in the mapping table. Then, a linear proportional formula is used to calculate the compensation value, which is rounded. Finally, the actual temperature value is calculated from the position number and the compensation value. Using the same method, the second core calculates the temperature values ​​of the first and second current sensors respectively. These temperature values ​​are then used in the current calculations of the first and second current sensors to eliminate the influence of temperature on the current measurement accuracy, thus obtaining the compensated first and second current values.

[0038] The main control chip also includes a fault collection and control unit port, which constitutes the fault signal source of the third safe execution path, including a third fault port and a fourth fault port. The third fault port and the fourth fault port are configured to have a preset logical complementary relationship during system initialization, wherein the third fault port is configured to output a low level normally, and the fourth fault port is configured to output a high level normally. When the detection results of the first core and the third core are inconsistent, the main control chip determines that an internal hardware fault has been detected, and controls the level state of the third fault port to flip from low level to high level, and the level state of the fourth fault port to flip from high level to low level. The power management chip, as the execution unit of the third safety execution path, is configured to detect the level status of the third fault port and the fourth fault port in real time. When the third fault port is detected to be at a high level and the fourth fault port is at a low level and the duration exceeds the preset fault confirmation time, the first signal is output to the relay circuit power enable terminal to forcibly shut down the relay circuit power.

[0039] The system also includes a host computer that communicates with the second core. The host computer is used to acquire the calibration parameters of the first current sensor and the second current sensor during the production line calibration stage, and send them to the second core through the controller local area network bus. The calibration parameters include at least the resistivity, temperature coefficient and nonlinear compensation coefficient used to calculate the current value. The second core is also used to perform integrity verification on the received calibration parameters. Integrity verification includes cyclic redundancy check or cumulative check. If the verification passes, the calibration parameters are written to both the main memory block and the backup memory block of the internal non-volatile memory to form redundant storage. After the write operation is completed, a calibration success confirmation message is sent to the host computer. If the verification fails, a retransmission request is sent to the host computer, and the system waits to receive the calibration parameters again. The second core reads calibration parameters from the main memory block first when the system starts up. When the main memory block data verification fails, it automatically reads calibration parameters from the backup memory block for current calculation and writes the correct calibration parameters into the main memory block of the internal non-volatile memory.

[0040] The signal acquisition and safety protection method based on the vehicle battery management system includes the following steps: System initialization steps: In response to system power-on, the second core wakes up and performs a self-test on the high-voltage sampling chip, and reads and verifies the current sensor parameters from the memory to complete the system initialization configuration; The parallel security monitoring and data collection steps are executed periodically after the system enters normal operating mode, including: Redundant current acquisition and fusion sub-steps: The second core acquires the current signals from the first current sensor and the second current sensor at different cycles and converts them into the corresponding first current value and second current value. The first core acquires the current signal from the Hall current sensor and converts it into the third current value. The first core performs reliability assessment and data fusion based on the three current values ​​to determine the final high-voltage circuit current value, which is used for subsequent safety protection decision-making on fault status. The multi-path redundancy security protection sub-steps include: First protection path: When the high-voltage sampling chip detects a short circuit fault in the high-voltage circuit, it outputs a level flip signal through its fault output port to trigger the protection circuit connected to the fault output port to disconnect the fuse and thus cut off the high-voltage circuit. Second protection path: The first core detects the level status of the fault output port during periodic tasks. When a level flip signal is detected, it controls the relay circuit power enable terminal to output a low level to shut down the relay circuit power. The third protection path: When the main control chip detects that the detection results of the first core and the third core are inconsistent, it outputs the corresponding port fault signal. The power management chip monitors the port signal fault status of the main control chip in real time, determines that the main control chip has an internal hardware fault based on the port fault status, and outputs the first signal to the relay circuit power enable terminal after the fault is confirmed, so as to forcibly shut down the relay circuit power. The adaptive high-voltage acquisition sub-step is as follows: The second core dynamically configures the acquisition sequence of the high-voltage sampling channel according to the opening and closing status of the relays and the charging connection status in the high-voltage circuit, and sequentially acquires the voltage signals of multiple high-voltage sampling points according to the acquisition sequence. The acquired voltages are mainly used for battery total voltage calculation, current and temperature sensor calculation, and relay fault diagnosis.

[0041] The redundancy current acquisition and fusion sub-steps specifically include: The second core reads the first AD conversion value of the first current sensor in the first cycle and stores it in a circular queue with a length of N, where N is an integer greater than 1. It then reads the second AD conversion value of the second current sensor in the second cycle and calculates the corresponding second current value, where the second cycle is N times the first cycle. The second core determines whether the second current value is in the first interval representing the low current operating condition: if yes, the first AD conversion value in the circular queue is sorted, and a representative value is selected as the effective AD value of the first current sensor based on the sorting result; if no, the first AD conversion value in the circular queue is subjected to extreme value removal and averaging filtering, and the calculated average value is used as the effective AD value of the first current sensor. After the second core calculates the corresponding first current value based on the effective AD value, it sends the first current value and the second current value to the first core through inter-core communication. The first core calculates the error rate between each pair of the first current value, the second current value, and the third current value from the Hall current sensor; Based on the relationship between the error rate and the preset threshold, the reliability of the first current value, the second current value, and the third current value is evaluated, and the final high-voltage circuit current value is determined according to the preset priority rules.

[0042] The specific steps of the adaptive high-voltage data acquisition sub-step include: Detect the opening and closing status of the main positive relay and the main negative relay, as well as the connection status of the charging gun; Based on the detection results, select the corresponding acquisition sequence from a variety of pre-stored acquisition sequences for configuration; When the main positive relay and the main negative relay are detected to be in the closed state, the first acquisition sequence is configured. The first acquisition sequence is based on the current calculation cycle, and the window period is set to three times the current calculation cycle, so that the temperature and voltage values ​​of the two current sensors are acquired three times within the window period. When no charging gun connection signal is detected, a second acquisition sequence is configured. The second acquisition sequence performs at least two acquisitions of the voltage at the back end of the main positive relay and the voltage at the back end of the main negative relay within a preset window period. When a charging gun connection signal is detected, a third acquisition sequence is configured. The third acquisition sequence performs at least two acquisitions of the voltage at the back end of the main positive relay, the voltage at the back end of the main negative relay, the voltage at the back end of the charging positive relay, and the voltage at the back end of the charging negative relay within a preset window period. According to the configured acquisition sequence, the voltage signals of each high-voltage sampling point are acquired sequentially.

[0043] The parallel execution of safety monitoring and data acquisition steps also includes a temperature calculation sub-step: The second core acquires the temperature and voltage values ​​of the current sensor collected in the adaptive high-voltage acquisition sub-step. Call the pre-stored temperature-voltage mapping table. The mapping table is in 1 degree units and calibrates the standard voltage value corresponding to each temperature point from the minimum temperature to the maximum temperature. The binary lookup table algorithm is used to locate two temperature points adjacent to the temperature and voltage values ​​in the mapping table, and to determine the voltage range and corresponding position number of the temperature and voltage values. The compensation value is calculated using a linear proportional formula based on the standard voltage and temperature values ​​corresponding to the two ends of the voltage range, and then rounded off. The final temperature value is calculated from the location number and the rounded compensation value; The temperature value is used to calculate the first current value or the second current value.

[0044] The method also includes a production line calibration step before the system initialization step: During the production line calibration stage, the host computer sends the calibration parameters of the first current sensor and the second current sensor to the second core through the controller local area network bus. The calibration parameters include at least the resistivity, temperature coefficient and nonlinear compensation coefficient. The second core performs integrity checks on the received calibration parameters. Integrity checks include cyclic redundancy check or cumulative sum check. If the verification passes, the calibration parameters are simultaneously written to the main memory block and backup memory block of the internal non-volatile memory to form redundant storage, and a calibration success confirmation message is sent to the host computer after the write operation is completed; if the verification fails, a retransmission request is sent to the host computer and the system waits to receive the calibration parameters again. In the system initialization process, the second core first reads the calibration parameters from the main storage block. When the main storage block data verification fails, it automatically reads the calibration parameters from the backup storage block for current calculation and writes the correct calibration parameters into the main storage block of the internal non-volatile memory.

[0045] This invention provides a signal acquisition and safety protection system based on an on-board battery management system. The system includes a main control chip, a high-voltage sampling chip, a first safety execution path, a second safety execution path, and a third safety execution path. The main control chip adopts a multi-core architecture, such as the NXP S32K356 multi-core chip, which includes a first core, a second core, and a third core serving as the first core's lockstep core. The first and third cores execute the same instructions and mutually check the results, forming a built-in self-test and fault-tolerant unit. When the results are inconsistent, a kernel exception is triggered. The first core is mainly used for acquiring individual battery pack signals, power control, and running application algorithms. The second core communicates with the high-voltage sampling chip (e.g., L9965C) through a first serial peripheral interface (SPI0) to obtain the voltage and current signals of the high-voltage circuit. It also configures latches through a second serial peripheral interface (SPI2) to control the high-side drive and bottom-side drive circuits, thereby controlling the closing and opening of relays (such as main positive relays, main negative relays, pre-charge relays, and charging relays) in the high-voltage circuit. The relay circuit power enable terminal is controlled by the Bat EN1 port of the first core; a high level enables, and a low level disables. The power management chip (SBC) is connected to the main control chip and is used to monitor the port signal fault status of the main control chip. When a serious fault is detected (such as the main control chip abnormally triggering the FCCU fault signal), it outputs a first signal (such as FS1B low level) to forcibly shut down the relay circuit power.

[0046] The high-voltage sampling chip is connected to both the second and first cores to acquire voltage and current signals from the high-voltage circuit. It also features fault output ports such as FAULT1 and FAULT2. When a short-circuit fault is detected in the high-voltage circuit, the high-voltage sampling chip outputs a level-flipping signal through the fault output port. Specifically, during system initialization, to prevent common-cause failure, FAULT1 is configured to a normal low level, and FAULT2 is configured to a normal high level, forming a complementary logic relationship. Once a short-circuit fault is detected, the level state of the first fault port flips from low to high, and the level state of the second fault port flips from high to low, simultaneously triggering the first and second safety execution paths.

[0047] The first safety execution path includes a protection circuit (e.g., L9965P) connected to the fault output port. This protection circuit directly triggers a fuse to disconnect the high-voltage circuit upon receiving a level toggle signal. The second safety execution path includes a relay circuit power enable terminal connected to the first core. The first core detects the level states of FAULT1 and FAULT2 during periodic tasks (e.g., 5ms cycles). When a toggle signal is detected, it outputs a low level through Bat EN1 to shut down the relay circuit power. The third safety execution path is implemented by a power management chip. The power management chip monitors the port signal fault status of the main control chip. When the main control chip detects a fault signal at the core's abnormal output port, the power management chip determines that an internal hardware fault has occurred. After a fault confirmation delay (e.g., 200ms), it outputs a first signal to the relay circuit power enable terminal, forcibly shutting down the relay circuit power.

[0048] In addition, the second core is used to initialize and configure the high-voltage sampling chip after system startup, and periodically collects and calculates the high-voltage loop current signal in normal operating mode, sending it to the first core via inter-core communication. The first core is also used to collect the current signal from the Hall current sensor and calibrate multiple current signals, including the current signal collected by the high-voltage sampling chip (two Shunt sensors) and the Hall current sensor signal, to determine the final high-voltage loop current value. Through this redundant design, a higher functional safety level is decomposed and downgraded.

[0049] The present invention also provides a signal acquisition and security protection method based on the above system, comprising the following steps.

[0050] Production line calibration steps: During the production line calibration phase, the host computer sends the calibration parameters of the first current sensor (Shunt0) and the second current sensor (Shunt1) to the second core via the controller local area network bus. The parameters include at least the resistivity, temperature coefficient, and nonlinear compensation coefficients (such as Shunt0_R, Shunt0_A, Shunt0_B, Shunt0_C and Shunt1_R, Shunt1_A, Shunt1_B, Shunt1_C). Upon receiving the data, the second core performs integrity verification (such as cyclic redundancy check or cumulative check). If the verification passes, the parameters are simultaneously written to the main storage block and backup storage block of the internal non-volatile memory to form redundant storage, and a calibration success confirmation message is sent to the host computer. If the verification fails, a retransmission request is sent, and the system waits for re-reception. This step ensures reliable storage of the sensor parameters, providing an accurate reference for subsequent current calculations.

[0051] System initialization steps: In response to system power-on, the second core sends a wake-up frame to wake up the high-voltage sampling chip (e.g., L9965C) through the first serial peripheral interface (e.g., SPI0) and performs a self-test. Specifically, the second core sends a command to read the device number through a pre-configured device ID. If the read device ID is equal to the expected configuration value (e.g., 0x01), it indicates that a device ID has been assigned and the relevant registers have been configured. After the high-voltage sampling chip is woken up, it automatically downloads the register configuration from the chip's internal non-volatile memory. If the device ID does not match the expected value, it writes the device number through a broadcast command (device ID is 0), configures the relevant registers, and requests that the configuration be saved to the chip's internal non-volatile memory for automatic loading upon the next wake-up. Subsequently, the second core reads the current sensor parameters from the non-volatile memory inside the main control chip: it prioritizes reading the parameters of the first current sensor (Shunt0) and the second current sensor (Shunt1) from the main memory block, including the resistance coefficient, temperature coefficient, and nonlinear compensation coefficients (e.g., Shunt0_R, Shunt0_A, Shunt0_B, Shunt0_C and Shunt1_R, Shunt1_A, Shunt1_B, Shunt1_C), and performs verification. If the main memory block verification fails, it automatically reads from the backup memory block. If the reading is successful, the correct data is rewritten to the main memory block. If the backup block verification also fails, the current sensor parameters are set to fault, and the above parameters are set to their default values. After completing the initialization configuration, the system enters normal operating mode.

[0052] Parallel execution of security monitoring and data acquisition steps: After the system enters normal working mode, this step is executed cyclically at a fixed period (e.g., 5ms), including the following sub-steps.

[0053] The redundant current acquisition and fusion sub-step specifically includes: the second core defining the acquisition counter Sap_Cnt and initializing it to 0; defining a circular queue AD array Shunt0_AdBuff for the first current sensor (Shunt0), with a configurable array size (e.g., default 7); defining the array index Array_Idx and initializing it to 0; and defining the AD value variable Shunt1_Ad and its voltage value variable Shunt1_Volt for the second current sensor (Shunt1). This is executed cyclically in a 5-millisecond task period. The second core reads the first AD conversion value of the first current sensor every 10 milliseconds and the second AD conversion value of the second current sensor every 70 milliseconds, according to application requirements.Specifically, when the acquisition counter Sap_Cnt is a multiple of 2, the second core reads the relevant register value of the first current sensor in the high-voltage sampling chip through the first serial peripheral interface, obtains the first AD conversion value, and stores it in the current array index position of the circular queue array Shunt0_AdBuff. Then, the array index Array_Idx is incremented by 1. If the array index Array_Idx reaches the maximum number of elements in the array, it is reset to 0. When the acquisition counter Sap_Cnt is a multiple of 7, the second core reads the relevant register value of the second current sensor in the high-voltage sampling chip through the first serial peripheral interface. The second AD conversion value is obtained and stored in Shunt1_Ad. The corresponding voltage value Shunt1_Volt is calculated according to the formula. Then, the second current value Shunt1_Cur is calculated using the pre-stored second current sensor calibration parameters (including resistance coefficient Shunt1_R, temperature coefficients Shunt1_A, Shunt1_B, and Shunt1_C) and the current temperature value Shunt1_T (provided by the temperature calculation sub-step). Specifically, when the acquisition counter Sap_Cnt is an integer multiple of 2, i.e., Sap_Cnt%2=0 (with a remainder of 0), the second current value Shunt1_Cur is calculated. 0), the second core reads the relevant register value of the first current sensor in the high-voltage sampling chip through the first serial peripheral interface, obtains the first AD conversion value and stores it in the current array index position of the circular queue array Shunt0_AdBuff, that is: Shunt0_AdBuff[Array_Idx]. Then, the array index Array_Idx is incremented by 1. If the array index Array_Idx reaches the maximum number of arrays, it is reset to 0. When the acquisition counter Sap_Cnt is an integer multiple of 7, that is, Sap_Cnt%7=0 (remainder is ...[Array_Idx]. The peripheral interface reads the relevant register values ​​of the second current sensor in the high-voltage sampling chip, obtains the second AD conversion value and stores it in Shunt1_Ad, and calculates the corresponding voltage value Shunt1_Volt according to the formula. Then, using the pre-stored calibration parameters of the second current sensor (including the resistance coefficient Shunt1_R, temperature coefficient Shunt1_A, Shunt1_B, and Shunt1_C) and the current temperature value Shunt1_T (provided by the temperature calculation sub-step), the second current value Shunt1_Cur is calculated. The calculation formula is as follows: Shunt1_Volt = Shunt1_Ad. 0.25 / 262144, the current value equals the voltage divided by the resistance. The formula for calculating the current value is: Shunt1_Cur = Shunt1_Volt / ( Shunt1_R (Shunt1_T) Shunt1_T Shunt1_A+Shunt1_T Shunt1_B+Shunt1_C)), where Shunt1_T is the temperature value of the Shunt1 current sensor.

[0054] To prevent the first current sensor from drifting to zero, the second core selects different filtering methods to process the first AD conversion value in the circular queue according to the operating condition range in which the second current value Shunt1_Cur is located: If Shunt1_Cur is in the first interval representing a small current condition (e.g., greater than -2A and less than 2A), the data in the circular queue array is copied to a temporary array, the temporary array is bubble sorted, and the array data with the sorted sequence number 1 is selected as the effective AD value of the first current sensor; if Shunt1_Cur is in the second interval representing a non-small current condition, the circular queue array is subjected to extreme value removal averaging filtering, that is, each data in the array is accumulated sequentially, while recording the maximum and minimum values. After the accumulation is completed, the maximum and minimum values ​​are subtracted, and then divided by the remaining number (e.g., divided by 5 when the array size is 7), and the average value is obtained as the effective AD value of the first current sensor. Subsequently, the second core calculates the corresponding voltage value Shunt0_Volt based on the valid AD value, and calculates the first current value Shunt0_Cur using the pre-stored calibration parameters of the first current sensor (including the resistance coefficient Shunt0_R, temperature coefficients Shunt0_A, Shunt0_B, and Shunt0_C) and the current temperature value Shunt0_T (provided by the temperature calculation sub-step). The calculation formula is as follows: Shunt0_Volt = Shunt0_Ad 0.25 / 262144, the current value equals the voltage divided by the resistance. The formula for calculating the current value is: Shunt0_Cur = Shunt0_Volt / ( Shunt0_R (Shunt0_T) Shunt0_T Shunt0_A+Shunt0_T Shunt0_B+Shunt0_C), where Shunt0_T is the temperature value of the Shunt0 current sensor. The acquisition counter Sap_Cnt is incremented by 1. When the first current value or the second current value changes, the second core sends Shunt0_Cur and Shunt1_Cur to the first core through inter-core communication.

[0055] The first core acquires the current signal from the Hall current sensor during the same cycle task and converts it into a third current value, Hall_Cur. The first core receives the first and second current values ​​sent by the second core and calculates the error rates between each pair of the three current values: the first error rate ε1 is the absolute difference between Shunt0_Cur and Shunt1_Cur divided by their average value; the second error rate ε2 is the absolute difference between Shunt0_Cur and Hall_Cur divided by their average value; and the third error rate ε3 is the absolute difference between Shunt1_Cur and Hall_Cur divided by their average value. Based on preset error rate thresholds (e.g., a first threshold of 1% and a second threshold of 10%), the first core performs a reliability assessment and determines the final high-voltage loop current value: if ε1 ≤ 1%, both the first and second current sensors are considered reliable, and the average of Shunt0_Cur and Shunt1_Cur is taken as the high-voltage loop current value; if ε1 > 1% and ε2 ≤ 10% or ε3 ≤ 10%, ε2 and ε3 are compared, and the current value corresponding to the sensor with the smaller error rate is taken as the high-voltage loop current value; if ε1 > 1% and both ε2 and ε3 > 10%, the values ​​of Shunt0_Cur and Shunt1_Cur are compared, and the larger value is taken as the high-voltage loop current value. This fusion result is used for subsequent safety protection decisions.

[0056] The adaptive high-voltage acquisition sub-step specifically includes: During system startup, the second core controls the relevant I / O outputs to a high level to activate the detection circuits for the battery pack positive voltage and fuse voltage. After system startup, it enters the working mode. In a periodic task every 5 milliseconds, the second core dynamically configures the acquisition sequence of the high-voltage sampling channel based on the open / closed state of the relays in the high-voltage circuit and the connection state of the charging gun, and sequentially acquires the voltage signals of each high-voltage sampling point according to the configured sequence. The acquired voltage signals are used for relay fault diagnosis (e.g., comparing the battery pack positive voltage with the voltage at the back end of the main positive relay to determine adhesion or open circuit faults) and battery status calculation (e.g., total battery pack voltage, load voltage, fast-charging load voltage, etc.). Since the high-voltage sampling chip typically has only one voltage acquisition ADC converter, it can only acquire one channel at a time. Therefore, a polling method is used to achieve multi-channel time-division acquisition. Multiple acquisitions of key channels (such as battery pack positive voltage and relay back-end voltage) are set within the window period to ensure the real-time performance and diagnostic accuracy of key signals.

[0057] Specifically, the second core detects the status of the main positive relay, the main negative relay, and the charging gun connection signal, and selects the corresponding acquisition sequence from a variety of pre-stored acquisition sequences for configuration based on the detection results: If the main positive relay and the main negative relay are detected to be in a closed state, a first acquisition sequence is configured. This sequence is based on the current calculation cycle, with a window period set to three times the current calculation cycle. This ensures that the temperature and voltage values ​​of the two current sensors are acquired three times within the window period, guaranteeing real-time current accuracy compensation. An exemplary first acquisition sequence is configured as an array containing 40 channels, specifically in the following order: PACK+ channel, main positive relay back-end channel, PACK+ channel, main negative relay back-end channel, PACK+ channel, Shunt0 temperature sensor channel, PACK+ channel, Shunt1 temperature sensor channel, PACK+ channel, fuse channel, PACK+ channel, charging positive relay back-end channel, PACK+ channel, charging negative relay back-end channel, PACK+ channel, bronze positive temperature sensor channel, PACK+ channel, bronze negative temperature sensor channel, PACK+ channel. The sequence includes the following channels: Shunt0 temperature sensor channel, PACK+ channel, Shunt1 temperature sensor channel, PACK+ channel, main positive relay rear channel, PACK+ channel, main negative relay rear channel, PACK+ channel, fuse channel, PACK+ channel, charging positive relay rear channel, PACK+ channel, charging negative relay rear channel, PACK+ channel, Shunt0 temperature sensor channel, PACK+ channel, Shunt1 temperature sensor channel, PACK+ channel, bronze positive temperature sensor channel, PACK+ channel, and bronze negative temperature sensor channel. This sequence alternately and repeatedly acquires the positive voltage of the battery pack, inserting current sensor temperature voltage and other critical channel acquisitions between adjacent acquisitions. This ensures that the positive voltage of the battery pack is acquired multiple times within a 200ms window period, and the acquisition period of the two temperature sensor channels does not exceed 70ms, meeting accuracy requirements.

[0058] If no charging gun connection signal is detected (charging gun not plugged in), a second acquisition sequence is configured. This sequence acquires the voltages at the back ends of the main positive relay and the main negative relay at least twice within a preset window period (e.g., 100 milliseconds) for pre-discharge self-test. An exemplary second acquisition sequence is configured as an array of 20 channels, specifically in the following order: PACK+ channel, main positive relay back end channel, main negative relay back end channel, PACK+ channel, fuse channel, PACK+ channel, Shunt0 temperature sensor channel, PACK+ channel, Shunt1 temperature sensor channel, PACK+ channel, main positive relay back end channel, PACK+ channel, main negative relay back end channel, PACK+ channel, bronze negative temperature sensor channel, PACK+ channel, charging positive relay back end channel, charging negative relay back end channel, PACK+ channel, bronze positive temperature sensor channel. This sequence acquires the voltages at the back ends of the main positive relay and the main negative relay twice each within the preset window period to ensure rapid confirmation of the relay status.

[0059] If a charging gun connection signal (gun plug-in status) is detected, a third acquisition sequence is configured. This sequence acquires the voltages of the main positive relay, main negative relay, charging positive relay, and charging negative relay back-end voltages at least twice within a preset window period (e.g., 100 milliseconds) for pre-charging self-test. An exemplary third acquisition sequence is configured as an array of 20 channels, specifically in the following order: PACK+ channel, main positive relay back-end channel, main negative relay back-end channel, PACK+ channel, fuse channel, PACK+ channel, charging positive relay back-end channel, charging negative relay back-end channel, PACK+ channel, Shunt0 temperature sensor channel, Shunt1 temperature sensor channel, PACK+ channel, main positive relay back-end channel, main negative relay back-end channel, PACK+ channel, charging positive relay back-end channel, charging negative relay back-end channel, PACK+ channel, bronze plate positive temperature sensor channel, and bronze plate negative temperature sensor channel. This sequence acquires the voltages of each of the four relay back-ends twice within the preset window period to ensure rapid confirmation of the charging circuit relay status.

[0060] After configuration, the second core performs polling acquisition according to the current acquisition sequence: a channel number variable is defined and initialized to 0, and the currently acquired channel is the channel corresponding to that number in the acquisition sequence; the second core sends the configuration value of the corresponding voltage conversion channel to the high-voltage sampling chip through the first serial peripheral interface, enabling it to acquire the voltage of that channel, and then reads the conversion result and stores it in the corresponding voltage variable (such as the positive terminal voltage of the battery pack, the voltage value at the back end of the main positive relay, etc.). The channel number is incremented. If the incremented number is less than the maximum number of channels in the acquisition sequence, the next channel is acquired in the next cycle; if the maximum number of channels is reached, it is reset to 0, and acquisition starts again from the beginning of the sequence in the next cycle. Through the above polling method, the second core completes the traversal of all channels in the acquisition sequence within a preset window period, thereby obtaining the voltage signal of each high-voltage sampling point.

[0061] Temperature calculation sub-step: The second core acquires the current sensor temperature and voltage values ​​collected in the adaptive high-voltage acquisition sub-step, including the temperature and voltage of the first current sensor (Shunt0), the temperature and voltage of the second current sensor (Shunt1), the positive copper plate temperature sensor voltage, and the negative copper plate temperature sensor voltage. The calculation method for the temperature value of each channel is the same; the following explanation uses the temperature value of the first current sensor as an example.

[0062] The second core pre-stores a temperature-voltage mapping table for the first current sensor. This mapping table uses 1 degree as a unit, calibrating the temperature and voltage values ​​corresponding to each temperature point from the minimum to the maximum temperature, with lower temperatures corresponding to higher voltage values. During temperature conversion, the second core uses a binary lookup table algorithm to determine the position number of the input voltage value in the mapping table, calculates the compensation value using a linear proportional formula, rounds the compensation value, and finally calculates the actual temperature value using the position number and the compensation value.

[0063] Specifically, an array is defined as a temperature-voltage mapping table. The first data in the array is the array length, the second data is the voltage value corresponding to the lowest temperature (e.g., -40℃), and the last data is the voltage value corresponding to the highest temperature (e.g., 120℃). Voltage values ​​for each temperature are defined in increments of 1℃. During temperature conversion, the second core first checks if the temperature and voltage values ​​exceed the lookup table range: if the temperature and voltage values ​​are greater than or equal to the voltage value corresponding to index 1 in the table, the lowest temperature is directly taken (considering a 10x accuracy amplification, this is -400℃); if the temperature and voltage values ​​are less than or equal to the voltage value corresponding to the last index in the table, the highest temperature is directly taken (a 10x accuracy amplification, this is 1200℃). If within the normal range, a binary lookup algorithm is used to determine the position index of the temperature and voltage value in the mapping table.

[0064] A temperature-voltage mapping table stores the standard voltage values ​​corresponding to each temperature point in ascending order of temperature. The first data in the table is the array length, the second data is the voltage value corresponding to the lowest temperature (e.g., -40℃), and the last data is the voltage value corresponding to the highest temperature (e.g., 120℃). The voltage values ​​for each temperature are defined in increments of 1℃. An exemplary mapping table can be defined as follows: const uint16 Shunt0TempVoltCfgTable

[21] = { twenty one, / Array length / / 0°-9° / 1120, 1119, 1118, 1117, 1116, 1115, 1114, 1113, 1112, 1111, / 10°-19° / 1110, 1109, 1108, 1107, 1106, 1105, 1104, 1103, 1102, 1101 }; In the binary search process, the low-order digit is defined as 1, and the high-order digit is the array length minus 1. When the low-order digit is less than the high-order digit, the middle digit is calculated as the low-order digit plus the high-order digit minus half of the low-order digit. If the temperature and voltage values ​​are less than or equal to the voltage value corresponding to the middle digit but greater than the voltage value corresponding to the middle digit plus 1, then the lookup digit is determined to be the middle digit. If the temperature and voltage values ​​are greater than the voltage value corresponding to the middle digit, then the high-order digit is updated to the middle digit minus 1; otherwise, the low-order digit is updated to the middle digit plus 1. This process continues until the lookup digit is located.

[0065] After determining the location number, the compensation value is calculated using a linear scaling formula: Compensation value = ((Voltage value corresponding to the lookup table number - Current temperature and voltage value) × 100) / (Voltage value corresponding to the lookup table number - Voltage value corresponding to the lookup table number plus 1). The compensation value is rounded, i.e., the compensation value is divided by 10 and modulo 10. If the remainder is greater than or equal to 5, the compensation value is increased by 5. The final temperature value is calculated as: Temperature value = (((Lookup table number - 1) × 100) + Compensation value - 4000) / 10, which is the actual temperature value after being magnified 10 times.

[0066] Using the same method, the second core calculates the temperature value of the corresponding channel based on the voltage of the positive temperature sensor of the copper plate, the voltage of the negative temperature sensor of the copper plate, and the temperature voltage of the second current sensor.

[0067] The multi-path redundancy security protection sub-step is executed in parallel with the above data acquisition steps, and includes three independent protection paths: First protection path: During system initialization, to prevent common-cause failure of ports, the fault output ports of the high-voltage sampling chip are configured with a preset logical complementary relationship. The first fault port FAULT1 is configured to output a low level under normal conditions, and the second fault port FAULT2 is configured to output a high level under normal conditions. After entering normal operating mode, the high-voltage sampling chip internally detects short-circuit faults in the high-voltage circuit in real time based on the current fault threshold. Once a short-circuit fault is detected, the level state of the first fault port flips from low to high, or the level state of the second fault port flips from high to low. The protection circuit connected to the fault output port (e.g., L9965P) directly detects that FAULT1 is high or FAULT2 is low, and immediately triggers the fuse to disconnect the high-voltage circuit, thereby achieving a hardware-level ultra-fast response.

[0068] Second protection path: The first core continuously monitors the level status of the fault output ports FAULT1 and FAULT2 during periodic tasks (e.g., 5ms cycle). When the first fault port is detected to be high and the second fault port is detected to be low, the first core's safety module sets the safety fault level accordingly (e.g., set to level 5). The fault handling module controls the relay circuit power enable terminal Bat EN1 to output a low level according to the fault level requirements, shuts off the relay circuit power supply, and disconnects the relay in the high-voltage circuit, providing programmable software-level intelligent protection.

[0069] The third protection path: The power management chip (SBC) monitors the port signal fault status of the main control chip in real time. During system initialization, to prevent common-cause failure of ports, the fault collection and control unit ports of the main control chip are configured with a preset logical complementary relationship. The third fault port FCCU1 is configured to output a normal low level, and the fourth fault port FCCU2 is configured to output a normal high level. After entering normal operation mode, when the main control chip detects a hardware fault (e.g., the detection results of the first core and the third core, which is the lockstep core, are inconsistent), the level state of the third fault port flips from low to high, and the level state of the fourth fault port flips from high to low. The power management chip monitors the level states of FCCU1 and FCCU2 in real time. When it detects that the third fault port is high or the fourth fault port is low, it starts a timer to confirm the fault. If this state continues for more than a preset fault confirmation time (e.g., 200 milliseconds), it determines that the main control chip has experienced an internal hardware fault and outputs a first signal (e.g., FS1B low level) to the relay circuit power enable terminal, forcibly shutting off the relay circuit power supply, causing the relay in the high-voltage circuit to disconnect, ensuring system safety. The three paths are independent of each other, forming redundant protection to ensure that the high-voltage circuit can be reliably disconnected under any single fault mode.

[0070] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0071] The units described in some embodiments of this disclosure can be implemented in software or in hardware. The described units can also be located in a processor, and the functions described above can be performed at least in part by one or more hardware logic components.

[0072] The above description only illustrates the preferred embodiments of the present invention and should not be construed as limiting the scope of the claims. The present invention is not limited to the above embodiments, and variations in its specific structure are permitted. All modifications made within the scope of the independent claims of this invention are also within the scope of protection of this invention.

Claims

1. A signal acquisition and safety protection system based on an on-board battery management system, characterized in that, include: The main control chip is a multi-core chip, including a first core, a second core, and a third core that acts as a lockstep core for the first core. The first core and the third core are used to execute the same instructions and detect each other's results to form the built-in self-test and fault-tolerant unit of the main control chip. The first core is used to perform battery pack individual cell signal acquisition and power control, and to run application algorithms. The second core communicates with the high-voltage sampling chip through a first serial peripheral interface to acquire the voltage and current signals of the high-voltage circuit, and configures latches through a second serial peripheral interface to control the high-side drive circuit and the bottom-side drive circuit, thereby controlling the closing and opening of relays in the high-voltage circuit. The high-voltage sampling chip is connected to the second core and the first core respectively, and is used to collect the voltage and current signals of the high-voltage circuit. It is also equipped with a fault output port. The high-voltage sampling chip is also used to output a level flip signal through the fault output port when a short circuit fault is detected in the high-voltage circuit. The first safe execution path includes a protection circuit connected to the fault output port, which is used to receive the level flip signal and directly trigger the fuse to disconnect the high-voltage circuit. The second safe execution path includes a relay loop power enable terminal connected to the first core. The first core is used to detect the level state of the fault output port during periodic tasks. When the level flip signal is detected, the relay loop power enable terminal is controlled to output a low level to turn off the relay loop power. The third safety execution path includes a power management chip connected to the main control chip. The power management chip is used to monitor the port signal fault status of the main control chip. When a serious fault is detected, it outputs a first signal to forcibly shut down the power supply of the relay circuit. The second core is also used to initialize and configure the high-voltage sampling chip after the system starts up, and periodically collect and calculate the high-voltage loop current signal in normal working mode, and send it to the first core through inter-core communication. The first core is also used to collect the current signal of the Hall current sensor, and to calibrate the multiple current signals, including the current signal collected by the high-voltage sampling chip and the current signal of the Hall current sensor, to determine the final high-voltage loop current value.

2. The signal acquisition and safety protection system based on the vehicle battery management system according to claim 1, characterized in that, The second core is also used to dynamically configure the acquisition sequence of the high-voltage sampling channel according to different operating conditions of the high-voltage circuit during periodic tasks; When the main positive relay and the main negative relay are detected to be in a closed state, a first acquisition sequence is configured. The first acquisition sequence is based on the current calculation cycle, and the window period is set to three times the current calculation cycle, so that the temperature and voltage values ​​of the two current sensors are acquired three times within the window period. When no charging gun connection signal is detected, a second acquisition sequence is configured. The second acquisition sequence includes at least two acquisitions of the voltage at the back end of the main positive relay and the voltage at the back end of the main negative relay within a preset window period. When a charging gun connection signal is detected, a third acquisition sequence is configured. The third acquisition sequence includes at least two acquisitions of the voltage at the back end of the main positive relay, the voltage at the back end of the main negative relay, the voltage at the back end of the charging positive relay, and the voltage at the back end of the charging negative relay within a preset window period. The second core sequentially acquires the voltage signals of each high-voltage sampling point according to the configured acquisition sequence. The high-voltage sampling points include at least the positive voltage of the battery pack, the voltage of the fuse, the voltage of the back end of the main positive relay, the voltage of the back end of the main negative relay, the voltage of the back end of the charging positive relay, the voltage of the back end of the charging negative relay, the temperature voltage of the first current sensor, and the temperature voltage of the second current sensor.

3. The signal acquisition and safety protection system based on the vehicle battery management system according to claim 1, characterized in that, The high-voltage sampling chip is equipped with a first current sensor and a second current sensor with different sampling periods; the second core is configured as follows: The first AD conversion value of the first current sensor is read in the first cycle and stored in a circular queue, the length of which is N, where N is an integer greater than 1; The second current sensor's second AD conversion value is read in the second cycle and the corresponding second current value is calculated, wherein the second cycle is N times the first cycle; Based on the current range in which the second current value is located, different filtering methods are selected to process the first AD conversion value in the circular queue: When the second current value is in the first interval representing a low current operating condition, the effective AD value of the first current sensor is determined by a sorting-based representative value selection method. When the second current value is in the second interval that characterizes non-small current operating conditions, the effective AD value of the first current sensor is determined by the extreme value removal averaging filter method.

4. The signal acquisition and safety protection system based on the vehicle battery management system according to claim 3, characterized in that, The first core is specifically used for: Calculate the first error rate between the first current value and the second current value, the second error rate between the first current value and the third current value, and the third error rate between the second current value and the third current value; The reliability of the first current value, the second current value, and the third current value is evaluated based on a preset error rate threshold. Based on the credibility assessment process, the final high-voltage circuit current value is determined according to the following priority order: When the first error rate is less than or equal to the first threshold, it is determined that both the first current sensor and the second current sensor are reliable, and the fused value of the first current value and the second current value is taken as the high voltage circuit current value. When the first error rate is greater than the first threshold and the second error rate is less than or equal to the second threshold, the first current sensor is determined to be reliable and the third current sensor is partially reliable, and the first current value is taken as the high voltage circuit current value. When the first error rate is greater than the first threshold and the third error rate is less than or equal to the second threshold, it is determined that the second current sensor is reliable and the third current sensor is partially reliable, and the second current value is used as the high-voltage circuit current value. When the first error rate, the second error rate, and the third error rate are all greater than their respective thresholds, it is determined that all three sensors are in a low confidence state, and the larger of the first current value and the second current value is taken as the high voltage circuit current value.

5. The signal acquisition and safety protection system based on an on-board battery management system according to claim 1, characterized in that, The fault output port of the high-voltage sampling chip includes a first fault port and a second fault port. The first fault port and the second fault port are configured to have a preset logical complementary relationship during system initialization to form a redundant fault signal transmission channel for common cause failure protection. When the high-voltage sampling chip detects a short-circuit fault in the high-voltage circuit, the level state of the first fault port flips from low to high, and the level state of the second fault port flips from high to low, so as to trigger the first safety execution path and the second safety execution path to perform corresponding protection actions respectively.

6. The signal acquisition and safety protection system based on the vehicle battery management system according to claim 4, characterized in that, The second core is also used for: Obtain the temperature and voltage values ​​of the first current sensor or the second current sensor; Based on a pre-stored temperature-voltage mapping table, the temperature and voltage values ​​are looked up and converted to obtain the corresponding temperature values. The temperature value is used to calculate the first current value or the second current value; The table lookup conversion includes: the temperature-voltage mapping table is set in units of 1 degree, from the minimum temperature to the maximum temperature, and the temperature and voltage values ​​corresponding to each temperature point are calibrated; the position number of the input voltage value in the mapping table is determined by the binary lookup table algorithm, the compensation value is calculated using the linear proportional formula, the compensation value is rounded, and finally the actual temperature value is calculated from the position number and the compensation value.

7. The signal acquisition and safety protection system based on the vehicle battery management system according to claim 1, characterized in that, The main control chip also includes a fault collection and control unit port, which constitutes a fault signal source for the third safe execution path, including a third fault port and a fourth fault port. The third fault port and the fourth fault port are configured to have a preset logical complementary relationship during system initialization, wherein the third fault port is configured to output a low level normally, and the fourth fault port is configured to output a high level normally. When the detection results of the first core and the third core are inconsistent, the main control chip determines that an internal hardware fault has been detected, and controls the level state of the third fault port to flip from low level to high level, and the level state of the fourth fault port to flip from high level to low level. The power management chip, as the execution unit of the third safe execution path, is configured to detect the level status of the third fault port and the fourth fault port in real time. When the third fault port is detected to be at a high level and the fourth fault port is at a low level and the duration exceeds the preset fault confirmation time, the chip outputs a first signal to the relay circuit power enable terminal to forcibly shut down the relay circuit power.

8. The signal acquisition and safety protection system based on the vehicle battery management system according to claim 3, characterized in that, The system also includes a host computer that is communicatively connected to the second core. The host computer is used to acquire the calibration parameters of the first current sensor and the second current sensor during the production line calibration stage, and send them to the second core through the controller local area network bus. The calibration parameters include at least the resistivity, temperature coefficient and nonlinear compensation coefficient used to calculate the current value. The second core is also used to perform integrity verification on the received calibration parameters. The integrity verification includes cyclic redundancy check or cumulative check. If the verification passes, the calibration parameters are simultaneously written to the main storage block and backup storage block of the internal non-volatile memory to form redundant storage. After the writing operation is completed, a calibration success confirmation message is sent to the host computer. If the verification fails, a retransmission request is sent to the host computer, and the core waits to receive the calibration parameters again. The second core reads calibration parameters from the main storage block first when the system starts up. When the main storage block data verification fails, it automatically reads calibration parameters from the backup storage block for current calculation and writes the correct calibration parameters into the main storage block of the internal non-volatile memory.

9. A signal acquisition and safety protection method based on an on-board battery management system, applied to the signal acquisition and safety protection system based on an on-board battery management system as described in any one of claims 1-8, characterized in that, Includes the following steps: System initialization steps: In response to system power-on, the second core wakes up and performs a self-test on the high-voltage sampling chip, and reads and verifies the current sensor parameters from the memory to complete the system initialization configuration; The parallel security monitoring and data collection steps are executed periodically after the system enters normal operating mode, including: Redundant current acquisition and fusion sub-step: The second core acquires the current signals from the first current sensor and the second current sensor at different cycles and converts them into corresponding first current values ​​and second current values. The first core acquires the current signal from the Hall current sensor and converts it into a third current value. The first core performs reliability assessment and data fusion based on the three current values ​​to determine the final high-voltage circuit current value for subsequent safety protection decisions. The multi-path redundancy security protection sub-steps include: First protection path: When the high-voltage sampling chip detects a short circuit fault in the high-voltage circuit, it outputs a level flip signal through its fault output port to trigger the protection circuit connected to the fault output port to disconnect the fuse and thus cut off the high-voltage circuit. Second protection path: The first core detects the level status of the fault output port during periodic tasks. When the level flip signal is detected, it controls the relay circuit power enable terminal to output a low level to shut down the relay circuit power. The third protection path: When the main control chip detects that the detection results of the first core and the third core are inconsistent, it outputs the corresponding port fault signal. The power management chip monitors the port signal fault status of the main control chip in real time, determines that the main control chip has an internal hardware fault based on the port fault status, and outputs the first signal to the relay circuit power enable terminal after the fault is confirmed, so as to forcibly shut down the relay circuit power. The adaptive high-voltage acquisition sub-step is as follows: The second core dynamically configures the acquisition sequence of the high-voltage sampling channel according to the opening and closing status and charging connection status of the relay in the high-voltage circuit, and sequentially acquires the voltage signals of multiple high-voltage sampling points according to the acquisition sequence.

10. The signal acquisition and safety protection method based on an on-board battery management system according to claim 9, characterized in that, The redundant current acquisition and fusion sub-steps specifically include: The second core reads the first AD conversion value of the first current sensor in the first cycle and stores it in a circular queue with a length of N, where N is an integer greater than 1. It also reads the second AD conversion value of the second current sensor in the second cycle and calculates the corresponding second current value. The second cycle is N times the first cycle. The second core determines whether the second current value is in the first interval representing a low current operating condition: if yes, the first AD conversion value in the circular queue is sorted, and a representative value is selected as the effective AD value of the first current sensor based on the sorting result; if no, the first AD conversion value in the circular queue is subjected to extreme value removal and averaging filtering, and the calculated average value is used as the effective AD value of the first current sensor. After the second core calculates the corresponding first current value based on the effective AD value, it sends the first current value and the second current value to the first core through inter-core communication. The first core calculates the error rate between each pair of the first current value, the second current value, and the third current value from the Hall current sensor; Based on the relationship between the error rate and the preset threshold, the reliability of the first current value, the second current value, and the third current value is evaluated, and the final high-voltage circuit current value is determined according to the preset priority rules.

11. The signal acquisition and safety protection method based on an on-board battery management system according to claim 9, characterized in that, The specific steps of the adaptive high-voltage acquisition sub-step include: Detect the opening and closing status of the main positive relay and the main negative relay, as well as the connection status of the charging gun; Based on the detection results, select the corresponding acquisition sequence from a variety of pre-stored acquisition sequences for configuration; When the main positive relay and the main negative relay are detected to be in a closed state, a first acquisition sequence is configured. The first acquisition sequence is based on the current calculation cycle, and the window period is set to three times the current calculation cycle, so that the temperature and voltage values ​​of the two current sensors are acquired three times within the window period. When no charging gun connection signal is detected, a second acquisition sequence is configured. The second acquisition sequence performs at least two acquisitions of the voltage at the back end of the main positive relay and the voltage at the back end of the main negative relay within a preset window period. When a charging gun connection signal is detected, a third acquisition sequence is configured. The third acquisition sequence performs at least two acquisitions of the voltage at the back end of the main positive relay, the voltage at the back end of the main negative relay, the voltage at the back end of the charging positive relay, and the voltage at the back end of the charging negative relay within a preset window period. According to the configured acquisition sequence, the voltage signals of each high-voltage sampling point are acquired sequentially.

12. The signal acquisition and safety protection method based on an on-board battery management system according to claim 9, characterized in that, The parallel execution of the security monitoring and data acquisition steps also includes a temperature calculation sub-step: The second core acquires the temperature and voltage values ​​of the current sensor collected in the adaptive high-voltage acquisition sub-step. Call the pre-stored temperature-voltage mapping table, which uses 1 degree as a unit and calibrates the standard voltage value corresponding to each temperature point from the minimum temperature to the maximum temperature. The binary lookup table algorithm is used to locate two temperature points adjacent to the temperature and voltage values ​​in the mapping table, and to determine the voltage range and corresponding position number of the temperature and voltage values. The compensation value is calculated using a linear proportional formula based on the standard voltage and temperature values ​​corresponding to the two ends of the voltage range, and the compensation value is rounded off. The final temperature value is calculated from the location number and the rounded compensation value; The temperature value is used to calculate the first current value or the second current value.

13. The signal acquisition and safety protection method based on an on-board battery management system according to claim 9, characterized in that, The method further includes a production line calibration step before the system initialization step: During the production line calibration stage, the host computer sends the calibration parameters of the first current sensor and the second current sensor to the second core through the controller local area network bus. The calibration parameters include at least the resistivity, temperature coefficient and nonlinear compensation coefficient. The second core performs integrity verification on the received calibration parameters, including cyclic redundancy check or cumulative sum check; If the verification passes, the calibration parameters are simultaneously written to the main storage block and backup storage block of the internal non-volatile memory to form redundant storage, and a calibration success confirmation message is sent to the host computer after the write operation is completed; if the verification fails, a retransmission request is sent to the host computer and the system waits to receive the calibration parameters again. In the system initialization step, the second core preferentially reads calibration parameters from the main storage block. When the main storage block data verification fails, it automatically reads calibration parameters from the backup storage block for current calculation and writes the correct calibration parameters into the main storage block of the internal non-volatile memory.

Images