Direct current charging pile core controller based on stm32 multi-core architecture

Abstract

The application relates to the technical field of new energy automobile charging infrastructure, in particular to a direct-current charging pile core controller based on an STM32 multi-core architecture, which comprises two components of a charging control terminal and a power environment information module, the charging control terminal takes STM32H767 as a main control chip, builds a three-level layered storage system of an AXI high-speed RAM in a chip, QSPI extended PSRAM and an externally connected SD card of an SDMMC, and the power environment information module takes two STM32F407s as a power control slave core and a group charging data collection slave core respectively, and the two slave cores realize memory sharing through SPI mounting and sharing of SRAM. In the scheme, through cooperation of the three-level heterogeneous architecture of the main control and the double slave cores and three-level layered storage, real-time cross verification of three-party data of in-gun isolation sampling, a metering electric meter and a vehicle BMS is realized, cooperation of full-dimension hardware isolation sampling eliminates data distortion hidden dangers, and sampling precision and system fault tolerance are improved; a three-level ring bridge layered power scheduling algorithm realizes multi-scene adaptive output of ring nearest reuse, two-bridge group cross-zone pairing and liquid-cooled supercharging cross-pile aggregation.

Description

Technical Field

[0001] This invention relates to the field of new energy vehicle charging infrastructure technology, and in particular to a core controller for DC charging piles based on the STM32 multi-core architecture. Background Technology

[0002] The STM32 multi-core architecture DC charging pile is an intelligent charging device that uses a high-performance embedded multi-core processor as the core control unit and is specifically designed for high-power DC fast charging of new energy electric vehicles. Its core controller is the control center of the entire charging pile system, undertaking core functions such as vehicle-charging pile BMS communication, power metering, cloud interaction, data storage, whole machine safety monitoring, multi-power module collaborative scheduling, and unified management of multi-gun parallel output.

[0003] With the rapid iteration of fast charging technology for new energy vehicles and the continuous increase in market share, public charging stations are gradually upgrading towards megawatt-level high-power, multi-gun concurrent, and multi-module stacked networking. The industry has placed higher demands on the real-time computing power scheduling, multi-module collaborative control, bus data processing, and overall safety and fault tolerance capabilities of charging piles. However, traditional charging pile controllers have many technical shortcomings: the single MCU centralized architecture lacks computing power resources under megawatt-level conditions, and multiple types of tasks competing for system resources leads to control delays and operational jitter; when multiple modules are stacked, the number of CAN bus nodes surges, and the single-bus centralized processing mode is prone to message congestion and data loss; ARM core boards and industrial control computer solutions have redundant hardware resources, insufficient real-time performance, poor adaptability to harsh operating conditions, and no hardware-level fault tolerance mechanism; existing architectures lack multi-core hardware mutual inspection and cross-core emergency response systems, and single-point failures can lead to system paralysis or even safety accidents. These shortcomings greatly restrict the high-performance, high-safety, and large-scale development of megawatt-level multi-gun group charging and photovoltaic-storage-charging integrated charging equipment.

[0004] To address this, this invention proposes a DC charging pile core controller based on an STM32 multi-core architecture. It employs a three-level heterogeneous hierarchical modular architecture with an STM32H767 main controller and dual STM32F407 slave cores, coupled with a three-level hierarchical isolated storage system consisting of on-chip AXI high-speed RAM, QSPI extended PSRAM, and an SD card, as well as a cross-core high-speed data interaction mechanism using SPI shared SRAM. This achieves complete hardware-level decoupling between real-time control and back-end operations. Furthermore, it utilizes real-time cross-verification of data from the charging gun's internal isolated sampling, the meter, and the vehicle's BMS, combined with comprehensive hardware isolation. The sampling and optocoupler-isolated bus enables high-precision acquisition of charging electrical data and system-level fault tolerance. Through a three-level ring bridge hierarchical power scheduling algorithm, including ring-based proximity multiplexing, first-level binary bridge pairing, second-level liquid-cooled supercharging cross-stacking aggregation, combined with dual-path isolated CAN binary bus scheduling and a reserved RS485 liquid-cooled expansion interface, it achieves flexible aggregation of multiple modules and adaptive output for various scenarios such as air-cooled conventional charging and liquid-cooled single-gun extreme supercharging. This effectively solves the core technical problems of traditional controllers, such as poor real-time performance, easy data distortion, rigid power scheduling, weak scenario adaptability, and lack of safety fault tolerance mechanisms. Summary of the Invention

[0005] Technical problems solved: The existing charging pile controllers have solved the problems of insufficient computing power leading to control delay, poor data acquisition accuracy and easy distortion, rigid power scheduling that cannot adapt to multiple scenarios, and lack of hardware-level safety fault tolerance mechanism.

[0006] To address the shortcomings of existing technologies, this invention provides a core controller for DC charging piles based on an STM32 multi-core architecture, thereby solving the technical problems mentioned in the background section.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] A core control method for DC charging piles based on STM32 multi-core architecture, the method comprising the following steps:

[0009] Step S1: After the system is powered on, the main control chip completes the hierarchical deployment and address space allocation of the three-level hierarchical storage system of on-chip AXI high-speed RAM, QSPI extended PSRAM and SDMMC external SD card;

[0010] Step S2: The main control chip starts the whole machine safety self-test, including safety switch quantity acquisition, contactor engagement feedback verification, insulation monitoring, short circuit detection, temperature and CC gun identification self-test. After all tests are passed, it enters standby mode.

[0011] Step S3: After the main control chip determines that the charging gun has completed the physical connection through the voltage of the CC pin, it communicates and shakes hands with the vehicle BMS, receives the vehicle electrical data and stores it in the AXI high-speed RAM, and at the same time reads the meter data and the sampling voltage inside the gun to establish a three-party dataset.

[0012] Step S4: The main control chip negotiates charging parameters based on vehicle demand, equipment status, and station load, and sends instructions to the slave core; the group charging core calculates the contactor switching scheme and writes it into the shared SRAM; the power control slave core performs three-level ring bridge hierarchical power scheduling to complete the power module networking.

[0013] Step S5: The main control chip performs closed-loop control in 30ms cycles, and performs real-time cross-verification of the sampling voltage inside the gun, the meter data and the vehicle BMS data. After the verification is passed, the adjustment amount is calculated and sent out for execution, and the gun temperature linkage verification and environmental monitoring are performed simultaneously.

[0014] Step S6: The group charging collection core polls and collects data from 12 charging terminals via a dual-channel CAN bus at a 50ms cycle, writes the results to the shared SRAM, collects the contactor feedback status through the DI port to perform fault self-diagnosis, and monitors the liquid cooling system status through the RS485 port.

[0015] Step S7: The master control and slave cores work together to perform graded fault monitoring and cross-core emergency response. Faults are classified into three levels: minor, general, and severe. In the event of a severe fault, the master control cuts off the contactor and auxiliary power supply in milliseconds, issues an emergency shutdown message, writes the fault information to the three-level storage, and uploads it to the cloud.

[0016] Step S8: Throughout the charging process, the sampled data is automatically transferred from DMA to AXI high-speed RAM for zero-wait storage, the logs and curves are periodically written to the PSRAM cache, the order data is written to the SD card for persistent storage, and interacts with the cloud through wired Ethernet and 4G / 5G wireless dual redundant links;

[0017] Step S9: After charging is completed, the main controller sends an end confirmation to the BMS. The power control reduces the power to zero according to the core descent curve and then drives the contactor to open. The main controller merges all data to generate a complete charging order, writes it to the three-level storage, uploads it to the cloud for confirmation, and then returns to standby state.

[0018] In one possible implementation, the overall safety self-test in step S2 specifically includes: the main controller collects the status of emergency stop, access control, and water immersion switches through the optocoupler-isolated DI channel, and can only continue after confirming that they are all in a normal non-triggered state. If any trigger occurs, the start is locked and a fault is reported; the main controller drives the contactor to engage through DO and compares and verifies the contact feedback collected through DI to determine whether the contactor fails to operate or is stuck; the main controller reads the insulation resistance data of the positive and negative poles to ground of the bus through the SPI bus and confirms that they are all greater than the safety threshold; during the insulation self-test, the main controller simultaneously performs short circuit detection, controls the positive contactor to close and the negative contactor to remain open, reads the switch status of the negative outer node converted by optocoupler isolation, and if it is high, it determines that the output is short-circuited and locks the contactor; the main controller reads the NTC voltage divider value through the ADC to calculate the gun temperature and confirms that the temperature is within a reasonable range and the multi-channel deviation does not exceed the threshold; the main controller reads the CC voltage sampling value through SPI and confirms that it is within the effective recognition range.

[0019] In one possible implementation, the charging gun connection identification and BMS communication handshake in step S3 specifically includes: determining the physical connection status and identifying the maximum charging current level by reading the voltage amplitude of two CC channels via SPI; triggering an alarm and limiting power when CC is abnormal; after connection confirmation, completing the BMS handshake via CAN bus according to the GB / T 27930 protocol, and caching BMS messages with zero wait time using AXI high-speed RAM; after successful handshake, receiving vehicle-side electrical data and storing it in AXI high-speed RAM, while simultaneously reading meter data via isolated RS485 and collecting the internal voltage of the charging gun via isolated sampling to establish a three-party dataset.

[0020] In one possible implementation, the three-level ring bridge hierarchical power scheduling described in step S4 specifically includes:

[0021] First priority ring scheduling strategy: The power control slave uses the power group number corresponding to the target charging gun as the basis, and first queries the idle status of the adjacent power group. If it is available, the corresponding ring contactor is turned on; if it is not available, the adjacent power group is decremented and the power resources are reused nearby.

[0022] Second priority level one-level two-branch group scheduling strategy: When the number of power supply groups called by the ring scheduling is insufficient, the core divides all 12 power supply modules into the first half (numbers 1 to 6) and the second half (numbers 7 to 12). Based on the current power supply group number n, cross-regional pairing bridge groups are established between the nth power supply group in the first half and the nth power supply group in the second half, forming six fixed pairings: 1-7, 2-8, 3-9, 4-10, 5-11, and 6-12. The corresponding level one pairing bridge group contactors are automatically activated to realize the parallel connection of cross-regional power supply groups. If it is still insufficient, the three-level cyclic calling mechanism is activated to link and call the idle groups on the left and right sides of the paired bridge groups, and call half of the power supply modules of the whole machine for centralized output.

[0023] The third priority secondary liquid-cooled supercharging bridge group scheduling strategy: When the core identifies the current charging gun as liquid-cooled charging gun No. 2, No. 5, No. 8, or No. 11 and there is still a power capacity gap, the supercharging scheduling permission is automatically unlocked. The cross-reactor parallel contactors of the adjacent power groups on the same side, the primary paired bridge group, and the secondary supercharging bridge group are activated in sequence. The cross-reactor contactors are activated step by step to gather all 12 power modules into a single liquid-cooled charging gun for centralized output. During the scheduling process, the liquid cooling heat dissipation is activated simultaneously through the reserved RS485 port in linkage communication with the liquid-cooled chiller unit controller.

[0024] In one possible implementation, the real-time cross-verification of the three parties in step S5 specifically includes: the main controller calculates the difference between the isolation sampling voltage inside the gun and the sampling voltage outside the meter. If the absolute value of the deviation exceeds a preset threshold, it is determined that there is a voltage divider circuit breakage or optocoupler temperature drift distortion, and a power current limiting command is issued; the main controller calculates the load UI curve characteristic value based on the current output voltage and output current collected by the meter, and performs deviation verification between the characteristic value and the voltage and current values ​​in the vehicle-side electrical data uploaded by the vehicle BMS. If the UI logic deviation threshold exceeds the normal range, it is determined that there is a metering communication abnormality or vehicle-pile interaction fault, and a protective shutdown command is triggered; the main controller also includes insulation monitoring data and CC sampling data in the cross-verification. If the insulation resistance value jumps or the CC voltage fluctuates abnormally, it is simultaneously determined that the line is damaged, the insulation is aging, or the gun has poor contact; when the verification is abnormal, alarms, power derating, or shutdown protection are executed according to the severity of the fault.

[0025] In one possible implementation, the data collection for group charging in step S6 specifically includes: polling 12 terminals in parallel via dual-channel isolated CAN at a 50ms cycle, with the load evenly distributed between the two channels to ensure full data collection within the cycle; determining communication abnormality when a terminal does not respond and synchronizing it to the power control slave core via shared SRAM; summarizing the power of each channel, the total load of the station, and the terminal priority and writing it into the shared SRAM; collecting feedback from 24 groups of contactors via DI and comparing it with the switching scheme one by one; determining failure to operate when closing via DI and sticking via DI when opening via DI; determining an abnormality in opening or closing via feedback that does not flip after operation and synchronizing it to the power control slave core via shared SRAM after identification; collecting the status of auxiliary power sources and fuses, terminating charging when abnormal; and monitoring the liquid cooling system via RS485 and activating linkage control after identification and access.

[0026] In one possible implementation, the graded fault monitoring and cross-core emergency response described in step S7 specifically includes: the master controller incorporates output voltage and current, insulation resistance, gun temperature, CC voltage, short circuit, and emergency stop access control water immersion status into millisecond-level judgments in each control cycle; minor faults are recorded and reported without interrupting charging; general faults trigger derating and send instructions to the slave core via CAN; in case of severe faults, the contactor and auxiliary power are disconnected via DO in milliseconds, and an emergency stop message containing fault codes is sent to the slave core via CAN. The slave core performs protection and sends back confirmation, and the fault information is synchronously written to the three-level storage and uploaded to the cloud; the master controller and slave core monitor each other across cores through heartbeat messages. When the slave core does not receive a heartbeat, it enters a safety degradation mode to maintain output and notifies the group charging aggregation core to coordinate reporting through shared SRAM; when the slave core detects a communication interruption with the master controller, it maintains polling and SRAM writing; when the master controller detects a timeout in the slave core, it records the fault and attempts to rebuild the link.

[0027] In one possible implementation, the core controller of the DC charging pile based on the STM32 multi-core architecture that performs the above control method includes a charging control terminal and a power environment information module.

[0028] The charging control terminal uses the STM32H767 as the main control chip, and is equipped with an on-chip AXI high-speed RAM, a PSRAM connected to the QSPI peripheral, and an SD card connected to the SDMMC interface to form a three-level hierarchical storage system; it integrates an isolation voltage sampling circuit, an insulation monitoring circuit, a CC signal acquisition circuit, an isolation digital input / output circuit, and a dual redundant communication module.

[0029] The power environment information module uses two STM32F407 chips as the power control slave core and the group charging data collection slave core, respectively. The two slave cores share global memory by connecting to the shared SRAM through the SPI peripheral. The power control slave core is configured with a dual-channel isolated CAN bus, and the group charging data collection slave core is configured with a dual-channel isolated CAN bus and has reserved an RS485 expansion interface.

[0030] The main control chip connects to two slave cores via two isolated CAN buses to achieve three-core collaborative control.

[0031] Beneficial effects compared to existing technologies:

[0032] 1. This solution achieves hardware-level decoupling between real-time control and back-end services through a multi-core hierarchical heterogeneous architecture and three-level layered isolated storage. It employs a three-level heterogeneous architecture with an STM32H767 main core and dual STM32F407 slave cores, separating the three major services—charging terminal management, power closed-loop control, and group charging aggregation scheduling—into independent hardware cores for independent processing. Simultaneously, it constructs a three-level layered storage system: on-chip AXI high-speed RAM dedicated to millisecond-level closed-loop control, QSPI extended PSRAM dedicated to back-end big data caching, and SD card dedicated to offline persistent archiving. The three types of storage media are partitioned and isolated, and computing power and bus bandwidth do not compete with each other, completely solving the problems of computing power contention, control latency, and task scheduling jitter caused by the mixed storage of real-time control data, back-end logs, and network cache data in traditional single-MCU solutions. This ensures hard real-time response for power closed-loop regulation and fault protection under megawatt-level high-power conditions.

[0033] 2. This solution achieves high-precision acquisition and system-level fault tolerance of charging electrical data through multi-source data cross-validation and full-dimensional hardware isolation sampling. It integrates three independent data sources: linear optocoupler isolation sampling inside the charging gun, RS485 isolated metering meter, and vehicle BMS. Real-time comparison and cross-validation of voltage and current data are performed in the on-chip high-speed RAM. This proactively identifies hidden faults such as open circuits in the voltage divider circuit, optocoupler temperature drift, metering deviation, and abnormal vehicle-charging station communication, triggering tiered current-limiting shutdown protection. Simultaneously, insulation monitoring, CC identification, short-circuit detection, NTC temperature measurement, and all digital I / O channels employ independent isolated sampling front-ends and optocoupler isolation buses, ensuring complete electrical isolation between high-voltage analog quantities and the main control low-voltage circuit. This mechanism eliminates high-voltage crosstalk and strong electromagnetic interference at the underlying hardware level, effectively eliminating the safety hazards of data distortion and missed fault detection under a single sampling method, and significantly improving the data reliability and operational safety level of charging piles in complex electromagnetic field environments.

[0034] 3. In this solution, a three-level ring bridge hierarchical power scheduling algorithm and SPI shared SRAM cross-core collaboration are used to achieve flexible aggregation of multiple modules and adaptive output in multiple scenarios. Its innovative design of a three-level priority scheduling strategy, namely ring proximity multiplexing, first-level binary bridge group pairing, and second-level liquid-cooled supercharging cross-stack aggregation, can flexibly group up to 36 power modules into 12 power supply groups. It supports adaptive switching of three modes: air-cooled low-power proximity calling, conventional high-power cross-group parallel connection, and liquid-cooled supercharging extreme full-site aggregation. The power control slave core and the group charging aggregation slave core achieve millisecond-level cross-core data synchronization through SPI shared SRAM. With the help of a dual-path isolated CAN binary bus, 50ms terminal polling and 30ms command issuance are achieved. This mechanism solves the problems of rigid power distribution, weak supercharging aggregation capability, and poor real-time performance of module paralleling in traditional charging piles. It takes into account both multi-gun equal charging and single-gun extreme supercharging scenarios. At its limit, a single gun can gather all 12 power supplies of the entire station for output. With the reserved RS485 liquid cooling expansion interface, it realizes heat dissipation linkage under high current supercharging conditions, which significantly improves the scenario adaptability and power resource utilization efficiency of high-power charging equipment. Attached Figure Description

[0035] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, the preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0036] Figure 1 This is a block diagram of the overall architecture of the power environment information module of the present invention;

[0037] Figure 2 This is a schematic diagram of the overall architecture of the charging control terminal of the present invention;

[0038] Figure 3 This is the main topology circuit diagram of the power distribution of the 12-channel DC group charging system of the present invention;

[0039] Figure 4 for Figure 3 Enlarged view of area A in the middle;

[0040] Figure 5 for Figure 3 Enlarged view of area B in the middle;

[0041] Figure 6 for Figure 3 Enlarged view of area C;

[0042] Figure 7 for Figure 3 Enlarged view of area D in the middle;

[0043] Figure 8 This is a flowchart of the control method of the present invention. Detailed Implementation

[0044] Preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention can also be implemented in various different forms, and therefore the present invention is not limited to the embodiments described below.

[0045] The technical solution in this application embodiment is to solve the problems mentioned in the background art, and the overall idea is as follows:

[0046] Please refer to Figures 1 to 8 As shown in the figure, this embodiment introduces a DC charging pile core controller based on the STM32 multi-core architecture. This controller adopts a hierarchical modular architecture and includes two main components: a charging control terminal and a power environment information module.

[0047] The charging control terminal uses an STM32H767 (480MHz) as its main control hub, and establishes a three-tiered storage system: 512KB on-chip AXI high-speed RAM for real-time vehicle charging control, QSPI extended PSRAM for backend big data services, and an external SD card for persistent storage via SDMMC. The charging control terminal is primarily responsible for dual-gun vehicle-charging-pile BMS communication, charging metering, cloud platform interaction, millisecond-level charging data monitoring, overall safety monitoring, and human-machine interface display. The terminal integrates multiple independent isolated sampling circuits, including gun-pile NTC temperature acquisition, isolated output voltage sampling, insulation monitoring and short-circuit detection, CC signal acquisition, fully isolated digital input / output control, and wired Ethernet and 4G / 5G wireless dual-redundant communication links.

[0048] The power environment information module is equipped with two STM32F407 chips, defined as a power control slave core and a group charging data aggregation slave core, respectively. The two slave cores share global memory via SPI peripherals and utilize an independent hardware bus for high-speed read / write interaction, achieving millisecond-level real-time data sharing across slave cores. The SPI bus is also used to expand hardware channels by adding multiple GPIO ports. The power control slave core is configured with a dual-channel isolated CAN bus (125kbps), employing a binary search method to parse module interaction messages in real time. It supports monitoring up to 36 charging modules, handling megawatt-level multi-power module parallel output closed-loop control, automatic adaptation and dynamic switching of 30kW / 40kW power modules, and rack environment monitoring. The group charging data aggregation slave core is also configured with a dual-channel isolated CAN bus, employing a binary search wiring method with a dual-task scheduling mechanism. It supports full data polling acquisition from up to 12 charging terminals, undertaking tasks such as balanced power distribution and load coordination scheduling for multiple charging piles in the site. An RS485 liquid-cooled expansion interface is also reserved.

[0049] The STM32H767 master controller is configured with two independent isolated CAN buses that connect to two slave cores respectively. The three cores synchronize all sampling, fault, and load data stored in the on-chip AXI RAM in real time, and work together to complete the integrated control from the bottom module closed loop, the middle layer group charging scheduling to the upper layer terminal management.

[0050] Based on the above controller architecture, this embodiment elaborates on the DC charging pile control method based on STM32 multi-core architecture. The method includes the following steps:

[0051] Step S1: System power-on initialization and hierarchical deployment of the three-tier storage architecture

[0052] After the system powers on, the STM32H767 main controller of the charging control terminal first completes the chip clock system configuration, setting the core frequency to 480MHz, and enabling the DMA hardware automatic transfer channel, QSPI peripherals, SDMMC peripherals, and clocks for various ADC, SPI, I2C, USART, and CAN communication peripherals. Simultaneously, the two STM32F407 slave cores of the power environment information module complete clock configuration and peripheral initialization, and connect to the shared SRAM via the SPI bus to complete memory read / write verification.

[0053] The main controller completes the hierarchical deployment and address space allocation of the three-tiered storage system, physically isolating the storage areas for different types of business data. Specifically, the 512KB on-chip AXI high-speed RAM is entirely allocated as a dedicated real-time data buffer, specifically for hard real-time services such as millisecond-level charging closed-loop control, BMS message parsing, multi-source data cross-validation, and instantaneous fault determination. The DMA channel is configured to automatically transfer ADC sampling results, switch status, and CAN transmit / receive FIFO data directly to the AXI RAM, requiring no CPU intervention during the transfer process. This ensures zero-wait access to core real-time data, completely unaffected by background tasks.

[0054] The CSSI2804LS PSRAM chip is initialized and configured using the chip's native four-wire QSPI peripheral. This storage area is mapped as a dedicated cache space for backend services, specifically for high-throughput, low-real-time background tasks such as cloud interaction message caching, HMI graphic data, device operation logs, historical charging data archiving, and fault tracing records. Data access in this area does not consume the main chip's real-time computing power or on-chip high-speed RAM resources, achieving physical isolation between frontend and backend business data and preventing bus bandwidth contention. The external SD storage card is initialized and its file system mounted via the chip's hardware SDMMC four-wire high-speed interface. This storage area is configured as an offline persistent storage space, specifically for long-term archiving of charging orders throughout the entire lifecycle, complete vehicle-to-charging station interaction records, fault logs, overall machine operation ledgers, device configuration parameters, and local firmware upgrade packages. Data is permanently preserved even in the event of power failure. After initialization of the three types of storage media, the system performs read / write tests on each storage area to confirm that the three-tier storage system is functioning correctly before proceeding to the next operational step.

[0055] Step S2: System-wide safety self-test and initial determination of all hardware status

[0056] After the three-level storage system is deployed, the main controller of the charging control terminal immediately initiates a comprehensive safety self-test process. The main controller collects the status of the emergency stop button, access control switch, and water immersion sensor through each optocoupler-isolated DI channel. Only after confirming that all three safety switch quantities are in a normal, non-triggered state can the subsequent self-test steps be executed. If any safety switch quantity is triggered, the entire machine startup process is directly locked and a fault is reported.

[0057] The main controller collects the auxiliary power output status and fuse on / off status of the two charging guns via the DI channel. After confirming that the auxiliary power supply is normal and the fuses are intact and conducting, it proceeds to the next step. The main controller drives the positive contactors of the two charging guns to perform a closing test via the DO electromagnetic relay. At the same time, it collects the actual contact feedback status of the contactors via the DI channel and compares it with the DO command: if the DI feedback is on after the closing command is issued, the contactor is judged to be normally closed; if the closing command is issued but the DI feedback is still open, the contactor is judged to have a failure to operate fault; if the closing command is not issued but the DI feedback is on, the contactor is judged to have a contact sticking fault. After the contactor self-test is completed, the main controller issues a trip command to confirm that the contactor is reliably disconnected. After the contactor passes the self-test, the main controller sends a start self-test command to the power control slave core and the group charging data collection slave core through two isolated CAN buses respectively. The two slave cores synchronously execute the self-test of their respective peripherals and communication links, and verify the normality of the cross-core data interaction link by writing and reading from each other through shared SRAM. The self-test results are reported to the main controller for summary via the CAN bus.

[0058] The main controller initiates the insulation monitoring self-test process. The main controller reads the insulation resistance data of the positive and negative bus terminals to ground from two ADX112 analog-to-digital converter chips via the SPI bus and M601 optocoupler isolation. After confirming that the insulation resistance values ​​of both the positive and negative bus terminals to ground are greater than the set safety threshold, the insulation self-test passes. During the insulation self-test, the main controller simultaneously performs output short-circuit detection: it controls the positive contactor to close and the negative contactor to remain open. The voltage divider sampling circuit is connected to the outer node of the negative contactor via an AQV258 optocoupler relay. The node voltage signal is converted to a high / low level switch signal via an LTV214 optocoupler isolation and sent to the main controller's IO port. The main controller reads the switch signal status. If it is low, it determines that there is no short-circuit fault in the output circuit; if it is high, meaning the potential outside the negative contactor is equal to the DC+ potential of the bus terminal, it directly determines that there is a short-circuit fault in the output positive and negative terminals, immediately locks all contactors to close the output, and reports a serious fault. After the insulation resistance, short-circuit switching quantity, and bus voltage are jointly verified, all self-test data are automatically stored in the on-chip AXI high-speed RAM via DMA. At the same time, temporary self-test records are generated and cached in the QSPI extended PSRAM, and finally written to the SD card for persistent archiving.

[0059] The main controller initiates a self-test for temperature sensor and CC charging gun identification. The main controller reads the voltage divider values ​​of the positive and negative NTC thermistors of the two charging guns via its on-chip 16-bit high-precision ADC. After impedance isolation and noise filtering by the LVM358 op-amp voltage follower circuit, the current gun column temperature is calculated, confirming that the temperature is within a reasonable ambient temperature range and that the deviation of the two four-channel sampling values ​​does not exceed the set threshold. The main controller reads the two CC pin voltage sampling values ​​collected by the ADX112 analog-to-digital converter chip via the SPI bus, confirming that the CC voltage is within the valid identification range, used for subsequent identification of the charging gun connection status and matching the vehicle charging current level. All self-test data is transferred to AXI RAM via DMA and synchronously cached in PSRAM. After summarizing all self-test results, the main controller determines that the entire unit meets the safe startup conditions and officially enters the standby charging monitoring state. Simultaneously, the self-test completion status is uploaded to the cloud management platform via dual redundant communication links.

[0060] Step S3: Charging gun connection identification and vehicle-charging station BMS communication handshake

[0061] After the system completes its self-test for overall safety, it enters the charging gun connection identification and vehicle-to-charging-MS communication handshake phase. The main controller reads the voltage sampling values ​​of the two CC pins collected by the ADX112 analog-to-digital converter chip via the SPI bus. Based on the CC voltage amplitude, it determines whether the charging gun and the vehicle socket have completed a reliable physical connection. At the same time, it identifies the maximum allowable charging current level parameter of the vehicle based on the voltage level. The main controller performs linkage verification between the CC sampling value and the insulation monitoring data. If the CC voltage is abnormal, exceeding the effective range or fluctuating, it determines that there is a broken wire or poor contact fault in the charging gun, immediately triggers a fault alarm, and limits the power output of that charging gun to zero. After the CC connection is confirmed, the main controller initiates the communication handshake process with the vehicle BMS via two isolated CAN buses. It completes the BMS connection establishment, identification, and version negotiation according to the communication protocol specified in the national standard GB / T 27930. The main controller completes the zero-wait buffering and parsing of BMS messages through the on-chip AXI high-speed RAM, ensuring millisecond-level response during the handshake phase.

[0062] After a successful BMS handshake, the main controller receives vehicle-side electrical data uploaded by the vehicle's BMS via the CAN bus. This data includes key parameters such as the battery pack's rated total voltage, maximum allowable charging current, current state of charge, maximum and minimum battery temperature, insulation status, and battery fault information. The main controller stores these vehicle-side parameters, along with the device-side data acquired during the self-test phase, into the real-time data buffer of the on-chip AXI high-speed RAM. Simultaneously, the main controller reads the raw data of the charging pile's output voltage and current collected by two dedicated metering meters via an isolated RS485 bus. Combined with the two-channel internal output voltage data collected by the internal isolation optocoupler sampling circuit (via HCLP-7800A linear optocoupler isolation and ADS1110 analog-to-digital converter), a three-way dataset containing vehicle-side BMS data, internal sampling data, and external metering data is established in the AXI RAM. This dataset prepares the data for subsequent multi-source data cross-validation during the charging process. The main controller then reports vehicle access events and vehicle battery parameters to the cloud management platform via a dual-redundant communication link, completing cloud registration and authentication before charging.

[0063] Step S4: Charging parameter negotiation and power scheduling decision

[0064] After the vehicle's BMS communication handshake is completed, the charging parameter negotiation and power scheduling decision-making phase begins. The main controller performs comprehensive charging parameter calculations based on the vehicle BMS demand data (rated total battery pack voltage, maximum allowable charging current) stored in the AXI high-speed RAM, the charging terminal equipment status data (maximum equipment output capacity, current ambient temperature, and gun cooling mode identification), and the overall station load data (current power of each in-use charging gun and total station power load) reported from the group charging data collection core via the CAN bus. If multiple charging guns are currently charging simultaneously at the station, the main controller compares the calculation results with the global power balancing allocation suggestions sent from the group charging data collection core to determine the maximum allowable output current and target output voltage of the current charging gun.

[0065] After completing the charging parameter decision, the master controller sends control commands, including parameters such as the target output voltage, the maximum output current limit, the number of power modules to be activated, and the power module number list, to the power control slave core and the group charging data aggregation slave core respectively via two isolated CAN buses. The group charging data aggregation slave core calculates and determines the specific contactor switching scheme based on the power allocation target sent by the master controller and the real-time load data of all 12 charging terminals in the station. This scheme is then written into the shared SRAM for the power control slave core to read and execute. After reading the contactor switching scheme from the shared SRAM, the power control slave core executes a three-level ring bridge hierarchical adaptive power allocation scheduling based on the power module number list and the number of integrated power modules in a single group (maximum 4 modules connected in parallel as a power supply group) determined in the scheme.

[0066] The specific execution process of power allocation scheduling is as follows:

[0067] The ring scheduling strategy (first priority) execution phase: The power control slave core uses the power group number corresponding to the target charging gun as a reference and first executes ring topology proximity multiplexing scheduling. The slave core employs directional addressing logic, following a preset ring contactor layout, first checking if the power group one position adjacent to the target charging gun's power group number is idle and not occupied by other charging guns. If the adjacent power group is idle and available, the corresponding ring contactor is directly activated, incorporating the idle power group into the current charging gun's power supply group, thus reusing power resources nearby and reducing contactor switching losses. If the adjacent power group is unavailable, the system continues to check the idle status of the power group one position lower than the target charging gun's position. If the lower than the target power group is idle and available, the corresponding ring contactor is activated to complete proximity multiplexing scheduling. If both adjacent power groups on the left and right sides are in use or faulty, the ring scheduling strategy cannot meet the current power demand, and the system proceeds to the next level of scheduling.

[0068] The execution phase of the first-level two-way bridge group scheduling strategy (second priority): When the number of power supply groups called by the ring scheduling strategy is insufficient to meet the output power demand of the vehicle, the power control slave core initiates the first-level two-way bridge group pairing scheduling logic. The slave core divides all 12 power supply modules into a front half (numbers 1 to 6) and a back half (numbers 7 to 12). Using the current charging gun's corresponding power supply group number n as the pairing reference node, a general two-way pairing logic is used to establish a cross-region pairing bridge group between the nth power supply module in the front half and the nth power supply module in the back half. Specifically, six fixed pairings are formed for the 12 power supply modules: 1 and 7, 2 and 8, 3 and 9, 4 and 10, 5 and 11, and 6 and 12. When the current power supply group (which already includes adjacent groups called by the ring scheduling strategy) still cannot meet the output power demand, the slave core automatically activates the corresponding first-level pairing bridge group contactor to include the paired cross-region power supply group into the power supply combination. After successful pairing, the current charging gun can achieve a maximum of 4 power modules connected in parallel (i.e., the local power module, the adjacent ring group, and the two-way bridge pairing group are connected in parallel). If the output power demand cannot be met after the 4 power modules are connected in parallel, a three-level cyclic calling mechanism is initiated from the core to call up the idle groups adjacent to the paired bridge group on the left and right. Half of the power modules (6 groups) of the whole machine can be called up for centralized output, which is suitable for conventional high-power air-cooled charging scenarios.

[0069] The execution phase of the secondary liquid-cooled supercharging bridge group scheduling strategy (third priority): When the power control core identifies the current charging gun as one of the four liquid-cooled charging guns (numbers 2, 5, 8, and 11), and there is still a power capacity gap after completing the above-mentioned ring scheduling and first-level bi-branch bridge group scheduling, the slave core automatically unlocks the third-priority secondary liquid-cooled supercharging bridge group scheduling authority. The slave core first identifies the supercharging mini-stacking group corresponding to the current liquid-cooled gun (each mini-stacking group corresponds to one liquid-cooled supercharging gun, internally using a semi-matrix interconnecting contactor layout), and activates resources at each level sequentially according to the hierarchical scheduling logic: priority is given to activating adjacent power supply groups on the same side using the bi-branch method; if the power is insufficient, the first-level paired bridge group is activated; if there is still a power gap, the secondary supercharging bridge group cross-stacking parallel contactor is activated. After the secondary supercharging bridge group is activated, the power supply group of this supercharging mini-stacking group can perform cross-stacking aggregated output with the power supply group of the adjacent supercharging mini-stacking group. Under extreme operating conditions, by sequentially activating the cross-reactor contactors of the secondary supercharging bridge group, all 12 power modules of the entire unit are ultimately converged to a single liquid-cooled charging gun for centralized output, achieving single-gun super-fast charging. During supercharging scheduling, the nuclear synchronous controller communicates with the liquid-cooled chiller unit controller via a reserved RS485 expansion port to activate the liquid-cooled heat dissipation system for coordinated temperature control, ensuring the thermal management safety of the charging gun under high-current supercharging conditions.

[0070] After the three-level power scheduling is completed, the power control slave core synchronizes the finalized contactor switching scheme (including the list of activated ring contactor numbers, the list of primary paired bridge group contactor numbers, and the list of secondary supercharging bridge group contactor numbers) to the group charging data aggregation slave core via shared SRAM. The group charging data aggregation slave core then collects the actual contact feedback signals of all power distribution contactors through the DI channel, completing the closed-loop verification between the contactor switching scheme and the actual hardware status. Simultaneously, the power control slave core drives the corresponding contactor to engage through the DO port, completing the physical network connection of the power modules.

[0071] Step S5: Multi-source data cross-validation and charging closed-loop control

[0072] After the contactor switching is completed and the power module is physically connected, the system enters the charging closed-loop control stage. The main controller continuously executes closed-loop control according to the set voltage and current adjustment cycle (30ms cycle), as follows:

[0073] Three-phase data cross-validation: At the beginning of each control cycle, the main controller simultaneously reads the current charging electrical parameters from three independent data sources. The first data source is the isolated high-voltage sampling circuit inside the charging gun: the high-voltage signal inside the charging gun is divided by multiple high-impedance stages and then connected to an HCLP-7800A linear optocoupler to achieve strong and weak current isolation. The analog signal output by the optocoupler is filtered by RC and then sent to the ADS1110 high-precision isolated analog-to-digital converter chip. The chip uploads the two-channel internal voltage sampling data of the charging gun to the main controller via the I2C bus. The high-voltage sampling circuit is completely electrically isolated from the low-voltage circuit of the main controller. The second data source is an external dedicated meter: the meter uploads the original metering data of the external voltage and external current of the charging pile output at regular intervals via an isolated RS485 differential bus. The third data source is the real-time electrical data of the vehicle end (including the actual voltage, actual current, battery status, etc.) uploaded by the vehicle BMS via the CAN bus. After the main controller writes the three data sources into the AXI high-speed RAM simultaneously, it performs real-time comparison and cross-validation.

[0074] The main controller calculates the difference between the voltage sampled inside the charging gun and the voltage sampled outside the meter. If the absolute value of the deviation exceeds a preset threshold, it determines that there is a voltage divider circuit open circuit or optocoupler temperature drift distortion, immediately issues a power current limiting command, caches the fault record to PSRAM, and archives it to the SD card. The main controller calculates the load UI curve characteristic value based on the current output voltage and current collected by the meter, and checks the deviation of this characteristic value against the voltage and current values ​​in the vehicle-side electrical data uploaded by the vehicle BMS. If the UI logic deviation exceeds the normal range, it determines that there is a metering communication abnormality or a vehicle-pile interaction fault, and immediately triggers a protective shutdown command. The main controller also incorporates insulation monitoring data and CC sampling data as auxiliary verification parameters into the cross-verification system. If the insulation resistance value jumps or the CC voltage fluctuates abnormally, it simultaneously determines hidden faults such as line damage, insulation aging, and poor gun contact. When the three-party data verification is abnormal, the main controller executes alarm, power derating, and shutdown protection measures according to the severity of the fault. After all verifications pass, the verification results and the sampled data are automatically transferred by DMA to the AXI RAM real-time data buffer. At the same time, the sampled curve data is temporarily cached in the QSPI extended PSRAM for subsequent cloud upload and local export.

[0075] Voltage and current closed-loop regulation: After the three-way data cross-verification is successful, the main controller calculates the voltage and current regulation amounts for this control cycle based on the target voltage and current values ​​determined during the charging parameter negotiation phase, combined with the current real-time sampled values ​​and the dynamic requirements of the vehicle's BMS. The main controller converts the PID calculation results into power module control commands and sends them to the power control slave core via a dual-channel isolated CAN bus. After receiving the voltage and current regulation commands from the main controller, the power control slave core sends the commands to each charging power module for execution via its own dual-channel isolated CAN bus (using a binary message parsing mechanism, communication rate 125kbps) at a 30ms cycle. Each module responds to the regulation commands to achieve current sharing output, meeting the national standard's 100ms voltage and current regulation rate interaction timing constraint.

[0076] Charger temperature linkage verification: During the voltage and current closed-loop regulation process, the main controller synchronously performs charger temperature safety verification in each control cycle. The main controller continuously acquires the voltage divider temperature signals of the positive and negative NTC thermistors of the two charging guns through the on-chip 16-bit high-precision ADC (using the chip's analog domain 3.3V VDDA as the conversion reference). After impedance isolation and noise filtering by the voltage follower conditioning circuit composed of LVM358 op-amps, the temperature sample value is directly sent to the main controller's ADC channel. The main controller performs linkage verification between the charger temperature sample value and the current real-time output current, and calculates the matching relationship between the current charger temperature rise rate and the current ratio. If the charger temperature exceeds the set derating temperature threshold, the main controller immediately executes the power derating strategy, gradually reducing the output current limit value according to the preset temperature-current derating curve, and synchronously sends the derating command to the power control slave core for execution via the CAN bus. If the gun temperature exceeds the set shutdown protection threshold, the main controller triggers a system-wide shutdown protection within milliseconds. This involves disconnecting the positive and negative contactors via the DO electromagnetic relay, and simultaneously sending an emergency shutdown command to the power control slave core and the group charging data aggregation slave core via two isolated CAN buses. Upon receiving the command, the slave core immediately cuts off the PWM output of all power modules and disconnects the module's AC input contactor. During power derating and shutdown, real-time temperature data is stored in the on-chip AXI high-speed RAM for closed-loop control. The temperature sampling curve is temporarily cached in the QSPI extended PSRAM, and finally written to the SD card for persistent archiving of the entire charging temperature data.

[0077] Environmental monitoring linkage: During closed-loop control, the power control slave synchronously reads the cabinet temperature and humidity sensor and bus temperature sampling signals through multiple analog acquisition interfaces, adjusts the cooling fan speed through the PWM output interface, and collects fan fault feedback signals in real time. If the power control slave determines that the cabinet is overheating or the cooling has failed, it immediately generates an environmental anomaly alarm message and sends it to the master controller via the CAN bus. Upon receiving the alarm, the master controller synchronously executes power derating protection, caches the alarm event in PSRAM, and archives it to the SD card.

[0078] Step S6: Data aggregation and balanced scheduling of multiple charging stations

[0079] While implementing closed-loop charging control, the group charging data aggregation slave core continuously executes parallel data acquisition and balanced scheduling tasks for all multi-gun charging terminals in the entire station. This slave core is configured with two independent isolated high-speed CAN buses, employing a binary routing structure and a dual-task scheduling mechanism to perform fixed-period (50ms) full data polling acquisition on up to 12 single-gun or dual-gun main control modules throughout the station. The specific process is as follows:

[0080] The group charging data collection slave core polls each charging terminal's uploaded operating data, status, and fault information via a first isolated CAN bus at a fixed 50ms interval. This includes core parameters such as the current output voltage, output current, charging capacity, charging mode, vehicle BMS communication status, and fault codes of each charging gun. Similarly, it polls the remaining terminals in parallel via a second isolated CAN bus at a 50ms interval. The dual buses evenly distribute the load, ensuring that all 12 terminal data points are collected and aggregated within the 50ms interval. During the polling process, if a terminal fails to respond multiple times consecutively, the slave core determines that the terminal's communication link is abnormal, immediately generates a communication fault record, synchronizes it to the power control slave core via shared SRAM, and simultaneously reports it to the master control via the CAN bus to trigger an alarm.

[0081] The group charging data aggregation core performs real-time summarization and statistical calculations on the polled data from all terminals in the station, including the cumulative calculation of the current power of each terminal, the total power load statistics of the station, and the priority ranking of the charging demand of each terminal. The slave core writes the summarized statistical results into the SPI shared SRAM, and the power control slave core reads the total power load data of the station through the shared SRAM as input parameters for its own power module scheduling decisions. The two slave cores achieve millisecond-level cross-core data interaction through the shared SRAM, ensuring high-speed synchronization of power load data and module operating condition data. At the same time, the group charging data aggregation slave core uploads the summarized global power data of the station to the master controller via a dedicated CAN bus. The master controller dynamically adjusts the power allocation weight of each charging terminal according to the global load, realizing station-level multi-gun balanced charging scheduling.

[0082] During the polling and acquisition process, the group charging data aggregation slave core simultaneously performs real-time monitoring of the power distribution contactor status. The slave core continuously collects the actual contact feedback signals of all 24 power distribution contactors through multi-channel isolated digital input (DI) ports, comparing the feedback status with the currently effective contactor switching scheme one by one to achieve real-time self-diagnosis of contactor faults: if the contactor drive command is closing but the DI feedback is opening, a contactor failure to operate is identified; if the drive command is opening but the DI feedback is conducting, a contactor contact sticking fault is identified; if the feedback status does not reverse as expected within a specified time after contactor operation, a contactor abnormal opening / closing fault is identified. Once the slave core identifies any contactor fault, it immediately synchronizes the fault information to the power control slave core via shared SRAM. The power control slave core executes corresponding protection actions according to the fault type (retransmitting the drive command or switching to a backup contactor in case of failure to operate; locking the corresponding power module output and alarming the upper level in case of sticking). Simultaneously, the group charging aggregation slave core reports the fault record to the master controller via the CAN bus. The master controller synchronously records the fault event to the three-level storage and reports it to the cloud platform. In addition, the auxiliary power source status and fuse on / off status signals are collected from the nuclear synchronous generator. When the auxiliary power source loses power or the fuse blows, the corresponding charging gun process is immediately terminated and the fault indicator light is activated.

[0083] The group charging data collection slave core continuously monitors the communication data of the liquid-cooled chiller unit controller through the reserved RS485 expansion port. If the liquid cooling system access signal is detected, the liquid cooling linkage control function is automatically activated. Based on the coolant temperature and flow parameters uploaded by the liquid cooling unit, the heat dissipation power level is adjusted in real time and the liquid cooling status data is incorporated into the whole machine operation monitoring system. The data is then uploaded to the main controller to complete the unified management of the status of all equipment.

[0084] Step S7: Fault classification and handling and cross-core emergency response

[0085] Throughout the entire charging process (including standby monitoring, handshake negotiation, and charging closed-loop stages), the master controller and the two slave cores collaborate to perform graded fault monitoring and cross-core emergency response. The system classifies faults into three levels according to their severity: minor faults, general faults, and severe faults, with different levels triggering differentiated protection response strategies.

[0086] Master Control Level Fault Monitoring and Response: Within each control cycle, the master controller executes a full-machine safety inspection logic, incorporating all safety parameters such as output voltage, output current, insulation monitoring values, gun column temperature, CC voltage, short-circuit switching status, emergency stop status, access control status, water immersion status, and contactor DI feedback status into millisecond-level rolling judgments. When the master controller detects a minor fault (such as slight fluctuations in CC voltage or gun temperature approaching the derating threshold but not exceeding it), it records the fault event and caches it in PSRAM, simultaneously reporting it to the cloud platform for record-keeping via a dual-redundant communication link, without interrupting the current charging process. When the master controller detects a general fault (such as gun temperature reaching the derating threshold, internal and external voltage deviation exceeding limits but still within a controllable range, or ambient temperature being too high), it triggers a power derating protection command in milliseconds, sending the drated current limit value to the power control slave core and the group charging data aggregation slave core via two isolated CAN buses, simultaneously writing the fault information to the three-level storage medium, reporting it to the cloud platform via the communication link, and pushing a site maintenance alarm. When the main control detects a serious fault (including but not limited to: short-circuit switch trigger at high level, insulation resistance value below the safety threshold, gun temperature exceeding the shutdown protection threshold, emergency stop button trigger, abnormal access control opening, water immersion sensor trigger, contactor sticking or failure to operate, auxiliary power failure, fuse blown, BMS communication timeout, vehicle BMS uploading fault code, internal and external voltage deviation exceeding the allowable limit), the main control executes the following emergency response sequence within milliseconds:

[0087] First, the main controller immediately cuts off the positive and negative contactors of the two charging guns directly through the DO electromagnetic relay, physically disconnecting the main charging circuit; simultaneously, it cuts off the auxiliary power supply of the two gun bodies through the DO channel, releasing the electronic lock of the charging gun.

[0088] Secondly, within the same millisecond-level time window, the master controller sends emergency stop messages in parallel to the power control slave core and the group charging data aggregation slave core via two dedicated isolated CAN buses. The message contains the fault type code, fault level, and the protection action code to be executed (such as immediately blocking the PWM output of the power module, disconnecting the AC input contactor, etc.). After receiving the emergency stop message, the two slave cores complete the protection action in the shortest possible time and send back an acknowledgment message.

[0089] Furthermore, the main controller simultaneously writes complete information about serious faults (fault type, trigger time, voltage and current sampling values ​​at the trigger time, insulation resistance, gun temperature data, CC status, contactor feedback status, etc.) into a three-level storage medium: real-time fault identifiers and trigger data are stored in AXI high-speed RAM for subsequent safety logic judgment by the main controller, temporary fault records are stored in QSPI extended PSRAM, and the complete fault ledger is written to an SD card to achieve persistent archiving after power failure.

[0090] Finally, the main controller uploads critical fault events to the cloud management platform in real time via a dual redundant communication link of wired Ethernet (preferred) or 4G / 5G wireless (backup), ensuring that the cloud platform records the fault in a timely manner and triggers a site-level linkage response.

[0091] Fault monitoring and response at the core level: During closed-loop operation, the power control slave core continuously monitors the CAN communication status of the power modules, overvoltage, overcurrent, and overheat fault flags uploaded by the modules, cabinet temperature and humidity sensor data, and fan fault feedback signals. When a module-level fault or environmental anomaly alarm is detected, the slave core first executes module-level protection actions locally (such as removing the abnormal module from the parallel group), and simultaneously writes the fault information to the shared SRAM for the group charging aggregation slave core to read, and reports it to the master control via the CAN bus. During the polling acquisition process, the group charging data aggregation slave core continuously monitors the communication status of each terminal, the contactor status fed back by DI, the auxiliary power fuse status, and the liquid cooling system status. When a fault is detected, it synchronously links with the power control slave core through the shared SRAM and reports it to the master control via the CAN bus.

[0092] Cross-core collaborative fault tolerance mechanism: Cross-core health monitoring is achieved between the master controller and the two slave cores through periodic status heartbeat messages. If the power control slave core does not receive a heartbeat or control command from the master controller within a set timeout period, the slave core automatically enters a safety degradation mode, maintaining the current power module output parameters unchanged and continuously monitoring the module status. Simultaneously, it notifies the group charging aggregation slave core via shared SRAM to coordinate the reporting of master controller anomalies. If the group charging data aggregation slave core detects a master controller communication interruption, the slave core continues terminal polling and data writing to shared SRAM, ensuring that the power control slave core can still obtain global load data and continue power scheduling. If the master controller detects any slave core timeout, it immediately records the slave core communication failure event and attempts to re-establish the communication link while ensuring safety. Multi-level hardware mutual inspection and emergency response mechanisms ensure that a single core failure will not cause the entire system control to collapse, improving system reliability.

[0093] Step S8: End-to-end management of data storage and cloud interaction

[0094] Throughout the entire charging process, from start to finish, the system performs full lifecycle data storage and cloud interaction management. Three types of data are written to three levels of storage media based on real-time requirements:

[0095] Real-time data storage with zero wait: All ADC sampled values ​​(gun temperature, CC voltage, insulation voltage divider), DI switch quantities (emergency stop, access control, water immersion, contactor feedback, auxiliary power status, fuse status), CAN interaction messages (BMS data, module operating status, slave core status), and third-party cross-verification results are directly and automatically transferred by DMA hardware to the on-chip AXI high-speed RAM real-time data buffer without CPU intervention. This achieves zero-wait storage and retrieval of sampled data, supports millisecond-level closed-loop control, instantaneous fault determination, and real-time cross-verification, and eliminates the computing power contention and control delay caused by the mixed storage of real-time data and background data in traditional solutions.

[0096] Background data temporary cache: Sampling curve data, charging process logs, temporary fault records, and cloud interaction messages (including charging start events, charging parameter changes, charging end events, fault alarms, etc.) generated during the charging process are periodically and in batches written to the QSPI extended PSRAM temporary cache area. The data cached in PSRAM is indexed by data type and timestamp, and runs completely independently of AXI high-speed RAM. The high-throughput data writing operations in the background do not consume the main chip's real-time computing power and on-chip high-speed RAM resources, achieving physical isolation of front-end and back-end business hardware resources.

[0097] Offline data persistent archiving: After each charging order is completed, the system periodically writes the complete charging order data cached in PSRAM, the full record of vehicle-charging station BMS interaction messages, fault logs, overall machine operation ledgers, and equipment configuration parameters to the SD card for permanent storage after power failure. The archived data on the SD card is indexed by date and order number, supporting offline traceability and local export of data throughout its entire lifecycle. When the system detects that the SD card is full or there is a write error, the main controller generates a storage alarm and reports it to the cloud platform via the communication link.

[0098] Dual Redundancy Cloud Interaction: The main controller interacts with the cloud management platform via dual communication links: wired Ethernet (ZLSN2000 protocol conversion chip) and 4G / 5G wireless (EC200 full-network CAT1 module). Both communication units have built-in TCP protocol stacks, compatible with both IPv4 and IPv6 network protocols. All communication links are optically isolated to prevent external network electromagnetic interference. The system defaults to using wired Ethernet as the primary communication link and 4G / 5G wireless as the backup link. When the primary link is normal, all uplink data (real-time charging status, metering data, fault alarms, order records, etc.) is uploaded to the cloud via wired Ethernet, and downlink data (cloud scheduling instructions, remote configuration parameters, firmware upgrade packages, etc.) is received via wired Ethernet. When the main controller detects a wired Ethernet link disconnection or communication timeout, the system automatically switches to the 4G / 5G wireless link within milliseconds to continue data transmission. The switching process does not interrupt the charging process or lose uplink data. Once the network is restored, the system automatically switches back to wired Ethernet priority mode and automatically re-uploads any data cached in PSRAM that was not uploaded during the network outage to the cloud platform, ensuring complete and unlossable charging data. During charging, remote shutdown commands and power adjustment commands issued by the cloud platform are received through the communication link, and the main controller responds with the same priority as local faults.

[0099] Step S9: Charging completion process and full lifecycle data closed loop

[0100] The system enters the charging termination process when the vehicle BMS sends a charging end request message via the CAN bus, the vehicle battery charge status reaches the preset full charge threshold, the user initiates a stop charging command through the human-machine interface, or the main controller detects a fault event that requires termination of charging.

[0101] The master controller first sends a charging completion confirmation message to the vehicle's BMS via the CAN bus, and simultaneously sends a power module shutdown command to the power control slave core via two isolated CAN buses. Upon receiving the shutdown command, the power control slave core gradually reduces the output power of each power module to zero according to a preset power reduction curve (typically with a millisecond-level reduction time), avoiding sudden shocks to the vehicle battery. After the power drops to zero, the slave core drives all contactors to trip via the DO port, disconnecting the electrical connection between the power modules and the charging gun.

[0102] After the contactor trips, the main controller disconnects the positive and negative main contactors of both charging guns via the DO electromagnetic relay, cutting off the main charging circuit and simultaneously disconnecting the auxiliary power supply to the charging gun body. The main controller collects the actual contact feedback status of the contactors through the DI channel. After confirming that all contactors have reliably tripped, it sends charging completion confirmation and contactor trip confirmation messages to the vehicle BMS via the CAN bus.

[0103] After charging completion is confirmed, the main controller reads all real-time data from the AXI high-speed RAM (including voltage and current sampling values ​​at various times, gun temperature change curves, fault trigger records, and protection action records), and reads the charging process cache data from the PSRAM (including cloud interaction message records, charging process logs, and temporary cache of sampling curves). The two sets of data are then merged by timestamp to generate a complete charging order record. This order record includes full information such as order number, charging start and end times, cumulative charging amount, average power, peak power, voltage and current data for each stage, BMS interaction record summary, and fault event log.

[0104] The main controller simultaneously writes the complete charging order record to three levels of storage media: the current charging status indicator and key settlement parameters are stored in AXI high-speed RAM for subsequent charging startup logic calls; the complete order data is cached in PSRAM pending cloud upload confirmation; and the charging order is appended to the SD card for permanent storage even after power failure. The main controller uploads the charging order to the cloud management platform via dual redundant communication links. After the cloud platform confirms receipt, it returns a confirmation response. Upon receiving the response, the main controller marks the cached order data in PSRAM as uploaded and allows subsequent overwriting. If the cloud confirmation times out, the system retains the order cache in PSRAM and re-uploads it when communication resumes, ensuring no order data is lost.

[0105] The main controller updates the device operation log records on the SD card, including the cumulative running time of this charging session, contactor operation count statistics, power module cumulative output statistics, fault counts, and other full lifecycle maintenance data, achieving complete offline record-keeping of device lifecycle data. After the entire process is completed, the main controller restores the system to standby mode, awaiting the next charging start, while maintaining the continuous operation of the three-level storage system, continuously performing overall machine safety monitoring and cloud platform heartbeat keep-alive. This concludes a complete DC charging control process.

[0106] Finally, it should be noted that the above embodiments are merely examples for clearly illustrating the present invention and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A core control method for DC charging piles based on STM32 multi-core architecture, characterized in that, The method includes the following steps: Step S1: After the system is powered on, the main control chip completes the hierarchical deployment and address space allocation of the three-level hierarchical storage system of on-chip AXI high-speed RAM, QSPI extended PSRAM and SDMMC external SD card; Step S2: The main control chip starts the whole machine safety self-test, including safety switch quantity acquisition, contactor engagement feedback verification, insulation monitoring, short circuit detection, temperature and CC gun identification self-test. After all tests are passed, it enters standby mode. Step S3: After the main control chip determines that the charging gun has completed the physical connection through the voltage of the CC pin, it communicates and shakes hands with the vehicle BMS, receives the vehicle electrical data and stores it in the AXI high-speed RAM, and at the same time reads the meter data and the sampling voltage inside the gun to establish a three-party dataset. Step S4: The main control chip negotiates charging parameters based on vehicle demand, equipment status, and station load, and sends instructions to the slave core; the group charging core calculates the contactor switching scheme and writes it into the shared SRAM; the power control slave core performs three-level ring bridge hierarchical power scheduling to complete the power module networking. Step S5: The main control chip performs closed-loop control in 30ms cycles, and performs real-time cross-verification of the sampling voltage inside the gun, the meter data and the vehicle BMS data. After the verification is passed, the adjustment amount is calculated and sent out for execution, and the gun temperature linkage verification and environmental monitoring are performed simultaneously. Step S6: The group charging collection core polls and collects data from 12 charging terminals via a dual-channel CAN bus at a 50ms cycle, writes the results to the shared SRAM, collects the contactor feedback status through the DI port to perform fault self-diagnosis, and monitors the liquid cooling system status through the RS485 port. Step S7: The master control and slave cores work together to perform graded fault monitoring and cross-core emergency response. Faults are classified into three levels: minor, general, and severe. In the event of a severe fault, the master control cuts off the contactor and auxiliary power supply in milliseconds, issues an emergency shutdown message, writes the fault information to the three-level storage, and uploads it to the cloud. Step S8: Throughout the charging process, the sampled data is automatically transferred from DMA to AXI high-speed RAM for zero-wait storage, the logs and curves are periodically written to the PSRAM cache, the order data is written to the SD card for persistent storage, and interacts with the cloud through wired Ethernet and 4G / 5G wireless dual redundant links; Step S9: After charging is completed, the main controller sends an end confirmation to the BMS. The power control reduces the power to zero according to the core descent curve and then drives the contactor to open. The main controller merges all data to generate a complete charging order, writes it to the three-level storage, uploads it to the cloud for confirmation, and then returns to standby state.

2. The core control method for DC charging piles based on STM32 multi-core architecture as described in claim 1, characterized in that, The overall safety self-test described in step S2 specifically includes: the main controller collects the status of emergency stop, access control, and water immersion switches through the optocoupler-isolated DI channel, and can only continue after confirming that they are all in a normal non-triggered state. If any trigger occurs, the start is locked and a fault is reported; the main controller drives the contactor to engage through DO and compares and verifies the contact feedback collected through DI to determine whether the contactor fails to operate or is stuck; the main controller reads the insulation resistance data of the positive and negative poles to ground through the SPI bus and confirms that they are all greater than the safety threshold; during the insulation self-test, the main controller simultaneously performs short circuit detection, controls the positive contactor to close and the negative contactor to remain open, reads the switch status of the negative outer node converted by optocoupler isolation, and if it is high, it determines that the output is short-circuited and locks the contactor; the main controller reads the NTC voltage divider value through ADC to calculate the gun temperature and confirms that the temperature is within a reasonable range and the multi-channel deviation does not exceed the threshold; the main controller reads the CC voltage sampling value through SPI and confirms that it is within the valid recognition range.

3. The core control method for DC charging piles based on STM32 multi-core architecture as described in claim 1, characterized in that, Step S3, specifically the charging gun connection identification and BMS communication handshake, includes: reading the voltage amplitude of two CC channels via SPI to determine the physical connection status and identify the maximum charging current level; triggering an alarm and limiting power when CC is abnormal; after connection confirmation, completing the BMS handshake via CAN bus according to the GB / T 27930 protocol; and buffering BMS messages with zero wait time using AXI high-speed RAM; after successful handshake, receiving vehicle-side electrical data and storing it in AXI high-speed RAM; simultaneously reading meter data via isolated RS485 and collecting the internal voltage of the charging gun via isolated sampling to establish a three-party dataset.

4. The core control method for DC charging piles based on STM32 multi-core architecture as described in claim 1, characterized in that, The three-level ring bridge hierarchical power scheduling described in step S4 specifically includes: First priority ring scheduling strategy: The power control slave uses the power group number corresponding to the target charging gun as the basis, and first queries the idle status of the adjacent power group. If it is available, the corresponding ring contactor is turned on; if it is not available, the adjacent power group is decremented and the power resources are reused nearby. Second priority level one-level two-branch group scheduling strategy: When the number of power supply groups called by the ring scheduling is insufficient, the core divides all 12 power supply modules into the first half (numbers 1 to 6) and the second half (numbers 7 to 12). Based on the current power supply group number n, cross-regional pairing bridge groups are established between the nth power supply group in the first half and the nth power supply group in the second half, forming six fixed pairings: 1-7, 2-8, 3-9, 4-10, 5-11, and 6-12. The corresponding level one pairing bridge group contactors are automatically activated to realize the parallel connection of cross-regional power supply groups. If it is still insufficient, the three-level cyclic calling mechanism is activated to link and call the idle groups on the left and right sides of the paired bridge groups, and call half of the power supply modules of the whole machine for centralized output. The third priority secondary liquid-cooled supercharging bridge group scheduling strategy: When the core identifies the current charging gun as liquid-cooled charging gun No. 2, No. 5, No. 8, or No. 11 and there is still a power capacity gap, the supercharging scheduling permission is automatically unlocked. The cross-reactor parallel contactors of the adjacent power groups on the same side, the primary paired bridge group, and the secondary supercharging bridge group are activated in sequence. The cross-reactor contactors are activated step by step to gather all 12 power modules into a single liquid-cooled charging gun for centralized output. During the scheduling process, the liquid cooling heat dissipation is activated simultaneously through the reserved RS485 port in linkage communication with the liquid-cooled chiller unit controller.

5. The core control method for DC charging piles based on STM32 multi-core architecture as described in claim 1, characterized in that, The three-party real-time cross-verification in step S5 specifically includes: the main controller calculates the difference between the isolation sampling voltage inside the gun and the sampling voltage outside the meter. If the absolute value of the deviation exceeds the preset threshold, it is determined that there is a voltage divider circuit breakage or optocoupler temperature drift distortion, and a power current limiting command is issued; the main controller calculates the load UI curve characteristic value based on the current output voltage and output current collected by the meter, and verifies the deviation of this characteristic value with the voltage and current values ​​in the vehicle-side electrical data uploaded by the vehicle BMS. If the UI logic deviation threshold exceeds the normal range, it is determined that there is a metering communication abnormality or vehicle-pile interaction fault, and a protective shutdown command is triggered; the main controller also includes insulation monitoring data and CC sampling data in the cross-verification. If the insulation resistance value jumps or the CC voltage fluctuates abnormally, it is simultaneously determined that the line is damaged, the insulation is aging, or the gun has poor contact; when the verification is abnormal, alarms, power derating, or shutdown protection are executed according to the severity of the fault.

6. The core control method for DC charging piles based on STM32 multi-core architecture as described in claim 1, characterized in that, The data collection for group charging in step S6 specifically includes: polling 12 terminals in parallel via dual-channel isolated CAN at a 50ms cycle, with the load evenly distributed between the two channels to ensure full data acquisition within the cycle; determining communication abnormality when a terminal does not respond and synchronizing it to the power control slave core via shared SRAM; summarizing the power of each channel, the total load of the station, and the terminal priority and writing it into shared SRAM; collecting feedback from 24 groups of contactors via DI and comparing it with the switching scheme one by one; determining failure to operate when closing via DI and sticking via DI when opening via DI; determining abnormality in opening / closing if feedback does not flip after operation and synchronizing it to the power control slave core via shared SRAM after identification; collecting the status of auxiliary power sources and fuses, terminating charging when abnormal; and monitoring the liquid cooling system via RS485 and activating linkage control after identification and access.

7. The core control method for DC charging piles based on STM32 multi-core architecture as described in claim 1, characterized in that, The graded fault monitoring and cross-core emergency response described in step S7 specifically include: the master controller incorporates output voltage and current, insulation resistance, gun temperature, CC voltage, short circuit, and emergency stop access control water immersion status into millisecond-level judgments in each control cycle; minor faults are recorded and reported without interrupting charging; general faults trigger derating and send instructions to the slave core via CAN; in case of severe faults, the contactor and auxiliary power are disconnected via DO in milliseconds, and an emergency stop message containing fault codes is sent to the slave core via CAN. The slave core executes protection and sends back confirmation, and the fault information is synchronously written to the three-level storage and uploaded to the cloud; the master controller and slave core monitor each other across cores through heartbeat messages. When the slave core does not receive a heartbeat, it enters a safety degradation mode to maintain output and notifies the group charging aggregation core to coordinate reporting through shared SRAM; when the slave core detects a communication interruption with the master controller, it maintains polling and SRAM writing; when the master controller detects a timeout in the slave core, it records the fault and attempts to rebuild the link.

8. A DC charging pile core controller based on an STM32 multi-core architecture that executes the control method as described in any one of claims 1 to 7, characterized in that, Includes a charging control terminal and a power environment information module; The charging control terminal uses the STM32H767 as the main control chip, and is equipped with an on-chip AXI high-speed RAM, a PSRAM connected to the QSPI peripheral, and an SD card connected to the SDMMC interface to form a three-level hierarchical storage system; it integrates an isolation voltage sampling circuit, an insulation monitoring circuit, a CC signal acquisition circuit, an isolation digital input / output circuit, and a dual redundant communication module. The power environment information module uses two STM32F407 chips as the power control slave core and the group charging data collection slave core, respectively. The two slave cores share global memory by connecting to the shared SRAM through the SPI peripheral. The power control slave core is configured with a dual-channel isolated CAN bus, and the group charging data collection slave core is configured with a dual-channel isolated CAN bus and has reserved an RS485 expansion interface. The main control chip connects to two slave cores via two isolated CAN buses to achieve three-core collaborative control.

Images