Vehicle-mounted hardware redundancy control system and control method

Abstract

The application discloses a kind of vehicle-mounted hardware redundancy control system and control method, the system includes: power management chip is connected with vehicle-mounted controller, logic processing module respectively, and power management chip is powered by battery interface;Vehicle-mounted controller is connected with low-side drive module by first hard-wire control circuit, and is connected with high-side drive module by second hard-wire control circuit;Logic processing module is connected with low-side drive module by third hard-wire control circuit, and is connected with high-side drive module by fourth hard-wire control circuit;Wherein, when vehicle-mounted controller is in OTA upgrade state, third hard-wire control circuit and fourth hard-wire control circuit are placed in active state, to make logic processing module control low-side drive module enter the mode of limping home, and control the enable state of load driven by high-side drive module.The system can solve the problem that vehicle OTA process is caused by load out of control in prior art due to vehicle-mounted controller reset or watchdog timeout.

Description

Technical Field

[0001] This application relates to the field of automotive electronic control technology, and in particular to an on-board hardware redundancy control system and control method. Background Technology

[0002] With the development of intelligent connected vehicles, Over-The-Air (OTA) technology has become a core means of vehicle software iteration, supporting remote firmware updates for the Electronic Control Unit (ECU), allowing users to fix vulnerabilities, add features, or optimize performance without visiting a service center. However, during OTA execution, the Microcontroller Unit (MCU) often temporarily loses control of the load drive modules due to watchdog timeout or active reset, leading to the unexpected shutdown of some critical loads or the abnormal startup of non-critical loads, potentially causing safety hazards such as engine stalling, system voltage fluctuations, and thermal management failure.

[0003] Existing solutions largely rely on the KL15 relay to uniformly control the vehicle's power supply status, lacking the ability to finely and independently control different loads. For example, during OTA (Over-The-Air) updates for gasoline vehicles, the fuel pump and cooling fan need to be kept running to prevent engine stalling and overheating, but high-current loads such as the air conditioner should be prohibited from operating to stabilize the system voltage. During system reset after OTA completion, the same strategy needs to be maintained until the software fully restores control. Traditional pure software control solutions cannot cope with the MCU "disabled" phase, necessitating the introduction of hardware-level safety redundancy mechanisms. Summary of the Invention

[0004] This application provides an on-board hardware redundancy control system and control method, which aims to solve the problem of load loss during the vehicle OTA process caused by on-board controller reset or watchdog timeout in the prior art.

[0005] To achieve the above objectives, this application provides the following technical solution:

[0006] An on-board hardware redundancy control system includes:

[0007] Power management chip, vehicle controller, logic processing module, low-side driver module and high-side driver module;

[0008] The power management chip is connected to the vehicle controller and the logic processing module respectively, and the power management chip is powered by the battery interface.

[0009] The vehicle controller is connected to the low-side drive module via a first hardwired control circuit and to the high-side drive module via a second hardwired control circuit.

[0010] The logic processing module is connected to the low-side drive module via a third hardwired control circuit and to the high-side drive module via a fourth hardwired control circuit. When the vehicle controller is in OTA upgrade mode, the third and fourth hardwired control circuits are activated, enabling the logic processing module to control the low-side drive module to enter limp-home mode and to control the enable state of the load driven by the high-side drive module.

[0011] A control method, applied to an on-board hardware redundancy control system, includes:

[0012] When the vehicle controller is in normal operation, the vehicle controller controls the load driven by the low-side drive module through the first hardwired control circuit and controls the load driven by the high-side drive module through the second hardwired control circuit.

[0013] When the vehicle controller is in OTA upgrade mode, the power management chip is placed in deep security mode to trigger the logic processing module to generate a hard-wired control signal.

[0014] In response to the hardwired control signal, the logic processing module activates the third hardwired control circuit and the fourth hardwired control circuit, so that the logic processing module controls the low-side drive module to enter the limp home mode through the third hardwired control circuit, and controls the enable state of the load driven by the high-side drive module through the fourth hardwired control circuit.

[0015] When the vehicle controller upgrade is completed and reset, the power management chip exits the deep security mode to trigger the logic processing module to stop generating the hardwired control signal;

[0016] When the hardwired control signal disappears, the logic processing module stops activating the third hardwired control circuit and the fourth hardwired control circuit, so that the vehicle controller controls the low-side drive module to enter the normal mode through the first hardwired control circuit, and controls the enable state of the load driven by the high-side drive module through the second hardwired control circuit.

[0017] The technical solution provided in this application, through the deep security mode triggered by the power management chip, combined with the logic processing module, the third hardwired control circuit and the fourth hardwired control circuit, can realize independent hardware control of the load, ensure that critical loads continue to work and non-critical loads are reliably shut down, and maintain mode switching without disturbance or transient impact, thereby effectively solving the problem of load loss of control caused by vehicle controller reset or watchdog timeout in the prior art. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A schematic diagram of the architecture of an on-board hardware redundancy control system provided in an embodiment of this application;

[0020] Figure 2 This application provides a schematic diagram of an on-board hardware redundancy control circuit; wherein, D1 represents the first diode, D2 represents the second diode, D3 represents the third diode, D4 ​​represents the fourth diode, D5 represents the fifth diode, D6 represents the sixth diode, D7 represents the seventh diode, D8 represents the eighth diode, D9 represents the ninth diode, D10 represents the tenth diode, D11 represents the eleventh diode, R1 represents the first resistor, R2 represents the second resistor, R3 represents the third resistor, R4 represents the fourth resistor, R5 represents the fifth resistor, R6 represents the sixth resistor, R7 represents the seventh resistor, and R8 represents the eighth diode. Resistors: R9 represents the ninth resistor, R10 represents the tenth resistor, R11 represents the eleventh resistor, R12 represents the twelfth resistor, R13 represents the thirteenth resistor, R14 represents the fourteenth resistor, Q1 represents the first transistor, Q2 represents the second transistor, Q3 represents the third transistor, L1, L2, and L3 all represent loads, C1 represents the first capacitor, UBD represents the battery interface, MCU represents the microcontroller unit, PMIC represents the power management chip, LDO represents the low dropout regulator, LSD represents the low-side drive module, HSD represents the side drive module, KL15 represents the KL15 relay, and BAT represents the vehicle battery.

[0021] Figure 3 This is a flowchart illustrating a control method provided in an embodiment of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] In this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0024] like Figure 1 The diagram shown is an architectural schematic of an on-board hardware redundancy control system provided in an embodiment of this application, including a power management chip 100, an on-board controller 200, a logic processing module 300, a low-side driver module 400, a high-side driver module 500, and a voltage regulator 600.

[0025] In some examples, the vehicle controller includes, but is not limited to, an MCU that specifically supports multi-channel pulse width modulation (PWM) signal control and serial peripheral interface (SPI) control.

[0026] In some examples, the power management chip needs to have a deep safe mode and a fault state terminal (i.e., / FS terminal). When the dog feed signal periodically sent by the vehicle controller to the power management chip times out, the power management chip is put into deep safe mode to trigger the fault state terminal of the power management chip to be pulled low to a low impedance state to generate a low level signal.

[0027] In some examples, the low-side driver module (LSD) needs to support normal mode (i.e., SPI control mode) and limp home mode. In normal mode, the low-side driver module controls all outputs based on the internal SPI register. In limp home mode, the low-side driver module controls the load on the corresponding X-th output (OUTX) based on the input signal of the X-th input (INX).

[0028] Generally speaking, the load driven by the low-side drive module is directly powered by the vehicle battery (BAT).

[0029] In some examples, the high-side driver module (HSD) needs to provide level control functionality for the enable pin. Specifically, by controlling the level state of the enable pin, the operation of the load on the corresponding output pin can be controlled. For example, if the first enable pin (EN1) is at a low level, the load on the corresponding first output pin (OUT1) is disabled, and if the second enable pin (EN2) is at a high level, the load on the corresponding second output pin (OUT2) remains operational.

[0030] Generally speaking, the load driven by the high-side driver module is powered by the high-side driver module, and the power supply control is based on the enable terminal.

[0031] In some examples, the regulator type can be a low-dropout regulator (LDO).

[0032] The power management chip is connected to the vehicle controller and the logic processing module, and is powered by the battery interface (UBD).

[0033] The vehicle controller is connected to the low-side drive module through a first hard-wired control circuit and to the high-side drive module through a second hard-wired control circuit.

[0034] The logic processing module is connected to the low-side drive module through the third hardwired control circuit and to the high-side drive module through the fourth hardwired control circuit. When the vehicle controller is in OTA upgrade mode, the third and fourth hardwired control circuits are activated, so that the logic processing module controls the low-side drive module to enter the limp home mode and controls the enable state of the load driven by the high-side drive module.

[0035] In some examples, the power management chip can trigger the logic processing module to generate a hardwire control signal to activate the third hardwire control circuit and the fourth hardwire control circuit.

[0036] The input terminal (IN) of the voltage regulator is connected to the battery interface, the enable terminal (EN) is connected to the vehicle controller, and the output terminal (VCC5V2) is connected to the power supply terminal (VDD) of the low-side drive module and the third hard-wired control circuit, respectively.

[0037] In some examples, assuming the load driven by the low-side driver module is L1, and the loads driven by the high-side driver module include L2 and L3, the specific circuit structure of each module can be found in [reference needed]. Figure 2 As shown.

[0038] Optionally, the logic processing module includes a first transistor, a second transistor, and a third transistor; the collector of the first transistor is connected to the vehicle relay, the base is connected to the power management chip, the emitter is connected to the third hard-wired control circuit through the second transistor, and the emitter is also connected to the fourth hard-wired control circuit through the third transistor; the first transistor is a bipolar junction transistor, and the second and third transistors are power transistors.

[0039] For example, the vehicle relay includes the KL15 relay.

[0040] Optionally, the enable terminal of the high-side drive module includes a first enable terminal and a second enable terminal; the first enable terminal is connected to the emitter of the first transistor through a tenth diode; and the second enable terminal is connected to the third transistor.

[0041] For example, the gate of the second transistor is connected to the emitter of the first transistor, the drain is connected to the sixth resistor and the seventh resistor respectively, and the source is grounded.

[0042] For example, the gate of the third transistor is connected to the emitter of the first transistor, the drain is connected to the thirteenth resistor, and the source is grounded.

[0043] Optionally, a sixth resistor is provided between the idle state terminal (IDLE) of the low-side drive module and the collector of the second transistor, and the sixth resistor is connected to the output terminal of the voltage regulator; a seventh diode is provided between the voltage regulator and the vehicle controller, the anode of the seventh diode is connected to the vehicle controller, and the cathode is connected to the enable terminal of the voltage regulator; a ninth diode is provided in the third hard-wired control circuit, the anode of the ninth diode is connected to the vehicle controller, and the cathode is connected to the input terminal of the low-side drive module; an eleventh diode is provided in the second hard-wired control circuit, the anode of the eleventh diode is connected to the vehicle controller, and the cathode is connected to the first enable terminal of the high-side drive module.

[0044] It should be noted that the structural design based on the sixth resistor, seventh diode, ninth diode, and eleventh diode enables a hardware interlock mechanism, thereby improving the safety of the vehicle hardware redundancy control system.

[0045] To ensure that the on-board hardware redundancy control system does not experience signal backflow into the on-board controller and to prevent the hardware input voltage from exceeding the withstand voltage of each module, a hardware protection network composed of reverse connection protection diodes, Zener diodes, and isolation diodes is added to the on-board hardware redundancy control system.

[0046] Optionally, the structure of the hardware protection network can be as follows: a first diode is provided between the power management chip and the battery interface; a first resistor, a second resistor, and a fourteenth resistor are provided between the power management chip and the vehicle controller; a third resistor and a fourth resistor are provided between the power management chip and the logic processing module; a fifth resistor, a fourth diode, a fifth diode, and a sixth diode are provided between the logic processing module and the voltage regulator; an eighth resistor is also provided between the vehicle controller and the voltage regulator; a tenth resistor is provided in the first hard-wired control circuit; an eleventh resistor, a twelfth resistor, an eleventh diode, and a thirteenth resistor are provided in the second hard-wired control circuit; an eighth diode, a seventh resistor, and a first capacitor are provided in the third hard-wired control circuit; and a tenth diode and a thirteenth resistor are provided in the fourth hard-wired control circuit.

[0047] For example, the anode of the first diode is connected to the battery interface, and the cathode is connected to the input terminal (VIN) of the power management chip.

[0048] For example, a fourteenth resistor is provided between the SPI register of the power management chip and the vehicle controller, a first resistor is provided between the watchdog timer interface (WDI) of the power management chip and the vehicle controller, and a second resistor is connected in parallel between the first circuit and the second circuit. The first circuit is the circuit between the reset ( / RST) pin of the power management chip and the vehicle controller, and the second circuit is the circuit between the output terminal (VCC5V1) of the power management chip and the power supply terminal (VDD) of the vehicle controller.

[0049] For example, a third resistor is provided between the fault state terminal of the power management chip and the base of the first transistor, and a fourth resistor is connected in parallel between the base and emitter of the first transistor.

[0050] For example, a fifth resistor and a sixth diode are provided between the collector of the first transistor and the enable terminal of the voltage regulator; the anode of the sixth diode is connected to the fifth resistor, and the cathode is connected to the enable terminal of the voltage regulator. Furthermore, the cathode of the fourth diode is connected to the series connection point of the fifth resistor and the sixth diode, the anode is connected to the anode of the fifth diode, and the cathode of the fifth diode is grounded.

[0051] For example, an eighth resistor and a seventh diode are connected in series between the vehicle controller and the enable terminal of the voltage regulator.

[0052] For example, a tenth resistor is provided between the vehicle controller and the serial peripheral interface (SPI) of the low-side driver module.

[0053] For example, an eleventh resistor and an eleventh diode are provided between the vehicle controller and the first enable terminal of the high-side drive module. The anode of the eleventh diode is connected to the vehicle controller through the eleventh resistor, and the cathode is connected to the first enable terminal of the high-side drive module.

[0054] For example, a twelfth resistor and a thirteenth resistor are connected in series between the vehicle controller and the second enable terminal of the high-side drive module.

[0055] For example, an eighth diode is provided between the gate of the second transistor and the input terminal of the low-side driving module. The anode of the eighth diode is connected to the gate of the second transistor, and the cathode is connected to the input terminal of the low-side driving module. A sixth resistor is provided between the drain of the second transistor and the output terminal of the voltage regulator. A seventh resistor is provided between the drain of the second transistor and the idle state terminal of the low-side driving module. One end of the first capacitor is connected between the seventh resistor and the idle state terminal of the low-side driving module, and the other end is grounded.

[0056] For example, a tenth diode is provided between the collector of the first transistor and the first enable terminal of the high-side drive module, and a thirteenth resistor is provided between the drain of the third transistor and the second enable terminal of the high-side drive module.

[0057] In some examples, the first capacitor may be a filter capacitor.

[0058] In some examples, the first resistor, second resistor, third resistor, fifth resistor, seventh resistor, eighth resistor, ninth resistor, tenth resistor, eleventh resistor, twelfth resistor, thirteenth resistor, and fourteenth resistor may be current-limiting resistors.

[0059] In some examples, the fourth and sixth resistors can be pull-up resistors.

[0060] In a possible implementation, the fourth resistor is specifically used to pull up the fault state terminal of the power management chip to a high impedance state to prevent false triggering of the fault state terminal of the power management chip.

[0061] In a possible implementation, the sixth resistor is specifically used to pull up the level of the idle state terminal of the low-side driver module to ensure that the low-side driver module operates normally in normal mode.

[0062] In some examples, the first, second, and third diodes can be reverse-connection protection diodes. The first diode specifically prevents the power supply from creating a circuit through the body diode inside the power management chip when the power is reverse-connected, thus preventing damage to the power management chip. The third diode prevents the power supply from creating a circuit through the body diode inside the voltage regulator when the power is reverse-connected, thus preventing damage to the voltage regulator.

[0063] In some examples, the fourth and fifth diodes may be Zener diodes.

[0064] In a possible implementation, the fourth diode is specifically used to regulate the output voltage of the vehicle relay to obtain the OTA_EN voltage, preventing the high level of the vehicle relay from exceeding the withstand voltage of the enable terminal of the high-side drive module and the withstand voltage of the input terminal of the low-side drive module, thereby damaging the high-side drive module and the low-side drive module.

[0065] In a possible implementation, the fifth diode is specifically used to prevent power from being transmitted through the fourth diode, the sixth diode, the eighth diode, and the tenth diode to the corresponding port or key when the power is reversed, thereby damaging the corresponding hardware.

[0066] In some examples, the sixth, seventh, eighth, ninth, tenth, and eleventh diodes may be isolation diodes.

[0067] In a possible implementation, the sixth diode and the seventh diode form a redundancy mechanism to ensure that the vehicle controller cannot shut down the regulator when the power management chip is in deep security mode, thus ensuring the normal output of the regulator.

[0068] In some examples, Figure 2 The load L1 shown can be set as an oil pump. During the OTA upgrade of the vehicle controller, the oil pump must continue to operate. For this purpose, a third hardwired control circuit is needed to control the load L1 to keep running.

[0069] In some examples, Figure 2 The load L2 shown can be set as a cooling fan. During the OTA upgrade of the vehicle controller, the cooling fan needs to be kept running. For this purpose, the fourth hardwired control circuit is needed to control the enabled state of the load L2 to be running.

[0070] In some examples, Figure 2 The load L3 shown can be set as an air conditioning compressor. During the OTA upgrade of the vehicle controller, the air conditioning compressor needs to be disabled. For this purpose, the fourth hardwired control circuit is needed to control the enable state of load L3 to stop running.

[0071] based on Figure 2 The circuit architecture shown below illustrates the working principle of the on-board hardware redundancy control system.

[0072] Optionally, when the vehicle controller is in OTA upgrade mode, the power management chip is placed in deep security mode, triggering the first transistor to be in the on state so that the logic processing module generates a hard-wired control signal.

[0073] Optionally, the second and third transistors are turned on in response to the hard-wire control signal to activate the third and fourth hard-wire control circuits.

[0074] Optionally, when the power management chip is in deep security mode, the logic processing module triggers the idle state terminal of the low-side drive module to be set to a low level to activate the third hard-wired control circuit; when the power management chip exits deep security mode, the logic processing module triggers the idle state terminal of the low-side drive module to be set to a high level to stop activating the third hard-wired control circuit.

[0075] In some examples, when the vehicle controller is in normal operation, it periodically sends a "feed the dog" signal to the power management chip to prevent the chip from entering deep security mode. Furthermore, the regulator's output is pulled high (e.g., 5V) to the idle state of the low-side driver module via a sixth resistor, ensuring the low-side driver module remains in normal mode. Additionally, the vehicle controller controls the load driven by the low-side driver module via a first hardwired control circuit and controls the load driven by the high-side driver module via a second hardwired control circuit.

[0076] In some examples, when the vehicle controller is in OTA upgrade mode, the dog feed signal listened to by the power management chip times out. Therefore, the power management chip is put into deep security mode, which triggers the fault state terminal of the power management chip to generate a low-level signal. This low-level signal triggers the first transistor to be turned on, so that the output voltage of the vehicle relay is regulated by the fourth resistor to generate the corresponding hard-wired control signal (i.e., OTA_EN voltage).

[0077] Furthermore, the hard-wired control signal controls the second transistor to pull the idle state terminal of the low-side drive module to a low level, causing the low-side drive module to enter limp-home mode. The load L1 driven by the low-side drive module continues to operate based on the signal at the input terminal of the low-side drive module.

[0078] Furthermore, the hard-wired control signal controls the third transistor to pull the second enable terminal of the high-side drive module low, thereby turning off the second output terminal of the high-side drive module and stopping the third load L3 connected to the second output terminal. Additionally, the hard-wired control signal pulls the first enable terminal of the high-side drive module high via the tenth diode, thereby turning on the first output terminal of the high-side drive module and maintaining the operation of the second load L2 connected to the first output terminal.

[0079] In some examples, when the vehicle controller upgrade is complete and reset, the vehicle controller resumes periodically sending a dog-feed signal to the power management chip. To this end, the power management chip exits deep security mode, so that the fault state terminal of the power management chip no longer generates a low-level signal, the first transistor is placed in the off state, and the logic processing module no longer generates hard-wired control signals.

[0080] Furthermore, the second and third transistors are placed in the off state, causing the low-side drive module to exit the limp-home mode. The vehicle controller then controls the low-side drive module to enter the normal mode again through the first hardwired control circuit, and controls the enable state of the load driven by the high-side drive module through the second hardwired control circuit.

[0081] It is important to note that the second and third transistors are immediately turned off. The sixth resistor and the first capacitor then slowly raise the idle state of the low-side driver module to a high level, delaying the low-side driver module's exit from limp-home mode. Furthermore, during the vehicle controller reset, the voltage regulator continuously supplies power to the low-side driver module, ensuring stable logic levels and preventing malfunctions at its output.

[0082] In some examples, when the hard-wired control signal disappears, the idle state terminal of the low-side drive module switches from low to high. The output voltage of the regulator charges the first capacitor through the sixth and seventh resistors, making the maximum low threshold input voltage (VIL_max) of the idle state terminal equal to 1V. The worst-case delay time is calculated to be no less than 2.9ms, which is greater than the startup time of the vehicle controller (e.g., 1.8ms, 2.1ms). Therefore, it can be ensured that when the system control mode switches from logic processing module control to vehicle controller control, the load driven by the low-side drive module does not fluctuate.

[0083] In summary, the vehicle hardware redundancy control system shown in the embodiments of this application can achieve the following beneficial effects.

[0084] (1) Hardware-level redundancy protection: During the failure or reset of the vehicle controller, the hard-wired control path triggered by the power management chip (i.e., activating the third hard-wired control circuit and the fourth hard-wired control circuit) ensures that the load operates according to the preset safety strategy and avoids functional failure.

[0085] (2) Refined load management: The working status during OTA upgrade can be independently configured for different load types (such as critical / non-critical, power consumption level, etc.) to meet the complex vehicle requirements.

[0086] (3) Disturbance-free mode switching: The load control is smoothly transferred from software (i.e., vehicle controller) to hardware (i.e. logic processing module) and then back to software. There is no jump in load status or voltage surge during the control handover process.

[0087] (4) High compatibility and scalability: The circuit architecture is universal and can be adapted to a variety of vehicle controllers, power management chips, low-side drive modules and high-side drive modules, which facilitates platform development.

[0088] (5) Improve OTA security and success rate: prevent high current loads from interfering with the upgrade process, ensure the continuous operation of critical loads, and reduce the risk of OTA upgrade failure or vehicle downtime.

[0089] like Figure 3 The diagram shown is a flowchart illustrating a control method for an on-board hardware redundancy control system provided in an embodiment of this application, including the following steps.

[0090] S301: When the vehicle controller is in normal operation, the vehicle controller controls the load driven by the low-side drive module through the first hardwired control circuit and controls the load driven by the high-side drive module through the second hardwired control circuit.

[0091] When the vehicle controller is in normal operation, the control of the loads driven by the low-side drive module and the high-side drive module is handed over to the vehicle controller.

[0092] S302: When the vehicle controller is in OTA upgrade mode, the power management chip is placed in deep security mode to trigger the logic processing module to generate a hard-wired control signal.

[0093] When the vehicle controller is in OTA upgrade mode, it can no longer handle load control, so a load control transfer process needs to be triggered.

[0094] S303: The logic processing module responds to the hardwired control signal and activates the third hardwired control circuit and the fourth hardwired control circuit, so that the logic processing module controls the low-side drive module to enter the limp home mode through the third hardwired control circuit, and controls the enable state of the load driven by the high-side drive module through the fourth hardwired control circuit.

[0095] When the third hardwired control circuit and the fourth hardwired control circuit are active, the load control is transferred to the logic processing module. Since the logic processing module is a hardware network based on the first transistor, the second transistor and the third transistor, this can be regarded as the completion of the transfer of load control from software to hardware.

[0096] S304: When the vehicle controller upgrade is completed and reset, the power management chip exits deep security mode to trigger the logic processing module to stop generating hardwired control signals.

[0097] When the vehicle controller upgrade is completed and reset, the vehicle controller regains its ability to handle load control, which requires triggering the software to hand over load control back.

[0098] S305: When the hardwired control signal disappears, the logic processing module stops activating the third and fourth hardwired control circuits, so that the vehicle controller controls the low-side drive module to enter the normal mode through the first hardwired control circuit, and controls the enable state of the load driven by the high-side drive module through the second hardwired control circuit.

[0099] When the hard-wire control signal disappears, the first, second, and third transistors in the logic processing module are all turned off, so that the third and fourth hard-wire control circuits are no longer activated, and the load control is transferred from the logic processing module back to the vehicle controller.

[0100] In summary, the deep security mode triggered by the power management chip, combined with the logic processing module, the third hardwired control circuit, and the fourth hardwired control circuit, enables independent hardware control of the load, ensuring that critical loads continue to work and non-critical loads are reliably shut down. Furthermore, the mode switching is maintained without disturbance or transient impact, thus effectively solving the problem of load loss of control caused by vehicle controller reset or watchdog timeout in existing technologies.

[0101] While several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0102] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A vehicle-mounted hardware redundancy control system, characterized in that, include: Power management chip, vehicle controller, logic processing module, low-side driver module and high-side driver module; The power management chip is connected to the vehicle controller and the logic processing module respectively, and the power management chip is powered by the battery interface. The vehicle controller is connected to the low-side drive module via a first hardwired control circuit and to the high-side drive module via a second hardwired control circuit. The logic processing module is connected to the low-side drive module via a third hardwired control circuit and to the high-side drive module via a fourth hardwired control circuit. When the vehicle controller is in OTA upgrade mode, the third and fourth hardwired control circuits are activated, enabling the logic processing module to control the low-side drive module to enter limp-home mode and to control the enable state of the load driven by the high-side drive module.

2. The system according to claim 1, characterized in that, The logic processing module includes a first transistor, a second transistor, and a third transistor; the collector of the first transistor is connected to the vehicle relay, the base is connected to the power management chip, the emitter is connected to the third hard-wired control circuit through the second transistor, and the emitter is also connected to the fourth hard-wired control circuit through the third transistor; the first transistor is a bipolar transistor, and the second and third transistors are power transistors.

3. The system according to claim 2, characterized in that, The enable terminal of the high-side drive module includes a first enable terminal and a second enable terminal; the first enable terminal is connected to the emitter of the first transistor through a tenth diode; the second enable terminal is connected to the third transistor.

4. The system according to claim 2, characterized in that, When the vehicle controller is in OTA upgrade mode, the power management chip is placed in deep security mode, triggering the first transistor to be in the on state so that the logic processing module generates a hard-wired control signal.

5. The system according to claim 4, characterized in that, The second transistor and the third transistor are turned on in response to the hard-wire control signal to activate the third hard-wire control circuit and the fourth hard-wire control circuit.

6. The system according to claim 1, characterized in that, When the power management chip is in deep security mode, the logic processing module triggers the idle state terminal of the low-side driver module to be set to a low level to activate the third hard-wired control circuit; when the power management chip exits deep security mode, the logic processing module triggers the idle state terminal of the low-side driver module to be set to a high level to stop activating the third hard-wired control circuit.

7. The system according to claim 1, characterized in that, It also includes voltage regulators; The input terminal of the voltage regulator is connected to the battery interface, the enable terminal is connected to the vehicle controller, and the output terminal is connected to the power supply terminal of the low-side drive module and the third hard-wired control circuit, respectively.

8. The system according to claim 7, characterized in that, A sixth resistor is provided between the idle state terminal of the low-side drive module and the collector of the second transistor, and the sixth resistor is connected to the output terminal of the voltage regulator; a seventh diode is provided between the voltage regulator and the vehicle controller, the anode of the seventh diode is connected to the vehicle controller, and the cathode is connected to the enable terminal of the voltage regulator; a ninth diode is provided in the third hard-wired control circuit, the anode of the ninth diode is connected to the vehicle controller, and the cathode is connected to the input terminal of the low-side drive module; an eleventh diode is provided in the second hard-wired control circuit, the anode of the eleventh diode is connected to the vehicle controller, and the cathode is connected to the first enable terminal of the high-side drive module.

9. The system according to claim 7, characterized in that, A first diode is provided between the power management chip and the battery interface; a first resistor, a second resistor, and a fourteenth resistor are provided between the power management chip and the vehicle controller; a third resistor and a fourth resistor are provided between the power management chip and the logic processing module; a fifth resistor, a fourth diode, a fifth diode, and a sixth diode are provided between the logic processing module and the voltage regulator; an eighth resistor is also provided between the vehicle controller and the voltage regulator; a tenth resistor is provided in the first hardwired control circuit; an eleventh resistor, a twelfth resistor, an eleventh diode, and a thirteenth resistor are provided in the second hardwired control circuit; an eighth diode, a seventh resistor, and a first capacitor are provided in the third hardwired control circuit; and a tenth diode and a thirteenth resistor are provided in the fourth hardwired control circuit.

10. A control method, characterized in that, The vehicle-mounted hardware redundancy control system applied to any one of claims 1-9 includes: When the vehicle controller is in normal operation, the vehicle controller controls the load driven by the low-side drive module through the first hardwired control circuit and controls the load driven by the high-side drive module through the second hardwired control circuit. When the vehicle controller is in OTA upgrade mode, the power management chip is placed in deep security mode to trigger the logic processing module to generate a hard-wired control signal. In response to the hardwired control signal, the logic processing module activates the third hardwired control circuit and the fourth hardwired control circuit, so that the logic processing module controls the low-side drive module to enter the limp home mode through the third hardwired control circuit, and controls the enable state of the load driven by the high-side drive module through the fourth hardwired control circuit. When the vehicle controller upgrade is completed and reset, the power management chip exits the deep security mode to trigger the logic processing module to stop generating the hardwired control signal; When the hardwired control signal disappears, the logic processing module stops activating the third hardwired control circuit and the fourth hardwired control circuit, so that the vehicle controller controls the low-side drive module to enter the normal mode through the first hardwired control circuit, and controls the enable state of the load driven by the high-side drive module through the second hardwired control circuit.

Images