Circuit for fault safety turn-off of vehicle controller

Abstract

The utility model discloses a circuit for safely turning off a load in case of failure of a vehicle controller. The fault signal logic judgment module comprises a fault signal logic judgment module and a safety switch driving signal part, the fault signal logic judgment module is connected with a vehicle-mounted motor M through the safety switch driving signal part, and the fault signal logic judgment module and the safety switch driving signal part are respectively connected with the MCU micro-control unit; the fault signal logic judgment module comprises a logic AND gate and a logic NAND gate. According to the utility model, the load of the controller can be forcibly turned off in an active or passive manner, so that the load is powered off and does not act, and the circuit design improves the functional safety level of the vehicle in use.

Description

Technical Field

[0001] The utility model relates to the technical field of automobile electronic circuits, in particular to a circuit for safety shutdown of a vehicle controller failure. Background Art

[0002] When a traditional fuel vehicle steps on the brake pedal, the pedal pushes the vacuum booster pump, which pushes the brake master cylinder to generate brake hydraulic pressure to control the brake caliper to brake. However, for new energy vehicles, the engine cannot provide power for the vacuum booster pump in electric mode. Therefore, a brake mechanism that does not require a vacuum booster pump was born - the ibooster electronically controlled brake booster system.

[0003] Compared with the traditional vacuum booster pump, ibooster electronically controlled brake booster has changed the way of boosting, from vacuum booster to motor booster. The electric booster consists of 4 parts: servo motor, booster transmission mechanism, brake pedal travel sensor, and control unit. When the driver steps on the brake pedal, the brake pedal travel sensor senses the depth of the pedal, and the controller calculates the required braking force based on the vehicle speed, and instructs the servo motor to drive the brake master cylinder to complete the braking action.

[0004] The controllability of the power-assist motor is one of the most important indicators for safety. Therefore, when a system failure occurs, if the power-assist motor cannot be powered off, it will have a significant impact on driving safety. Utility Model Content

[0005] In order to solve the problems existing in the background technology, the utility model discloses a circuit for safety shutdown of a vehicle controller due to a fault.

[0006] The technical solution of the utility model is achieved in this way:

[0007] The circuit includes two parts: a fault signal logic judgment module and a safety switch drive signal part. The fault signal logic judgment module is connected to the vehicle-mounted motor M via the safety switch drive signal part, and the fault signal logic judgment module and the safety switch drive signal part are respectively connected to the MCU micro-control unit; the fault signal logic judgment module is mainly composed of a logic AND gate and a logic NAND gate chip, and controls the safety switch drive signal part to drive the motor M to work or not work by performing logic judgment on the passive shutdown fault output pins FCCU[0], FCCU[1] and the active shutdown output pin M_OFF_MR of the MCU micro-control unit.

[0008] The fault signal logic judgment module includes a chip IC1 and a chip IC12; the IN pin and the OUT pin of the chip IC1 are connected to the power supply 3V3 via a resistor R1 and a resistor R4 respectively, and the IN pin of the chip IC1 is connected to the passive fault output pin FCCU[0] of the MCU micro-control unit, the OUT pin of the chip IC1 is connected to the INB pin of the chip IC2, the EN pin of the chip IC1 is grounded via a resistor R3, and the EN pin of the chip IC1 is connected to the passive fault output pin FCCU[1] of the MCU micro-control unit, the VCC pin of the chip IC1 is grounded via a capacitor C1, and the VCC pin of the chip IC1 is connected to the power supply 3V3; the INB pin and the INA pin of the chip IC2 are connected to the power supply 3V3 via a resistor R4 and a resistor R5 respectively, and the INA pin of the chip IC2 is connected to the active shutdown signal pin M_OFF_MR of the MCU micro-control unit, the OUT pin of the chip IC2 is connected to the safety switch drive signal part, the VCC pin of the chip IC2 is grounded via a capacitor C2, and the VCC pin of the chip IC2 is connected to the power supply 3V3.

[0009] The safety switch drive signal part includes a composite triode Q2 and a MOS tube Q1. The composite triode Q2 is composed of two triodes. The emitters of the two triodes are grounded, the bases of the two triodes are connected to the OUT pin of the chip IC2, the collectors of the two triodes are connected together and also connected to the gate of the MOS tube Q1, the gate of the MOS tube Q1 is connected to the drive signal pin M_DRV_MR of the MCU micro-control unit via the resistor R2, the drain of the MOS tube Q1 is connected to the power supply VBAT_MR, and the source of the MOS tube Q1 is connected to one end of the motor M.

[0010] The chip IC1 and the chip IC2 are both switch chips.

[0011] The chip IC1 uses a logic AND gate, and the chip IC2 uses a logic NAND gate.

[0012] The innovation of the utility model lies in that the active shutdown and passive shutdown of the load under fault safety are realized through the coordinated setting of the fault signal logic judgment module and the safety switch drive signal part, and the control is carried out through the combination of two chips and one logic gate in the safety switch drive signal part, so that the active shutdown and the passive shutdown do not interfere with each other, and the operation is realized quickly and effectively.

[0013] Beneficial effects of the utility model:

[0014] The utility model can forcibly shut down the load of the controller in an active or passive manner, so that the load is powered off and does not operate. This circuit design improves the functional safety level of vehicle use. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 The schematic diagram of a circuit for a fail-safe shutdown of a vehicle controller is shown in FIG. DETAILED DESCRIPTION

[0016] The utility model is further described below in conjunction with the accompanying drawings and embodiments.

[0017] like Figure 1 As shown, the circuit includes two parts: an MCU micro-control unit, a fault signal logic judgment module 1 and a safety switch drive signal part 2. The fault signal logic judgment module 1 is connected to the vehicle-mounted motor M via the safety switch drive signal part 2, and the fault signal logic judgment module 1 and the safety switch drive signal part 2 are respectively connected to the MCU micro-control unit; the motor M is connected to the drive signal via the MOS tube Q1.

[0018] The fault signal logic judgment module 1 is mainly composed of logic AND gates and logic NAND gate chips. It controls the safety switch drive signal part 2 to drive the motor M to work or not work by performing logic judgment on the passive shutdown fault output pins FCCU[0], FCCU[1] and the active shutdown output pin M_OFF_MR of the MCU microcontroller unit.

[0019] Specifically, when there is no fault, the fault signal logic judgment module 1 outputs a low level, so that the output of the safety switch drive signal part 2 is suspended, which does not affect the normal function of the motor M.

[0020] When a fault occurs, the fault signal logic judgment module 1 outputs a high level, and then the safety switch drive signal part 2 outputs a low level, thereby short-circuiting the drive signal of the motor M load to the ground, so that the MOS tube Q1 of the motor M load disconnects the power supply and makes the motor M load unable to operate.

[0021] like Figure 1 As shown, the fault signal logic judgment module 1 includes a chip IC1 and a chip IC12.

[0022] The No. 1 IN pin and the No. 2 OUT pin of the chip IC1 are connected to the power supply 3V3 via resistors R1 and R4 respectively. At the same time, the No. 1 IN pin of the chip IC1 is connected to the passive fault output pin FCCU[0] of the MCU micro-control unit. The No. 2 OUT pin of the chip IC1 is connected to the No. 1 INB pin of the chip IC2. The No. 3 GND pin of the chip IC1 is grounded. The No. 4 EN pin of the chip IC1 is grounded via resistor R3. At the same time, the No. 4 EN pin of the chip IC1 is connected to the passive fault output pin FCCU[1] of the MCU micro-control unit. The No. 5 VCC pin of the chip IC1 is grounded via capacitor C1. At the same time, the No. 5 VCC pin of the chip IC1 is connected to the power supply 3V3.

[0023] The No. 1 INB pin and the No. 2 INA pin of the chip IC2 are connected to the power supply 3V3 via the resistor R4 and the resistor R5 respectively. At the same time, the No. 2 INA pin of the chip IC2 is connected to the active shutdown signal pin M_OFF_MR of the MCU micro-control unit. The No. 2 INA pin of the chip IC2 is connected to the No. 2 OUT pin of IC1, the No. 3 GND pin of the chip IC2 is grounded, the No. 4 OUT pin of the chip IC2 is connected to the safety switch drive signal part 2, the No. 5 VCC pin of the chip IC2 is grounded via the capacitor C2, and the No. 5 VCC pin of the chip IC2 is connected to the power supply 3V3.

[0024] The safety switch drive signal part 2 includes a composite transistor Q2 and a MOS transistor Q1. The composite transistor Q2 is composed of two transistors. The emitters of the two transistors are grounded, the bases of the two transistors are connected to the No. 4 OUT pin of the chip IC2, the collectors of the two transistors are connected together and also connected to the gate of the MOS transistor Q1, and the connection point is the network OFF_SWITCH. The gate of the MOS transistor Q1 is connected to the drive signal pin M_DRV_MR of the MCU micro-control unit through the resistor R2, the drain of the MOS transistor Q1 is connected to the power supply VBAT_MR, the source of the MOS transistor Q1 is connected to one end of the motor M, and the other end of the motor M is grounded.

[0025] Chip IC1 and chip IC2 are both switch chips. Chip IC1 uses logic AND gates, and chip IC2 uses logic NAND gates.

[0026] In the specific implementation, the chip IC1 is MC74VHC1G66, which is a two-signal input AND gate, the chip IC2 is NLVVHC1G132DFT2G, which is a two-signal input NAND gate, the composite transistor Q2 is PUMH9-Q, the resistance of resistors R1, R4, R5, R6, R7, and R8 is 100Ω, and the capacitance of capacitors C1 and C2 is 100nF.

[0027] The specific working mode of the utility model includes two modes: a passive shutdown mode and an active shutdown mode; the load is not the motor M in the specific implementation.

[0028] Passive shutdown mode:

[0029] The specific implementation of the controller includes a fail-safe shutdown circuit, which is mainly related to Figure 1 Connect the motor M in the control unit to control the start and stop of the motor.

[0030] When the controller is operating normally, the MCU microcontroller unit has no faults. At this time, the passive fault output pin FCCU[0] outputs a high level of 3.3V, and the passive fault output pin FCCU[1] outputs a low level of 0V. At this time, the EN pin of the chip IC1 is a low level of 0V. At this time, the IN pin of the chip IC1 is disconnected from the OUT pin. Therefore, the potential of the OUT pin is pulled up to 3.3V by the pull-up resistor R4, making the potential of the INB pin of the chip IC2 a high level of 3.3V.

[0031] The active shutdown signal pin M_OFF_MR of the MCU microcontroller unit outputs a high level of 3.3V in normal mode. At this time, the OUT pin of the chip IC2 NAND gate outputs a low level of 0V to the compound transistor Q2. This low level 0V potential cannot turn on the compound transistor Q2, so that the compound transistor Q2 is disconnected. The drive signal pin M_DRV_MR can normally drive the MOS tube Q1 switch of the motor M to control the action of the motor M.

[0032] When the controller is not operating normally, such as when the MCU microcontroller unit has a power supply undervoltage fault, the passive fault output pin FCCU[0] of the MCU microcontroller unit outputs a low level of 0V, and the passive fault output pin FCCU[1] outputs a high level of 3.3V. At this time, the EN pin of the chip IC1 is a high level of 3.3V. At this time, the IN pin of the chip IC1 is connected to the OUT pin, so the potential of the OUT pin is a low level of 0V, so the potential of the INB pin of the chip IC2 is a low level of 0V.

[0033] The active shutdown signal pin M_OFF_MR of the MCU microcontroller unit is pulled up to 3.3V by the resistor R5, so the potential of the INA pin of the chip IC2 is high level 3.3V. At this time, the OUT pin of the chip IC2 NAND gate outputs a high level of 3.3V. This high level 3.3V potential turns on the composite transistor Q2, so that the composite transistor Q2 is grounded, and the connection OFF_SWITCH is low level 0V. The voltage of the drive signal pin M_DRV_MR is short-circuited to the ground after passing through the resistor R2. At this time, the motor MOS tube switch cannot be driven to turn on, and the motor M is forced not to move.

[0034] Active Shutdown Mode:

[0035] When the controller operates normally, the MCU microcontroller unit has no faults. If some components fail or need to be safely shut down, the passive fault output pin FCCU[0] outputs a high level of 3.3V, and the passive fault output pin FCCU[1] outputs a low level of 0V. At this time, the EN pin of the chip IC1 is a low level of 0V. At this time, the IN pin of the chip IC1 is disconnected from the OUT pin. Therefore, the potential of the OUT pin of the chip IC1 is pulled up to 3.3V by the pull-up resistor R4, so the potential of the INB pin of the chip IC2 is a high level of 3.3V.

[0036] When the active shutdown signal pin M_OFF_MR of the MCU microcontroller unit outputs a low level of 0V, the OUT pin of the chip IC2 NAND gate outputs a high level of 3.3V. This high level 3.3V potential turns on the composite transistor Q2, so that the composite transistor Q2 is grounded, and the connection OFF_SWITCH is a low level of 0V.

[0037] The voltage of the driving signal pin M_DRV_MR is short-circuited to the ground after passing through the resistor R2. At this time, the motor MOS tube switch cannot be driven to turn on, and the motor M is forced not to move.

Claims

1. A circuit for fail-safe shutdown of a vehicle controller, characterized in that: The device comprises two parts: a fault signal logic judgment module (1) and a safety switch drive signal part (2); the fault signal logic judgment module (1) is connected to a motor M on a vehicle through the safety switch drive signal part (2); and the fault signal logic judgment module (1) and the safety switch drive signal part (2) are respectively connected to an MCU micro-control unit; The fault signal logic judgment module (1) is mainly composed of logic AND gates and logic NAND gate chips. It controls the safety switch drive signal part (2) to drive the motor M to work or not work by performing logic judgment on the passive shutdown fault output pins FCCU[0], FCCU[1] and the active shutdown output pin M_OFF_MR of the MCU microcontroller unit.

2. A circuit for vehicle controller fail-safe shutdown according to claim 1, characterized in that: The fault signal logic judgment module (1) comprises a chip IC1, wherein the IN pin and the OUT pin of the chip IC1 are connected to the power supply 3V3 via resistors R1 and R4 respectively, and the IN pin of the chip IC1 is connected to the passive fault output pin FCCU[0] of the MCU micro-control unit, the OUT pin of the chip IC1 is connected to the INB pin of the chip IC2, the EN pin of the chip IC1 is grounded via resistor R3, and the EN pin of the chip IC1 is connected to the passive fault output pin FCCU[1] of the MCU micro-control unit, the VCC pin of the chip IC1 is grounded via capacitor C1, and the VCC pin of the chip IC1 is connected to the power supply 3V3.

3. A circuit for vehicle controller fail-safe shutdown according to claim 1, characterized in that: The fault signal logic judgment module (1) comprises a chip IC2, wherein the INB pin and the INA pin of the chip IC2 are connected to the power supply 3V3 via resistors R4 and R5 respectively, and the INA pin of the chip IC2 is connected to the active shutdown signal pin M_OFF_MR of the MCU micro-control unit, the OUT pin of the chip IC2 is connected to the safety switch drive signal part (2), the VCC pin of the chip IC2 is grounded via a capacitor C2, and the VCC pin of the chip IC2 is connected to the power supply 3V3.

4. A circuit for vehicle controller fail-safe shutdown according to claim 1, characterized in that: The safety switch drive signal part (2) comprises a composite triode Q2 and a MOS transistor Q1. The composite triode Q2 is composed of two triodes. The emitters of the two triodes are both grounded. The bases of the two triodes are both connected to the OUT pin of the chip IC2. The collectors of the two triodes are connected together and also connected to the gate of the MOS transistor Q1. The gate of the MOS transistor Q1 is connected to the drive signal pin M_DRV_MR of the MCU micro-control unit via a resistor R2. The drain of the MOS transistor Q1 is connected to the power supply VBAT_MR. The source of the MOS transistor Q1 is connected to one end of the motor M.

5. A circuit for vehicle controller fail-safe shutdown according to claim 1, characterized in that: The chip IC1 and the chip IC2 are both switch chips.

6. A circuit for fail-safe shutdown of a vehicle controller according to claim 1 or 5, characterized in that: The chip IC1 uses a logic AND gate, and the chip IC2 uses a logic NAND gate.

Images