Controller, power domain control system and vehicle

Abstract

The utility model provides a controller, a power domain control system and a vehicle, and the controller comprises a power monitoring module which is provided with a first dog feeding signal input end and a first reset signal output end; the first main control chip is provided with a first dog feeding signal output end, a second dog feeding signal input end, a first reset signal input end and a second reset signal output end, the first dog feeding signal output end is connected with the first dog feeding signal input end, and the first reset signal input end is connected with the first reset signal output end; and the second main control chip is provided with a second dog feeding signal output end and a second reset signal input end. Through connection deployment and signal control among the power supply monitoring module, the second main control chip and the first main control chip, the function meets the function safety requirement of the ASIL C level, a single power supply chip is used in the power supply monitoring module to monitor the double main control chips, the cost is reduced, the integration level is improved, and the applicability of mass production and application is improved.

Description

Technical Field

[0001] The utility model relates to the technical field of vehicles, and in particular to a controller, a power domain control system and a vehicle. Background Art

[0002] With the advancement of vehicle electrification and intelligence, vehicle electrical and electronic architectures are evolving toward a centralized domain architecture. The integration of power domain controller software and hardware in vehicles is becoming more complex, increasing functional safety requirements and the resulting safety risks associated with electronic system failures. Existing all-in-one power domain controller products are mostly physically integrated, utilizing powerful technology and processing capabilities to handle complex control algorithms and large amounts of data. They also employ redundant designs and fault detection mechanisms. If dual-controller chip systems are used to meet functional safety requirements, such as ASIL (Automotive Safety Integrity Level) C, dual power supply chip monitoring solutions are often employed to improve functional safety relevance and mitigate safety risks associated with electronic system failures.

[0003] However, the above-mentioned all-in-one power domain control products do not meet the functional safety requirements sufficiently. If a dual-master chip system is used to meet the functional safety requirements, two power supply chips are required to independently monitor the main chip. This has high costs and low integration, making it not suitable for mass production and application. Utility Model Content

[0004] The utility model aims to solve at least one of the technical problems existing in the prior art.

[0005] To this end, one purpose of the present invention is to propose a controller that meets the functional safety requirements of ASIL C level, uses a single power chip to monitor dual main control chips, reduces costs, improves integration, and improves applicability for mass production and application.

[0006] Therefore, the second object of the present invention is to provide a power domain control system.

[0007] Therefore, the third object of the present invention is to provide a vehicle.

[0008] In order to achieve the above-mentioned objectives, an embodiment of the first aspect of the present utility model proposes a controller, including: a power supply monitoring module, having a first dog feeding signal input terminal and a first reset signal output terminal; a first main control chip, having a first dog feeding signal output terminal, a second dog feeding signal input terminal, a first reset signal input terminal and a second reset signal output terminal, wherein the first dog feeding signal output terminal is connected to the first dog feeding signal input terminal, and the first reset signal input terminal is connected to the first reset signal output terminal; a second main control chip, having a second dog feeding signal output terminal and a second reset signal input terminal, wherein the second dog feeding signal output terminal is connected to the second dog feeding signal input terminal, and the second reset signal input terminal is connected to the second reset signal output terminal.

[0009] According to the controller of the embodiment of the present invention, a power monitoring chip is set up, and based on the signal communication between the power monitoring chip and the first main control chip, the power monitoring chip monitors the operation status of the first main control chip, and through the signal communication between the first main control chip and the second main control chip, the first main control chip monitors the operation status of the second main control chip, that is, a single power chip is used to monitor dual main control chips, which reduces costs, improves integration, and improves the applicability of mass production and application. At the same time, based on the connection deployment and signal control between the power monitoring module, the second main control chip and the first main control chip, the controller meets the functional safety requirements of ASIL C level.

[0010] In some embodiments, the power supply monitoring module includes: a watchdog unit and a monitoring control unit, the input end of the watchdog unit is connected to the first dog feeding signal input end, the output end of the watchdog unit is connected to the first reset signal output end and the input end of the monitoring control unit, and the output end of the monitoring control unit is connected to the second abnormal signal output end.

[0011] In order to achieve the above-mentioned purpose, an embodiment of the second aspect of the present utility model proposes a power domain control system, including a controller as described in the above embodiment; wherein, the first main control chip includes: a first non-safety core control unit; the first non-safety core control unit has a demand signal input terminal and an expected torque output terminal, and the demand signal input terminal inputs a vehicle status signal; the second main control chip includes: a second non-safety core control unit; the second non-safety core control unit has an expected torque input terminal and a torque command output terminal, and the expected torque input terminal is connected to the expected torque output terminal.

[0012] In some embodiments, the first main control chip also includes: a first safety core control unit; the first safety core control unit has a demand signal input terminal and a demand torque output terminal, and the demand signal input terminal inputs the vehicle status signal; the second main control chip also includes: a second safety core control unit; the second safety core control unit has a demand torque input terminal, a drive motor status input terminal, a first abnormal signal output terminal and a fault signal output terminal, the demand torque input terminal is connected to the demand torque output terminal, and the drive motor status input terminal inputs the drive motor status signal.

[0013] In some embodiments, the driving power module has a torque command input terminal, a power output terminal, a first abnormal signal input terminal and a second abnormal signal input terminal. The torque command input terminal is connected to the torque command output terminal, the first abnormal signal input terminal is connected to the first abnormal signal output terminal, the second abnormal signal input terminal is connected to the second abnormal signal output terminal, and the power output terminal is connected to the driving motor.

[0014] In some embodiments, it further includes: a decoding circuit, which is connected to the second main control chip and the motor rotary transformer respectively, and the decoding circuit includes a hardware decoding circuit and a software decoding circuit.

[0015] In some embodiments, it also includes: the first non-safety core control unit and the first safety core control unit both have a first voltage signal input terminal and a discharge demand output terminal, and the first voltage signal is input at the first voltage signal; the second non-safety core control unit and the second safety core control unit both have a discharge demand input terminal, and the discharge demand input terminal is connected to the discharge demand output terminal; the second non-safety core control unit also has a discharge instruction output terminal, and the discharge instruction output terminal is connected to the discharge module of the power domain control system; the second safety core control unit also has a discharge fault monitoring output terminal and a voltage signal verification input terminal, and the voltage signal verification input terminal inputs a bus voltage signal; the first safety core control unit and the second safety core control unit also have an alarm signal output terminal.

[0016] In some embodiments, it further includes: a fault alarm module having an alarm signal input terminal and a discharge fault monitoring input terminal, the alarm signal input terminal is connected to the alarm signal output terminal, and the discharge fault monitoring input terminal is connected to the discharge fault monitoring output terminal.

[0017] In some embodiments, the power supply monitoring module further has a fault signal input terminal, a third abnormal signal output terminal, a first voltage signal input terminal and a second voltage signal input terminal. The input terminal of the monitoring control unit is respectively connected to the fault signal input terminal and the two voltage signal input terminals, the output terminal of the monitoring control unit is connected to the third abnormal signal output terminal, the first voltage signal input terminal is connected to the voltage output terminal of the first main control chip, the second voltage signal input terminal is connected to the voltage output terminal of the second main control chip, the fault signal input terminal is connected to the fault signal output terminal, and the third abnormal signal output terminal is connected to the third abnormal signal input terminal of the driving power module.

[0018] According to the power domain control system of the embodiment of the present invention, the system has the controller of the above embodiment, and by setting a power monitoring chip, based on the signal communication between the power monitoring chip and the first main control chip, the power monitoring chip monitors the operation status of the first main control chip, and through the signal communication between the first main control chip and the second main control chip, the first main control chip monitors the operation status of the second main control chip, that is, a single power chip is used to monitor dual main control chips, which reduces costs, improves integration, and improves applicability of mass production and application. At the same time, based on the connection deployment and signal control between the power monitoring module, the second main control chip, the first main control chip and the driving power module, the power domain control system meets the functional safety requirements of ASIL C level.

[0019] In order to achieve the above-mentioned object, an embodiment of the third aspect of the present utility model provides a vehicle, which includes: a power domain control system as described in the above-mentioned embodiment.

[0020] According to the vehicle of the embodiment of the present utility model, the power domain control system of the above embodiment is deployed on the vehicle, and by setting a power monitoring chip, based on the signal communication between the power monitoring chip and the first main control chip, the power monitoring chip monitors the operation status of the first main control chip, and through the signal communication between the first main control chip and the second main control chip, the first main control chip monitors the operation status of the second main control chip, that is, a single power chip is used to monitor dual main control chips, which reduces costs, improves integration, and improves applicability of mass production and application. At the same time, based on the connection deployment and signal control between the power monitoring module, the second main control chip, the first main control chip and the driving power module, the power domain control system meets the functional safety requirements of ASIL C level.

[0021] Additional aspects and advantages of the present invention will be given in part in the following description and will become apparent from the following description or learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0023] Figure 1 is a block diagram of a controller according to a specific embodiment of the present utility model;

[0024] Figure 2 is a block diagram of a controller according to another specific embodiment of the present invention;

[0025] Figure 3 This is a block diagram of the equipment power domain control system architecture according to a specific embodiment of the present utility model;

[0026] Figure 4 It is a block diagram of a vehicle according to a specific embodiment of the present utility model.

[0027] Reference numerals:

[0028] Controller 100;

[0029] Power monitoring module 1; first main control chip 2; second main control chip 3;

[0030] First dog feeding signal input terminal 110; first reset signal output terminal 111; first dog feeding signal output terminal 112; second dog feeding signal input terminal 115; first reset signal input terminal 114; second reset signal output terminal 116; second dog feeding signal output terminal 109; second reset signal input terminal 117;

[0031] Output terminal 121 of the watchdog unit; input terminal 120 of the monitoring control unit; monitoring control unit 80; watchdog unit 69; first non-safety core control unit 10; first safety core control unit 11; second non-safety core control unit 12; second safety core control unit 13; hardware decoding circuit 14; software decoding circuit 15; motor A rotary transformer 16; motor B rotary transformer 17; drive power module 18; motor A 19; motor B 20;

[0032] Function monitoring layer 54; processor monitoring layer 64;

[0033] Power domain control system 101;

[0034] Required torque management and arbitration 51; active discharge demand management 52; main control chip 2-CPU0 safety core 55; actual torque comparison and verification 56; verification, calculation and protection module 57; verification module 58; main control chip 1-CPU0 safety core 59; program flow monitoring module 60; watchdog 62; GPIO pin 88; main control chip 1-CPU1 non-safe core 70; main chip 2-CPU1 non-safe core 71; second abnormal signal output terminal 144; first voltage signal input terminal and second voltage signal input terminal 123; first voltage signal input terminal 124; discharge command output terminal 125; demand signal input terminal 126; expected torque output terminal 127; discharge command input terminal 128; expected torque input terminal 129; torque command output Terminal 130; torque command input terminal 131; discharge demand output terminal 99; demand torque output terminal 132; discharge demand input terminal 133; discharge fault monitoring output terminal 134; voltage signal verification input terminal 135; current signal input terminal 136; resolver signal input terminal 137; alarm signal input terminal 138; demand torque input terminal 139; power output terminal 97; third abnormal signal input terminal 142; first abnormal signal input terminal 141; second abnormal signal input terminal 140; motor 66; first abnormal signal output terminal 143; third abnormal signal output terminal 122; alarm signal output terminal 145; fault signal input terminal 150; fault signal output terminal 155; discharge fault monitoring input terminal 160; output terminal 162 of monitoring control unit;

[0035] Vehicle 102. DETAILED DESCRIPTION

[0036] The embodiments of the present invention are described in detail below. The embodiments described with reference to the accompanying drawings are exemplary. The embodiments of the present invention are described in detail below.

[0037] Reference below Figure 1-Figure 2 The controller according to the embodiment of the present invention is described.

[0038] like Figure 11 is a block diagram of a controller according to a specific embodiment of the present invention. The controller 100 according to the present invention comprises: a power monitoring module 1 having a first dog feeding signal input terminal 110 and a first reset signal output terminal 111; a first main control chip 2 having a first dog feeding signal output terminal 112, a second dog feeding signal input terminal 115, a first reset signal input terminal 114, and a second reset signal output terminal 116, wherein the first dog feeding signal output terminal 112 is connected to the first dog feeding signal input terminal 110, and the first reset signal input terminal 114 is connected to the first reset signal output terminal 111; and a second main control chip 3 having a second dog feeding signal output terminal 109 and a second reset signal input terminal 117, wherein the second dog feeding signal output terminal 109 is connected to the second dog feeding signal input terminal 115, and the second reset signal input terminal 117 is connected to the second reset signal output terminal 116.

[0039] In an embodiment, Figure 1 As shown, the power monitoring module 1 includes a single power chip; the first dog feeding signal output terminal 112 and the second dog feeding signal output terminal 109 are used to output the dog feeding signal, which is a signal sent to the watchdog timer at a specified period to confirm the normal operation of the system; the reset signal is a triggered reset condition signal, and the hardware and / or software can be reset by the reset signal. The watchdog can be a hardware watchdog or a software watchdog.

[0040] For example, the controller 100 is designed with reference to the ISO26262 functional safety standard. Safety goals and functional safety concepts are defined based on hazard analysis and risk assessment results. A power monitoring module 1 is designed. The power monitoring module 1 communicates with the first main control chip 2 via an SPI (Serial Peripheral Interface). The power monitoring module 1 has a first dog feeding signal input terminal 110 for receiving a first dog feeding signal and monitoring the first main control chip 2 via SPI; and a first reset signal output terminal 111 for outputting a reset signal based on the monitoring result to reset the first main control chip 2. For example, if a communication anomaly occurs during SPI monitoring, the power monitoring module 1 periodically asks the first main control chip 2 questions via SPI communication and monitors the first main control chip 2. The first main control chip 2 answers within a preset time. The power monitoring module 1 judges the answer. If an incorrect answer is received, the same question is repeatedly sent and a fault counter is started. When the fault counter reaches a preset number of times, the first main control chip 2 is considered abnormal. The power monitoring module 1 sends a first reset signal via the first reset signal output terminal 111 (i.e., the RTSB pin). At this time, the RTSB (Real-Time System Bus) The Bus) pin is pulled low to reset the first master control chip 2.

[0041] The first main control chip 2 has a first dog feeding signal output terminal 112 connected to the first dog feeding signal input terminal 110 on the power monitoring module 1, and is used to output the first dog feeding signal to the first dog feeding signal input terminal 110; a first reset signal input terminal (i.e., PORST pin) 114 is connected to the first reset signal output terminal 111, and is used to receive the first reset signal (i.e., RTSB pin is pulled low) sent by the first reset signal output terminal 111 to reset the first main control chip 2; a second reset signal output terminal 116 is used to output a second reset signal to the second main control chip 3. Specifically, the first main control chip 2 is connected to the first reset signal output terminal 111 through an internal HSSL (High-Speed ​​Serial Link) Link) bus, using a software watchdog to monitor the second master chip 3. For example, the software watchdog timer receives a dog feeding signal related to the operation of the second master chip 3 at a specified period. The software is designed with an inter-chip communication counter. If the second master chip 3 works normally, the inter-chip communication counter will be cyclically accumulated. If the inter-chip communication counter of the second master chip 3 monitored by the first master chip 2 is abnormal, such as a jump or a stagnation, the abnormal situation will be analyzed for an abnormality level. According to the fault classification principle, if it is necessary to reset the second master chip 3 after analysis, the first master chip 2 sends a second reset signal to the second master chip 3 through the second reset signal output terminal 116 to reset the second master chip 3.

[0042] The second main control chip 3 has a second dog feeding signal output terminal 109, which is connected to the second dog feeding signal input terminal 115 on the first main control chip 2, and is used to send a second dog feeding signal so that the first main control chip 2 can monitor the second main control chip 3; a second reset signal input terminal (i.e., PORST pin) 117, which is connected to the second reset signal output terminal (i.e., GPIO pin) 116 on the first main control chip 2, so that after an abnormality is detected through the second dog feeding signal, the abnormality level analysis will be performed on the abnormal situation. According to the fault classification principle, if the second main control chip 3 needs to be reset after the analysis, the GPIO (General Purpose Input / Output) pin on the first main control chip 2 and the PORST (Reset pin, Reset pin) on the second main control chip 3 will be automatically pulled low. Pin) pin resets the second main control chip 3. For example, the first main control chip 2 monitors the second main control chip 3 based on the internal high-speed serial HSSL bus through the second dog feeding signal. The first main control chip 2 monitors the operation of the second main control chip 3. If the second main chip 3 works normally, the inter-chip communication counter will be cyclically accumulated. If the inter-chip communication counter of the first main chip 2 monitoring the second main chip 3 is abnormal, such as jumping or stuck, the abnormal situation will be analyzed for abnormality level. According to the fault classification principle, if it is necessary to reset the second main control chip 3 after analysis, the first reset signal output terminal 116 will send the first reset signal. Second reset signal, at this time, the GPIO pin on the first main control chip 2 and the PORST pin on the second main chip 3 are pulled low to reset the second main chip 3. If the abnormal situation is not only related to the second main chip 3, it means that the abnormal level is high, and resetting the second main chip 3 alone cannot solve the existing abnormality. Then, on the basis of resetting the second main chip 3, the first main chip 2 can trigger the safety function of the power monitoring module 1 by stopping outputting the first dog feeding signal, etc. The power monitoring module 1 actively short-circuits the functional safety-related pin (i.e., the FS0B pin) to drive the power module 18 to turn off the PWM (Pulse Width Modulation) output, thereby cutting off the torque output and entering a safe state.

[0043] In addition, if an exception occurs in the task execution of the software operating system in the safety core CPU (Central Processing Unit) 0 in the second main control chip 3, such as a safety task timeout, the software fault counter designed in the second main control chip 3 will be started and accumulated. When the fault counter reaches a preset number of times, the inter-chip communication counter will be stopped, and the first main control chip 2 will monitor the second main control chip 3 through the second dog feeding signal. If the inter-chip communication counter of the second main control chip 3 is detected to be abnormal, the abnormal situation will be analyzed for abnormality level. After analysis, if the second main control chip 3 needs to be reset, a second reset signal will be sent through the second reset signal output terminal 116. At this time, the GPIO pin on the first main control chip 2 and the RTSB pin on the second main control chip 3 are pulled low to reset the second main control chip 3.

[0044] Since the design of the controller 100 refers to the ISO26262 functional safety standard, the monitoring and signal control related functions between the power monitoring module 1, the first main control chip 2 and the second main control chip 3 meet the functional safety requirements of the ASILC level when designed according to needs, and a single power chip (i.e., the power monitoring module 1) is used to monitor and control the signals of the dual main control chips (i.e., the first main control chip 2 and the second main control chip 3), which reduces costs, improves integration, and improves applicability for mass production and application.

[0045] According to the controller of the embodiment of the present invention, a power monitoring chip is set up, and based on the signal communication between the power monitoring chip and the first main control chip, the power monitoring chip monitors the operation status of the first main control chip, and through the signal communication between the first main control chip and the second main control chip, the first main control chip monitors the operation status of the second main control chip, that is, a single power chip is used to monitor dual main control chips, which reduces costs, improves integration, and improves the applicability of mass production and application. At the same time, based on the connection deployment and signal control between the power monitoring module, the second main control chip and the first main control chip, the controller meets the functional safety requirements of ASIL C level.

[0046] In some embodiments, as Figure 2 FIG2 is a block diagram of a controller according to another embodiment of the present invention. The power monitoring module 1 includes a watchdog unit 69 and a monitoring control unit 80. The input of the watchdog unit 69 is connected to a first watchdog feeding signal input 110. The output 121 of the watchdog unit is connected to a first reset signal output 111 and an input 120 of the monitoring control unit. The output of the monitoring control unit 80 is connected to a second abnormality signal output 144.

[0047] In the embodiment, the abnormal signal is a signal sent when the power monitoring module 1 monitors the abnormality of the first main control chip 2 and / or the first main control chip 2 monitors the abnormality of the second main control chip 3, and the second abnormal signal output terminal 144 is used to output the second abnormal signal; the watchdog unit 69 is a hardware watchdog and is integrated in the power monitoring module 1, which is used to receive the dog feeding signal and monitor the operating status of the system; Figure 2 As shown, the input end of the watchdog unit 69 is connected to the first dog feeding signal input end 110, which is used to receive the first dog feeding signal and monitor the first main control chip 2 through SPI according to the received first dog feeding signal; the output end 121 of the watchdog unit is connected to the first reset signal output end (i.e., RTSB pin) 111, which is used to send a first reset signal to reset the first main control chip 2 when the monitoring is abnormal; the output end 121 of the watchdog unit is also connected to the input end 120 of the monitoring control unit, which is used to send the first reset signal to the monitoring control unit 80; the output end of the monitoring control unit 80 is connected to the second abnormal signal output end 144 (i.e., FS0B pin), which is used to send the second abnormal signal to the driving power module 18, so as to realize the control of actively short-circuiting the driving power module 18 through the FS0B (functional safety related pin) pin, shutting down the PWM output of the driving power module 18, and cutting off the torque output.

[0048] Reference below Figure 3 The power domain control system according to the embodiment of the present invention is described.

[0049] The power domain control system of the present invention is implemented based on the power domain control system architecture, which is explained below.

[0050] It should be noted that the ISO 26262 standard is a globally recognized automotive functional safety standard and one of the industry-recognized compliance entry thresholds. The design of the power domain control system refers to the ISO26262 functional safety standard, and defines safety goals and functional safety concepts based on hazard analysis and risk assessment results. The all-in-one power domain control integrates the VCU (Vehicle Control Unit) control unit, the MCU (Motor Control Unit) control unit, the TCU (Transmission Control Unit) transmission shift control unit, the DCDC (DC-DC Converter Control Unit, high-voltage-low-voltage converter control unit) control unit, the PDU (Power Distribution Unit) high-voltage distribution control unit, the DCAC (DC to AC Converter) auxiliary drive control unit, etc. Since the all-in-one power domain control system is relatively large and complex, the MCU control unit is used as an example to illustrate the design of the functional safety architecture, and the following is obtained: Figure 3 The power domain control system architecture block diagram is shown in the figure, and two safety goals obtained in the functional safety concept phase are selected for design, namely preventing unexpected vehicle acceleration (ASIL C) and preventing active discharge failure from causing electric shock to personnel (ASIL A).

[0051] like Figure 3 The figure shows a block diagram of the power domain control system architecture of a specific embodiment of the present invention. Figure 2 As shown, the power domain control system architecture of the present invention includes: a functional layer, a functional monitoring layer 54, and a processor monitoring layer 64. Among them:

[0052] The driving power module 18 is deployed as a control unit on the MCU physical architecture.

[0053] The functional layer includes the main control chip 1-CPU1 non-safety core 70 and the main control chip 2-CPU1 non-safety core 71; the power domain control system, such as an all-in-one power domain control system, uses dual main control chips (i.e., the first main control chip 2 and the second main control chip 3) and a single power supply chip. The first non-safety core control unit 10 of the first main chip 2, for example, the main control chip 1-CPU1 non-safety core 70, the main chip 1-CPU1 non-safety core 70 detects and receives external demand signals and voltage signals, and performs active discharge demand management on the voltage signal in the internal active discharge demand management 52, and performs torque management and arbitration on the demand signal in the demand torque management and arbitration 51, and finally sends the expected torque and discharge demand to the second non-safety core control unit 12 of the second main control chip 3, for example, to the main control chip 2-CPU1 non-safety core 71, so as to complete the preliminary processing of the signal in the functional layer 50.

[0054] The functional monitoring layer 54 is connected to the functional layer. The first safety core control unit 11 of the first main control chip 2, for example, the main control chip 1-CPU0 safety core 59, performs an E2E check on the demand signal in the verification module 58 of the main control chip 1-CPU0 safety core 59 according to verification and protection requirements. The demand torque is then E2E protected in the verification, calculation, and protection module 57. The signal is then sent via the HSSL bus to the second safety core control unit 13 of the second main control chip 3, for example, the main control chip 2-CPU0 safety core 55. The actual torque comparison check 56 of the main control chip 2-CPU0 safety core 55 performs an actual torque comparison check. If an abnormality occurs, a first abnormality signal is sent to the drive power module 18 via the GPIO pin 88, which actively shorts the drive power module 18, shuts down its PWM output, and cuts off torque output control. The security tasks in the CPU0 safety cores of the dual main control chips (i.e., the first main control chip 2 and the second main control chip 3) should include a program flow monitoring module 60 responsible for program flow monitoring. The watchdog unit 69 is, for example, the watchdog 62, and the flow monitoring module 60 communicates with the watchdog 62, that is, the program flow monitors the watchdog function of the associated power chip. The ASIL level allocation is consistent with the safety concept stage. Functions such as program flow monitoring are ASILC level, so as to achieve signal verification and safety protection processing at the functional monitoring layer, so that the functional safety level reaches ASIL C level.

[0055] The processor monitoring layer is connected to the functional monitoring layer and is used to send a first reset signal to reset the first main control chip 2 when an abnormal signal is triggered. The first main control chip 2 communicates and monitors the power chip (i.e., the power monitoring module 1) through SPI to monitor the working status of the first main control chip 2. When the first main control chip 2 is abnormal, it will not be able to output the dog feeding signal to the watchdog unit 69. After the dog feeding timeout, the power chip resets the first main control chip 2 through the RSTB pin, and at the same time actively short-circuits the PWM output through the functional safety-related pins of the power chip, such as the FSOB pin, to achieve the execution of signal monitoring and management results.

[0056] The power domain control system functions undertaken by each main control chip use the E-GAS three-layer functional architecture that meets the ISO26262 functional safety standard, namely: functional layer, functional monitoring layer, and processor monitoring layer. Through the design of relevant safety mechanisms such as hardware and software, the safe operation of the entire power domain control system is guaranteed.

[0057] The power domain control system is described below based on the above-mentioned power domain control system architecture.

[0058] The power domain control system of the present utility model comprises a controller as described in the above embodiment; Figure 2 and Figure 3 As shown, the first main control chip 2 includes: a first non-safety core control unit 10; the first non-safety core control unit 10 has a demand signal input terminal 126 and an expected torque output terminal 127, and the demand signal input terminal 126 inputs the vehicle status signal; the second main control chip 3 includes: a second non-safety core control unit 12; the second non-safety core control unit 12 has an expected torque input terminal 129 and a torque command output terminal 130, and the expected torque input terminal 129 is connected to the expected torque output terminal 127.

[0059] In an embodiment, combining Figure 2 and Figure 3 As shown, the power domain control system 101 includes the controller 100 of the above embodiment, wherein the first main control chip 2 includes: a first non-safety core control unit 10, for example, the main control chip 1-CPU1 non-safety core 70, for receiving and processing signals;

[0060] The main control chip 1-CPU1 non-safety core 70 has a demand signal input terminal 126 and a desired torque output terminal 127. The demand signal input terminal 126 is used to receive demand signals, such as a demand torque input signal, an accelerator pedal signal, and a torque demand signal. After receiving the demand signal, demand torque management and arbitration are performed in the demand torque management and arbitration 51. The demand torque is then limited, distributed, and calculated to obtain the desired torque, which is then output through the desired torque output terminal 127. The demand signal input terminal 126 receives a vehicle status signal, such as the aforementioned demand signal. The various connections within the first non-safety core control unit 10 are used to process the demand signal and output the desired torque.

[0061] The second main control chip 3 includes: a second non-safety core control unit 12, which is used to receive the desired torque and perform further processing;

[0062] The second non-safety core control unit 12 has a desired torque input terminal 129 and a torque command output terminal 130. The desired torque input terminal 129 is connected to the desired torque output terminal 127 and is used to receive the desired torque. The second non-safety core control unit 122 first performs torque control calculation and filtering on the desired torque received through the desired torque input terminal 129, then performs PWM control and outputs the torque command through the torque command output terminal 130. The torque command is a command for controlling torque, for example, to degrade torque. The second non-safety core control unit 12 receives and further processes the desired torque and outputs the torque command.

[0063] In some embodiments, combined Figure 2 and Figure 3 As shown, the first main control chip 2 also includes: a first safety core control unit 11, the first safety core control unit 11 has a demand signal input terminal 126 and a demand torque output terminal 132, and the demand signal input terminal 126 inputs the vehicle status signal; the second main control chip 3 also includes: a second safety core control unit 13, the second safety core control unit 13 has a demand torque input terminal 139, a drive motor status input terminal, a first abnormal signal output terminal 143 and a fault signal output terminal 155, the demand torque input terminal 139 is connected to the demand torque output terminal 132, and the drive motor status input terminal inputs the drive motor status signal.

[0064] In the embodiment, the first main control chip 2 further includes: a first safety core control unit 11, configured to receive a demand signal and process the signal accordingly;

[0065] The first safety core control unit 11, for example, the main control chip 1-CPU0 safety core 59, has a demand signal input terminal 126 and a demand torque output terminal 132; the demand signal input terminal 126 inputs the vehicle status signal, such as the accelerator pedal signal, the torque demand signal and the brake switch signal, etc. After the main control chip 1-CPU0 safety core 59 receives the demand signal through the demand signal input terminal 126, it performs safety signal E2E verification and signal rationality verification in the verification module 58 according to the verification requirements of each signal, and sends the verification result to the verification, calculation and protection module 57. The verification, calculation and protection module 57 performs further processing according to the processing requirements of different signals, for example, performs driver intention verification requirements, demand torque calculation and demand torque signal E2E protection, and sends the further processed results through the demand torque output terminal 132; the connection relationship within the first safety core control unit 11 is used to realize the verification and protection of different demand signals.

[0066] The second main control chip 3 further includes: a second safety core control unit 13, for example, the main control chip 2-CPU0 safety core 55, which is used to receive the required torque and the driving motor status.

[0067] The second safety core control unit 13 has a demand torque input terminal 139, a drive motor state input terminal, a first abnormal signal output terminal 143 and a fault signal output terminal 155, wherein the drive motor state input terminal includes: a current signal input terminal 136 and a resolver signal input terminal 137; the drive motor state includes: resolver, three-phase current, bus voltage and duty cycle, etc.; the demand torque input terminal 139 is connected to the demand torque output terminal 132, which is used to output the demand torque to the second safety core control unit 13, first perform torque demand analysis processing, then perform actual torque comparison verification, safety state control, hardware fault processing and / or PWM function safety control, and perform abnormal level analysis on the abnormal torque. When the abnormal level meets the level requirements of actively short-circuiting the drive power module 18, shutting down the PWM output of the drive power module 18 and cutting off the torque output, the first abnormal signal output terminal 143 outputs the first abnormal signal. Normal signal; the second safety core control unit 13 receives the three-phase current by connecting the three-phase current through the current signal input terminal 136, and receives the resolver signal by connecting the resolver signal input terminal 137. The second safety core control unit 13 performs safety signal E2E verification and / or signal rationality verification on the received three-phase current and resolver signal, and performs drive state estimation, actual torque comparison verification, safety state control, hardware fault processing and / or PWM function safety control on the verification result; the program flow monitoring module 60 is responsible for program flow monitoring, combined with memory detection and fault response mechanism, and outputs a fault signal through the fault signal output terminal 155 when an abnormality is monitored; through the connection relationship within the second safety core control unit 13, the received required torque and drive motor state, as well as the program flow, are subjected to corresponding fault monitoring, torque verification and safety state control, and output corresponding abnormal signal or fault signal.

[0068] In some embodiments, as Figure 3 As shown, the driving power module 18 has a torque command input terminal 131, a power output terminal 97, a first abnormal signal input terminal 141 and a second abnormal signal input terminal 140. The torque command input terminal 131 is connected to the torque command output terminal 130, the first abnormal signal input terminal 141 is connected to the first abnormal signal output terminal 143, the second abnormal signal input terminal 140 is connected to the second abnormal signal output terminal 144, and the power output terminal 97 is connected to the drive motor.

[0069] In an embodiment, Figure 3As shown, the driving power module 18 has a torque command input terminal 131, a power output terminal 97, a first abnormal signal input terminal 141 and a second abnormal signal input terminal 140; the torque command input terminal 131 is connected to the torque command output terminal 130, and is used to input the received torque command into the driving power module 18 to control the driving motor, such as the motor 66, to execute the torque command. The torque command is, for example: for the monitored abnormal torque, according to the fault classification principle, the torque execution is downgraded; the first abnormal signal input terminal 141 is connected to the first abnormal signal output terminal 143, and is used to input the received first abnormal signal into the driving power module 18 for functional safety shutdown and perform active short-circuit control. For example, for the abnormal torque after the safety state control processing, according to the fault classification principle, for the fault that requires PWM to cut off the drive output, the GPIO pin 88 is actively short-circuited to drive the power module 18. The second abnormal signal input terminal 140 is connected to the second abnormal signal output terminal 144, and is used to input the received second abnormal signal into the driving power module 18 for functional safety shutdown and active short-circuit control. For example, when the monitoring control unit 80 detects an abnormal fault, according to the fault classification principle, for the fault requiring PWM drive output cutoff, the second abnormal signal is sent to the driving power module 18 via the second abnormal signal output terminal 144 (i.e., the FSOB pin), which actively short-circuits the driving power module 18, shuts off the PWM output of the driving power module 18, and cuts off the torque output. The power output terminal 97 is connected to the driving motor, such as motor 66, which includes motor A 19 and motor B 20, and is used for the driving power module 18 to control the motor according to the received torque command or signal. The received torque command and signal are executed through the connection between the driving power module 18, the two main control chips (i.e., the first main control chip 2 and the second main control chip 3), and the power monitoring module 1.

[0070] In some embodiments, as Figure 2 As shown, it also includes: a decoding circuit, which is connected to the second main control chip 3 and the motor rotary transformer respectively, and the decoding circuit includes a hardware decoding circuit 14 and a software decoding circuit 15.

[0071] In an embodiment, Figure 2As shown, the decoding circuit is respectively connected to the second main control chip 3 and the motor resolver, and the decoding circuit includes a hardware decoding circuit 14 and a software decoding circuit 15; the motor resolver includes a motor A resolver 16 and a motor B resolver 17; the second main control chip 3 sends data related to the motor resolver to the decoding circuit, and the hardware decoding circuit 14 in the decoding circuit decodes the hardware part of the data, and the software decoding circuit 15 decodes the software part of the data to ensure that both the hardware and software of the data can be decoded successfully. The decoding circuit sends the decoding result to the motor resolver to realize control of the motor resolver.

[0072] In some embodiments, as Figure 3 As shown, it also includes: the first non-safety core control unit 10 and the first safety core control unit 11 also have a first voltage signal input terminal 124 and a discharge demand output terminal 99, and the first voltage signal input terminal 124 inputs the first voltage signal; the second non-safety core control unit 12 and the second safety core control unit 13 also have a discharge demand input terminal 133, and the discharge demand input terminal 133 is connected to the discharge demand output terminal 99; the second non-safety core control unit 13 also has a discharge instruction output terminal 125, and the discharge instruction output terminal 125 is connected to the discharge module of the power domain control system; the second safety core control unit 13 also has a discharge fault monitoring output terminal 134 and a voltage signal verification input terminal 135, and the voltage signal verification input terminal 135 inputs the bus voltage signal; the first safety core control unit 11 and the second safety core control unit 13 also have an alarm signal output terminal 145.

[0073] In an embodiment, the first non-safety core control unit 10 and the first safety core control unit 11 both further have a first voltage signal input terminal 124 and a discharge demand output terminal 99, wherein the first voltage signal input terminal 124 is used to receive a first voltage signal, such as a KL (Klemme, connector / connector‌) 15 ignition signal, and process the first voltage signal through active discharge demand management to obtain a discharge demand and output it through the discharge demand output terminal 99, so as to send the discharge demand to the second main control chip 3 for further processing; the second non-safety core control unit 12 and the second safety core control unit 13 both further have a discharge demand input terminal 133, and the discharge demand input terminal 133 is connected to the discharge demand output terminal 99. Terminal 99 is used to receive a discharge demand; in the second safety core control unit 13, the received discharge demand is monitored through active discharge failure fault monitoring, the active discharge failure in the discharge demand is treated as a fault, the discharge fault monitoring information related to the fault is integrated, and the discharge fault monitoring information is output through the discharge fault monitoring output terminal 134; in the second non-safety core control unit 12, the received discharge demand is actively discharged and controlled to perform resistance discharge and / or bridge arm direct discharge; the second non-safety core control unit 13 also has a discharge instruction output terminal 125, the discharge instruction output terminal 125 is connected to the discharge module of the power domain control system, when the above-mentioned active discharge control is resistance discharge, The discharge instruction is a resistor discharge instruction outputted to the discharge module through the discharge instruction output terminal 125 for discharge drive control; the second safety core control unit 13 also has a discharge fault monitoring output terminal 134 for outputting discharge fault monitoring information; the second safety core control unit 13 also has a voltage signal verification input terminal 135 for receiving a voltage bus signal. The second safety core control unit 13 first verifies the bus voltage of the received voltage bus signal, and then monitors the result of the verification through active discharge failure fault monitoring. The active discharge failure triggered by the bus voltage signal is regarded as a fault, and the discharge fault monitoring information related to the fault is integrated, and the discharge fault monitoring information is monitored through the discharge fault The monitoring output terminal 134 is output, and at the same time, the verified result is used to estimate the driving state, including one or more of the resolver / phase current / bus voltage / duty cycle, etc., and the actual torque is estimated for the estimated result, for example, the actual torque is estimated using the power method, and the result after the actual torque estimation is subjected to actual torque comparison verification, safety state control, hardware fault processing and / or PWM function safety control; the first safety core control unit 11 and the second safety core control unit 13 also have an alarm signal output terminal 145, which is used to output the alarm signal obtained after the result monitored by the program flow monitoring module 60 is processed by memory detection and fault response mechanism to the fault alarm module 65 for alarming.Through the connection relationship related to the voltage signal among the first non-safety core control unit, the first safety core control unit, the second non-safety core control unit and the second non-safety core control unit, the voltage signal can be managed and monitored, and corresponding alarm control can be performed.

[0074] In some embodiments, as Figure 3 As shown, it also includes: a fault alarm module 65, which has an alarm signal input terminal 138 and a discharge fault monitoring input terminal 160, the alarm signal input terminal 138 is connected to the alarm signal output terminal 145, and the discharge fault monitoring input terminal 160 is connected to the discharge fault monitoring output terminal 134.

[0075] In an embodiment, the fault alarm module 65 has an alarm signal input terminal 138 and a discharge fault monitoring input terminal 160, wherein the alarm signal input terminal 138 is connected to the alarm signal output terminal 145, and the fault alarm module 65 receives the alarm signal output from the alarm signal output terminal 145 through the alarm signal input terminal 138. For example, the program flow monitoring module 60 is responsible for program flow monitoring, and processes the monitored results through memory detection and fault response mechanism to obtain an alarm signal of abnormal program flow, and outputs the alarm signal through the alarm signal output terminal 145 to the alarm signal input terminal of the fault alarm module 65. Terminal 138, the fault alarm module 65 will alarm after receiving the alarm signal; the discharge fault monitoring input terminal 160 is connected to the discharge fault monitoring output terminal 134, and the fault alarm module 65 receives the discharge fault monitoring information output from the discharge fault monitoring output terminal 134 through the discharge fault monitoring input terminal 160, and alarms according to the discharge fault monitoring information; through the connection relationship between the fault alarm module 65, the first safety core control unit 11 and the second safety core control unit 13, the fault alarm module 65 can receive the alarm signal and alarm, remind the user to deal with it in time and facilitate the user to check the fault, etc.

[0076] In some embodiments, as Figure 3 As shown, the power supply monitoring module 1 also has a fault signal input terminal 150, a third abnormal signal output terminal 122, a first voltage signal input terminal and a second voltage signal input terminal 123. The input terminal of the monitoring control unit 80 is respectively connected to the fault signal input terminal 150, the first voltage signal input terminal and the second voltage signal input terminal 123. The output terminal 162 of the monitoring control unit is connected to the third abnormal signal output terminal 122. The first voltage signal input terminal is connected to the voltage output terminal of the first main control chip 2, and the second voltage signal input terminal is connected to the voltage output terminal of the second main control chip 3. The fault signal input terminal 150 is connected to the fault signal output terminal 155, and the third abnormal signal output terminal 122 is connected to the third abnormal signal input terminal 142 of the driving power module.

[0077] In an embodiment, combining Figure 2 and Figure 3 As shown, the power supply monitoring module 1 also has a fault signal input terminal 150, a third abnormal signal output terminal 122, a first voltage signal input terminal and a second voltage signal input terminal 123, the first voltage signal is such as a KL15 ignition signal, and the second voltage signal is such as a KL30 long power signal; the input terminals of the monitoring control unit 80 are respectively connected to the fault signal input terminal 150, the first voltage signal input terminal and the second voltage signal input terminal 123, the program flow monitoring module 60 is responsible for program flow monitoring, and processes the monitored abnormalities through memory detection and fault response mechanism, and inputs them into the monitoring control unit 80 for monitoring through the fault signal input terminal 150. At the same time, the monitoring control unit 80 monitors the voltage signals received through the first voltage signal input terminal and the second voltage signal input terminal 123, wherein the first voltage signal input terminal The first main control chip 2 is connected to the voltage output terminal, and the second voltage signal input terminal is connected to the voltage output terminal of the second main control chip 3. The output terminal 162 of the monitoring control unit is connected to the third abnormal signal output terminal 122. The monitoring control unit performs abnormal level analysis on the abnormal signal obtained after hardware fault processing. For faults that require PWM cut-off of the drive output, the third abnormal signal is output to the third abnormal signal output terminal 122 through the output terminal 162 of the monitoring control unit. The fault signal input terminal 150 is connected to the fault signal output terminal 155, and the third abnormal signal output terminal 122 is connected to the third abnormal signal input terminal 142 of the drive power module, which is used to input the received third abnormal signal into the drive power module 18 to actively short-circuit the drive power module 18, shut down the PWM output of the drive power module 18, and cut off the torque output. Through the connection relationship in the power supply monitoring module 1, voltage monitoring and fault processing are realized, and corresponding signals are output according to the monitoring and processing results.

[0078] According to the power domain control system of the embodiment of the present invention, the system has the controller of the above embodiment, and by setting a power monitoring chip, based on the signal communication between the power monitoring chip and the first main control chip, the power monitoring chip monitors the operation status of the first main control chip, and through the signal communication between the first main control chip and the second main control chip, the first main control chip monitors the operation status of the second main control chip, that is, a single power chip is used to monitor dual main control chips, which reduces costs, improves integration, and improves applicability of mass production and application. At the same time, based on the connection deployment and signal control between the power monitoring module, the second main control chip, the first main control chip and the driving power module, the power domain control system meets the functional safety requirements of ASIL C level.

[0079] Reference below Figure 4 A vehicle according to an embodiment of the present invention is described.

[0080] like Figure 4FIG. 1 is a block diagram of a vehicle according to a specific embodiment of the present invention. A vehicle 102 according to the present invention includes: a power domain control system 101 according to the above embodiment.

[0081] According to the vehicle 102 of the embodiment of the present utility model, the power domain control system 101 of the above embodiment is deployed on the vehicle. By setting a power monitoring chip, based on the signal communication between the power monitoring chip and the first main control chip, the power monitoring chip monitors the operation status of the first main control chip, and through the signal communication between the first main control chip and the second main control chip, the first main control chip monitors the operation status of the second main control chip, that is, a single power chip is used to monitor dual main control chips, which reduces costs, improves integration, and improves applicability of mass production and application. At the same time, based on the connection deployment and signal control between the power monitoring module, the second main control chip, the first main control chip and the driving power module, the power domain control system meets the functional safety requirements of ASIL C level.

[0082] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "illustrative embodiments," "example," "specific example," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example.

[0083] Although the embodiments of the present invention have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and purpose of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A controller, characterized in that: include: A power supply monitoring module having a first dog feeding signal input terminal and a first reset signal output terminal; A first main control chip has a first dog feeding signal output terminal, a second dog feeding signal input terminal, a first reset signal input terminal, and a second reset signal output terminal, wherein the first dog feeding signal output terminal is connected to the first dog feeding signal input terminal, and the first reset signal input terminal is connected to the first reset signal output terminal; The second main control chip has a second dog feeding signal output end and a second reset signal input end, wherein the second dog feeding signal output end is connected to the second dog feeding signal input end, and the second reset signal input end is connected to the second reset signal output end.

2. The controller according to claim 1, characterized in that The power supply monitoring module includes: a watchdog unit and a monitoring control unit, the input end of the watchdog unit is connected to the first dog feeding signal input end, the output end of the watchdog unit is connected to the first reset signal output end and the input end of the monitoring control unit, and the output end of the monitoring control unit is connected to the second abnormal signal output end.

3. A power domain control system, characterized in that: comprising a controller as claimed in claim 1 or 2; Wherein, the first main control chip includes: a first non-safety core control unit; The first non-safety core control unit has a demand signal input terminal and a desired torque output terminal, and the demand signal input terminal inputs a vehicle state signal; The second main control chip includes: a second non-safety core control unit; The second non-safety core control unit has an expected torque input terminal and a torque command output terminal, and the expected torque input terminal is connected to the expected torque output terminal.

4. The power domain control system according to claim 3, characterized in that: include: The first main control chip also includes: a first safety core control unit; The first safety core control unit has a demand signal input terminal and a demand torque output terminal, and the demand signal input terminal inputs the vehicle status signal; The second main control chip also includes: a second safety core control unit; The second safety core control unit has a required torque input terminal, a drive motor status input terminal, a first abnormal signal output terminal and a fault signal output terminal. The required torque input terminal is connected to the required torque output terminal, and the drive motor status input terminal inputs a drive motor status signal.

5. The power domain control system according to claim 4, characterized in that: Also includes: The driving power module has a torque command input terminal, a power output terminal, a first abnormal signal input terminal and a second abnormal signal input terminal. The torque command input terminal is connected to the torque command output terminal, the first abnormal signal input terminal is connected to the first abnormal signal output terminal, the second abnormal signal input terminal is connected to the second abnormal signal output terminal, and the power output terminal is connected to the driving motor.

6. The power domain control system according to claim 3, characterized in that: Also includes: The decoding circuit is connected to the second main control chip and the motor rotary transformer respectively, and the decoding circuit includes a hardware decoding circuit and a software decoding circuit.

7. The power domain control system according to claim 4, characterized in that: The first non-safe core control unit and the first safe core control unit each further comprise a first voltage signal input terminal and a discharge demand output terminal, wherein the first voltage signal input terminal inputs a first voltage signal; The second non-safety core control unit and the second safety core control unit each further have a discharge demand input terminal, wherein the discharge demand input terminal is connected to the discharge demand output terminal; The second non-safety core control unit further has a discharge instruction output terminal, and the discharge instruction output terminal is connected to the discharge module of the power domain control system; The second safety core control unit further comprises a discharge fault monitoring output terminal and a voltage signal verification input terminal, wherein the voltage signal verification input terminal inputs a bus voltage signal; The first safety core control unit and the second safety core control unit also each have an alarm signal output terminal.

8. The power domain control system according to claim 7, characterized in that: Also includes: The fault alarm module comprises an alarm signal input terminal and a discharge fault monitoring input terminal, wherein the alarm signal input terminal is connected to the alarm signal output terminal, and the discharge fault monitoring input terminal is connected to the discharge fault monitoring output terminal.

9. The power domain control system according to claim 5, characterized in that: The power supply monitoring module also has a fault signal input end, a third abnormal signal output end, a first voltage signal input end and a second voltage signal input end. The input end of the monitoring control unit is respectively connected to the fault signal input end and the two voltage signal input ends, the output end of the monitoring control unit is connected to the third abnormal signal output end, the first voltage signal input end is connected to the voltage output end of the first main control chip, the second voltage signal input end is connected to the voltage output end of the second main control chip, the fault signal input end is connected to the fault signal output end, and the third abnormal signal output end is connected to the third abnormal signal input end of the driving power module.

10. A vehicle, characterized in that: include: A power domain control system as claimed in any one of claims 3 to 9.

Images