Safety control device and domain controller

Abstract

The utility model discloses a safety control device and a domain controller, and the safety control device comprises a first control part which comprises a first output part which is used for outputting a high level or a low level; the second output part is used for power driving output, and the second output part comprises a switch part which is used for enabling the second output part to be switched between an on state and an off state; the third output part is used for outputting a high level or a low level; the execution part comprises a first input end, a second input end and a first output end, the first input end is connected with the third output part, the first output end is connected with the switch part, and the first output end is used for outputting a high level or a low level to the switch part; the second control part comprises a third input end, a second output end and a third output end, the third input end is connected with the first output part, the second output end is connected with the second input end, and the third output end is connected with the first input end, so that the first output end outputs a high level or a low level. According to the utility model, multi-stage protection can be provided for the domain controller.

Description

[0001] This application claims priority to Chinese Patent Application No. 202411744516.7, filed on November 28, 2024, entitled "A Security Control Device and Domain Controller", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This utility model relates to the field of vehicle safety control, and in particular to a safety control device and a domain controller. Background Art

[0003] A vehicle's domain controller is an integrated controller in an automotive electronic system responsible for managing specific functions. It can control multiple vehicle subsystems such as power control, internal communication, lighting systems, and the body, improving the overall system efficiency and performance by centrally processing and optimizing these functions.

[0004] Based on the functions of automotive electronic components, the entire vehicle is divided into several domains such as powertrain, smart cockpit, and autonomous driving. Each domain is controlled in a relatively centralized manner using multi-core CPU / GPU chips with stronger processing power, replacing the current distributed electronic and electrical architecture.

[0005] With the development of the automotive industry, the demand for domain controllers is gradually increasing. At the same time, for increasingly complex automotive domain controllers, the requirements for safety protection in the event of failure are also higher. Existing technologies are insufficient to meet the higher safety protection requirements for domain controller failures. Utility Model Content

[0006] The purpose of this invention is to address the problem that the existing security protection design for domain controllers is insufficient to meet higher security protection requirements. This invention provides a security control device that can provide multi-level protection for domain controllers. When the domain controller experiences faults such as over-temperature, under-voltage, over-current, and over-voltage, it can promptly cut off the power supply to ensure the safety of the domain controller and the vehicle.

[0007] To address the aforementioned technical problems, this utility model discloses a safety control device, comprising:

[0008] A first control unit, comprising a first output unit, a second output unit, and a third output unit, wherein the first output unit is used to output a high level or a low level, the second output unit is used for power drive output, and the third output unit is used to output a high level or a low level. The second output unit includes a switch unit for switching the second output unit between an on state and an off state.

[0009] An execution unit, the execution unit includes a first input terminal, a second input terminal and a first output terminal, the first input terminal is connected to the third output unit, the first output terminal is connected to the switch unit, and the first output terminal is used to output a high level or a low level to the switch unit;

[0010] The second control unit includes a third input terminal, a second output terminal, and a third output terminal. The third input terminal is connected to the first output unit, the second output terminal is connected to the second input terminal, and the third output terminal is connected to the first input terminal. The third output terminal outputs a high level or a low level to cause the first output terminal to output a high level or a low level.

[0011] Using the above technical solution, the second output of the first control unit is used for power drive output, which can provide drive current or drive voltage for the domain controller to control other components of the vehicle (e.g., control door lock closing, window raising and lowering, motor starting and closing, etc.). When the domain controller is working normally, the first output terminal of the execution unit is connected to the switch unit, the third output of the first control unit is connected to the first input terminal of the execution unit, and the second output terminal of the second control unit is connected to the second input terminal of the execution unit. Therefore, the first control unit and the second control unit can be used together to change the output signal of the first output terminal. When the first output terminal outputs a high level, the switch unit is open and the second output terminal is in the conducting state; when the first output terminal outputs a low level, the switch unit is closed and the second output terminal is in the off state; or, when the first output terminal outputs a low level, the switch unit is open and the second output terminal is in the conducting state; when the first output terminal outputs a high level, the switch unit is closed and the second output terminal is in the off state, thereby realizing the control of the on and off of the second output terminal, forming the first level of safety protection.

[0012] When the second output of the second control unit or the first control unit fails, for example, when the first control unit overheats, the first-level safety protection may fail. In this case, the third output of the second control unit outputs a high or low level to cause the first output to output a high or low level. When the first output outputs a high level, the switch is open, and the second output is in a conducting state; when the first output outputs a low level, the switch is closed, and the second output is in a turned-off state. Alternatively, when the first output outputs a low level, the switch is open, and the second output is in a conducting state; when the first output outputs a high level, the switch is closed, and the second output is in a turned-off state. When the second output is in a turned-off state, the drive current supply can be cut off, protecting the domain controller from damage. For example, it can prevent excessive drive current caused by a failure of the first control unit, which could overheat and damage the internal chips of the domain controller, thus forming a second-level safety protection. In this way, the safety performance of the domain controller and the vehicle can be further improved, meeting higher safety protection requirements.

[0013] According to another specific embodiment of the present invention, a safety control device is disclosed, including a drive unit. The drive unit includes a fourth input terminal, a fifth input terminal, and a fourth output terminal. The fourth input terminal is connected to the first output terminal, the fifth input terminal is connected to the third output terminal, and the fourth output terminal is connected to the first input terminal.

[0014] By adopting the above technical solution, the fifth input terminal of the drive unit is connected to the third output terminal of the second control unit, and the fourth output terminal of the drive unit is connected to the first input terminal of the execution unit. This can increase the driving capability of the execution unit, enabling the drive unit to forcibly cut off the control of the first control unit, and in abnormal situations, to promptly shut down the second output unit.

[0015] According to another specific embodiment of the present invention, a safety control device is disclosed. The driving unit includes a first transistor and a second transistor. The first end of the first transistor is connected to the first output unit, the second end of the first transistor is connected to the fifth input terminal, the third end of the first transistor is connected to the first end of the second transistor, the second end of the second transistor is connected to the fourth output terminal, and the third end of the second transistor is grounded.

[0016] According to another specific embodiment of the present invention, a safety control device is disclosed. The first transistor includes a first PNP transistor, and the second transistor includes a first NPN transistor. The base of the first PNP transistor is connected to the fifth input terminal, the emitter of the first PNP transistor is connected to the first output terminal, the collector of the first PNP transistor is connected to the base of the first NPN transistor, the emitter of the first NPN transistor is grounded, and the collector of the first NPN transistor is connected to the fourth output terminal for outputting a high level to the first input terminal.

[0017] Using the above technical solution, the first transistor includes a first PNP transistor, and the second transistor includes a first NPN transistor. By building the driving unit with low-cost electronic components, the cost can be effectively reduced.

[0018] According to another specific embodiment of the present invention, a safety control device is disclosed, wherein the execution unit includes a third transistor and a fourth transistor, the first end of the third transistor is connected to the first input terminal, the second end of the third transistor is connected to the first end of the fourth transistor, the third end of the third transistor is grounded, the second end of the fourth transistor is connected to the second input terminal, and the second output terminal of the fourth transistor is connected to the second output unit.

[0019] According to another specific embodiment of the present invention, a safety control device is disclosed, wherein the second output part includes a first load output terminal and a second load output terminal connected in parallel, the switch part is disposed at the second load output terminal, and the third terminal of the fourth transistor is connected to the switch part through the first output terminal.

[0020] When the third terminal of the fourth transistor outputs a high level, the switch is open and the second output is in a conducting state; when the third terminal of the fourth transistor outputs a low level, the switch is closed and the second output is in a turning-off state. Alternatively, when the third terminal of the fourth transistor outputs a low level, the switch is open and the second output is in a conducting state; when the third terminal of the fourth transistor outputs a high level, the switch is closed and the second output is in a turning-off state.

[0021] Using the above technical solution, the first load output terminal can be used to power components such as interior ambient lights, with a lower functional safety protection level. The second load output terminal can be used to power components such as door locks, windows, and motors, with a higher functional safety protection level, which ordinary safety protection designs cannot meet. The second output terminal of the fourth transistor is connected to the second load output terminal to control the on / off state of the second load output terminal, which can reduce costs and avoid adverse effects on loads with lower functional safety protection levels.

[0022] According to another specific embodiment of the present invention, a safety control device is disclosed, wherein the switching part includes a field-effect transistor, and the gate of the field-effect transistor is connected to the third terminal of the fourth transistor.

[0023] According to another specific embodiment of the present invention, a safety control device is disclosed, wherein the third transistor includes a second NPN transistor, the fourth transistor includes a second PNP transistor, the base of the second NPN transistor is connected to the first input terminal, the collector of the second NPN transistor is connected to the base of the second PNP transistor, the emitter of the second NPN transistor is grounded, the emitter of the second PNP transistor is connected to the second input terminal, and the collector of the second PNP transistor is connected to the second output terminal.

[0024] According to another specific embodiment of the present invention, a safety control device is disclosed, wherein the field-effect transistor includes an NMOS transistor, the gate of the NMOS transistor is connected to the emitter of a second PNP transistor, and the NMOS transistor is disconnected when the emitter of the second PNP transistor outputs a low level.

[0025] Using the above technical solution, the third transistor includes a second NPN transistor, the fourth transistor includes a second PNP transistor, and the field-effect transistor includes an NMOS transistor. By building the execution unit with low-cost electronic components to control the second output unit, the cost can be effectively reduced.

[0026] The present invention also discloses a domain controller, which includes at least the security control device described in any of the above embodiments. Attached Figure Description

[0027] Figure 1 A schematic diagram of the circuit module of the safety control device provided in an embodiment of this application is shown.

[0028] Figure 2 A simplified circuit diagram of the safety control device provided in an embodiment of this application is shown.

[0029] Figure 3 A circuit diagram of the drive unit of the safety control device provided in an embodiment of this application is shown.

[0030] Figure 4 The diagram shows a circuit schematic of the execution unit and the second load output terminal of the safety control device provided in an embodiment of this application.

[0031] Figure 5 A circuit diagram of the safety control device provided in an embodiment of this application is shown. Detailed Implementation

[0032] The following specific embodiments illustrate the implementation of this utility model. Those skilled in the art can easily understand other advantages and effects of this utility model from the content disclosed in this specification. Although the description of this utility model will be presented in conjunction with preferred embodiments, this does not mean that the features of this utility model are limited to this embodiment. On the contrary, the purpose of describing the utility model in conjunction with the embodiments is to cover other options or modifications that may be derived based on the claims of this utility model. To provide a deep understanding of this utility model, many specific details will be included in the following description. This utility model may also be implemented without using these details. Furthermore, to avoid confusion or obscuring the focus of this utility model, some specific details will be omitted in the description. It should be noted that, without conflict, the embodiments and features in the embodiments of this utility model can be combined with each other.

[0033] It should be noted that in this specification, similar reference numerals and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0034] In the description of this embodiment, it should be noted that the terms "upper", "lower", "inner", "bottom", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship that the utility model product is usually placed in during use. They are only for the convenience of describing the utility model and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the utility model.

[0035] The terms “first”, “second”, etc., are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0036] In the description of this embodiment, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set up," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this embodiment based on the specific circumstances.

[0037] To make the objectives, technical solutions, and advantages of this utility model clearer, the embodiments of this utility model will be described in further detail below with reference to the accompanying drawings.

[0038] See Figure 1 This application provides a domain controller, including a safety control device. The safety control device includes a first control unit, an execution unit, and a second control unit. The first control unit includes a first output unit 11, a second output unit 12, and a third output unit 13. The first output unit 11 is used to output a high or low level. The second output unit 12 is used for power drive output, that is, the second output unit 12 can provide drive current or drive voltage to the load. The second output unit 12 includes a switch unit 120 for switching the second output unit 12 between an on state and an off state. The third output unit 13 is used to output a high or low level. Exemplarily, the first control unit includes an MCU (Microcontroller Unit), also known as a single-chip microcomputer or microcontroller. The first output unit 11, the second output unit 12, and the third output unit 13 correspond to different pins of the MCU and are used to execute different instructions. For example, the drive current or drive voltage output by the second output unit 12 can be used by the domain controller to control other components of the vehicle (e.g., control door lock closing, window raising and lowering, motor starting and closing, etc.).

[0039] In some embodiments, see Figure 1The execution unit includes a first input terminal 21, a second input terminal 22, and a first output terminal 23. The first input terminal 21 is connected to a third output unit 13, and the first output terminal 23 is connected to a switch unit 120. The first output terminal 23 is used to output a high level or a low level to the switch unit 120 to control the on / off state of the second output unit 12. The second control unit includes a third input terminal 31, a second output terminal 32, and a third output terminal 33. The third input terminal 31 is connected to the first output unit 11, and the second output terminal 32 is connected to the second input terminal 22. The second output terminal 32, together with the third output unit 13, controls the on / off state of the second output unit 12. The third output terminal 33 is connected to the first input terminal 21, and the third output terminal 33 outputs a high level or a low level to cause the first output terminal 23 to output a high level or a low level, thereby turning off the second output unit 12.

[0040] When the first output terminal 23 outputs a high level, the switch 120 is open and the second output terminal 12 is in the conducting state; when the first output terminal 23 outputs a low level, the switch 120 is closed and the second output terminal 12 is in the off state; or, when the first output terminal 23 outputs a low level, the switch 120 is open and the second output terminal 12 is in the conducting state; when the first output terminal 23 outputs a high level, the switch 120 is closed and the second output terminal 12 is in the off state.

[0041] For example, the second control unit includes an SBC chip (System Basis Chip). The SBC chip integrates power supply, communication, monitoring and diagnostics, safety monitoring, and many other functions such as GPIO onto a single chip to meet the requirements of miniaturization and centralization in automotive electronics. The third input terminal 31, the second output terminal 32, and the third output terminal 33 correspond to different pins of the SBC chip and are used to execute different instructions.

[0042] Using the above technical solution, when the domain controller is working normally, the first output terminal 23 of the execution unit is connected to the switch unit 120, the third output terminal 13 of the first control unit is connected to the first input terminal 21 of the execution unit, and the second output terminal 32 of the second control unit is connected to the second input terminal 22 of the execution unit. Therefore, the first control unit and the second control unit can be used together to change the output signal of the first output terminal 23. When the first output terminal 23 outputs a high level, the switch unit 120 is open and the second output terminal 12 is in the on state. When the first output terminal 23 outputs a low level, the switch unit 120 is closed and the second output terminal 12 is in the off state. Alternatively, when the first output terminal 23 outputs a low level, the switch unit 120 is open and the second output terminal 12 is in the on state. When the first output terminal 23 outputs a high level, the switch unit 120 is closed and the second output terminal 12 is in the off state, thereby realizing the control of the on / off state of the second output terminal 12 and forming the first level of safety protection.

[0043] When the second output terminal 32 of the second control unit or the first control unit fails, for example, when the first control unit experiences an overheating fault, the first-level safety protection may fail. At this time, the third output terminal 33 of the second control unit outputs a high level or a low level to make the first output terminal 23 output a high level or a low level, which is used to control the electrical signal output by the first output terminal 23 of the actuator. When the first output terminal 23 outputs a high level, the switch 120 is open and the second output terminal 12 is in the conducting state. When the first output terminal 23 outputs a low level, the switch 120 is closed and the second output terminal 12 is in the off state. Alternatively, when the first output terminal 23 outputs a low level, the switch 120 is open and the second output terminal 12 is in the conducting state. When the first output terminal 23 outputs a high level, the switch 120 is closed and the second output terminal 12 is in the off state. When the second output unit 12 is in the off state, it can cut off the supply of drive current or drive voltage, protecting the domain controller from damage. For example, it can prevent the internal chip of the domain controller from overheating and being damaged due to excessive drive current or drive voltage caused by a failure of the first control unit, thus forming a second level of safety protection. In this way, the safety performance of the domain controller and the vehicle can be further improved, meeting higher safety protection requirements.

[0044] In some embodiments, see Figure 1 The safety control device includes a drive unit, which includes a fourth input terminal 41, a fifth input terminal 42, and a fourth output terminal 43. The fourth input terminal 41 is connected to the first output unit 11, the fifth input terminal 42 is connected to the third output terminal 33, and the fourth output terminal 43 is connected to the first input terminal 21. For example, Figure 1 The TRM30_G1 shown is the power module of the first control unit, and the TRM30_G1_REVP is a reverse voltage protection circuit (REVP), a common protection measure in electronic circuit design, mainly used to ensure that the circuit system can still operate safely when the DC power supply is connected with the wrong voltage polarity. Exemplarily, this application embodiment designs a dual reverse protection circuit, that is, a reverse voltage protection circuit is connected in series on the second output unit 12, and a reverse voltage protection circuit is also provided at the sixth input terminal 34 of the SBC chip.

[0045] Understandably, the embodiments of this application adopt a modular design and do not limit the number of execution units. Multiple execution units can be set in parallel for modular expansion. Each execution unit is controlled by a drive unit, so that the safety control device provided by the embodiments of this application supports multiple individual and composite application scenarios.

[0046] In some embodiments, see Figure 1The second output section 12 includes a first load output terminal 121 and a second load output terminal 122 connected in parallel. Exemplarily, the switching section 120 includes a first field-effect transistor for controlling the on / off state of the second load output terminal 122. Exemplarily, see [reference needed]. Figure 1 and combined Figure 5 The first field-effect transistor includes an NMOS transistor. When the gate of the NMOS transistor receives a low level output from the first output terminal 23, the NMOS transistor is turned off, and the second load output terminal 122 is in a turned-off state, no longer supplying power to the external load. When the gate of the NMOS transistor receives a high level output from the first output terminal 23, the NMOS transistor is turned on, and the second load output terminal 122 is in a turned-on state, supplying power to the external load. Figure 5 (middle POWER) through the second load output terminal 122 ( Figure 5 The OUTPUT is normally supplying power to the external load. Figure 5 The Safety Mos corresponds to the NMOS transistor.

[0047] Understandably, the embodiments of this application do not limit the type of the first field-effect transistor. For example, it can also be a PMOS transistor. In this case, when the gate of the PMOS transistor receives a high level output from the first output terminal 23, the PMOS transistor is turned off, and the second load output terminal 122 is turned off and no longer supplies power to the external load. When the gate of the PMOS transistor receives a low level output from the first output terminal 23, the PMOS transistor is turned on, and the second load output terminal 122 supplies power to the external load normally.

[0048] For example, TRM30_G1 is used to provide drive current or drive voltage to the first load output terminal 121 and the second load output terminal 122. The first load output terminal 121 is used to provide power to components such as interior ambient lights, and its functional safety protection level is lower. The second load output terminal 122 is used to provide power to components such as door locks, windows, and motors, and its functional safety protection level is higher. Ordinary safety protection designs cannot meet its requirements.

[0049] For example, Figure 2 U12_P in the figure represents the logic signal output by the first output unit 11. Figure 1 , Figure 2 In this context, CP_SBC represents the electrical signal output from the second output terminal 32 of the second control unit. CP stands for Charge Pump (CP) of the SBC chip, which increases or decreases voltage through the charging and discharging process of a capacitor. It is commonly used in power management, battery-powered devices, and integrated circuits due to its simple structure and high efficiency. Furthermore, Figure 1 , Figure 2In this context, SBC_FO represents the electrical signal output from the second output terminal 32 of the second control unit, and Safety_FET_EN represents the enable signal output from the third output terminal 13 of the MCN. Output 1 ( Figure 2 OUTPUT1) corresponds to the first load output terminal 121 in the aforementioned embodiment, outputting 2 ( Figure 2 OUTPUT2) corresponds to the second load output terminal 122 in the aforementioned embodiment.

[0050] In some embodiments, see Figure 2 , Figure 3 , Figure 4 The driving unit includes a first transistor 44 and a second transistor 45. The first end 441 of the first transistor 44 is connected to the first output unit 11 through the fourth input terminal 41. The second end 442 of the first transistor 44 is connected to the third output terminal 33 through the fifth input terminal 42. The third end 443 of the first transistor 44 is connected to the first end 451 of the second transistor 45. The second end 452 of the second transistor 45 is connected to the fourth output terminal 43. The third end 453 of the second transistor 45 is grounded.

[0051] For example, see Figure 3 , Figure 4 , Figure 5 The first transistor 44 includes a first PNP transistor, and the second transistor 45 includes a first NPN transistor. The first PNP transistor corresponds to... Figure 3 T5017 in the diagram corresponds to the first NPN transistor. Figure 4 In the T6004, a diode D5008 is connected in series between the first output section 11 and the first PNP transistor to prevent reverse current flow. The base B of the first PNP transistor is connected to the third output terminal 33 of the second control section through the fifth input terminal 42. The emitter E of the first PNP transistor is connected to the first output section 11. The collector C of the first PNP transistor is connected to the base B of the first NPN transistor. Furthermore, a grounded resistor 401 is connected in parallel between the collector C of the first PNP transistor and the base B of the first NPN transistor. The emitter E of the first NPN transistor is grounded. The collector C of the first NPN transistor is connected to the fourth output terminal 43 to output a high level to the first input terminal 21.

[0052] When the third output terminal 33 of the second control unit outputs a low-level signal, that is, when SBC_FO is low, the first PNP transistor T5017 is turned on, the base B of the first NPN transistor T6004 receives a high-level signal and is turned on, and the fourth output terminal 43 and the first input terminal 21 are at a high level.

[0053] In some embodiments, see Figure 3 , Figure 4 , Figure 5The execution unit includes a third transistor 24 and a fourth transistor 25. The first terminal 241 of the third transistor 24 is connected to the first input terminal 21, the second terminal 242 of the third transistor 24 is connected to the first terminal 251 of the fourth transistor 25, the third terminal 243 of the third transistor 24 is grounded, the second terminal 252 of the fourth transistor 25 is connected to the second input terminal 22, and the third terminal 253 of the fourth transistor 25 is connected to the first output terminal 23, and further connected to the second output unit 12. In some embodiments, the gate of the first field-effect transistor is connected to the third terminal 253 of the fourth transistor 25.

[0054] For example, see Figure 3 , Figure 4 , Figure 5 and combined Figure 2 The third transistor 24 includes a second NPN transistor, and the fourth transistor 25 includes a second PNP transistor. The base B of the second NPN transistor is connected to the first input terminal 21, and the collector C of the second NPN transistor is connected to the base B of the second PNP transistor. A first resistor 201 is connected in series between the collector C of the second NPN transistor and the base B of the second PNP transistor. The emitter E of the second NPN transistor is grounded through a second resistor 202. The emitter E of the second NPN transistor is connected to the second input terminal 22. The collector C of the second PNP transistor is connected to the second output unit 12 through the first output terminal 23. A fourth resistor 204 is connected in parallel between the emitter E and the base B of the second PNP transistor, and a third resistor 203 is connected in parallel between the emitter E and the base B of the second PNP transistor. For example, the gate of the NMOS transistor is connected to the emitter E of the second PNP transistor. When the emitter E of the second PNP transistor outputs a low level, the NMOS transistor is turned off.

[0055] When the domain controller is working normally, the second output terminal 32 of the second control unit and the second input terminal 22 of the execution unit are connected, enabling the emitter E of the second PNP transistor to conduct normally. The MCU sends a Safety_FET_EN signal to the base B of the second NPN transistor through the third output terminal 13 and the first input terminal 21. When the Safety_FET_EN signal is high, the collector C of the second PNP transistor outputs a low level through the first output terminal 23, the NMOS transistor is turned off, and the second load output terminal 122 is turned off, no longer providing drive current or drive voltage to the external load. When the Safety_FET_EN signal is low, the collector C of the second PNP transistor outputs a high level through the first output terminal 23, the NMOS transistor is turned on, the second load output terminal 122 is turned on, and normally provides drive current or drive voltage to the external load. The CP_SBC signal output by the second control unit through the second output terminal 33, together with the Safety_FET_EN signal output by the first control unit through the third output terminal 13, forms the first level of safety protection, enabling power supply control.

[0056] When the second output terminal 32 of the second control unit or the first control unit fails, for example, when the first control unit experiences an overheating fault, the first-level safety protection may fail. In this case, the third output terminal 33 of the second control unit outputs a low level, and the fifth input terminal 42 of the actuator transmits the low-level signal to the base B of the first PNP transistor. The first PNP transistor turns on, and the collector C of the first PNP transistor outputs a high-level signal (corresponding to...). Figure 3 , Figure 4 , Figure 5 When the base B of the first NPN transistor receives a high-level signal (FAULT_IND signal), the first NPN transistor turns on and its collector C outputs a high-level signal to the first input 21 through the fourth output terminal 43. Similarly, when the base B of the second NPN transistor receives a high-level signal from the first input 21, the second NPN transistor turns on and its collector C outputs a high-level signal. Likewise, when the base B of the second PNP transistor receives a high-level signal, the second PNP transistor turns on and its collector C outputs a low-level signal, the NMOS transistor turns off, and the second load output terminal 122 is turned off, no longer providing drive current or drive voltage to the external load. The second control unit outputs a low level through the third output terminal 33, forming a second level of safety protection together with the drive unit, enabling timely power cut-off in abnormal situations.

[0057] Understandably, the embodiments of this application do not limit the specific types of electronic components of the first transistor 44, the second transistor 45, the third transistor 24, and the fourth transistor 25. The safety control device provided by the embodiments of this application can solve increasingly complex automotive domain control safety problems with low-cost circuits and highly reliable logic.

[0058] In some embodiments, see Figure 1 The second output section 12 also includes a second field-effect transistor 123. The gate of the second field-effect transistor 123 is connected to the collector C of the third PNP transistor 124. The emitter E of the third PNP transistor 124 is connected to the second output terminal 32. The base B of the third PNP transistor 124 is connected to the collector C of the third NPN transistor 125. The base B of the third NPN transistor 125 is connected to the TRM_G1_EN of the MCU. The emitter E of the third NPN transistor 125 is grounded. Thus, the on / off state of the second output section 12 can be controlled via the TRM_G1_EN of the MCU and the second output terminal 32 of the second control section.

[0059] Although the present invention has been illustrated and described with reference to certain preferred embodiments, those skilled in the art should understand that the above description is a further detailed explanation of the present invention in conjunction with specific embodiments, and should not be construed as limiting the specific implementation of the present invention to these descriptions. Those skilled in the art can make various changes in form and detail, including some simple deductions or substitutions, without departing from the spirit and scope of the present invention.

Claims

1. A safety control device, characterized in that, include: A first control unit, comprising a first output unit, a second output unit, and a third output unit, wherein the first output unit is used to output a high level or a low level, the second output unit is used for power drive output, the second output unit includes a switch unit for switching the second output unit between an on state and an off state, and the third output unit is used to output a high level or a low level. An execution unit, the execution unit includes a first input terminal, a second input terminal and a first output terminal, the first input terminal is connected to the third output unit, the first output terminal is connected to the switch unit, and the first output terminal is used to output a high level or a low level to the switch unit; The second control unit includes a third input terminal, a second output terminal, and a third output terminal. The third input terminal is connected to the first output unit, the second output terminal is connected to the second input terminal, and the third output terminal is connected to the first input terminal. The third output terminal outputs a high level or a low level to cause the first output terminal to output a high level or a low level.

2. The safety control device as described in claim 1, characterized in that, The device includes a driving unit, which includes a fourth input terminal, a fifth input terminal, and a fourth output terminal. The fourth input terminal is connected to the first output terminal, the fifth input terminal is connected to the third output terminal, and the fourth output terminal is connected to the first input terminal.

3. The safety control device as described in claim 2, characterized in that, The driving unit includes a first transistor and a second transistor. The first end of the first transistor is connected to the first output unit, the second end of the first transistor is connected to the fifth input terminal, the third end of the first transistor is connected to the first end of the second transistor, the second end of the second transistor is connected to the fourth output terminal, and the third end of the second transistor is grounded.

4. The safety control device as described in claim 3, characterized in that, The first transistor includes a first PNP transistor, and the second transistor includes a first NPN transistor. The base of the first PNP transistor is connected to the fifth input terminal, the emitter of the first PNP transistor is connected to the first output terminal, the collector of the first PNP transistor is connected to the base of the first NPN transistor, the emitter of the first NPN transistor is grounded, and the collector of the first NPN transistor is connected to the fourth output terminal for outputting a high level to the first input terminal.

5. The safety control device as described in claim 1, characterized in that, The actuator includes a third transistor and a fourth transistor. The first end of the third transistor is connected to the first input terminal, the second end of the third transistor is connected to the first end of the fourth transistor, the third end of the third transistor is grounded, the second end of the fourth transistor is connected to the second input terminal, and the third end of the fourth transistor is connected to the first output terminal.

6. The safety control device as described in claim 5, characterized in that, The second output section includes a first load output terminal and a second load output terminal connected in parallel. The switch section is located at the second load output terminal. The third terminal of the fourth transistor is connected to the switch section through the first output terminal. When the third terminal of the fourth transistor outputs a high level, the switch is turned on and the second output is in the on state; when the third terminal of the fourth transistor outputs a low level, the switch is turned off and the second output is in the off state. Alternatively, when the third terminal of the fourth transistor outputs a low level, the switch is turned on and the second output is in a conducting state; when the third terminal of the fourth transistor outputs a high level, the switch is turned off and the second output is in a turning-off state.

7. The safety control device as described in claim 6, characterized in that, The switching unit includes a field-effect transistor, the gate of which is connected to the third terminal of the fourth transistor.

8. The safety control device as described in claim 7, characterized in that, The third transistor includes a second NPN transistor, and the fourth transistor includes a second PNP transistor. The base of the second NPN transistor is connected to the first input terminal, the collector of the second NPN transistor is connected to the base of the second PNP transistor, the emitter of the second NPN transistor is grounded, the emitter of the second PNP transistor is connected to the second input terminal, and the collector of the second PNP transistor is connected to the second output terminal.

9. The safety control device as described in claim 8, characterized in that, The field-effect transistor includes an NMOS transistor, the gate of which is connected to the emitter of the second PNP transistor. When the emitter of the second PNP transistor outputs a low level, the NMOS transistor is turned off.

10. A domain controller, characterized in that, Includes the safety control device as described in any one of claims 1-9.

Images