Automobile controller

Abstract

The utility model relates to the technical field of automobile controllers, in particular to an automobile controller, which comprises a multi-protocol self-adaptive communication module, a dynamic heat dissipation control module, a triple hardware redundancy module and a safety storage and upgrade module, the multi-domain cooperative power management module is electrically connected with the multi-protocol adaptive communication module, the dynamic heat dissipation control module, the triple hardware redundancy module and the secure storage and upgrade module. And the multi-protocol adaptive communication module is electrically connected with the dynamic heat dissipation control module, the triple hardware redundancy module and the secure storage and upgrade module. According to the utility model, the multi-domain collaborative power management module can be automatically switched according to the actual situation by means of the bidirectional DC / DC controller, so that the circuit can adapt to different types of automobile power systems, and the compatibility is enhanced; the intelligent anti-reverse protection circuit can monitor the direction of the input voltage in real time, effectively prevents electronic components in the circuit from being damaged due to reverse connection of the power supply, and improves the safety of the circuit.

Description

Technical Field

[0001] This utility model relates to the field of automotive controller technology, specifically to an automotive controller. Background Technology

[0002] An automotive controller is an electronic device used to manage and control various systems and components of a vehicle. It receives signals from sensors and other input devices, and then processes and analyzes these signals according to predetermined programs and algorithms to achieve precise control of the vehicle's acceleration, braking, steering, and other operations, ensuring safe and reliable vehicle operation. It plays a vital role in the automotive industry.

[0003] In the prior art, a multi-functional automotive controller circuit with publication number CN204998351U includes a radio receiver / decoder circuit, a central processing circuit, a power-off delay circuit, an automatic braking circuit, a delay alarm circuit, an alcohol test display circuit, a relay control circuit, and a 5V voltage regulator circuit. One output terminal of the radio receiver / decoder circuit is connected to the input terminal of the central processing circuit, and the other output terminal is connected to the input terminal of the alcohol test display circuit. One output terminal of the central processing circuit is connected to the input terminal of the automatic braking circuit and simultaneously to the input terminal of the relay control circuit through the power-off delay circuit. The other output terminal of the central processing circuit is connected to the input terminal of the delay alarm circuit, and the output terminal of the alcohol test display circuit is connected to the input terminal of the central processing circuit. This invention provides multiple functions, including theft prevention and detection of excessive alcohol concentration.

[0004] Compared to the above applications, existing controller circuits still have the following problems:

[0005] Limited power management: Traditional power circuits only support single power domain control, which cannot meet the multi-voltage platform requirements of new energy vehicles.

[0006] Low heat dissipation efficiency: Static heat dissipation strategies cannot dynamically adjust fan power based on real-time temperature, leading to the risk of controller overheating.

[0007] In light of the problems mentioned above, we propose an automotive controller. Utility Model Content

[0008] The purpose of this invention is to provide an automotive controller to solve the problems mentioned in the background section.

[0009] To achieve the above objectives, this utility model provides the following technical solution:

[0010] An automotive controller, comprising:

[0011] Multi-protocol adaptive communication module, dynamic heat dissipation control module, triple hardware redundancy module, and secure storage and upgrade module;

[0012] The multi-domain collaborative power management module is electrically connected to the multi-protocol adaptive communication module, the dynamic heat dissipation control module, the triple hardware redundancy module, and the secure storage and upgrade module, respectively. The multi-protocol adaptive communication module is electrically connected to the dynamic heat dissipation control module, the triple hardware redundancy module, and the secure storage and upgrade module.

[0013] Preferably, the multi-domain collaborative power management module includes a bidirectional DC / DC controller, an intelligent reverse protection circuit, and a multi-rail voltage regulator circuit. The input terminal of the bidirectional DC / DC controller is connected to the dual-battery power supply of the vehicle, and the output terminal is connected to the multi-rail voltage regulator circuit through the intelligent reverse protection circuit. The multi-rail voltage regulator circuit outputs an independent regulated power supply to the Freescale MCU and various functional modules.

[0014] Preferably, the multi-protocol adaptive communication module includes a programmable logic device (CPLD) and a signal isolation circuit. The CPLD is connected to the automotive CAN bus and LIN bus respectively through the signal isolation circuit. The CPLD is electrically connected to the Freescale MCU to realize dynamic switching between CAN FD and LIN 2.2A protocols.

[0015] Preferably, the dynamic heat dissipation control module includes three high-precision temperature sensors, an H-bridge driver chip, and a cooling fan. The high-precision temperature sensors collect inlet water temperature, outlet water temperature, and ambient temperature signals and transmit them to the Freescale MCU. The Freescale MCU controls the PWM speed of the fan through the H-bridge driver chip.

[0016] Preferably, the triple hardware redundancy module includes a dual MCU redundancy control circuit, a dual ADC sampling circuit, and a dual power supply redundancy switching circuit. The dual ADC sampling circuit independently acquires voltage, current, and temperature signals. The dual MCU redundancy control circuit realizes fault switching between the main control MCU and the auxiliary control MCU through SPI communication. The dual power supply redundancy switching circuit realizes seamless switching between the main power supply and the backup power supply through an ideal diode controller.

[0017] Preferably, the secure storage and upgrade module includes a security chip and a secure boot circuit. The security chip is electrically connected to the Freescale MCU and is used to encrypt the stored data with AES-256 and verify the upgraded firmware with ECC digital signature.

[0018] Preferably, the bidirectional DC / DC controller uses an ADI LT8708 chip, and the intelligent reverse protection circuit includes a reverse voltage detection chip and a MOSFET blocking device.

[0019] Preferably, both the main control MCU and the auxiliary control MCU in the dual MCU redundant control circuit are Freescale MPC5643L.

[0020] Compared with the prior art, the beneficial effects of this utility model are:

[0021] The multi-domain collaborative power management module, with the help of a bidirectional DC / DC controller, can automatically switch according to the actual situation, which makes the circuit adaptable to different types of automotive power systems and enhances compatibility; the intelligent reverse protection circuit can monitor the direction of the input voltage in real time, effectively preventing damage to electronic components in the circuit due to reverse power connection and improving circuit safety.

[0022] The multi-rail voltage regulator circuit converts the input voltage into multiple stable voltage outputs, ensuring the stability of the output voltage and reducing the impact of voltage fluctuations on other modules.

[0023] The programmable logic device (CPLD) of the multi-protocol adaptive communication module can dynamically switch between two communication protocols, CAN FD (5Mbps) and LIN 2.2A (20kbps), according to actual needs.

[0024] The signal isolation circuit uses a digital isolator to achieve electrical isolation between the communication signal and the power supply ground, effectively suppressing common-mode interference and improving the anti-interference capability of communication.

[0025] The triple hardware redundancy module employs a dual-MCU design, with the two MCUs communicating via SPI and using a 10ms periodic heartbeat mechanism to detect each other's status. Dual-channel ADC sampling circuits independently acquire voltage, current, and temperature signals with an accuracy of 0.1%FS. By comparing the two sampled data streams, hardware fault diagnosis is triggered when the difference exceeds 1%, allowing for timely detection of sampling circuit faults and improving the accuracy and reliability of data acquisition.

[0026] The security chip in the secure storage and upgrade module encrypts the stored data using AES-256 encryption, ensuring data security. Even if the data storage device is illegally accessed, the data cannot be decrypted without the correct key, preventing data leakage. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the structure of this utility model. Detailed Implementation

[0028] The technical solutions of the present utility model will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present utility model, and not all embodiments. Based on the embodiments of the present utility model, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present utility model.

[0029] Example 1:

[0030] Please see Figure 1 A car controller, comprising:

[0031] The system includes a multi-domain collaborative power management module, a multi-protocol adaptive communication module, a dynamic heat dissipation control module, a triple hardware redundancy module, and a secure storage and upgrade module. The multi-domain collaborative power management module is electrically connected to the multi-protocol adaptive communication module, the dynamic heat dissipation control module, the triple hardware redundancy module, and the secure storage and upgrade module. The multi-protocol adaptive communication module is also electrically connected to the dynamic heat dissipation control module, the triple hardware redundancy module, and the secure storage and upgrade module.

[0032] The multi-domain collaborative power management module includes a bidirectional DC / DC controller, an intelligent reverse protection circuit, and a multi-rail voltage regulator circuit. The input of the bidirectional DC / DC controller is connected to the dual-battery power supply of the car (main battery and backup battery), and the output is connected to the multi-rail voltage regulator circuit through the intelligent reverse protection circuit. The multi-rail voltage regulator circuit outputs an independent regulated power supply to the Freescale MCU and various functional modules.

[0033] The grounding terminals of the multi-protocol adaptive communication module, dynamic heat dissipation control module, triple hardware redundancy module, and secure storage and upgrade module are isolated by independent grounding planes. Noise isolation is achieved between each module using 0Ω ferrite beads or inductors to reduce electromagnetic interference (EMI).

[0034] The bidirectional DC / DC controller uses the ADI LT8708 chip, which supports automatic switching between 12V / 24V / 48V multi-voltage domains. The intelligent reverse protection circuit includes a reverse voltage detection chip (TI TPS61088) and a MOSFET blocking device (Infineon IPB032N06N3G). When a reverse voltage > 0.3V is detected, the MOSFET blocking device cuts off the power input within 0.1ms.

[0035] The multi-rail regulator circuit includes a combination of LDO (TI ADP1761) and DCDC (TI LM25118) circuits to provide independently isolated 1.8V / 3.3V / 5V regulated power supplies for Freescale MCUs, communication modules and sensors, with ripple rejection ratio between each power rail >60dB;

[0036] The multi-protocol adaptive communication module includes a programmable logic device (CPLD) and a signal isolation circuit. The CPLD is connected to the automotive CAN bus and LIN bus respectively through the signal isolation circuit. The CPLD is electrically connected to the Freescale MCU to realize dynamic switching between CAN FD (5Mbps) and LIN 2.2A (20kbps) protocols.

[0037] The programmable logic device is a Lattice MachXO3 series CPLD, which supports hardware-level protocol parsing and dynamic switching with a response time of <1ms. The signal isolation circuit uses a digital isolator (ADI ADuM5401) to achieve 2.5kVrms electrical isolation between communication signals and power ground, with a common-mode rejection ratio of >80dB.

[0038] The dynamic heat dissipation control module includes three high-precision temperature sensors, an H-bridge driver chip, and a cooling fan. The high-precision temperature sensors collect inlet water temperature, outlet water temperature, and ambient temperature signals and transmit them to the Freescale MCU. The Freescale MCU controls the PWM speed of the fan through the H-bridge driver chip, achieving a temperature control accuracy of ±0.5℃.

[0039] The high-precision temperature sensor is the TI TMP117, which supports wide temperature detection from -40℃ to 150℃ and has a resolution of 0.0078℃; the H-bridge driver chip is the TI DRV8873, which supports 0 to 100% duty cycle PWM speed regulation and overcurrent protection (response time < 100μs).

[0040] In the dynamic heat dissipation control module, Freescale MCU dynamically adjusts the fan speed based on inlet water temperature, outlet water temperature and ambient temperature data through PID algorithm, so that the controller temperature fluctuation range is <5℃ and power consumption is reduced by 40%.

[0041] The triple hardware redundancy module includes a dual MCU redundancy control circuit, a dual ADC sampling circuit, and a dual power supply redundancy switching circuit. The dual ADC sampling circuit independently acquires voltage, current, and temperature signals (accuracy 0.1% FS). The dual MCU redundancy control circuit realizes fault switching between the main control MCU and the auxiliary control MCU through SPI communication (switching time ≤ 50ms). The dual power supply redundancy switching circuit realizes seamless switching between the main power supply and the backup power supply through an ideal diode controller (switching delay < 1μs).

[0042] In the dual-MCU redundant control circuit, both the main control MCU and the auxiliary control MCU are Freescale MPC5643L. They detect each other's status through a 10ms periodic heartbeat mechanism, and switch control through hardware reset in case of failure.

[0043] The dual-channel ADC sampling circuit uses an independent ADC device (TI ADS1256) for synchronous sampling, and the dual power supply redundancy switching circuit uses a TI LM74900-Q1 ideal diode controller to support reverse current blocking of the main / backup power supply.

[0044] The secure storage and upgrade module includes a security chip and a secure boot circuit. The security chip is electrically connected to the Freescale MCU and is used to encrypt the stored data with AES-256 and verify the upgraded firmware with ECC digital signature.

[0045] The security chip is a Microchip ATECC608A, which communicates with the Freescale MCU via the I2C bus (400kHz) and supports 256-byte key storage and AES-256 hardware encryption. The secure boot circuit uses the Secure Boot function of the Freescale MCU to verify the consistency between the firmware hash value and the ECC signature (verification time < 1ms).

[0046] Example 2:

[0047] Multi-domain collaborative power management module

[0048] The bidirectional power supply unit includes:

[0049] The Analog Devices LT8708 bidirectional DC / DC controller is selected, which supports a wide input voltage range of 4.5V to 60V and integrates a synchronous rectifier controller with a conversion efficiency of ≥96%.

[0050] Dual battery access:

[0051] The main power interface (J1) is connected to the 48V power battery (BATT_MAIN), and the backup power interface (J2) is connected to the 12V startup battery (BATT_BACKUP), which are respectively connected to the VIN1 and VIN2 pins of the LT8708.

[0052] A 100μF electrolytic capacitor (C1, C2) and a 10nF ceramic capacitor (C3, C4) are connected in parallel on the input side to filter out high-frequency ripple and low-frequency noise. The capacitor voltage ratings are 63V (main power supply) and 25V (backup power supply), respectively.

[0053] Control logic:

[0054] The MODE pin of the LT8708 is connected to GPIO_01 of the Freescale MCU and is configured to "automatic mode" via software. When the main power supply voltage is <10V, the internal switching circuit triggers the backup power supply, with a switching response time of <200μs.

[0055] Intelligent anti-reverse protection circuit

[0056] Reverse voltage detection: The TI TPS61088 chip is used, and its VIN pin monitors the input voltage. When VIN < -0.3V, the / FLT pin outputs a low level to the MOSFET drive circuit.

[0057] MOSFET blocking:

[0058] The Infineon IPB032N06N3G N-channel MOSFET is selected, with the drain (D) connected to the input power supply and the source (S) connected to the input terminal (VIN) of the LT8708.

[0059] The gate (G) is connected to the drive output of the TPS61088 through a 10kΩ current-limiting resistor (R1). When triggered by reverse voltage, the MOSFET gate voltage is pulled down to 0V, thus cutting off the power supply. The response time is <50μs.

[0060] Multi-rail voltage regulator circuit

[0061] MCU power supply:

[0062] Core power supply: 5V is converted to 1.8V via TI ADP1761 LDO (output current 500mA, ripple <50μV), and a 10μF tantalum capacitor (C5) and a 100nF ceramic capacitor (C6) are connected in parallel at the output.

[0063] Peripheral power supply: TI LM25118 DCDC converter is used to step down 12V to 5V (output current 2A, efficiency 92%) to power the CAN / LIN transceiver and H-bridge driver chip. A 47μF electrolytic capacitor (C7) and a 10nF ceramic capacitor (C8) are connected in parallel at the output.

[0064] Isolation design:

[0065] Each power rail is isolated from the main ground through 0Ω ferrite beads (FB1, FB2) to form an independent grounding plane. The ferrite beads have a rated current of ≥3A and an impedance of ≥50Ω@100MHz.

[0066] Multi-protocol adaptive communication module:

[0067] CPLD protocol dynamic switching circuit:

[0068] The Lattice MachXO3 series CPLD (model LCMXO3LF-6900C) has 5000 built-in logic cells and supports hardware description language programming.

[0069] Communication interface configuration:

[0070] CAN bus: Connects to the NXP TJA1145 CAN FD transceiver, supporting 5Mbps high-speed communication. The CPLD's I / O pins (IO_01, IO_02) are connected to the TJA1145's TXD / RXD, and the protocol control information (PCI) in the message header is parsed to determine whether to switch to CAN FD mode.

[0071] LIN Bus: Connects to the NXP TJA1021 LIN transceiver, supporting LIN 2.2A. The CPLD's I / O pin (IO_03) is connected to the TJA1021's TXD, monitoring the slave address (SA=0x05) to trigger a communication handshake.

[0072] Switching logic:

[0073] The CPLD's internal state machine scans the input signal every 1μs. When it detects a CAN message PID=0x18FF or a LIN slave address match, it completes the protocol register configuration within 0.5ms and outputs an enable signal to the corresponding transceiver.

[0074] Signal isolation circuit:

[0075] Digital isolator application: The ADI ADuM5401 four-channel digital isolator is used. Channels 1 and 2 isolate CAN_H / CAN_L differential signals, and channel 3 isolates LIN bus signals. The isolation voltage is 2.5kVrms and it complies with AEC-Q100 certification.

[0076] Peripheral circuit:

[0077] A 120Ω terminating resistor (R2) is connected in series on the CAN bus input side, and a 33pF filter capacitor (C9) is connected in parallel. A 470Ω pull-up resistor (R3) is connected in series on the LIN bus input side, and a 10nF capacitor (C10) is connected in parallel to suppress common-mode noise (CMRR > 80dB).

[0078] Dynamic heat dissipation control module:

[0079] Temperature acquisition circuit:

[0080] Sensor layout:

[0081] Inlet water temperature sensor (T1): Installed on the coolant inlet pipe, it uses an NTC thermistor (B value 3950K, accuracy ±0.2℃) and a TI TMP117 ADC, with a resolution of 0.0078℃, and is connected to the ADC_01 pin of the MCU via a three-wire connection.

[0082] Outlet water temperature sensor (T2): Installed at the coolant outlet, same model as T1, connected to ADC_02 pin.

[0083] Ambient temperature sensor (T3): Mounted on the PCB surface, using the on-chip temperature sensor of TMP117, connected to the ADC_03 pin.

[0084] Signal conditioning: Each sensor is equipped with a 10kΩ precision resistor (R4~R6) to form a bridge circuit. The output voltage is amplified by 2 times by the TIOPA2333 op-amp before being input to the MCU. The offset voltage of the amplifier circuit is <10μV.

[0085] Fan drive circuit:

[0086] The TI DRV8873 chip is used. IN1 / IN2 are connected to the PWM_01 / PWM_02 pins of the MCU (frequency 20kHz), and OUT1 / OUT2 are connected to the 12V centrifugal fan (rated current 0.5A).

[0087] The nFAULT pin of the DRV8873 is connected to 5V through a 10kΩ pull-up resistor. When there is an overcurrent (>1A), it is pulled low to 0V, triggering an external interrupt (EXT_INT_01) of the MCU. The interrupt response time is <100μs. The MCU immediately shuts down the PWM output and records the fault code (0x0101).

[0088] Triple hardware redundancy module:

[0089] Dual MCU redundancy control:

[0090] Both the main control MCU (U1) and the auxiliary control MCU (U2) are Freescale MPC5643L, exchanging data via the SPI bus (10MHz clock). U1's GPIO_02 is connected to U2's reset pin (RESET_N), and U2's GPIO_03 is connected to U1's external interrupt pin (EXT_INT_02).

[0091] U1 sends a heartbeat packet (0x55AA) to U2 every 10ms, and U2 replies with an acknowledgment packet (0xAA55) upon receiving it. If U1 fails to receive an acknowledgment for 3 consecutive times (timeout of 30ms), it determines that U2 is faulty, pulls the reset pin of U2 low via GPIO_02, and U2 restarts and takes over control within 50ms.

[0092] Dual-channel ADC sampling circuit:

[0093] The main ADC (ADS1256_CH1) acquires the bus voltage (0~60V), converts it into a 0~5V signal through a resistor divider network (R7=100kΩ, R8=10kΩ), and connects it to the AIN1 pin of ADS1256.

[0094] The fan current (0~1A) is acquired from the ADC (ADS1256_CH2), converted into a 0~5V signal through the INA240 current detection chip via a 20mΩ sampling resistor (R9), and then connected to the AIN2 pin.

[0095] Both ADCs are driven by the same 2.5MHz clock, and the MCU triggers sampling synchronously via SPI, with a sampling time deviation of <1μs.

[0096] Dual power supply redundancy switching:

[0097] Ideal diode controller: TI LM74900-Q1 is used. VIN1 is connected to the main battery, VIN2 to the backup battery, and VOUT to the input of the bidirectional DC / DC controller. It has a built-in 0.5Ω on-resistance. When the main battery voltage > backup battery voltage +0.2V, the main power path is automatically switched on, with a switching delay of <1μs.

[0098] Secure storage and upgrade module:

[0099] Encrypted storage circuit:

[0100] Security Chip Interface: The Microchip ATECC608A connects to the MCU via an I2C bus (400kHz), with device address 0x60. The MCU sends data frames (128 bytes) to the ATECC608A, which encrypts the data using a pre-programmed AES-256 key. The encrypted data is then written to sectors 0x1000~0x1FFF of the external Flash (Winbond W25Q128).

[0101] Key management: The ATECC608A supports 256-byte key storage. The key is written using a secure programming tool and cannot be read.

[0102] Example test data:

[0103]

[0104] Industrial application scenarios

[0105] The circuit in this embodiment is applied to an ATS controller for a new energy vehicle, and its typical workflow is as follows:

[0106] Step 1, Power-on initialization:

[0107] The multi-domain power module detected that the main battery was at 48V and was normal. It then powered the system through the LT8708 and the MCU read the EEPROM configuration parameters (such as temperature threshold and communication baud rate).

[0108] Step 2, Normal Operation:

[0109] The ECU sends fan control commands (such as target temperature 85℃) via the CAN FD bus. After the CPLD parses the commands, it switches to CAN FD mode. The signal is then isolated by the ADuM5401 and transmitted to the MCU.

[0110] Three temperature sensors collect data in real time. The MCU calculates T_avg=82℃ and outputs a PWM duty cycle of 30% to drive the fan and maintain the controller temperature at 85℃±0.5℃.

[0111] Step 3, Troubleshooting:

[0112] If the main battery suddenly loses power, the LM74900-Q1 automatically switches to the backup battery 12V power supply, and the LT8708 operates in boost mode to ensure that the system is not interrupted;

[0113] If the main control MCU detects a fault in its own ADC, it notifies the auxiliary control MCU via SPI. Within 50ms, the control switch is completed, and the auxiliary control MCU takes over the fan control and reports the fault to the ECU.

[0114] Step 4, Online Upgrade:

[0115] The maintenance personnel send an upgrade command through the diagnostic tool, the MCU triggers the safe boot process, and after the ATECC608A verifies the firmware signature, the old program is erased and the new firmware is written. The whole process takes less than 10 seconds.

[0116] Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the present invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A car controller, characterized in that, include: Secure storage and upgrade module, multi-protocol adaptive communication module, dynamic heat dissipation control module, triple hardware redundancy module and secure storage and upgrade module; The multi-domain collaborative power management module is electrically connected to the multi-protocol adaptive communication module, the dynamic heat dissipation control module, the triple hardware redundancy module, and the secure storage and upgrade module, respectively. The multi-protocol adaptive communication module is electrically connected to the dynamic heat dissipation control module, the triple hardware redundancy module, and the secure storage and upgrade module.

2. The vehicle controller according to claim 1, characterized in that, The multi-domain collaborative power management module includes a bidirectional DC / DC controller, an intelligent reverse protection circuit, and a multi-rail voltage regulator circuit. The input terminal of the bidirectional DC / DC controller is connected to the dual-battery power supply of the vehicle, and the output terminal is connected to the multi-rail voltage regulator circuit through the intelligent reverse protection circuit. The multi-rail voltage regulator circuit outputs an independent regulated power supply to the Freescale MCU and various functional modules.

3. The vehicle controller according to claim 1, characterized in that, The multi-protocol adaptive communication module includes a programmable logic device (CPLD) and a signal isolation circuit. The CPLD is connected to the automotive CAN bus and LIN bus through the signal isolation circuit. The CPLD is electrically connected to the Freescale MCU to realize dynamic switching between CAN FD and LIN 2.2A protocols.

4. The vehicle controller according to claim 1, characterized in that, The dynamic heat dissipation control module includes three high-precision temperature sensors, an H-bridge driver chip, and a cooling fan. The high-precision temperature sensors collect inlet water temperature, outlet water temperature, and ambient temperature signals and transmit them to the Freescale MCU. The Freescale MCU controls the PWM speed of the fan through the H-bridge driver chip.

5. A car controller according to claim 1, characterized in that, The triple hardware redundancy module includes a dual MCU redundancy control circuit, a dual ADC sampling circuit, and a dual power supply redundancy switching circuit. The dual ADC sampling circuit independently acquires voltage, current, and temperature signals. The dual MCU redundancy control circuit realizes fault switching between the main control MCU and the auxiliary control MCU through SPI communication. The dual power supply redundancy switching circuit realizes seamless switching between the main power supply and the backup power supply through an ideal diode controller.

6. A car controller according to claim 1, characterized in that, The secure storage and upgrade module includes a security chip and a secure boot circuit. The security chip is electrically connected to the Freescale MCU and is used to encrypt the stored data with AES-256 and verify the upgraded firmware with ECC digital signature.

7. A car controller according to claim 2, characterized in that, The bidirectional DC / DC controller uses the ADI LT8708 chip, and the intelligent reverse protection circuit includes a reverse voltage detection chip and a MOSFET blocking device.

8. A car controller according to claim 5, characterized in that, Both the main control MCU and the auxiliary control MCU in the dual MCU redundant control circuit are Freescale MPC5643L.

Images