Intelligent power distribution controller and safety monitoring system and controller thereof, and vehicle

Abstract

An intelligent power distribution controller and a safety monitoring system and controller thereof, and a vehicle, which relate to the technical field of vehicles. The intelligent power distribution controller comprises a main power supply channel for supplying power to loads of a first level and loads of a second level, a backup power supply channel for supplying power to the loads of the first level, and a controller for monitoring the main power supply channel and the backup power supply channel. The safety monitoring system is applied to a controller, and the safety monitoring system comprises: a first software layer, which is used for performing first-level diagnosis on power supply channels, and performing communication management; a second software layer, which is used for performing second-level diagnosis and control on the power supply channels, and performing fault mode processing; and a third software layer, which is used for performing hardware monitoring on the controller.

Description

Intelligent power distribution controller and its safety monitoring system, controller and vehicle

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application number 202311673423.5 filed on December 6, 2023, entitled “Intelligent power distribution controller and its safety monitoring system, controller and vehicle,” the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of vehicle technology, and in particular to a safety monitoring system for an intelligent power distribution controller, a controller, an intelligent power distribution controller, and a vehicle. Background Art

[0004] To meet the requirements of independent protection of each power supply channel and redundant power supply for important safety loads, intelligent power distribution controllers have become the mainstream solution for low-voltage power supply control.

[0005] When intelligent power distribution controllers are applied to low-voltage power supply control in electric vehicles, along with the development of intelligent electric vehicles, in order to ensure safety and operability despite failure of vehicle components, the functional safety level of the low-voltage power supply of the entire vehicle needs to reach ASIL D under the ISO26262 standard. However, the technical solutions of the safety monitoring system of the intelligent power distribution controller in related technologies are difficult to meet this functional safety level requirement.

[0006] Summary of the Invention

[0007] In view of the above problems, the present application provides an intelligent power distribution controller and its safety monitoring system, controller and vehicle. By analyzing the functional safety requirements and non-functional safety requirements of the intelligent power distribution controller, the application layer software functions of the intelligent power distribution device are modularly designed. The first-level diagnosis that does not affect the power supply control is deployed in the first software layer, the second-level diagnosis and power supply-related safety mechanisms involving power supply control are deployed in the second software layer, and the hardware monitoring function of the controller is deployed in the third software layer, so that the power supply of the intelligent power distribution controller to the load can easily meet the target functional safety level requirements.

[0008] In the first aspect, the present application provides a safety monitoring system for an intelligent power distribution controller, wherein the intelligent power distribution controller includes a main power supply channel for supplying power to a first-level load and a second-level load, a backup power supply channel for supplying power to the first-level load, and a controller for monitoring the main power supply channel and the backup power supply channel. The safety monitoring system is applied to the controller, and the safety monitoring system includes: a first software layer for performing a first-level diagnosis on each power supply channel and performing communication management; a second software layer for performing a second-level diagnosis and control on each power supply channel and performing fault mode processing; and a third software layer for performing hardware monitoring on the controller.

[0009] In the technical solution of the embodiments of the present application, an intelligent power distribution controller is configured to receive power from a power supply and supply power to first-level loads and second-level loads. A primary power supply channel and a backup power supply channel are provided for the first-level loads, and a primary power supply channel is provided for the second-level loads. The controller monitors the primary power supply channel and the backup power supply channel.

[0010] The safety monitoring system of the intelligent power distribution controller is applied to the controller. By analyzing the functional safety requirements and non-functional safety requirements of the intelligent power distribution controller, the application layer software functions of the intelligent power distribution device are modularly designed. The first-level diagnosis that does not affect the power supply control is deployed in the first software layer, the second-level diagnosis and power supply-related safety mechanisms involving power supply control are deployed in the second software layer, and the hardware monitoring function of the controller is deployed in the third software layer, so that the power supply of the intelligent power distribution controller to the load can easily meet the target functional safety level requirements.

[0011] In some embodiments, the first software layer includes: a first-level diagnostic module for performing first-level diagnosis on each power supply channel; and a communication management module for performing communication management.

[0012] The first software layer uses the first-level diagnostic module to perform first-level diagnostics on each power supply channel, such as first-level overcurrent, first-level overvoltage, and first-level overtemperature diagnosis. The communication management module manages communication signals between the controller and the external environment, such as processing and packaging the diagnostic results generated by the first-level diagnostic module and sending the processed diagnostic results to the external communication bus.

[0013] In some embodiments, the first-level diagnostic module is used to perform a first-level diagnosis on each power supply channel to obtain a first-level fault signal; the communication management module is used to process the first-level fault signal and send the processed first-level fault signal to the external communication bus of the intelligent power distribution controller; wherein, the first-level diagnosis includes one or more of a first-level overcurrent diagnosis, a first-level overvoltage diagnosis, a first-level undervoltage diagnosis and a first-level overtemperature diagnosis.

[0014] The first-level diagnostic module can implement one or more of the first-level overcurrent diagnosis, first-level overvoltage diagnosis, first-level undervoltage diagnosis, and first-level overtemperature diagnosis for the main power supply channel and the backup power supply channel, and generate corresponding first-level fault signals based on each power supply channel, the first-level diagnostic type, and the diagnostic results. The communication management module receives and processes the first-level fault signal generated by the first-level diagnostic module, and sends the processed first-level fault signal to the external communication bus. For example, when the intelligent power distributor is used for low-voltage power supply of the vehicle, the communication management module sends the processed first-level fault signal to the vehicle communication bus, such as the CAN bus, and then sends it to the vehicle controller through the vehicle communication bus. The vehicle controller issues a fault reminder based on the first-level fault signal.

[0015] In some embodiments, the functional safety level of the primary diagnostic module and the communication management module is QM under the ISO26262 standard.

[0016] Modules in the first software layer have no ASIL requirements and issue warnings based solely on Level 1 fault signals, which do not affect the power supply control of the intelligent power distribution controller. For example, based on a Level 1 overcurrent fault signal from the Level 1 diagnostic module for the corresponding power channel, only a Level 1 overcurrent warning signal is issued for that channel, ensuring continued power supply.

[0017] In some embodiments, the second software layer includes: a main secondary monitoring module for performing secondary diagnosis and control of the main power supply channel; a backup secondary monitoring module for performing secondary diagnosis and control of the backup power supply channel; and a fault mode processing module for performing fault mode processing.

[0018] The main power supply channel is diagnosed and controlled at the secondary level through the main secondary monitoring module, and the backup power supply channel is diagnosed and controlled at the secondary level through the backup secondary monitoring module. The fault module receives the fault signals and control signals diagnosed by the main secondary monitoring module and the backup secondary monitoring module to perform corresponding fault mode processing.

[0019] In accordance with the independence requirements after functional safety redundancy decomposition, this embodiment deploys the functions of secondary diagnosis and control of the main power supply channel and the functions of secondary diagnosis and control of the backup power supply channel in two different software modules, namely the main secondary monitoring module and the backup secondary monitoring module.

[0020] In some embodiments, the main secondary monitoring module is used to perform secondary diagnosis on the main power supply channel to obtain a secondary fault signal, and perform fault protection control on the main power supply channel; the backup secondary monitoring module is used to perform secondary diagnosis on the backup power supply channel to obtain a secondary fault signal, and perform fault protection control on the backup power supply channel; the fault mode processing module is used to arbitrate the secondary fault signal to obtain a fault mode signal, and send the fault mode signal to the external communication bus of the intelligent power distribution controller through the first software layer; wherein, the secondary diagnosis includes one or more of secondary overcurrent diagnosis, secondary overvoltage diagnosis, secondary undervoltage diagnosis, secondary overtemperature diagnosis, power switch stuck diagnosis and current acquisition unit self-test diagnosis.

[0021] The main power supply channel is diagnosed at the secondary level through the main secondary monitoring module to obtain a secondary fault signal, and the main power supply channel is controlled for fault protection, such as controlling the corresponding main power supply channel to be disconnected. The backup power supply channel is diagnosed at the secondary level through the backup secondary monitoring module to obtain a secondary fault signal, and the backup power supply channel is controlled for fault protection, such as controlling the corresponding main power supply channel to be disconnected.

[0022] The fault mode processing module arbitrates the secondary fault signals generated by the primary secondary monitoring module and the backup secondary monitoring module to obtain a fault mode signal, and then processes the fault mode signal through the communication management module of the first software layer and sends it to the external communication bus. For example, the fault mode processing module may determine the highest priority secondary fault signal based on multiple received secondary fault signals and use the highest priority secondary fault signal as the fault mode signal, or determine the corresponding fault mode based on the highest priority secondary fault signal to obtain the corresponding fault mode signal, and then process the fault mode signal through the communication management module and send it to the vehicle communication bus. The vehicle controller receives the fault mode signal through the vehicle control bus and controls the vehicle based on the fault mode signal, such as controlling the vehicle to decelerate.

[0023] In some embodiments, each power supply channel includes a power switch and an electronic fuse. The electronic fuse is used to output a secondary overcurrent signal and control the corresponding power switch to be disconnected when the secondary overcurrent of the corresponding power supply channel occurs, and output a secondary overcurrent recovery signal when the secondary overcurrent of the corresponding power supply channel is restored. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: receive the secondary overcurrent signal of the corresponding power supply channel; when receiving the secondary overcurrent signal of the corresponding power supply channel, output a secondary overcurrent fault signal, and send a power cut-off signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to be disconnected; after a first preset time delay, obtain the power recovery number of the corresponding power supply channel, and when the power recovery number is less than the preset recovery number and the secondary overcurrent recovery signal of the corresponding power supply channel is received, send a power connection signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to be closed for power recovery.

[0024] When a secondary overcurrent occurs in the corresponding power supply channel, the electronic fuse outputs a secondary overcurrent signal to the corresponding secondary monitoring module and controls the corresponding power switch to be disconnected. For example, when the electronic fuse set on the main power supply channel determines that a secondary overcurrent has occurred in the main power supply channel, it outputs a secondary overcurrent signal to the main secondary monitoring module and controls the corresponding power switch to be disconnected, so that the main power supply channel with the secondary overcurrent has stopped supplying power. When the electronic fuse set on the backup power supply channel determines that a secondary overcurrent has occurred in the backup power supply channel, the electronic fuse outputs a secondary overcurrent signal to the backup secondary monitoring module and controls the corresponding power switch to be disconnected, so that the backup power supply channel with the secondary overcurrent has stopped supplying power. At the same time, when the electronic fuse determines that the secondary overcurrent of the corresponding power supply channel has recovered based on current sampling, it outputs a secondary overcurrent recovery signal to the corresponding main secondary monitoring module and backup secondary monitoring module, so that the main secondary monitoring module and backup secondary monitoring module control the corresponding power switch to be closed based on the secondary overcurrent recovery signal.

[0025] The primary and backup secondary monitoring modules receive the secondary overcurrent signals corresponding to the primary and backup power supply channels, respectively. Based on the secondary overcurrent signals, they determine that a secondary overcurrent has occurred in the corresponding power supply channel. Based on the received secondary overcurrent signals, the primary and backup secondary monitoring modules output secondary overcurrent fault signals to the fault mode processing module and control the disconnection of the power switches in the corresponding power supply channels. It is understood that before the primary and backup secondary monitoring modules issue the power disconnection signals, the electronic fuse has already disconnected the corresponding power switches. The transmission of the power disconnection signals by the primary and backup secondary monitoring modules allows the electronic fuse to reconfirm the disconnection of the power switches, thereby improving control stability.

[0026] After the disconnection time of the power switch reaches a first preset time, the power recovery times of the corresponding power supply channel are obtained. If the power recovery times are less than the preset recovery times and the secondary overcurrent recovery signal of the corresponding power supply channel is received, a power connection signal is sent to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to close, so that the corresponding power supply channel continues to supply power to the load.

[0027] In this embodiment, when a secondary overcurrent occurs in the power supply channel, the corresponding power supply channel is promptly controlled to stop supplying power based on the electronic fuse, and the power supply cut-off signal output by the main secondary monitoring module and the backup secondary monitoring module is used to perform another cut-off control, thereby improving control stability. The main secondary monitoring module and the backup secondary monitoring module control the closing of the power switch based on conditional judgment.

[0028] In some embodiments, each power supply channel includes a power switch and an electronic fuse. The electronic fuse is used to output a secondary overvoltage signal and control the corresponding power switch to disconnect when the corresponding power supply channel has a secondary overvoltage, and output a secondary overvoltage recovery signal when the secondary overvoltage of the corresponding power supply channel is restored. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: receive the secondary overvoltage signal of the corresponding power supply channel; when receiving the secondary overvoltage signal of the corresponding power supply channel, output a secondary overvoltage fault signal, and send a power supply cut-off signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to disconnect; receive the secondary overvoltage recovery signal of the corresponding power supply channel; when receiving the secondary overvoltage recovery signal of the corresponding power supply channel, send a power supply connection signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to close for power restoration.

[0029] In this embodiment, when a secondary overvoltage occurs in the power supply channel, the corresponding power supply channel is promptly controlled to stop supplying power based on the electronic fuse, and the power supply cut-off signal output by the main secondary monitoring module and the backup secondary monitoring module is used to perform another cut-off control, thereby improving control stability. When the main secondary monitoring module and the backup secondary monitoring module receive the secondary overvoltage recovery signal of the corresponding power supply channel, they control the closing of the power switch.

[0030] In some embodiments, each power supply channel includes a power switch and an electronic fuse, the electronic fuse is used to obtain the actual switch state of the corresponding power switch, and the main secondary monitoring module and the backup secondary monitoring module are respectively used to: receive the actual switch state of the corresponding power switch; when the actual switch state is different from the expected switch state, accumulate the stuck fault time of the corresponding power switch, and when the accumulated stuck fault time reaches a first preset value, output a power switch stuck fault signal; when the actual switch state is the same as the expected switch state, deduct the stuck fault time of the corresponding power switch, and when the accumulated stuck fault time reaches a second preset value, determine that the corresponding power switch is recovered from being stuck.

[0031] When a stuck power switch in a power supply channel fails, the intelligent power distribution controller cannot correctly control the power supply to the load, violating functional safety requirements. Therefore, it is necessary to diagnose the stuck power switch and inform the staff in a timely manner when the stuck fault occurs to avoid hazards.

[0032] The electronic fuse obtains the actual switching state of the corresponding power switch. The primary and backup secondary monitoring modules compare the actual switching state of the corresponding power switch with the expected switching state. If the actual switching state differs from the expected switching state, the power switch is deemed to be stuck. The stuck fault time of the power switch is incremented by one. When the accumulated stuck fault time reaches a first preset value, a stuck fault is determined to have occurred and a stuck fault signal is output. If the actual switching state matches the expected switching state, the stuck fault time of the corresponding power switch is decremented by one. When the accumulated stuck fault time reaches a second preset value, the stuck state of the corresponding power switch is determined to have been resolved.

[0033] In some embodiments, each power supply channel includes an electronic fuse, which includes a current acquisition unit for collecting the current of the corresponding power supply channel. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: send a current acquisition self-test instruction to the electronic fuse of the corresponding power supply channel, so that the electronic fuse of the corresponding power supply channel performs a self-test on its own current acquisition unit and outputs the sampling resistor voltage difference of the current acquisition unit; receive the sampling resistor voltage difference of the corresponding power supply channel; when the sampling resistor voltage difference does not reach a preset voltage difference threshold, output a current acquisition unit self-test fault signal; when the sampling resistor voltage difference reaches the preset voltage difference threshold, determine that the current acquisition unit self-test fault has been recovered.

[0034] The electronic fuse has a current acquisition unit. When a secondary overcurrent occurs in the corresponding power supply channel, the electronic fuse will send a secondary overcurrent fault signal and disconnect the power switch. If the current acquisition unit of the electronic fuse fails, the secondary overcurrent cannot be detected in time. When an overcurrent occurs in the power supply channel, the secondary overcurrent fault signal cannot be sent in time, and the intelligent power distribution controller cannot control the power supply switch of the corresponding power supply channel to disconnect in time, resulting in the intelligent power distribution controller being unable to work normally and the power supply of each power supply channel being uncontrolled, causing hazards. Therefore, this embodiment diagnoses the current acquisition unit and issues a fault alarm in time.

[0035] This embodiment determines the working state of the current acquisition unit of the electronic fuse based on the sampling resistor voltage difference of the current acquisition unit obtained by the electronic fuse based on the current acquisition self-test instruction, so as to timely detect the current acquisition unit fault and issue a fault alarm.

[0036] In some embodiments, the functional safety level of the main secondary monitoring module and the backup secondary monitoring module is greater than or equal to ASIL B under the ISO26262 standard, and the functional safety level of the failure mode processing module is ASIL D under the ISO26262 standard.

[0037] This embodiment adopts the concept of redundant decomposition. By dividing the power supply control function into two ASIL B(D) level functional modules, namely the main secondary monitoring module and the backup secondary monitoring module, secondary diagnostic functions for the main power supply channel and the backup power supply channel are implemented respectively, so that the power supply of the intelligent power distribution controller to the first-level load meets the ASIL D level safety requirements.

[0038] In some embodiments, the third software layer includes: a system module for performing hardware monitoring on the controller; and a driver module for driving and controlling each power supply channel.

[0039] The third software layer is the related module of the underlying software BSW (Basic Software). Through the system module, it provides the intelligent power distribution controller with basic operating system, watchdog monitoring, communication management and mode management functions, further realizing the hardware monitoring of the controller. The driver module is used to receive the relevant instructions sent by the second software layer to control the electronic fuses in each power supply channel.

[0040] In some embodiments, the intelligent power distribution controller also includes a safety power chip, and the system module is used to: receive a watchdog seed from the safety power chip; the watchdog seed includes a target control instruction for a target power supply channel, and the target power supply channel is at least one of the main power supply channel and the backup power supply channel; send the watchdog seed to the second software layer, so that the main secondary monitoring module and the backup secondary monitoring module of the second software layer generate a drive control instruction for the target power supply channel based on the target control instruction, and send it to the drive module, so that the drive module generates a watchdog response signal; receive the watchdog response signal, and send the watchdog response signal to the safety power chip, so that the safety power chip determines whether the controller is normal based on the watchdog response signal.

[0041] The third software layer is combined with the safety power chip to monitor the running sequence and running time of the software modules in the second software layer. When the relevant software modules are executed in the correct running sequence within the specified time, the correct watchdog response signal is returned to the safety power chip. If the relevant software modules do not run correctly within the specified time, the correct watchdog response signal cannot be returned to the safety power chip, thereby realizing hardware monitoring of the controller.

[0042] In some embodiments, the functional safety level of the system module and the driver module is ASIL D under the ISO26262 standard.

[0043] In some embodiments, the first level of load is a safety load, and the second level of load is an unsafe load.

[0044] In a second aspect, the present application provides a controller, including a safety monitoring system of the above-mentioned intelligent power distribution controller.

[0045] In a third aspect, the present application provides an intelligent power distribution controller, including the safety monitoring system of the above-mentioned intelligent power distribution controller, or the above-mentioned controller.

[0046] In a fourth aspect, the present application provides a vehicle comprising a safety monitoring system of the above-mentioned intelligent power distribution controller, or the above-mentioned controller, or the above-mentioned intelligent power distribution controller.

[0047] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference numerals are used throughout the drawings to represent the same components. In the drawings:

[0049] FIG1 is a block diagram of a safety monitoring system of an intelligent power distribution controller according to some embodiments of the present application;

[0050] FIG2 is a block diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0051] FIG3 is a connection diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0052] FIG4 is a schematic diagram of the architecture of a security monitoring system of an intelligent power distribution controller according to some embodiments of the present application;

[0053] FIG5 is a secondary overcurrent control flow chart of some embodiments of the present application;

[0054] FIG6 is a secondary overvoltage control flow chart of some embodiments of the present application;

[0055] FIG7 is a flowchart of power switch stuck fault control in some embodiments of the present application;

[0056] FIG8 is a self-test flow chart of a current acquisition unit according to some embodiments of the present application;

[0057] FIG9 is a block diagram of a controller according to some embodiments of the present application;

[0058] FIG10 is a block diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0059] FIG11 is a block diagram of an intelligent power distribution controller according to some embodiments of the present application;

[0060] FIG12 is a block diagram of a vehicle according to some embodiments of the present application;

[0061] FIG13 is a block diagram of a vehicle according to some embodiments of the present application;

[0062] FIG14 is a block diagram of a vehicle according to some embodiments of the present application.

[0063] Figure numerals: intelligent power distribution controller 100, main power supply channel 110, backup power supply channel 120, controller 130, CAN module 140, power supply switch 150, electronic fuse 160, safety power chip 170, safety monitoring system 200 of intelligent power distribution controller, first software layer 210, first-level diagnostic module 211, communication management module 212, second software layer 220, main second-level monitoring module 221, backup second-level monitoring module 222, fault mode processing module 223, third software layer 230, system module 231, drive module 232, high-voltage power battery 300, DC / DC module 310, low-voltage battery 400, vehicle 1000. DETAILED DESCRIPTION

[0064] The following embodiments of the technical solution of the present application will be described in detail with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application and are therefore only examples and are not intended to limit the scope of protection of the present application.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned figure descriptions are intended to cover non-exclusive inclusions.

[0066] In the description of the embodiments of this application, the technical terms "first" and "second" are used only to distinguish different objects and should not be understood to indicate or imply relative importance or implicitly specify the quantity, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, the meaning of "plurality" is more than two, unless otherwise clearly and specifically defined.

[0067] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0068] In the description of the embodiments of this application, the term "and / or" is simply a description of the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0069] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0070] In the description of the embodiments of the present application, the technical terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the embodiments of the present application.

[0071] In the description of the embodiments of the present application, unless otherwise expressly specified or limited, technical terms such as "installed," "connected," "connected," and "fixed" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integration; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; internal connections between two components or interactions between two components. Those skilled in the art can understand the specific meanings of the above terms in the embodiments of the present application based on specific circumstances.

[0072] To meet the requirements of independent protection for each power supply channel and redundant power supply for critical safety loads, intelligent power distribution controllers have become the mainstream power supply control solution. With the development of intelligent electric vehicles, the application of intelligent power distribution controllers in the vehicle's low-voltage power supply requires the entire vehicle's low-voltage power supply to achieve ASIL D functional safety level to ensure safety and operability even after vehicle component failures.

[0073] In the related art, the monitoring system of the functional unit of a vehicle includes: a functional module, a functional monitoring module and a controller monitoring module, wherein the functional module is used to perform corresponding control functions, including but not limited to torque control, functional component monitoring and verification module, the functional module and the functional monitoring module exchange safety data, the functional monitoring module performs fault monitoring and fault management on the safety-related data and programs in the functional module according to the internally defined algorithm, and the controller monitoring module performs fault management and fault monitoring on the functional module and the functional monitoring module based on hardware.

[0074] However, the monitoring system in the related technology is not suitable for intelligent distribution controllers and cannot meet the functional safety level requirements of intelligent distribution controllers. How to design a safety monitoring system for intelligent distribution controllers and make it reach the target functional safety level has become a design difficulty for intelligent distribution controllers.

[0075] To this end, this application proposes a safety monitoring system for an intelligent power distribution controller, which applies the idea of ​​redundant decomposition to the power supply control monitoring of the software, and deploys software control modules with different functional safety levels to different software layers, so that the power supply of the intelligent power distribution controller to the load can reach the functional safety level of ASIL D.

[0076] For the convenience of description, the following embodiments will be described with reference to the accompanying drawings to illustrate the safety monitoring system of the intelligent power distribution controller of the present application.

[0077] According to some embodiments of the present application, in combination with Figures 1 and 2, the intelligent power distribution controller 100 includes a main power supply channel 110 for supplying power to first-level loads and second-level loads, a backup power supply channel 120 for supplying power to the first-level loads, and a controller 130 for monitoring the main power supply channel 110 and the backup power supply channel 120, and the security monitoring system 200 is applied to the controller 130.

[0078] Specifically, the intelligent power distribution controller 100 automatically controls and manages various components in the power distribution network to achieve energy-saving, safe, and reliable operation. For example, the intelligent power distribution controller 100 can automatically adjust the operating parameters of various components based on real-time data to ensure the normal operation of the power distribution system.

[0079] The first-level load and the second-level load can be divided based on the actual functional requirements of the application equipment. For example, the first-level load is a safety load, and the second-level load is a non-safety load. For example, when the intelligent power distribution controller 100 is used to supply low-voltage power to a vehicle, the first-level load is the load required to ensure the safety of vehicle driving, such as the electric power steering system, the electronic stability system of the vehicle body, the electronic control braking system, etc. The second-level load is other loads in the vehicle except the first-level load, such as the cabin controller, the wiper washing system, the speaker, the cabin camera, etc. In order to ensure that the vehicle can drive safely, it is necessary to ensure the normal power supply of the first-level load, while the second-level load can be powered or not powered, and can be flexibly adjusted according to actual conditions.

[0080] The intelligent power distribution controller 100 is equipped with a main power supply channel 110 and a backup safety power supply channel 120 for powering first-level loads, and a main power supply channel for powering second-level loads. Taking Figure 3 as an example, one end of the multiple main power supply channels is connected to the high-voltage power battery 300 via a DC / DC (Direct Current-Direct Current) module 310, and the other end of each main power supply channel (main power supply channel 1, ..., main power supply channel n) is connected to the corresponding first-level load and second-level load, respectively. The DC / DC module 310 is used to convert the high-voltage direct current provided by the high-voltage power battery 300 into a low-voltage direct current output, and then supply power to the first-level load and the second-level load through the main power supply channel. Multiple backup power supply channels (backup power supply channel 1, ..., backup power supply channel n) are connected to the low-voltage battery 400 at one end and to the corresponding first-level load at the other end, so that the low-voltage direct current provided by the low-voltage battery 400 can be used to power the first-level load.

[0081] The controller 130 of the intelligent power distribution controller 100 monitors the main power supply channel 110 and the backup power supply channel 120, and timely adjusts the power supply channels based on the monitoring results. For example, the controller 130 can monitor the current, voltage, temperature and other parameters of each power supply channel in real time. For example, when the current of any power supply channel exceeds the preset overcurrent threshold, the controller 130 controls the corresponding power supply channel to stop supplying power.

[0082] The intelligent power distribution controller 100 uses a backup power supply channel 120 to redundantly design the main power supply channel 110 used to supply power to the first-level load, so that when the main power supply channel 110 used to supply power to the first-level load fails, the first-level load can still continue to be supplied with power through the corresponding backup power supply channel 120.

[0083] 1 , the safety monitoring system 200 of the intelligent power distribution controller of the present application may include: a first software layer 210 , a second software layer 220 and a third software layer 230 .

[0084] The first software layer 210 is used to perform primary diagnosis and communication management on each power supply channel. The second software layer 220 is used to perform secondary diagnosis and control on each power supply channel and handle fault mode. The third software layer 230 is used to monitor the hardware of the controller.

[0085] Specifically, the first-level diagnosis and second-level diagnosis are used to divide the diagnostic levels, where the level of the second-level diagnosis is higher than the first-level diagnosis and can be set based on actual conditions. For example, the first-level diagnosis is used to determine whether the current in each power supply channel exceeds the first threshold. If the current exceeds the first threshold, it is considered to have an overcurrent risk, but it does not affect the power supply safety, and an alarm signal can be issued to remind you; the second-level diagnosis is used to determine whether the current in each power supply channel exceeds the second threshold, where the second threshold is greater than the first threshold. When the current exceeds the second threshold, it is considered that the power supply channel has an overcurrent, affecting the power supply safety, and the power supply channel needs to be cut off.

[0086] Communication management may include data processing, data packaging, signal transmission, etc. of the controller's transmission signal, which is not limited here.

[0087] The safety monitoring system 200 of the intelligent power distribution controller performs a first-level diagnosis on each power supply channel based on the working parameters of each power supply channel obtained in real time through the first software layer 210, determines whether the working parameters of each power supply channel have reached the first-level fault threshold, and realizes communication with the outside through the first software layer 210. For example, when the working parameter is current, when the current of the power supply channel reaches the first current threshold, it is considered that the current of the power supply channel has reached the first-level fault threshold, and a corresponding fault reminder signal is generated, and the reminder signal is sent out through the first software layer 210.

[0088] The safety monitoring system 200 of the intelligent power distribution controller performs secondary diagnosis on each power supply channel based on the real-time working parameters of each power supply channel through the second software layer 220, and controls the corresponding power supply channel when it is determined that the power supply channel has reached the secondary fault threshold to ensure power supply safety. At the same time, corresponding fault mode processing is performed for the secondary fault of the corresponding power supply channel. Fault mode processing refers to determining the corresponding fault mode for the secondary diagnostic fault of each power supply channel to generate a corresponding fault mode signal. For example, taking the application of the intelligent power distribution controller 100 in the low-voltage power supply of a vehicle as an example, when it is determined that a secondary fault has occurred in the power supply channel, a corresponding fault mode signal is determined based on the secondary diagnostic fault, and the fault mode signal is sent to the vehicle controller through the first software layer 210. The vehicle controller controls the vehicle to enter a braking state based on the fault mode signal.

[0089] Different fault mode handling strategies can be configured for different types of secondary diagnostic faults, and these strategies are not limited here. For example, in an intelligent power distribution controller used for low-voltage power supply in a vehicle, where the operating parameter is current, if the current in a particular power supply channel reaches the second current threshold, the current in that channel is considered to have reached the secondary fault threshold, and a secondary overcurrent fault is determined to have occurred in that channel. This channel is then disconnected, and a corresponding fault mode signal is generated to control the vehicle to reduce speed corresponding to the secondary overcurrent fault.

[0090] The safety monitoring system 200 of the intelligent power distribution controller monitors the hardware of the controller through the third software layer 230 to ensure that the controller operates normally and meets functional safety requirements.

[0091] In the technical solution of the embodiment of the present application, the safety monitoring system 200 of the intelligent power distribution controller monitors the main power supply channel and the backup power supply channel through the first software layer 210 and the second software layer 220 to perform hazard analysis and risk assessment on the main power supply channel and the backup power supply channel to implement different safety strategies. For example, when the first software layer 210 determines that a first-level fault occurs in the power supply channel, a fault reminder is issued; when the second software layer 220 determines that a second-level fault such as overcurrent or overvoltage occurs in the power supply channel, the power supply of the faulty channel is switched to ensure that the power supply of other channels is not affected. At the same time, the backup power supply channel corresponding to the faulty main power supply channel can still be used to provide normal power supply to the first-level load. At the same time, the hardware of the controller is monitored through the third software layer 230, so that the above-mentioned safety monitoring strategy can be implemented when the controller is normal, meeting the functional safety requirements.

[0092] Therefore, the safety monitoring system of the present application modularly designs the application layer software functions of the intelligent power distribution controller by analyzing the functional safety requirements and non-functional safety requirements, deploys the first-level diagnosis that does not affect the power supply control in the first software layer 210, deploys the second-level diagnosis and power supply-related safety mechanisms involving power supply control in the second software layer 220, and deploys the hardware monitoring function in the third software layer 230.

[0093] According to some embodiments of the present application, as shown in FIG4 , the first software layer 210 includes: a first-level diagnostic module 211 for performing a first-level diagnosis on each power supply channel; and a communication management module 212 for performing communication management.

[0094] Specifically, the first software layer 210 can perform a first-level diagnosis on each power supply channel based on the working parameters of each power supply channel obtained in real time and a pre-set first-level diagnostic threshold through the first-level diagnostic module 211. The first-level diagnosis may include a first-level overcurrent diagnosis, a first-level overvoltage diagnosis, and a first-level overtemperature diagnosis, etc. The first-level diagnostic module 211 compares the working parameters obtained in real time with the first-level diagnostic threshold to determine the first-level diagnostic result of each power supply channel. For example, when it is determined that the current of a power supply channel reaches the first-level overcurrent diagnostic threshold, it is determined that the power supply channel has an overcurrent risk and generates a corresponding overcurrent reminder signal.

[0095] The communication management module 212 receives the reminder signal generated by the primary diagnostic module 211 and transmits the reminder signal. Furthermore, the communication management module 212 processes and transmits the transmission signals generated by the second software layer 220 and the third software layer 230. For example, when the intelligent power distribution controller 100 is used in a vehicle, the communication management module 212 transmits the reminder signal generated by the primary diagnostic module 211 to the vehicle's CAN bus via the CAN module 140.

[0096] According to some embodiments of the present application, the first-level diagnostic module 211 is used to perform a first-level diagnosis on each power supply channel to obtain a first-level fault signal; the communication management module 212 is used to process the first-level fault signal and send the processed first-level fault signal to the external communication bus of the intelligent power distribution controller; wherein, the first-level diagnosis includes one or more of a first-level overcurrent diagnosis, a first-level overvoltage diagnosis, a first-level undervoltage diagnosis and a first-level overtemperature diagnosis.

[0097] Specifically, the first-level diagnostic module 211 can set a first overcurrent threshold based on the first-level overcurrent diagnosis, a first overvoltage threshold based on the first-level overvoltage diagnosis, a first undervoltage threshold based on the first-level undervoltage diagnosis, and a first overtemperature threshold based on the first-level overtemperature diagnosis. The first-level diagnostic module 211 compares the current, voltage, and temperature parameters of each power supply channel acquired in real time with the preset thresholds to determine the corresponding first-level fault signal. For example, taking the first-level diagnostic module 211 as an example of performing a first-level overcurrent diagnosis on each power supply channel, the first-level diagnostic module 211 compares the received current of the power supply channel with the first overcurrent threshold and generates a first-level overcurrent fault signal if it determines that the current exceeds the first current threshold.

[0098] The communication management module 212 processes the first-level fault signal generated by the first-level diagnosis module 211, for example, encapsulates and packages the first-level fault signal, and then sends the processed first-level fault signal to the external communication bus of the smart power distributor.

[0099] According to some embodiments of the present application, the functional safety level of the first-level diagnostic module 211 and the communication management module 212 is QM.

[0100] Specifically, ISO26262 defines five QM, ASIL-A, B, C and D safety levels. Taking vehicles as an example, QM means that as long as the standard quality management process (IATF16949) is followed, no additional safety measures are required. ASIL A represents the lowest level of automotive hazards, while ASIL D represents the highest level of automotive hazards. For example, airbags, anti-lock braking systems, and power steering systems must reach ASIL D, which is the most stringent level applied to safety assurance because the risk of failure is the highest. Components at the lowest level of the safety level range, such as rear lights, only need to reach ASIL A. Headlights and brake lights are usually ASIL B, while cruise control is usually ASIL C.

[0101] In this implementation, the functional safety level of the first-level diagnostic module 211 and the communication management module 212 is QM, that is, the modules in the first software layer 210 have no ASIL level requirements and only issue alarms based on the first-level fault signal, which will not affect the power supply control of the intelligent distribution controller.

[0102] According to some embodiments of the present application, the second software layer 220 includes: a main secondary monitoring module 221, used to perform secondary diagnosis and control of the main power supply channel; a backup secondary monitoring module 222, used to perform secondary diagnosis and control of the backup power supply channel; and a fault mode processing module 223, used to perform fault mode processing.

[0103] Specifically, corresponding thresholds or judgment conditions can be set based on the secondary diagnosis. When the parameter data obtained for each power supply channel meets the preset conditions, it is determined that the corresponding power supply channel has a corresponding secondary fault. For example, the secondary diagnosis may include secondary overcurrent diagnosis, secondary overvoltage diagnosis, and secondary overtemperature diagnosis.

[0104] The second software layer 220 performs secondary diagnosis on the main power supply channel through the main secondary monitoring module 221, and when it is determined that the corresponding main power supply channel has a secondary fault, executes the corresponding control strategy based on the existing secondary fault type, such as controlling the corresponding main power supply channel to disconnect, limit current, etc.

[0105] The second software layer 220 performs secondary diagnosis on the backup power supply channel through the backup secondary monitoring module 222, and when it is determined that the corresponding backup power supply channel has a secondary fault, executes a corresponding control strategy based on the type of secondary fault in the backup power supply channel, such as controlling the corresponding backup power supply channel to disconnect, limit current, etc.

[0106] The fault mode processing module 223 receives the secondary fault signals diagnosed and output by the primary secondary monitoring module 221 and the backup secondary monitoring module 222 , and processes the secondary fault signals to determine corresponding fault modes.

[0107] In accordance with the independence requirements after the decomposition of functional safety redundancy, this embodiment deploys the functions of secondary diagnosis and control of the main power supply channel and the functions of secondary diagnosis and control of the backup power supply channel in two different software modules, namely the main secondary monitoring module 221 and the backup secondary monitoring module 222. Then, the fault mode processing module 223 processes the fault signals determined based on the main secondary monitoring module 221 and the backup secondary monitoring module 222 to determine the corresponding fault mode.

[0108] According to some embodiments of the present application, the main secondary monitoring module 221 is used to perform secondary diagnosis on the main power supply channel to obtain a secondary fault signal, and perform fault protection control on the main power supply channel. The backup secondary monitoring module 222 is used to perform secondary diagnosis on the backup power supply channel to obtain a secondary fault signal, and perform fault protection control on the backup power supply channel. The fault mode processing module 223 is used to arbitrate the secondary fault signal to obtain a fault mode signal, and send the fault mode signal to the external communication bus of the intelligent power distribution controller through the first software layer 210. Among them, the secondary diagnosis includes one or more of secondary overcurrent diagnosis, secondary overvoltage diagnosis, secondary undervoltage diagnosis, secondary overtemperature diagnosis, power switch stuck diagnosis and current acquisition unit self-test diagnosis.

[0109] Specifically, secondary overcurrent diagnosis can be implemented based on a preset second overcurrent threshold, secondary overvoltage diagnosis can be implemented based on a preset second overvoltage threshold, secondary undervoltage diagnosis can be implemented based on a preset second undervoltage threshold, secondary overtemperature diagnosis can be implemented based on a preset second overtemperature threshold, power switch stuck diagnosis can be determined based on the power switch status and stuck time, and current acquisition unit self-test diagnosis can be determined based on the operating status of the current sampling unit. It should be noted that the secondary diagnostic thresholds or secondary diagnostic conditions for different power supply channels can vary and can be specifically defined based on actual needs.

[0110] The main secondary monitoring module 221 performs secondary diagnosis on the main power supply channel to obtain a corresponding secondary fault signal, and performs corresponding fault protection control on the main power supply channel, for example, controlling the main power supply channel to be disconnected and controlling the corresponding backup power supply channel to be connected so that the corresponding first-level load can continue to be supplied by the backup power supply channel. The backup secondary monitoring module 222 performs secondary diagnosis on the backup power supply channel to obtain a corresponding secondary fault signal, and performs fault protection control on the backup power supply channel, for example, controlling the backup power supply channel to be disconnected.

[0111] The fault mode processing module 223 arbitrates the secondary fault signals generated by the primary secondary monitoring module 221 and the backup secondary monitoring module 222, then outputs a corresponding fault mode signal. The fault mode signal is then processed by the communication management module 212 of the first software layer 210 and sent to the external communication bus. Specifically, the primary fault signal and the fault mode signal determined based on the secondary fault signal are sent to the external communication bus via the communication management module 212. For example, when the intelligent power distribution controller is used for low-voltage power supply in a vehicle, the communication management module 212 may output the fault mode signal to the vehicle's CAN bus, and then, via the CAN bus, to other controllers in the vehicle, such as the central controller. Based on the received fault mode signal, the other controllers in the vehicle may execute corresponding fault control measures, such as reducing vehicle speed, to ensure driving safety.

[0112] According to some embodiments of the present application, in combination with Figures 3 and 4, each power supply channel includes a power switch 150 and an electronic fuse 160. The electronic fuse 160 is used to output a secondary overcurrent signal and control the corresponding power switch 150 to disconnect when the secondary overcurrent of the corresponding power supply channel occurs, and to output a secondary overcurrent recovery signal when the secondary overcurrent of the corresponding power supply channel is recovered.

[0113] The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: receive the secondary overcurrent signal of the corresponding power supply channel; when receiving the secondary overcurrent signal of the corresponding power supply channel, output a secondary overcurrent fault signal, and send a power cut-off signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to disconnect; after a first preset time delay, obtain the power supply recovery number of the corresponding power supply channel, and when the power supply recovery number is less than the preset recovery number and the secondary overcurrent recovery signal of the corresponding power supply channel is received, send a power connection signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to close for power recovery.

[0114] The power switch 150 can be connected in series with the corresponding power supply channel. Control of the corresponding power supply channel is achieved by controlling the power switch 150. Specifically, when the power switch 150 connected in series with a power supply channel is closed, the power supply channel is in the on state, and power can be supplied to the corresponding load through the power supply channel. When the power switch 150 connected in series with a power supply channel is opened, the power supply channel is in the off state, and power is stopped from the power supply channel.

[0115] A fuse is an electrical component used to protect circuits from damage caused by electric current. It works by controlling the current flowing through the fuse. When the current exceeds the rated current of the fuse, the fuse will melt, thereby disconnecting the circuit and protecting the circuit and equipment from damage caused by the current. Fuses include various types, such as liquid fuses, gas fuses, and electronic fuses. Electronic fuses 160 use electronic components, such as transistors or switches, to control the on / off state of the circuit. In this embodiment, the rated current can be set based on the requirements of the secondary overcurrent diagnosis.

[0116] During operation, the electronic fuse 160 samples the current of the corresponding power supply channel and, when a secondary overcurrent occurs in the corresponding power supply channel, outputs a secondary overcurrent signal to the corresponding secondary monitoring module and simultaneously disconnects the corresponding power switch 150. For example, when the electronic fuse 160 disposed on the main power supply channel determines that a secondary overcurrent has occurred, it outputs a secondary overcurrent signal to the main secondary monitoring module 221 and controls the power switch 150 on the corresponding main power supply channel to disconnect, thereby stopping power supply to the main power supply channel where the secondary overcurrent has occurred. When the electronic fuse 160 disposed on the backup power supply channel determines that a secondary overcurrent has occurred, it outputs a secondary overcurrent signal to the backup secondary monitoring module 222 and controls the power switch 150 to disconnect, thereby stopping power supply to the backup power supply channel where the secondary overcurrent has occurred. Furthermore, when the secondary overcurrent in the corresponding power supply channel recovers, the electronic fuse 160 outputs a secondary overcurrent recovery signal to both the main secondary monitoring module 221 and the backup secondary monitoring module 222. Among them, the secondary overcurrent recovery can be determined based on the received signal of the electronic fuse 160, or can be determined based on the current sampling value, which is not limited here.

[0117] The primary secondary monitoring module 221 and the backup secondary monitoring module 222 receive the secondary overcurrent signal corresponding to the primary power supply channel and the secondary overcurrent signal corresponding to the backup power supply channel, respectively. Based on the secondary overcurrent signal, they determine that a secondary overcurrent has occurred in the corresponding power supply channel. Based on the received secondary overcurrent signal, they then output a secondary overcurrent fault signal to the fault mode processing module 223 and simultaneously control the power switch 150 of the corresponding power supply channel to disconnect. It will be understood that before the primary secondary monitoring module 221 and the backup secondary monitoring module 222 control the corresponding power switch 150, the power switch 150 has already been disconnected by the electronic fuse 160.

[0118] After the power switch 150 has been off for a first preset time, the number of power restorations for the corresponding power channel is obtained. If the number of power restorations is less than the preset number, and upon receiving the secondary overcurrent restoration signal for the corresponding power channel, the primary secondary monitoring module 221 and the backup secondary monitoring module 222 send a power connection signal to the electronic fuse 160 of the corresponding power channel. Based on the received power connection signal, the electronic fuse 160 controls the power switch 150 of the corresponding power channel to close, restoring power to the power channel. Otherwise, the power switch 150 remains off.

[0119] As a specific embodiment of the present application, the overcurrent protection control of the main secondary monitoring module 221 and the backup secondary monitoring module 222 may include the following steps as shown in FIG5 :

[0120] S101, controlling the secondary overcurrent closing and recovery times timer to be cleared, and controlling the enabling signal of the electronic fuse to be set, thereby controlling the corresponding power supply switch to be closed.

[0121] S102: Determine whether the secondary overcurrent fault signal is set. If the secondary overcurrent fault signal is set to 1, then the corresponding primary secondary monitoring module 221 and backup secondary monitoring module 222 receive the secondary overcurrent signal and determine that a secondary overcurrent fault has occurred in the corresponding power supply channel, and then execute step S103. If not, then the primary secondary monitoring module 221 and backup secondary monitoring module 222 do not receive the secondary overcurrent signal and no secondary overcurrent has occurred in the power supply channel, and then execute step S102.

[0122] S103, outputting a secondary overcurrent fault signal to the fault mode processing module, and controlling the disconnection of the power supply switch corresponding to the electronic fuse.

[0123] S104, the overcurrent disconnection timer counts up by one.

[0124] S105, determining whether the overcurrent disconnection time reaches the first preset time t1. If so, executing step S106; if not, executing step S104.

[0125] S106: Obtain the power supply recovery times of the corresponding power supply channel.

[0126] S107: Determine whether the power supply recovery times are less than the preset recovery times N and whether the secondary overcurrent recovery signal of the corresponding power supply channel is received. If so, execute step S109; if not, execute step S108.

[0127] S108, maintain the current state.

[0128] S109: Send a power connection signal to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to close. Execute step S102.

[0129] It should be noted that the above-mentioned overcurrent protection control process corresponds to the power supply switch and the power supply channel. The parameters in the overcurrent protection control can be set based on parameters such as different power supply switch types, power supply loads or power supply requirements of the power supply channel, and are not limited here.

[0130] According to some embodiments of the present application, as shown in Figure 3, each power supply channel includes a power switch 150 and an electronic fuse 160. The electronic fuse 160 is used to output a secondary overvoltage signal and control the corresponding power switch 150 to disconnect when the secondary overvoltage occurs in the corresponding power supply channel, and output a secondary overvoltage recovery signal when the secondary overvoltage of the corresponding power supply channel is recovered.

[0131] The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: receive the secondary overvoltage signal of the corresponding power supply channel; when receiving the secondary overvoltage signal of the corresponding power supply channel, output the secondary overvoltage fault signal, and send a power cut-off signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to disconnect; receive the secondary overvoltage recovery signal of the corresponding power supply channel; when receiving the secondary overvoltage recovery signal of the corresponding power supply channel, send a power connection signal to the electronic fuse 160 of the corresponding power supply channel to control the power switch 150 of the corresponding power supply channel to close and restore power supply.

[0132] The power switch 150 can be connected in series with the corresponding power supply channel. Control of the corresponding power supply channel is achieved by controlling the power switch 150. Specifically, when the power switch 150 connected in series with a power supply channel is closed, the power supply channel is in the on state, and power can be supplied to the corresponding load through the power supply channel. When the power switch 150 connected in series with a power supply channel is opened, the power supply channel is in the off state, and the power supply channel stops supplying power to the corresponding load.

[0133] When the sampled voltage of the corresponding power supply channel exceeds the specified voltage value, the electronic fuse 160 controls the corresponding power switch to disconnect, thereby controlling the power supply channel to stop supplying power. In this embodiment, the specified voltage value can be set based on the secondary overvoltage diagnosis requirement. On the one hand, when a secondary overvoltage occurs in the corresponding power supply channel, the electronic fuse 160 can output a secondary overvoltage signal to the corresponding secondary monitoring module and simultaneously disconnect the corresponding power switch 150. For example, when the electronic fuse 160 set on the main power supply channel determines that a secondary overvoltage has occurred, it outputs a secondary overvoltage signal to the main secondary monitoring module 221 and controls the power switch 150 on the corresponding main power supply channel to disconnect, thereby stopping supplying power to the main power supply channel where the secondary overvoltage has occurred. When the electronic fuse 160 set on the backup power supply channel determines that a secondary overvoltage has occurred, it outputs a secondary overvoltage signal to the backup secondary monitoring module 222 and controls the power switch 150 on the corresponding power supply channel to disconnect, thereby stopping supplying power to the backup power supply channel where the secondary overvoltage has occurred. On the other hand, when the corresponding power supply channel recovers from a secondary overvoltage, electronic fuse 160 outputs a secondary overvoltage recovery signal to primary secondary monitoring module 221 and backup secondary monitoring module 222. Electronic fuse 160 may determine that the corresponding power supply channel has recovered from a secondary overvoltage based on a received signal or based on voltage sampling, without limitation.

[0134] Specifically, the primary secondary monitoring module 221 and the backup secondary monitoring module 222 generate corresponding secondary overvoltage fault signals based on the received secondary overvoltage signal, and control the power supply switch 150 of the corresponding power supply channel to open, and control the power supply switch 150 of the corresponding power supply channel to close based on the secondary overvoltage recovery signal to restore power. The control process for the secondary overvoltage by the primary secondary monitoring module 221 and the backup secondary monitoring module 222 can be shown in Figure 6, including the following steps:

[0135] S201: Set the overvoltage fault signal. Setting the signal to 1 indicates initialization of overvoltage monitoring for the primary and backup secondary monitoring modules 221 and 222. When the primary and backup secondary monitoring modules 221 and 222 receive a secondary overvoltage signal for the corresponding power supply channel, step S202 is executed. When the primary and backup secondary monitoring modules 221 and 222 receive a secondary overvoltage recovery signal for the corresponding power supply channel, step S204 is executed.

[0136] S202, output a secondary overvoltage fault signal.

[0137] S203 , sending a power cutoff signal to the electronic fuse of the corresponding power supply channel to reset the enable signal of the electronic fuse, so as to control the power switch of the corresponding power supply channel to be turned off.

[0138] S204: Determine whether the overvoltage fault of the corresponding power supply channel is repaired.

[0139] S205 , sending a power connection signal to the electronic fuse of the corresponding power supply channel to set the enable signal of the electronic fuse to control the power switch of the corresponding power supply channel to be closed.

[0140] It should be noted that before the main secondary monitoring module 221 and the backup secondary monitoring module 222 send the power cut-off signal based on the secondary overvoltage signal to control the corresponding power switch 150 to disconnect, the power switch 150 has been disconnected by the electronic fuse 160. The main secondary monitoring module 221 and the backup secondary monitoring module 222 send the power cut-off signal again, so that the electronic fuse 160 can control the power switch 150 to disconnect again based on the power cut-off signal, further improving the control stability of the power cut-off.

[0141] According to some embodiments of the present application, each power supply channel includes a power switch 150 and an electronic fuse 160, and the electronic fuse 160 is used to obtain the actual switch state of the corresponding power switch 150. The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: receive the actual switch state of the corresponding power switch 150; when the actual switch state is different from the expected switch state, accumulate the stuck fault time of the corresponding power switch 150, and when the accumulated stuck fault time reaches a first preset value, output a power switch stuck fault signal; when the actual switch state is the same as the expected switch state, decrement the stuck fault time of the corresponding power switch 150, and when the decremented stuck fault time reaches a second preset value, determine that the corresponding power switch has recovered from being stuck.

[0142] Specifically, the power switch 150 is connected in series in the corresponding power supply channel, and the corresponding power supply channel is controlled by controlling the power switch 150. The electronic fuse 160 detects the actual switching state of the corresponding power switch 150.

[0143] When the power switch 150 of the power supply channel is stuck, the intelligent power distribution controller cannot correctly control the power supply to the load, violating the functional safety requirements. Therefore, the stuck power switch 150 must be diagnosed and the staff must be informed of the fault in a timely manner to perform maintenance operations to avoid hazards.

[0144] To this end, the present application proposes a control process for a stuck fault of a power switch, as shown in FIG7 . The control process may include the following steps:

[0145] S301 , obtaining the actual switch status of the corresponding power switch. During operation, the electronic fuse obtains the actual switch status of the corresponding power switch and sends it to the corresponding primary secondary monitoring module 221 and backup secondary monitoring module 222 .

[0146] S302: Determine whether the actual switch state of the corresponding power switch is the same as the expected switch state. If so, execute step S303; if not, execute step S306.

[0147] S303: Determine whether the stuck fault time reaches a second preset value t2. If yes, go to step S304; if not, go to step S305.

[0148] S304: Determine whether the corresponding power switch is stuck and recovered. Execute step S301.

[0149] S305: Subtract 1 from the stuck fault time. Execute step S301.

[0150] S306: Determine whether the stuck fault time reaches the first preset value t1. If yes, go to step S307; if not, go to step S308.

[0151] S307: Determine that a stuck fault occurs on the power switch, and output a power switch stuck fault signal. Execute step S301.

[0152] S308: The stuck fault time is increased by 1. Execute step S301.

[0153] This embodiment diagnoses the stuck fault of the power switch based on the actual working state of the power switch 150 and the expected switching state, so that when the power switch 150 of the power supply channel has a stuck fault, the staff is promptly informed of the fault so that maintenance operations can be performed.

[0154] According to some embodiments of the present application, each power supply channel includes an electronic fuse 160, and the electronic fuse 160 includes a current acquisition unit for acquiring the current of the corresponding power supply channel. The main secondary monitoring module 221 and the backup secondary monitoring module 222 are respectively used to: send a current acquisition self-test instruction to the electronic fuse 160 of the corresponding power supply channel, so that the electronic fuse 160 of the corresponding power supply channel performs a self-test on its own current acquisition unit and outputs the sampling resistor voltage difference of the current acquisition unit; receive the sampling resistor voltage difference of the corresponding power supply channel; when the sampling resistor voltage difference does not reach a preset voltage difference threshold, output a current acquisition unit self-test fault signal; when the sampling resistor voltage difference reaches the preset voltage difference threshold, determine that the current acquisition unit self-test fault has been recovered.

[0155] Specifically, electronic fuse 160 includes a current acquisition unit, which collects the current of the power supply channel through the current acquisition unit. When an overcurrent is determined to have occurred in a power supply channel based on the collected current, electronic fuse 160 issues an overcurrent fault signal and disconnects the corresponding power switch 150. If the current acquisition unit of electronic fuse 160 fails, that is, electronic fuse 160 is unable to detect the overcurrent in a timely manner, then when an overcurrent occurs in the corresponding power supply channel, the intelligent power distribution controller will be unable to disconnect the corresponding power switch 150 in a timely manner, causing the intelligent power distribution controller to malfunction, uncontrolled power supply to each power supply channel, and potentially causing harm.

[0156] Therefore, the present application diagnoses the current acquisition unit and issues a timely fault warning. The electronic fuse 160 has a current unit self-test function. By sending a current acquisition self-test instruction to the corresponding electronic fuse 160 through the primary secondary monitoring module 221 and the backup secondary monitoring module 222, a fault in the current acquisition unit of the electronic fuse 160 can be detected in a timely manner. As a specific embodiment of the present application, the current acquisition unit self-test function of the primary secondary monitoring module 221 and the backup secondary monitoring module 222 can be implemented as shown in FIG8 , including the following steps:

[0157] S401, the secondary monitoring modules (main secondary monitoring module 221, backup secondary monitoring module 222) send a current collection self-test instruction to the electronic fuse of the corresponding power supply channel.

[0158] S402: The electronic fuse performs a self-test process on its own current acquisition unit based on the received current acquisition self-test instruction, and outputs the sampling resistor voltage difference obtained by the self-test to the corresponding secondary monitoring module.

[0159] S403: The secondary monitoring module determines whether the voltage difference of the sampling resistor reaches a preset voltage difference threshold. If so, step S404 is executed; if not, step S405 is executed.

[0160] S404 , determining that the current sampling unit has a self-detection fault, and outputting a current sampling unit self-detection fault signal.

[0161] S405: Determine whether the current acquisition unit self-test fault is recovered.

[0162] According to some embodiments of the present application, the functional safety level of the main secondary monitoring module 221 and the backup secondary monitoring module 222 is greater than or equal to ASIL B, and the functional safety level of the failure mode processing module is ASIL D.

[0163] Specifically, the present application adopts the concept of redundant decomposition, dividing the power supply control function into two functional modules with an ASIL B level or higher, namely, the main secondary monitoring module 221 and the backup secondary monitoring module 222. For example, the functional safety level of the main secondary monitoring module 221 and the backup secondary monitoring module 222 can be ASIL B, ASIL C, ASIL D, etc. When the functional safety level of the main secondary monitoring module 221 and the backup secondary monitoring module 222 is B, the functional safety requirements of ASIL D can be achieved due to the redundancy of the main power supply channel and the backup power supply channel.

[0164] This embodiment adopts the concept of redundant decomposition, dividing the power supply control function into two ASIL B(D) level functional modules to implement secondary diagnostic functions for the main power supply channel and the backup power supply channel respectively, so that the power supply of the intelligent power distribution controller to the first level load meets the ASIL D level safety requirements.

[0165] Therefore, the second software layer 220 of the present application realizes the functions of the application layer with a safety level above ASIL B level. The application layer includes two major categories of modules: the first category is the power supply control function directly derived from the functional safety requirements (supplying power to the outside when there is no fault, and promptly cutting off power when there is a fault); the second category is the safety mechanism for components that affect the power supply control function after a fault occurs (such as the stuck diagnosis of the power switch and the self-test of the current acquisition unit). Specifically, the second software layer 220 may include the following functions: overcurrent and overvoltage protection function of the main power supply channel, stuck diagnosis of the power switch of the main power supply channel, self-test function of the current acquisition unit of the main power supply channel, overcurrent and overvoltage protection function of the backup power supply channel, stuck diagnosis of the power switch of the backup safety channel, and self-test function of the current acquisition unit of the backup safety channel. Further, in accordance with the independence requirements after the functional safety redundancy decomposition, the relevant control and diagnosis functions of the main power supply channel and the control and diagnosis of the backup power supply channel are deployed in two different software modules.

[0166] According to some embodiments of the present application, the third software layer 230 includes: a system module 231 for performing hardware monitoring on the controller; and a driver module 232 for driving and controlling each power supply channel.

[0167] Specifically, the third software layer 230 is a module related to the underlying BSW (Basic Software) software. This layer is divided into two major modules: the AutoSar standard module, namely the system module 231, and the driver module 232. The system module 231 provides the intelligent power distribution controller with basic operating system, watchdog monitoring, communication management, and mode management functions, while the driver module 232 is used to receive relevant instructions from the application layer (i.e., the layer where the first software layer 210 and the second software layer 220 are located) to control the electronic fuse 160.

[0168] According to some embodiments of the present application, the intelligent power distribution controller also includes a safety power chip 170, and the system module 231 is used to: receive a watchdog seed from the safety power chip 170; the watchdog seed includes a target control instruction for a target power supply channel, and the target power supply channel is at least one of a main power supply channel and a backup power supply channel; send the watchdog seed to the second software layer 220, so that the main secondary monitoring module 221 and the backup secondary monitoring module 222 of the second software layer 220 generate a drive control instruction for the target power supply channel based on the target control instruction, and send it to the drive module 232, so that the drive module 232 generates a watchdog response signal; receive the watchdog response signal, and send the watchdog response signal to the safety power chip 170, so that the safety power chip 170 determines whether the controller is normal based on the watchdog response signal.

[0169] Specifically, the target control instruction of the target power supply channel refers to a control instruction for the electronic fuse of the target power supply channel, which is used to control the closing and opening of the electronic switch 150 corresponding to the electronic fuse 160 of the target power supply channel.

[0170] The third software layer 230 monitors the running sequence and running time of the software modules (main secondary monitoring module 221 and backup secondary monitoring module 222) in the second software layer 220 by combining with the safety power chip 170. When the relevant software modules fail to run in the correct order and time, the safety power chip 170 forces the backup power supply channel to supply power, and the power supply of the backup power supply channel is no longer controlled by the controller.

[0171] The specific program flow monitoring route is shown by the dotted line in Figure 4. First, the safety power chip 170 sends a target control instruction watchdog seed including the main power supply channel and the backup power supply channel. The system module 231 receives the watchdog seed, and then abstracts its watchdog seed into Wdg through the microcontroller abstraction layer inside the system module 231, and then abstracts it into WdgIf through the ECU abstraction layer. Finally, it is converted into WdgM by the service layer and sent to the main secondary monitoring module 221 and the backup secondary monitoring module 222 of the second software layer 220. The main secondary monitoring module 221 and the backup secondary monitoring module 222 generate a drive control instruction for the target power supply channel based on the received WdgM, and send it to the drive module 232. The drive module 232 generates a watchdog response signal based on the drive control instruction, and the watchdog response signal is sent to the safety power chip 170 through the system module 231.

[0172] If the relevant software modules of controller 130 execute correctly in the above-mentioned order within the specified time, the correct watchdog response signal will be returned to safety power chip 170. If the relevant software modules do not execute correctly within the specified time, the correct watchdog response signal will not be returned. Therefore, safety power chip 170 can determine whether controller 130 is functioning properly based on the received watchdog response signal. If the hardware of controller 130 is determined to be normal, controller 130 will continue to perform power supply control. If the hardware of controller 130 is determined to be abnormal, safety power chip 170 will control the fault pin to be high, and the vehicle system will enter limp home mode, that is, the electronic fuse 160 will be controlled by safety power chip 170.

[0173] According to some embodiments of the present application, the functional safety level of the system module 231 and the driver module 232 is ASIL D.

[0174] This embodiment implements a question-and-answer watchdog mechanism for logic and time independence diagnosis based on the system module 231 and the driver module 232 of the ASIL D functional safety level, monitors hardware failures at the ECU and microcontroller levels, and simultaneously receives the enable signal of the electronic fuse sent by the safety power chip 170 to control the closing and opening of the electronic switch 150 corresponding to the electronic fuse 160.

[0175] In summary, the safety monitoring system of the intelligent power distribution controller of the present application analyzes the functional safety requirements and non-functional safety requirements of the intelligent power distribution controller, modularly designs the application layer software functions of the intelligent power distribution controller, deploys the first-level diagnosis that does not affect the power supply control in the first software layer, deploys the second-level diagnosis and power supply-related safety mechanisms involving power supply control in the second software layer, and deploys the hardware monitoring function of the controller in the third software layer, so that the power supply of the intelligent power distribution controller to the load can easily meet the target functional safety level requirements.

[0176] Corresponding to the above embodiment, the present application also proposes a controller.

[0177] As shown in FIG9 , the controller 130 in the present application includes the safety monitoring system 200 of the above-mentioned intelligent power distribution controller.

[0178] Corresponding to the above embodiments, the present application also proposes an intelligent power distribution controller.

[0179] As shown in FIG10 , the intelligent power distribution controller 100 in the present application includes the above-mentioned security monitoring system 200 of the intelligent power distribution controller, or, as shown in FIG11 , the intelligent power distribution controller 100 in the present application includes the above-mentioned controller 130 .

[0180] Corresponding to the above embodiments, the present application also proposes a vehicle.

[0181] As shown in Figure 12, the vehicle 1000 in this application includes the safety monitoring system 200 of the above-mentioned intelligent power distribution controller, or, as shown in Figure 13, the vehicle 1000 in this application includes the above-mentioned controller 130, or, as shown in Figure 14, the vehicle 1000 in this application includes the above-mentioned intelligent power distribution controller 100.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application, and they should all be included in the scope of the claims and specification of the present application. In particular, as long as there is no structural conflict, the various technical features mentioned in the various embodiments can be combined in any way. The present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions that fall within the scope of the claims.

Claims

1. A safety monitoring system for an intelligent power distribution controller, wherein: The intelligent power distribution controller includes a main power supply channel for supplying power to a first level load and a second level load, a backup power supply channel for supplying power to the first level load, and a controller for monitoring the main power supply channel and the backup power supply channel, the safety monitoring system is applied to the controller, and the safety monitoring system includes: The first software layer is used to perform primary diagnosis on each power supply channel and to manage communications; The second software layer is used to perform secondary diagnosis and control of each power supply channel and perform fault mode processing; The third software layer is used to perform hardware monitoring on the controller.

2. The security monitoring system according to claim 1, wherein: The first software layer includes: The primary diagnosis module is used to perform primary diagnosis on each power supply channel; The communication management module is used for communication management.

3. The security monitoring system according to claim 2, wherein: The primary diagnosis module is used to perform primary diagnosis on each power supply channel to obtain a primary fault signal; The communication management module is used to process the first-level fault signal and send the processed first-level fault signal to the external communication bus of the intelligent power distribution controller; wherein the first-level diagnosis includes one or more of first-level overcurrent diagnosis, first-level overvoltage diagnosis, first-level undervoltage diagnosis and first-level overtemperature diagnosis.

4. The security monitoring system according to claim 2 or 3, wherein: The functional safety level of the primary diagnostic module and the communication management module is QM under the ISO26262 standard.

5. The security monitoring system according to any one of claims 1 to 4, wherein: The second software layer includes: A main secondary monitoring module, used for performing secondary diagnosis and control on the main power supply channel; A backup secondary monitoring module, used for performing secondary diagnosis and control on the backup power supply channel; The failure mode processing module is used for performing failure mode processing.

6. The security monitoring system according to claim 5, wherein: The main secondary monitoring module is used to perform secondary diagnosis on the main power supply channel to obtain a secondary fault signal, and perform fault protection control on the main power supply channel; The backup secondary monitoring module is used to perform secondary diagnosis on the backup power supply channel to obtain a secondary fault signal, and perform fault protection control on the backup power supply channel; The fault mode processing module is used to arbitrate the secondary fault signal to obtain a fault mode signal, and send the fault mode signal to the external communication bus of the intelligent power distribution controller through the first software layer; wherein the secondary diagnosis includes one or more of secondary overcurrent diagnosis, secondary overvoltage diagnosis, secondary undervoltage diagnosis, secondary overtemperature diagnosis, power switch stuck diagnosis and current acquisition unit self-test diagnosis.

7. The security monitoring system according to claim 6, wherein: Each power supply channel includes a power supply switch and an electronic fuse. The electronic fuse is used to output a secondary overcurrent signal and control the corresponding power supply switch to disconnect when the secondary overcurrent of the corresponding power supply channel occurs, and output a secondary overcurrent recovery signal when the secondary overcurrent of the corresponding power supply channel is restored. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: Receive a secondary overcurrent signal of a corresponding power supply channel; When receiving the secondary overcurrent signal of the corresponding power supply channel, outputting the secondary overcurrent fault signal, and sending the power supply cut-off signal to the electronic fuse of the corresponding power supply channel to control the power supply switch of the corresponding power supply channel to be disconnected; After a first preset delay time, the power supply recovery times of the corresponding power supply channel are obtained, and when the power supply recovery times are less than the preset recovery times and the secondary overcurrent recovery signal of the corresponding power supply channel is received, a power supply connection signal is sent to the electronic fuse of the corresponding power supply channel to control the power supply switch of the corresponding power supply channel to close for power recovery.

8. The security monitoring system according to claim 6, wherein: Each power supply channel includes a power switch and an electronic fuse. The electronic fuse is used to output a secondary overvoltage signal and control the corresponding power switch to disconnect when the secondary overvoltage of the corresponding power supply channel is over, and output a secondary overvoltage recovery signal when the secondary overvoltage of the corresponding power supply channel is restored. The main secondary monitoring module and the backup secondary monitoring module are respectively used to: receiving a secondary overvoltage signal of a corresponding power supply channel; When receiving the secondary overvoltage signal of the corresponding power supply channel, it outputs the secondary overvoltage fault signal and sends a signal to the electronic fuse of the corresponding power supply channel. The breaker sends a power supply cut-off signal to control the power switch of the corresponding power supply channel to disconnect; Receive a secondary overvoltage recovery signal of a corresponding power supply channel; When the secondary overvoltage recovery signal of the corresponding power supply channel is received, a power supply connection signal is sent to the electronic fuse of the corresponding power supply channel to control the power switch of the corresponding power supply channel to close and restore power supply.

9. The security monitoring system according to claim 6, wherein: Each power supply channel includes a power supply switch and an electronic fuse, wherein the electronic fuse is used to obtain the actual switch state of the corresponding power supply switch, and the main secondary monitoring module and the backup secondary monitoring module are respectively used to: Receiving the actual switch state of the corresponding power switch; When the actual switch state is different from the expected switch state, accumulating the stuck fault time of the corresponding power switch, and outputting a stuck fault signal of the power switch when the accumulated stuck fault time reaches a first preset value; When the actual switch state is the same as the expected switch state, the stuck fault time of the corresponding power switch is cumulatively decremented, and when the subtracted stuck fault time reaches a second preset value, it is determined that the stuck state of the corresponding power switch is recovered.

10. The security monitoring system according to claim 6, wherein: Each power supply channel includes an electronic fuse, and the electronic fuse includes a current acquisition unit for collecting the current of the corresponding power supply channel. The main secondary monitoring module and the backup secondary monitoring module are respectively used for: Sending a current collection self-test instruction to the electronic fuse of the corresponding power supply channel, so that the electronic fuse of the corresponding power supply channel performs a self-test on its own current collection unit and outputs a sampling resistor voltage difference of the current collection unit; Receive the sampling resistor voltage difference of the corresponding power supply channel; When the sampling resistor voltage difference does not reach a preset voltage difference threshold, a current acquisition unit self-test fault signal is output; When the sampling resistor voltage difference reaches the preset voltage difference threshold, it is determined that the current acquisition unit self-test fault is recovered.

11. The security monitoring system according to any one of claims 5 to 10, wherein: The functional safety level of the main secondary monitoring module and the backup secondary monitoring module is greater than or equal to ASIL B under the ISO26262 standard, and the functional safety level of the failure mode processing module is ASIL D under the ISO26262 standard.

12. The security monitoring system according to any one of claims 5 to 11, wherein: The third software layer includes: A system module, used for performing hardware monitoring on the controller; The driving module is used to drive and control each power supply channel.

13. The security monitoring system according to claim 12, wherein: The intelligent power distribution controller also includes a safety power chip, and the system module is used for: Receive a watchdog seed of the safety power chip; the watchdog seed includes a target control instruction of a target power supply channel, and the target power supply channel is at least one of the main power supply channel and the backup power supply channel; Sending the watchdog seed to the second software layer, so that the main secondary monitoring module and the backup secondary monitoring module of the second software layer generate the drive control instruction of the target power supply channel based on the target control instruction, and send it to the drive module, so that the drive module generates a watchdog response signal; The watchdog response signal is received, and the watchdog response signal is sent to the safety power chip, so that the safety power chip determines whether the controller is normal based on the watchdog response signal.

14. The security monitoring system according to claim 12 or 13, wherein: The functional safety level of the system module and the drive module is ASIL D under the ISO26262 standard.

15. The security monitoring system according to any one of claims 1 to 14, wherein: The first level of load is a safe load, and the second level of load is a non-safe load.

16. A controller, wherein: A safety monitoring system comprising an intelligent power distribution controller according to any one of claims 1-15.

17. An intelligent power distribution controller, wherein: Comprising a safety monitoring system of an intelligent power distribution controller according to any one of claims 1-15, or a controller according to claim 16.

18. A vehicle, wherein: It comprises a safety monitoring system of an intelligent power distribution controller according to any one of claims 1 to 15, or a controller according to claim 16, or an intelligent power distribution controller according to claim 17.

Images