Vehicle power control system

Abstract

A vehicle power control system, comprising: a power domain controller (110), communicatively connected to a sub-controller (120), and used for receiving a signal of a high-voltage battery, a signal of a low-voltage battery, and electrical parameters of charging and discharging circuits, which are sent by the sub-controller (120), and sending a functional safety control signal to the sub-controller (120), so that the sub-controller (120) performs a safety control function on the basis of the functional safety control signal. The vehicle power control system ensures the safety and stability of vehicles.

Description

Vehicle power control system Cross-reference to related applications This application claims priority to Chinese Patent Application No. 202510355451.5, filed with the Chinese Patent Office on March 25, 2025, the entire contents of which are incorporated herein by reference. Technical Field

[0001] This application relates to, but is not limited to, the field of functional safety technology for vehicles, and in particular to, but is not limited to, a vehicle power control system. Background Technology

[0002] With the development of electric, intelligent, connected, and shared vehicles, the functions and services they provide are constantly expanding. The complexity of automotive hardware is skyrocketing, and electronic software and electromechanical equipment are growing explosively. Consequently, the risks from system failures and random hardware failures are also increasing. Any failure in safety-related software or hardware can have very serious consequences for people, vehicles, and the environment, such as unexpected acceleration, unexpected braking, unexpected steering, and unexpected battery thermal runaway. Summary of the Invention

[0003] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0004] In a first aspect, this application provides a vehicle powertrain control system applied to a vehicle, comprising:

[0005] The power domain controller, which is communicatively connected to the sub-controller, is used to receive signals from the high-voltage battery, the low-voltage battery, and the power parameters of the charging / discharging circuit sent by the sub-controller, and to send functional safety control signals to the sub-controller so that the sub-controller performs safety control functions according to the functional safety control signals.

[0006] In one embodiment, the functional safety level of the power domain controller is higher than that of the sub-controller.

[0007] In one embodiment, the sub-controller includes a first sub-controller and a second sub-controller, wherein the first sub-controller is used to acquire signals from the high-voltage battery; the second sub-controller is used to acquire signals from the low-voltage battery and acquire power parameters of the charging / discharging circuit; and the step of sending the functional safety control signal to the sub-controller includes sending the functional safety control signal to the first sub-controller and the second sub-controller.

[0008] In one embodiment, the power domain controller includes: a battery functional safety control module for receiving signals from the high-voltage battery and the low-voltage battery, and sending battery safety control signals to the first sub-controller and the second sub-controller; and a circuit safety control module for receiving power parameters of the charging / discharging circuit, and sending circuit safety control signals to the second sub-controller.

[0009] In one embodiment, the circuit safety control signal is generated based on circuit safety control logic, which includes at least one of the following: charging overvoltage safety control logic, discharging overvoltage safety control logic, charging port cover overheating safety control logic, overvoltage safety control logic, undervoltage safety control logic, and current backflow prevention safety control logic.

[0010] In one embodiment, the battery functional safety control module includes a high-voltage battery control module and a low-voltage battery control module. The high-voltage battery control module is communicatively connected to the first sub-controller and is used to receive signals from the high-voltage battery and send high-voltage battery functional safety control signals to the first sub-controller. The low-voltage battery control module is communicatively connected to the second sub-controller and is used to receive signals from the low-voltage battery and send low-voltage battery power supply control signals to the second sub-controller.

[0011] In one embodiment, the second sub-controller is further configured to collect temperature data of the hot and cold circuits in the vehicle and send the temperature data to the power domain controller; the power domain controller further includes a thermal management safety control module, which is communicatively connected to the second sub-controller and is configured to receive the temperature data and send hot and cold circuit safety control signals to the second sub-controller.

[0012] In one embodiment, the high-voltage battery functional safety control signal is generated based on high-voltage battery safety control logic, which includes at least one of collision safety control logic, first cell overvoltage safety control logic, first cell undervoltage safety control logic, first cell overtemperature safety control logic, charging / discharging overcurrent safety control logic, relay status detection safety control logic, and stop heating request safety control logic; and / or, the low-voltage battery power supply control signal is generated based on low-voltage battery safety control logic, which includes at least one of second cell overvoltage safety control logic, second cell undervoltage safety control logic, second cell overtemperature safety control logic, and short-circuit protection safety control logic.

[0013] In one embodiment, the first cell overvoltage safety control logic includes: when the high-voltage battery signal includes a first cell sampling voltage, in response to the first cell sampling voltage being greater than a first preset overvoltage threshold, generating a high-voltage battery functional safety control signal matching the first cell overvoltage safety control logic; and / or, when the high-voltage battery signal includes a hardware overvoltage comparison signal, generating a high-voltage battery functional safety control signal matching the first cell overvoltage safety control logic when the hardware overvoltage comparison signal meets a preset overvoltage condition; the first cell undervoltage safety control logic includes: when the high-voltage battery signal includes a first cell sampling voltage, in response to the first cell sampling voltage being less than a first preset undervoltage threshold, generating a high-voltage battery functional safety control signal matching the first cell undervoltage safety control logic; and / or, when the high-voltage battery signal includes a hardware undervoltage comparison signal, generating a high-voltage battery functional safety control signal matching the first cell undervoltage safety control logic when the hardware undervoltage comparison signal meets a preset undervoltage condition. Under certain conditions, a high-voltage battery functional safety control signal matching the undervoltage safety control logic of the first battery cell is generated; the first battery cell over-temperature safety control logic includes: generating a functional safety control signal matching the first battery cell over-temperature safety control logic when the sampled temperature of the first battery cell exceeds a set functional safety threshold; the charging / discharging overcurrent safety control logic includes: monitoring the current during the charging / discharging process, and generating a functional safety control signal matching the charging / discharging overcurrent safety control logic when the current exceeds a functional safety threshold; the relay status detection safety control logic includes: monitoring the status of relays in the battery management system, and generating a functional safety control signal matching the relay status detection safety control logic when the relay cannot be reliably turned off; the stop heating request safety control logic includes monitoring the battery temperature status, and generating a functional safety control signal matching the stop heating request safety control logic when the battery temperature exceeds a functional safety protection threshold.

[0014] In one embodiment, the method for obtaining the first cell sampling voltage includes: the first sub-controller obtaining the first cell sampling voltage through the voltage sampling circuit corresponding to the high-voltage battery.

[0015] In one embodiment, the second cell overvoltage safety control logic includes: when the low-voltage battery signal includes a second sampling voltage, in response to the second sampling voltage being greater than a second preset overvoltage threshold, generating a low-voltage battery power supply control signal matching the second cell overvoltage safety control logic; the second cell undervoltage safety control logic includes: when the low-voltage battery signal includes a second sampling voltage, in response to the second sampling voltage being less than a second preset undervoltage threshold, generating a low-voltage battery power supply control signal matching the second cell undervoltage safety control logic.

[0016] In one embodiment, when the second sampling voltage includes the low-voltage battery voltage, after generating the low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic / second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the power supply relay of the low-voltage battery.

[0017] In one embodiment, when the second sampling voltage includes a low-voltage output voltage, after generating the low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic / second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller shuts down the DC-DC converter module corresponding to the low-voltage battery.

[0018] In one embodiment, when the second sampling voltage includes a high voltage, after generating a low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the charging relay corresponding to the low-voltage battery; after generating a low-voltage battery power supply control signal that matches the second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the discharging relay corresponding to the low-voltage battery.

[0019] In one embodiment, the power domain controller further includes a motor functional safety control module, which includes at least one of a torque management functional safety control module and a high-voltage drive safety control module; wherein the torque management functional safety control module designs torque safety control logic, functional safety protection thresholds, and safety states after fault triggering based on the torque management control function, and the torque safety control logic includes at least one of torque allowance functional safety control logic, actual torque estimation functional safety control logic, and torque request functional safety control logic; and / or, the high-voltage drive safety control module is used to design high-voltage drive safety control logic, functional safety protection thresholds, and safety states after fault triggering based on the high-voltage drive function, and the high-voltage drive safety control logic includes at least one of electric drive torque estimation functional safety control logic, electric drive torque accuracy functional safety control logic, electric drive torque direction functional safety control logic, torque allowance signal timeout functional safety control logic, collision functional safety control logic, and active discharge functional safety control logic.

[0020] In one embodiment, the power domain controller further includes an intelligent driving safety control module; the intelligent driving safety control module is used to design intelligent driving function safety control logic, function safety protection thresholds, and safety states after fault triggering, wherein the intelligent driving function safety control logic includes at least one of lane change function safety control logic, parking assist function safety control logic, and automatic parking function safety control logic.

[0021] Secondly, this application also provides a vehicle power control method, which is applied to a power domain controller in a vehicle power control system, wherein the power domain controller is communicatively connected to a sub-controller, and includes:

[0022] The system receives signals from the high-voltage battery, the low-voltage battery, and the power parameters of the charging / discharging circuit from the sub-controller, and sends a functional safety control signal to the sub-controller so that the sub-controller performs safety control functions according to the functional safety control signal.

[0023] The aforementioned vehicle powertrain control system, applied to vehicles, includes a power domain controller. The power domain controller communicates with sub-controllers, receiving signals from the high-voltage battery, low-voltage battery, and electrical parameters of the charging / discharging circuit. It then sends functional safety control signals to the sub-controllers, enabling them to execute safety control functions according to these signals, thus ensuring vehicle functional safety and stability. By separating the signal and parameter acquisition functions of the high-voltage battery, low-voltage battery, and charging / discharging circuit from the functional safety control signal design functions, these functions are executed by different controllers. The design functions of higher-critical parameters are separately assigned and integrated into the power domain controller with a higher functional safety level. Sub-controllers with lower functional safety levels only need to implement the acquisition and execution functions of lower-critical signals. This effectively simplifies the structure of the vehicle powertrain control system, significantly reducing the number and types of chips required, and lowering development difficulty and cost. For functional safety control of different dimensions such as the high-voltage battery, low-voltage battery, and charging / discharging circuit, the functional logic is decomposed according to its importance and impact on vehicle safety, and integrated into chips with corresponding functional safety levels. This effectively reduces the complexity of the control system structure and makes it suitable for more application scenarios. After reading and understanding the accompanying diagrams and detailed descriptions, the other aspects can be understood. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort. The drawings are used to provide a further understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0025] Figure 1 is a schematic diagram of the vehicle power control system in one embodiment.

[0026] Figure 2 is a schematic diagram of the vehicle power control system in another embodiment.

[0027] Figure 3 is a schematic diagram of the vehicle power control system in another embodiment.

[0028] Figure 4 is a schematic diagram of the vehicle power control system in another embodiment.

[0029] Figure 5 is a schematic diagram of the vehicle power control system in another embodiment.

[0030] Figure 6 is a flowchart illustrating a vehicle power control method in one embodiment.

[0031] Figure 7 is a structural block diagram of a vehicle power control device in one embodiment. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0033] To improve vehicle safety and reliability, vehicle controllers require functional safety development based on their functional design, such as vehicle controllers, thermal management system controllers, high-voltage battery management controllers, and low-voltage battery controllers. The development of functional safety requirements and the implementation of functional safety logic for different controllers necessitate the use of controller chips with corresponding functional safety levels.

[0034] To improve vehicle safety and reliability and reduce the serious consequences of vehicle malfunctions, controllers need to be designed and developed with functional safety in mind, based on the functions they perform. However, current functional safety solutions for vehicle powertrain systems primarily target distributed controllers, lacking suitable, highly integrated functional safety solutions for powertrain domain controllers. Functional safety solutions for distributed powertrain domain controllers require each controller to meet specific functional safety requirements. This necessitates the use of MCU (Microcontroller Unit) chips with appropriate or even higher functional safety levels, resulting in a large number and variety of chips, numerous controllers, complex structures, and high costs.

[0035] In an exemplary embodiment, as shown in FIG1, a vehicle powertrain control system 100 is provided for use in a vehicle, the system 100 including a power domain controller 110.

[0036] The power domain controller is communicatively connected to the sub-controller 120. It receives signals from the high-voltage battery, the low-voltage battery, and power parameters of the charging / discharging circuit from the sub-controller, and sends functional safety control signals to the sub-controller, causing the sub-controller to execute safety control functions according to these signals. In some implementations, the functional safety level of the power domain controller is higher than that of the sub-controller. In some embodiments, the power domain controller and the sub-controller have a master-slave collaborative, hierarchical management system architecture. The power domain controller, as the upper-level brain, is responsible for global decision-making, coordination, and resource allocation; while the sub-controller, as the lower-level execution unit, is responsible for receiving instructions and performing precise control of specific functions.

[0037] In some embodiments, functional safety control signals refer to control commands designed to achieve functional safety objectives, ensuring that the vehicle can still enter or maintain an acceptable safety state when a vehicle malfunctions.

[0038] For example, a vehicle powertrain control system is applied to a vehicle, wherein the vehicle powertrain control system is a control system for performing vehicle safety control-related functions and is part of the overall vehicle control system. The vehicle includes a high-voltage battery and a low-voltage battery. In one example, the high-voltage battery is the main power source of the vehicle, providing high-voltage power to the vehicle's control systems, such as high-voltage electric drive control modules, DC-DC modules, electric motors, etc.; the low-voltage battery (e.g., a low-voltage lithium battery) provides low-voltage power to the vehicle powertrain control system.

[0039] In some embodiments, the vehicle also includes a charging / discharging circuit for charging the vehicle's battery and supplying power to external loads. In one example, the charging / discharging circuit may include a battery management system (BMS), an inverter, a DC-DC converter, and a charging module. The BMS monitors the battery status, manages the charging / discharging process, and ensures safety and efficiency. The inverter converts the DC power from the high-voltage battery into AC power required by the external load. The DC-DC converter converts the voltage of the high-voltage battery into the voltage required by the low-voltage battery to power onboard electronic devices. The charging module inputs external power to the high-voltage battery during charging and charges the low-voltage battery when needed.

[0040] In one example, the vehicle powertrain control system includes a sub-controller and a power domain controller, which are communicatively connected. In another example, the sub-controller sends the acquired signals to the power domain controller. The power domain controller receives the signals, generates functional safety control signals, and sends them to the sub-controller, causing the sub-controller to execute safety control functions according to the functional safety control signals.

[0041] In one example, the functional safety control signal may include multiple control signals corresponding to different structures (such as high-voltage battery, low-voltage battery, charging / discharging circuit). The power domain controller sends the functional safety control signal to multiple sub-controllers corresponding to different structures according to the structure corresponding to the control signal.

[0042] Signals from the high-voltage battery include, but are not limited to, the voltage signal, current signal, and temperature signal of the high-voltage battery. Signals from the low-voltage battery include, but are not limited to, the voltage signal, current signal, and temperature signal of the low-voltage battery. Electrical parameters of the charging / discharging circuit include, but are not limited to, charging / discharging voltage, charging / discharging current, temperature of the charging / discharging interface, and status of the charging / discharging relay.

[0043] The vehicle powertrain control system provided in this disclosure is applied to a vehicle and includes a power domain controller. The power domain controller is communicatively connected to sub-controllers and can receive signals from the high-voltage battery, the low-voltage battery, and the power parameters of the charging / discharging circuit. It then sends functional safety control signals to the sub-controllers, enabling them to execute safety control functions according to the received signals, thereby ensuring the functional safety of the vehicle and guaranteeing its safety and stability. The system separates the signal and parameter acquisition functions of the high-voltage battery, low-voltage battery, and charging / discharging circuit from the functional safety control signal design functions, assigning them to different controllers. The design functions of higher-importance parameters are separately assigned and integrated into the power domain controller with a higher functional safety level. The sub-controllers with lower functional safety levels only need to implement the acquisition and execution functions of lower-importance signals. This effectively simplifies the structure of the vehicle powertrain control system, significantly reducing the number and types of chips required, and lowering development difficulty and cost. For functional safety control of different dimensions such as the high-voltage battery, low-voltage battery, and charging / discharging circuit, the functional logic is decomposed according to its importance and impact on vehicle safety, and integrated into chips with corresponding functional safety levels. This effectively reduces the complexity of the control system structure and makes it suitable for more application scenarios.

[0044] In one embodiment, as shown in FIG2, the sub-controller includes a first sub-controller 121 and a second sub-controller 122, wherein the first sub-controller is used to acquire signals from the high-voltage battery; and the second sub-controller is used to acquire signals from the low-voltage battery and acquire power parameters of the charging / discharging circuit.

[0045] Sending the functional safety control signal to the sub-controller includes sending the functional safety control signal to the first sub-controller and the second sub-controller.

[0046] In some embodiments, the vehicle powertrain control system includes a first sub-controller, a second sub-controller, and a power domain controller. The first sub-controller is used to acquire signals from the high-voltage battery, and the second sub-controller is used to acquire signals from the low-voltage battery and power parameters of the charging / discharging circuit. The power domain controller is communicatively connected to the first and second sub-controllers, respectively. In one example, the first and second sub-controllers send the acquired signals to the power domain controller. The power domain controller receives the signals, generates a functional safety control signal, and sends the functional safety control signal to the first and second sub-controllers, causing the first and second sub-controllers to perform safety control functions according to the functional safety control signal.

[0047] In one example, the functional safety control signal may include multiple control signals corresponding to different structures (such as high-voltage battery, low-voltage battery, charging / discharging circuit). The power domain controller sends the functional safety control signal to multiple sub-controllers corresponding to different structures according to the structure corresponding to the control signal.

[0048] In some embodiments, the first sub-controller is electrically connected to the high-voltage battery; the second sub-controller is electrically connected to the low-voltage battery; and the second sub-controller is electrically connected to the charging / discharging circuit.

[0049] In some embodiments, the power domain controller is a chip with a first functional safety level, and the first sub-controller and the second sub-controller are chips with a second functional safety level, wherein the second functional safety level is lower than or equal to the first functional safety level. Exemplarily, the first and second sub-controllers are mainly used for functional safety signal acquisition and execution of functional safety protection mechanisms. The power domain controller integrates high functional safety level control logic, processes functional safety signals, and outputs functional safety control signals corresponding to the functional safety protection mechanism. The power domain controller uses a chip with a higher functional safety level, while the first and second sub-controllers use chips with a lower safety level. Specifically, the power domain controller is a chip with a first functional safety level, and the first and second sub-controllers are chips with a second functional safety level, where the first functional safety level is higher than the second functional safety level. In one example, the power domain controller uses an MCU chip with functional safety level ASIL D (Automotive Safety Integrity Level D), and the first sub-controller and the second sub-controller use MCU chips with functional safety level ASIL B (Automotive Safety Integrity Level B). The power domain controller also includes a power management chip in the system base chip (SBC) with functional safety level ASIL D, which is used to provide low-voltage power supply to the power domain controller. In one example, the power management chip is used to provide low-voltage power supply to the power domain controller that meets the ASIL D level.

[0050] In one embodiment, the power domain controller includes a battery functional safety control module and a circuit safety control module.

[0051] The battery functional safety control module is used to receive signals from the high-voltage battery and the low-voltage battery, and to send battery safety control signals to the first sub-controller and the second sub-controller.

[0052] The circuit safety control module is used to receive the power parameters of the charging / discharging circuit and send the circuit safety control signal to the second sub-controller.

[0053] In some embodiments, the battery functional safety control module is used to receive signals from the high-voltage battery and the low-voltage battery, design battery safety control signals based on the signals from the high-voltage battery and the low-voltage battery, and send the battery safety control signals to the first sub-controller and the second sub-controller; the circuit safety control module is used to receive power parameters of the charging / discharging circuit, design circuit safety control signals based on the power parameters and circuit safety control logic, and send the circuit safety control signals to the second sub-controller.

[0054] For example, in the power domain controller, a battery functional safety control module and a circuit safety control module are respectively provided for the battery and the charging and discharging circuits. In one example, the battery functional safety control module is communicatively connected to both the first sub-controller and the second sub-controller, and the circuit safety control module is communicatively connected to the second sub-controller.

[0055] In some embodiments, the first sub-controller acquires signals from the high-voltage battery and sends them to the battery functional safety control module in the power domain controller, while the second sub-controller acquires signals from the low-voltage battery and sends them to the same module. After receiving the signals from both the high-voltage and low-voltage batteries, the battery functional safety control module designs battery safety control signals. In one example, battery safety control signals for the high-voltage and low-voltage batteries can be designed separately.

[0056] After the battery safety control signals are designed, they are sent to the first sub-controller and the second sub-controller. In one example, the battery safety control signal for the high-voltage battery is sent to the first sub-controller, and the battery safety control signal for the low-voltage battery is sent to the second sub-controller. In one example, the first and second sub-controllers execute the battery safety control function according to the received battery safety control signals. In some embodiments, the battery safety control signals are used to control the operating states of the high-voltage and low-voltage batteries, such as turning on, turning off, discharging, and charging, which can be specifically set according to the actual application scenario.

[0057] In some embodiments, after the second sub-controller acquires the power parameters of the charging / discharging circuit, it sends them to the circuit safety control module in the power domain controller. The circuit safety control module stores circuit safety control logic. In one example, the circuit safety control logic can be configured according to the safety control functions of the vehicle's charging and discharging circuits in the actual application scenario. Based on the acquired power parameters, the circuit safety control module designs circuit safety control signals and sends these signals to the second sub-controller, enabling the second sub-controller to execute the circuit safety control function according to the received signals. In some embodiments, the circuit safety control signals are used to control the operating state of the charging / discharging circuit, such as connection or disconnection, and can be specifically configured according to the actual application scenario.

[0058] In one example, the circuit safety control module includes a charging / discharging circuit safety control module and a DC-DC conversion safety control module. The second sub-controller is further configured to acquire parameters from the DC-DC conversion module and send them to the DC-DC conversion safety control module within the circuit safety control module. The charging / discharging circuit safety control module designs charging / discharging circuit safety control signals based on the power parameters of the charging / discharging circuit, and the DC-DC conversion safety control module designs DC-DC conversion safety control signals based on the parameters of the DC-DC conversion module and sends them to the second sub-controller. In some embodiments, the charging / discharging safety control module may include an OBC (On Board Charge) control module, and the DC-DC conversion safety control module may include a DCDC (On-Board DC / DC Converter) control module, used respectively to design the on-board charger control signals and the on-board DC / DC converter control signals.

[0059] In this embodiment, the power domain controller includes a battery functional safety control module and a circuit safety control module, which generate and send battery safety control signals and circuit safety control signals respectively, thereby distinguishing different functions, effectively improving the effectiveness of safety control, further simplifying the data processing of the first sub-controller and the second sub-controller, and improving the efficiency of safety control.

[0060] In one embodiment, the circuit safety control signal is generated based on circuit safety control logic, which includes at least one of the following: charging overvoltage safety control logic, discharging overvoltage safety control logic, charging port cover overheating safety control logic, overvoltage safety control logic, undervoltage safety control logic, and current backflow prevention safety control logic.

[0061] For example, the circuit safety control logic may include control logic corresponding to one or more safety protection functions.

[0062] In some embodiments, the charging overvoltage safety control logic refers to the system triggering a functional safety protection mechanism to disconnect the charging circuit when the charging voltage exceeds the functional safety threshold during the charging process. The purpose is to prevent battery damage and thermal runaway caused by excessive charging voltage, and to prevent personal injury caused by battery thermal runaway.

[0063] The overvoltage discharge safety control logic refers to the system triggering a functional safety protection mechanism during discharge when the discharge voltage exceeds the functional safety threshold. This disconnects the external discharge circuit, preventing damage to external electrical equipment, vehicles, or personnel due to excessively high external discharge voltage. The overtemperature charging port cover safety control logic refers to the system triggering a functional safety protection mechanism when the charging port temperature exceeds the functional safety threshold. This disables the charging function to prevent fires or personal injury caused by overheating of the charging port.

[0064] The overvoltage safety control logic is a protection mechanism that prevents the low-voltage supply voltage output by the DC-DC voltage conversion module from exceeding the safety threshold. Its purpose is to protect the low-voltage power supply system and its connected ECU (Electronic Control Unit), preventing overvoltage from causing faults in the low-voltage power supply system and ECU, which could lead to the braking, steering and other control systems failing to function properly and causing hazardous events.

[0065] The undervoltage safety control logic refers to the DC-DC low-voltage power supply system disconnecting the low-voltage output when the low-voltage supply voltage output of the DC-DC voltage conversion module falls below a set safety threshold. This prevents the low-voltage battery voltage from being pulled down, affecting the low-voltage battery's ability to provide low-voltage power to the entire vehicle system. This ensures the vehicle can perform appropriate safety controls even with only low-voltage battery power, avoiding potential hazards. The current reverse-current prevention safety control logic prevents current from flowing back from the low-voltage battery to the DC-DC module when a short-circuit fault occurs in the low-voltage output of the DC-DC voltage conversion module, causing undervoltage. If the vehicle's low-voltage power supply is pulled down, multiple functions such as power steering, power brakes, airbags, and lights will malfunction due to the low voltage, potentially leading to rear-end collisions or collisions during nighttime driving.

[0066] In this embodiment, the circuit safety control module stores circuit safety control logic for designing circuit safety control signals. The circuit safety control logic includes at least one of the following: charging overvoltage safety control logic, discharging overvoltage safety control logic, charging port cover overtemperature safety control logic, overvoltage safety control logic, undervoltage safety control logic, and current reverse current protection safety control logic. This enables the implementation of charging overvoltage safety protection, discharging overvoltage safety protection, charging port cover overtemperature safety protection, overvoltage safety protection, undervoltage safety protection, and current reverse current protection safety protection through communication interaction with the second sub-controller. While simplifying the safety control structure of the charging / discharging circuit, this effectively ensures the safety and reliability of the charging / discharging circuit.

[0067] In one embodiment, the battery functional safety control module includes a high-voltage battery control module and a low-voltage battery control module. The high-voltage battery control module is communicatively connected to the first sub-controller and is used to receive signals from the high-voltage battery and send high-voltage battery functional safety control signals to the first sub-controller; the low-voltage battery control module is communicatively connected to the second sub-controller and is used to receive signals from the low-voltage battery and send low-voltage battery power supply control signals to the second sub-controller.

[0068] In some embodiments, the battery functional safety control module includes a high-voltage battery control module and a low-voltage battery control module. The high-voltage battery control module is communicatively connected to the first sub-controller, and is used to receive sampling signals from the high-voltage battery, generate a high-voltage battery functional safety control signal based on the sampling signals and high-voltage battery safety control logic, and send the high-voltage battery functional safety control signal to the first sub-controller. The low-voltage battery control module is communicatively connected to the second sub-controller, and is used to receive sampling signals from the low-voltage battery, generate a low-voltage battery power supply functional safety control signal based on the sampling signals and low-voltage battery safety control logic, and send the low-voltage battery power supply functional safety control signal to the second sub-controller.

[0069] For example, the battery functional safety control module is further divided into a high-voltage battery control module and a low-voltage battery control module, wherein the high-voltage battery safety control module is communicatively connected to the first sub-controller, and the low-voltage battery safety control module is communicatively connected to the second sub-controller.

[0070] In one example, the high-voltage battery safety control module receives sampling signals from the high-voltage battery and designs high-voltage battery functional safety protection logic and fault triggering mechanisms based on the technical safety requirements of the high-voltage battery. It then sends high-voltage battery functional safety control signals to the first sub-controller, causing the first sub-controller to execute the high-voltage battery functional safety control functions according to these signals. The high-voltage battery safety control logic is designed based on the actual application scenario, actual battery parameters, and the actual vehicle operating voltage, current, and temperature range, and may include one or more control logics.

[0071] In one example, the low-voltage battery control module receives sampling signals from the low-voltage battery and designs low-voltage battery safety protection logic and fault triggering mechanisms based on the technical safety requirements of the low-voltage battery. It then sends low-voltage battery power supply function safety control signals to the second sub-controller, enabling the second sub-controller to execute the low-voltage battery power supply control function according to the low-voltage battery power supply safety mechanism. The low-voltage battery safety control logic is designed and calibrated based on the technical safety requirements obtained from the overall vehicle low-voltage power supply function safety analysis and the parameters of the low-voltage battery used, and may include one or more control logics.

[0072] In this embodiment, the battery functional safety control module includes a high-voltage battery control module and a low-voltage battery control module, which respectively store high-voltage battery safety control logic and low-voltage battery safety control logic. These logics are used to generate high-voltage battery functional safety control signals and low-voltage battery power supply control signals, and to send the functional safety control signals to the first sub-controller corresponding to the high-voltage battery and the second sub-controller corresponding to the low-voltage battery, respectively. This further simplifies the data processing of the first and second sub-controllers, effectively improves the effectiveness of safety control, and enhances safety control efficiency.

[0073] In one embodiment, the second sub-controller is further configured to collect temperature data of the hot and cold circuits in the vehicle and send the temperature data to the power domain controller; the power domain controller further includes a thermal management safety control module, which is communicatively connected to the second sub-controller and is configured to receive the temperature data and send hot and cold circuit safety control signals to the second sub-controller.

[0074] In some embodiments, the second sub-controller is further configured to acquire temperature data of the hot and cold circuits and send the temperature data to the power domain controller; the power domain controller further includes a thermal management safety control module, which is communicatively connected to the second sub-controller, and is configured to receive the temperature data, generate a hot and cold circuit safety control signal based on the temperature data and thermal management safety control logic, and send the hot and cold circuit safety control signal to the second sub-controller.

[0075] For example, the vehicle also includes a hot and cold circuit for thermal management. The second sub-controller is electrically connected to the hot and cold circuit to collect temperature data from the circuit and send it to the power domain controller. The power domain controller also includes a thermal management safety control module, which is communicatively connected to the second sub-controller. This module stores thermal management safety control logic to generate a hot and cold circuit safety control signal based on the received temperature data and sends it to the second sub-controller, causing the second sub-controller to execute the hot and cold circuit safety control function according to the received signal.

[0076] In one example, the temperature data for the hot and cold circuits may include, but are not limited to, the temperature of the coolant and the temperature of the battery, and can be designed according to the actual application scenario and battery temperature parameters.

[0077] In this embodiment, the power domain controller further includes a thermal management safety control module, which receives temperature data of the hot and cold circuits sent by the second sub-controller, generates a thermal management functional safety control mechanism based on the temperature data and thermal management safety control logic, obtains corresponding hot and cold circuit safety control signals, and sends them to the second sub-controller. This enables the second sub-controller to execute safety control functions according to the thermal management functional safety control mechanism, thereby realizing the safety control of vehicle thermal management, further improving vehicle safety and reliability. Furthermore, by dividing the thermal management safety control between the second sub-controller and the power domain controller, the complexity of the vehicle power control system is reduced while ensuring the realization of vehicle functional safety control.

[0078] In one embodiment, the high-voltage battery functional safety control signal is generated based on high-voltage battery safety control logic, which includes at least one of collision safety control logic, first cell overvoltage safety control logic, first cell undervoltage safety control logic, first cell overtemperature safety control logic, charging / discharging overcurrent safety control logic, relay status detection safety control logic, and stop heating request safety control logic.

[0079] The low-voltage battery power supply control signal is generated based on the low-voltage battery safety control logic, which includes at least one of the following: second cell overvoltage safety control logic, second cell undervoltage safety control logic, second cell overtemperature safety control logic, and short circuit protection safety control logic.

[0080] In some embodiments, the collision safety control logic in the high-voltage battery safety control logic is used to detect the state of the battery in a collision accident and provide a reliable functional safety protection mechanism. The purpose is to enable the battery management system to quickly cut off the high-voltage power supply when a vehicle collision occurs, so as to avoid dangerous events such as high-voltage electric shock, battery short circuit and fire, protect passenger safety and avoid secondary injuries.

[0081] The first cell overvoltage safety control logic is used to monitor the voltage of individual battery cells. When the cell voltage exceeds the functional safety threshold, the functional safety protection mechanism is triggered. The purpose is to prevent battery damage and thermal runaway caused by cell overvoltage, and to prevent personal injury caused by battery thermal runaway.

[0082] The first cell undervoltage safety control logic is used to monitor the voltage of individual battery cells. When the cell voltage is lower than the safety threshold, the functional safety protection mechanism is triggered. The purpose is to prevent the battery from being damaged by undervoltage due to over-discharge and to prevent battery thermal runaway, thus preventing personal injury caused by battery thermal runaway.

[0083] The first cell over-temperature safety control logic is used to monitor the temperature of the individual battery cells. When the temperature exceeds the set functional safety threshold, the functional safety protection mechanism is triggered. The purpose is to prevent battery damage and thermal runaway caused by overheating, and to prevent personal injury caused by thermal runaway.

[0084] The charging / discharging overcurrent safety control logic is used to monitor the current during the charging / discharging process. When the current exceeds the functional safety threshold, the functional safety protection mechanism is triggered to prevent battery damage and thermal runaway caused by overcurrent, and to prevent personal injury caused by battery thermal runaway.

[0085] The relay status detection safety control logic is used to monitor the status of relays in the battery management system to ensure their normal operation. The purpose is to monitor the relay status in real time to ensure that the relay can be reliably disconnected, and to prevent high-voltage electric shock or battery thermal runaway risks caused by the functional safety protection mechanism failing to reliably shut off the high-voltage battery due to relay failure.

[0086] The heating stop request safety control logic is used to monitor the battery temperature status. When the temperature exceeds the functional safety protection threshold, the functional safety protection mechanism is triggered, and a heating stop request is issued. The purpose is to prevent battery damage and thermal runaway caused by excessive battery temperature, and to prevent personal injury caused by battery thermal runaway.

[0087] In some embodiments, the low-voltage battery safety control logic includes a second cell overvoltage safety control logic that monitors the voltage of the low-voltage lithium battery cell. When the voltage exceeds the functional safety threshold, a functional safety protection mechanism is triggered to disconnect the low-voltage lithium battery voltage output, preventing damage to the vehicle ECU due to low-voltage overvoltage. The second cell undervoltage safety control logic also monitors the low-voltage battery cell voltage. When the voltage falls below the functional safety threshold, a functional safety protection mechanism is triggered, reporting an undervoltage fault and alerting the driver to pull over, preventing a sudden drop in low-voltage battery voltage from causing malfunctions in the vehicle's braking and steering systems, thus preventing potential hazards.

[0088] The second cell over-temperature safety control logic is used to monitor the temperature of the low-voltage lithium battery cell. When the temperature exceeds the functional safety protection threshold, the functional safety protection mechanism is triggered to prevent battery damage and thermal runaway caused by overheating of the low-voltage battery.

[0089] The short-circuit protection safety control logic is used to detect whether a short circuit occurs in the battery circuit. When the short circuit exceeds the functional safety protection threshold, the functional safety protection mechanism is triggered, disconnecting the low-voltage battery power supply. This prevents the low-voltage output voltage of the DC-DC module and other ECUs from dropping when a short circuit occurs in the low-voltage battery, thus preventing a sudden drop in the low-voltage power supply voltage from causing the vehicle's braking and steering systems to malfunction and resulting in a hazardous event. In this embodiment, the high-voltage battery safety control logic includes at least one of the following: collision safety control logic, first cell overvoltage safety control logic, first cell undervoltage safety control logic, first cell overtemperature safety control logic, charging / discharging overcurrent safety control logic, relay status detection safety control logic, and heating stop request safety control logic. This allows for the implementation of collision safety protection, first cell overvoltage safety protection, first cell undervoltage safety protection, first cell overtemperature safety protection, charging / discharging overcurrent safety protection, relay status detection safety protection, and heating stop through communication with the first sub-controller. The system requests safety protection, which simplifies the safety control structure of the high-voltage battery while effectively ensuring its safety and reliability. The low-voltage battery safety control logic includes at least one of the following: second cell overvoltage safety control logic, second cell undervoltage safety control logic, second cell overtemperature safety control logic, and short-circuit protection safety control logic. This allows for the implementation of cell overvoltage safety protection, cell undervoltage safety protection, cell overtemperature safety protection, and short-circuit protection through communication with the second sub-controller. This simplifies the safety control structure of the low-voltage battery while effectively ensuring its safety and reliability.

[0090] In one embodiment, the first cell overvoltage safety control logic includes: when the high-voltage battery signal includes a first cell sampling voltage, in response to the first cell sampling voltage being greater than a first preset overvoltage threshold, generating a high-voltage battery functional safety control signal matching the first cell overvoltage safety control logic; and / or, when the high-voltage battery signal includes a hardware overvoltage comparison signal, when the hardware overvoltage comparison signal meets a preset overvoltage condition, generating a high-voltage battery functional safety control signal matching the first cell overvoltage safety control logic.

[0091] The first cell undervoltage safety control logic includes: when the high-voltage battery signal includes a first cell sampling voltage, in response to the first cell sampling voltage being less than a first preset undervoltage threshold, generating a high-voltage battery functional safety control signal that matches the first cell undervoltage safety control logic; and / or, when the high-voltage battery signal includes a hardware undervoltage comparison signal, when the hardware undervoltage comparison signal meets a preset undervoltage condition, generating a high-voltage battery functional safety control signal that matches the first cell undervoltage safety control logic.

[0092] Figure 3 is a schematic diagram of a vehicle powertrain control system according to an exemplary embodiment. Exemplarily, when the high-voltage battery signal sent by the first sub-controller includes the sampling voltage of the first cell of the high-voltage battery, the sampling voltage of the first cell is judged. If the sampling voltage of the first cell is greater than a first preset overvoltage threshold, it can be considered that the high-voltage battery has an overvoltage risk. Therefore, a high-voltage battery functional safety control signal matching the overvoltage safety control logic of the first cell is generated. In one example, the first sub-controller sends the sampling voltage of the first cell to the high-voltage battery control module via E2E CAN communication; the power domain controller MCU control chip sends the high-voltage battery functional safety control signal to the first sub-controller within the FTTI (First Time To Interrupt) time.

[0093] For example, when the high-voltage battery signal sent by the first sub-controller includes a hardware overvoltage comparison signal, the hardware overvoltage comparison signal is judged. If the hardware overvoltage signal meets a preset overvoltage condition, it can be considered that the high-voltage battery is at risk of overvoltage. Therefore, a high-voltage battery functional safety control signal matching the first cell overvoltage safety control logic is generated. In one example, the preset overvoltage condition can be that the hardware overvoltage signal is a voltage greater than a first reference signal. The first reference signal can be determined based on the battery overvoltage condition and can be a large voltage signal. In one example, the first sub-controller sends the hardware overvoltage comparison signal to the high-voltage battery control module via E2E CAN communication; the power domain controller MCU control chip sends the high-voltage battery functional safety control signal to the first sub-controller within the FTTI (First Time To Interrupt) time.

[0094] For example, when the high-voltage battery signal sent by the first sub-controller includes the sampling voltage of the first cell of the high-voltage battery, the sampling voltage of the first cell is judged. If the sampling voltage of the first cell is less than a first preset undervoltage threshold, it can be considered that the high-voltage battery is at risk of undervoltage. Therefore, a high-voltage battery functional safety control signal matching the undervoltage safety control logic of the first cell is generated. In one example, the first sub-controller sends the sampling voltage of the first cell to the high-voltage battery control module via E2E CAN communication; the power domain controller MCU control chip sends the high-voltage battery functional safety control signal to the first sub-controller within the FTTI (First Time To Interrupt) time.

[0095] For example, when the high-voltage battery signal sent by the first sub-controller includes a hardware undervoltage comparison signal, the hardware undervoltage comparison signal is judged. If the hardware undervoltage signal meets a preset undervoltage condition, it can be considered that the high-voltage battery is at risk of undervoltage. Therefore, a high-voltage battery functional safety control signal matching the first cell undervoltage safety control logic is generated. In one example, the preset undervoltage condition can be that the voltage of the hardware undervoltage signal is less than a second reference signal. The second reference signal can be determined based on the battery undervoltage condition and can be a small voltage signal. In one example, the first sub-controller sends the hardware undervoltage comparison signal to the high-voltage battery control module via E2E CAN communication; the power domain controller MCU control chip sends the high-voltage battery functional safety control signal to the first sub-controller within the FTTI (First Time To Interrupt) time.

[0096] In this embodiment, the power domain controller performs verification and comparison by receiving the first cell sampling voltage, hardware overvoltage comparison signal, and hardware undervoltage comparison signal, thereby enabling rapid and accurate judgment of undervoltage and overvoltage of the high-voltage battery, effectively ensuring the safety and reliability of the high-voltage battery.

[0097] In one embodiment, the sampling voltage of the first battery cell is obtained by the following method.

[0098] The first sub-controller obtains the sampling voltage of the first cell through the voltage sampling circuit corresponding to the high-voltage battery.

[0099] For example, the first cell sampling voltage can be obtained directly through a voltage sampling circuit, or it can be obtained indirectly by processing the first cell sampling current collected by the voltage sampling circuit.

[0100] In some embodiments, the sampling current of the first cell can be directly sent to the high-voltage battery control module. The high-voltage battery control module determines whether there is an overcurrent based on the sampling current of the first cell, thereby determining whether there is an overvoltage risk in the high-voltage battery. The specific method can be determined according to the actual application scenario.

[0101] In this embodiment, the corresponding signal is obtained through the sampling circuit corresponding to the high-voltage battery, thereby enabling real-time and accurate judgment of the high-voltage battery status. The judgment method is easy to implement and applicable to more application scenarios.

[0102] In one embodiment, the second cell overvoltage safety control logic includes: when the low-voltage battery signal includes a second sampling voltage, in response to the second sampling voltage being greater than a second preset overvoltage threshold, generating a low-voltage battery power supply control signal matching the second cell overvoltage safety control logic; the second cell undervoltage safety control logic includes: when the low-voltage battery signal includes a second sampling voltage, in response to the second sampling voltage being less than a second preset undervoltage threshold, generating a low-voltage battery power supply control signal matching the second cell undervoltage safety control logic.

[0103] For example, when the low-voltage battery signal includes a second sampled voltage of the low-voltage battery, the second sampled voltage is judged. If the second sampled voltage is greater than a second preset overvoltage threshold, it can be considered that the low-voltage battery has an overvoltage risk. Therefore, a low-voltage battery power supply control signal matching the overvoltage safety control logic of the second cell is generated. In one example, the second sub-controller sends the second sampled voltage to the low-voltage battery control module via E2E CAN communication; the power domain controller MCU control chip sends the low-voltage battery power supply control signal to the second sub-controller within the FTTI (First Time To Interrupt) time.

[0104] For example, when the low-voltage battery signal includes a second sampled voltage of the low-voltage battery, the second sampled voltage is judged. If the second sampled voltage is less than a second preset undervoltage threshold, it can be considered that the low-voltage battery is at risk of undervoltage. Therefore, a low-voltage battery power supply control signal matching the undervoltage safety control logic of the second cell is generated. In one example, the second sub-controller sends the second sampled voltage to the low-voltage battery control module via E2E CAN communication; the power domain controller MCU control chip sends the low-voltage battery power supply control signal to the second sub-controller within the FTTI (First Time To Interrupt) time.

[0105] In this embodiment of the disclosure, the power domain controller can quickly and accurately determine the undervoltage or overvoltage of the low-voltage battery by verifying and comparing the received second sample voltage, thereby effectively ensuring the safety and reliability of the low-voltage battery.

[0106] Figure 4 is a schematic diagram of a vehicle power control system according to an exemplary embodiment. In one embodiment, when the second sampling voltage includes the low-voltage battery voltage, after generating the low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic / second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the power supply relay of the low-voltage battery.

[0107] In one example, the power domain controller also includes a low-voltage power management module (i.e., a low-voltage lithium battery management module & OBC & DC-DC control module). Exemplarily, the second sampled voltage includes the low-voltage battery voltage, which can be acquired by a low-voltage lithium battery voltage sampling circuit. This circuit sends the sampled voltage to the MCU chip of the low-voltage power management module via an AD port. The chip first verifies and performs overvoltage comparison on the two sampled voltages, and simultaneously sends the sampled voltage to the power domain controller via E2E CAN communication. The power domain control chip verifies the voltage sampling signal and performs overvoltage and undervoltage comparisons. In the MCU of the low-voltage power management module, the sampled voltage is verified and compared with overvoltage and undervoltage thresholds. If the sampled voltage triggers the overvoltage or undervoltage threshold, the MCU of the low-voltage power management module enters a safe state by disconnecting the low-voltage lithium battery power supply relay. After receiving the sampled signal through E2E CAN communication, the MCU chip of the power domain controller verifies the sampled voltage and compares it with the overvoltage and undervoltage thresholds within the FDTI time. If a fault is detected, the MCU control chip of the power domain controller sends a functional safety state control signal (low-voltage battery safety control signal) to the low-voltage power management module within the FRTI time, controlling the low-voltage lithium battery power supply relay to disconnect and put the vehicle into a safe state.

[0108] In some examples, where the second sampling voltage includes a low-voltage output voltage, after generating the low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic / second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller shuts down the DC-DC converter module corresponding to the low-voltage battery.

[0109] In one example, the power domain controller also includes a low-voltage power management module (i.e., a low-voltage lithium battery management module, OBC, and DC-DC control module). Exemplarily, the second sampled voltage includes a low-voltage output voltage, which can be obtained through a DC-DC converter (DCDC) low-voltage output voltage sampling circuit. The DCDC low-voltage output voltage sampling circuit sends the sampled voltage to the MCU chip of the low-voltage power management module via an AD sampling interface. The chip first verifies and performs overvoltage comparisons on the three sampled voltages, and simultaneously sends the sampled voltages to the power domain controller via E2E CAN communication. The power domain control chip verifies the voltage sampled signal and performs overvoltage and undervoltage comparisons. In the MCU of the low-voltage power management module, the sampled voltage is verified and compared with overvoltage and undervoltage thresholds. If the sampled voltage triggers the overvoltage or undervoltage threshold, the MCU of the low-voltage power management module enters a safe state by disconnecting the power supply of the DC-DC converter (i.e., the DC-DC conversion module) and disconnecting the output of the DC-DC converter. After receiving the sampled signal through E2E CAN communication, the MCU control chip of the power domain controller verifies the sampled voltage and compares it with the overvoltage and undervoltage thresholds within the FDTI time. If a fault is detected, a functional safety status control signal is sent to the functional safety execution module of the low-voltage power management module within the FRTI time, disconnecting the low-voltage output voltage (i.e. turning off the DC-DC conversion module corresponding to the low-voltage battery) and entering a safe state.

[0110] In some examples, where the second sampling voltage includes a high voltage, after generating the low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the charging relay corresponding to the low-voltage battery; after generating the low-voltage battery power supply control signal that matches the second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the discharging relay corresponding to the low-voltage battery.

[0111] In one example, the power domain controller also includes a low-voltage power management module (i.e., a low-voltage lithium battery management module & OBC & DC-DC control module). Exemplarily, the second sampling voltage includes a high-voltage voltage.

[0112] In one example, the high-voltage voltage may include, but is not limited to, high-voltage DC input voltage, high-voltage DC output voltage, high-voltage AC input voltage, and high-voltage AC output voltage. Specifically, the high-voltage DC input voltage can be obtained through a high-voltage DC input voltage sampling circuit, the high-voltage DC output voltage can be obtained through a high-voltage DC output voltage sampling circuit, the high-voltage AC input voltage can be obtained through a high-voltage AC input voltage sampling circuit, and the high-voltage AC output voltage can be obtained through a high-voltage AC output voltage sampling circuit.

[0113] For example, the high-voltage DC input voltage sampling circuit connects the sampled voltage to the MCU chip of the low-voltage power management module via an AD sampling interface. The MCU of the low-voltage power management module verifies the sampled voltage and compares it with an overvoltage threshold. If the sampled voltage exceeds the overvoltage protection threshold, an overvoltage protection fault is triggered, and the MCU sends a logic to disconnect the charging relay, thus disconnecting the charging relay and entering a safe state. Similarly, the high-voltage DC output voltage sampling circuit connects the sampled voltage to the MCU chip of the low-voltage power management module via an AD sampling interface. The MCU of the low-voltage power management module verifies the sampled voltage and compares it with an overvoltage threshold. If the sampled voltage exceeds the overvoltage protection threshold, an overvoltage protection fault is triggered, and the MCU sends a logic to disconnect the discharge relay, thus disconnecting the discharge relay and entering a safe state. The high-voltage AC input voltage sampling circuit connects the sampled voltage to the MCU chip of the low-voltage power management module via the AD sampling interface. The MCU of the low-voltage power management module verifies the sampled voltage and compares it with an overvoltage threshold. If the sampled voltage exceeds the overvoltage protection threshold, an overvoltage protection fault is triggered, and the MCU sends a disconnect logic to the charging relay, disconnecting the charging relay and entering a safe state. Similarly, the high-voltage AC output voltage sampling circuit connects the sampled voltage to the MCU chip of the low-voltage power management module via the AD sampling interface. The MCU of the low-voltage power management module verifies the sampled voltage and compares it with an overvoltage threshold. If the sampled voltage exceeds the overvoltage protection threshold, an overvoltage protection fault is triggered, and the MCU sends a disconnect logic to the discharge relay, disconnecting the discharge relay and entering a safe state.

[0114] This embodiment of the disclosure obtains different types of sampling voltages through different sampling circuits, thereby enabling accurate judgment of the low-voltage battery status through multi-angle data. This allows for accurate safety protection of the low-voltage battery in subsequent processes, ensuring vehicle safety and making it applicable to more application scenarios.

[0115] In one embodiment, the power domain controller further includes an intelligent driving safety control module and a motor functional safety control module, wherein the motor functional safety control module includes a torque management functional safety control module and a high-voltage drive safety control module.

[0116] For example, the power domain controller is also used to perform intelligent driving safety control and motor function safety control. The power domain controller is provided with an intelligent driving safety control module and a motor function safety control module. The motor function safety control module includes a torque management function safety control module and a high-voltage drive safety control module, which are used to perform vehicle motor torque management function safety control and high-voltage drive safety control functions.

[0117] In this embodiment, the power domain controller further includes an intelligent driving safety control module and a motor functional safety control module. The motor functional safety control module includes a torque management functional safety control module and a high-voltage drive safety control module. Thus, the power domain controller can realize intelligent driving safety protection, motor torque management safety protection, and high-voltage drive safety protection, ensuring the safety and reliability of vehicle power and intelligent control, and is suitable for more application scenarios.

[0118] In one embodiment, the torque management function safety control module designs torque safety control logic according to the safety requirements of torque safety control technology. The torque safety control logic includes at least one of torque allowance function safety control logic, actual torque estimation function safety control logic, and torque request function safety control logic.

[0119] For example, the torque safety control logic of the torque management function safety control module is designed and calibrated based on the safety requirements of torque safety control technology obtained from the functional safety analysis of the torque control function and the actual parameters of the vehicle. The torque safety control logic may include one or more safety control logics.

[0120] In some embodiments, the torque-permissible functional safety control logic refers to being developed according to ASIL C or ASIL D functional safety levels based on factors such as vehicle status, environmental factors, accelerator pedal, chassis braking torque request, and driving mode. It monitors the actual output torque of the motor and triggers functional safety protection logic when the actual output torque exceeds the torque-permissible functional safety threshold. This ensures the vehicle's driving safety and stability and prevents unexpected acceleration or deceleration caused by unexpected torque output, which could lead to accidents such as pedestrian collisions, rear-end collisions, or vehicle instability.

[0121] The actual torque estimation function safety control logic is responsible for estimating the actual output torque of the electric motor or engine and sending the actual torque signal to the torque allowance control logic. When the actual torque estimation or output is incorrect, the function safety protection mechanism is triggered to prevent the vehicle from accelerating unexpectedly and causing dangerous events such as collisions with pedestrians or rear-end collisions.

[0122] Torque request functional safety control logic refers to accepting torque requests from the driver or autonomous driving system and converting these requests into output commands from the electric motor or engine. Its purpose is to handle torque requests generated by the driver's acceleration, deceleration, steering, and other operations. The torque request control logic needs to be developed in accordance with ASIL B or higher functional safety levels to ensure that torque requests are safe and reliable, and to prevent excessive or insufficient torque requests from causing unexpected acceleration or deceleration of the vehicle, which could lead to collisions or instability and other hazardous events.

[0123] In this embodiment of the disclosure, the torque safety control logic of the torque management safety control module includes at least one of the following: torque allowable function safety control logic, actual torque estimation function safety control logic, and torque request function safety control logic. This enables the implementation of torque allowable function safety protection, actual torque estimation function safety protection, and torque request function safety protection, thereby preventing the vehicle from experiencing unexpected acceleration or deceleration that could lead to collisions, rear-end collisions, or instability, and effectively ensuring the safety and reliability of the vehicle's torque.

[0124] In one embodiment, high-voltage drive safety control logic is designed according to the high-voltage drive safety technology requirements. The high-voltage drive safety control logic includes at least one of the following: electric drive torque estimation function safety control logic, electric drive torque accuracy function safety control logic, electric drive torque direction function safety control logic, torque allowable signal timeout function safety control logic, collision function safety control logic, and active discharge function safety control logic.

[0125] For example, the high-voltage drive safety control logic of the high-voltage drive safety control module is designed and calibrated based on the technical safety requirements obtained from functional safety analysis of the high-voltage drive function and the actual parameters of the vehicle. The high-voltage drive safety control logic may include one or more safety control logics.

[0126] In some embodiments, in the high-voltage drive safety control logic, the electric drive torque estimation function safety control logic estimates the torque output of the motor at the functional safety layer. It can monitor the motor output torque based on various input signals, such as current, voltage, motor speed, and motor parameters, to ensure the reliability of the actual output torque, avoid functional failures that could lead to unexpected acceleration, deceleration, or vehicle instability, and improve the stability and control accuracy of the system.

[0127] The electric drive torque accuracy function safety control logic is used to monitor and correct the torque output of the electric drive system to ensure that it is within the specified accuracy range. The purpose is to ensure that the output torque of the motor matches the expectation in order to provide a good driving experience. Through real-time correction and feedback, the system can respond quickly and accurately to the needs of different operating conditions, avoid the dangers of unexpected acceleration, deceleration or vehicle instability caused by functional failure, and improve the safety and reliability of the system.

[0128] The electric drive torque direction function safety control logic is used to detect and control the torque direction of the electric drive system to ensure that the output torque meets the vehicle's motion requirements (such as acceleration, braking, etc.) and that the torque output direction is consistent with the driver's expected direction, thereby avoiding dangerous events such as vehicle collisions or collisions with pedestrians due to unintended driving directions.

[0129] The torque allowance signal timeout function safety control logic is used to monitor and receive the torque allowance signal from the vehicle control module. If the torque allowance signal is not received within the specified time, the system triggers the function safety protection mechanism through timeout control to avoid harmful events such as unexpected acceleration caused by system failure or communication problems, and to ensure driving safety.

[0130] The collision safety control logic is used to monitor vehicle collision signals and trigger the functional safety protection mechanism when a collision is detected. This reduces the torque output of the electric motor and performs active discharge, reduces the high voltage distribution of the entire vehicle, prevents the risk of electric shock, fire or explosion, improves the system's safety management capabilities in fault conditions, and ensures the safety of the vehicle and its occupants.

[0131] The active discharge function safety control logic is used to disconnect the high-voltage battery main relay under specific conditions (such as collision, system failure, etc.) to perform high-voltage active discharge, thereby reducing system energy and minimizing potential dangers. The purpose is to quickly disconnect the high-voltage battery power supply in the event of an accident or failure, rapidly discharge the residual high-voltage charge, reduce the high-voltage distribution throughout the vehicle, prevent the risk of electric shock, fire or explosion, improve the system's safety management capabilities in fault conditions, and ensure the safety of the vehicle and its occupants.

[0132] In this embodiment, the high-voltage drive safety control module stores high-voltage drive safety control logic, which is used to design high-voltage drive control signals and execute safety control functions according to the high-voltage control signals. The high-voltage drive safety control logic includes at least one of the following: electric drive torque estimation function safety control logic, electric drive torque accuracy function safety control logic, electric drive torque direction function safety control logic, torque allowance signal timeout function safety control logic, collision function safety control logic, and active discharge function safety control logic. This enables the implementation of electric drive torque estimation function safety protection, electric drive torque accuracy function safety protection, electric drive torque direction function safety protection, torque allowance signal timeout function safety protection, collision function safety protection, and active discharge function safety protection, effectively ensuring the safety and reliability of the vehicle's high-voltage drive.

[0133] In one embodiment, the intelligent driving safety control module is used to design an intelligent driving control protection mechanism according to intelligent driving safety control logic, wherein the intelligent driving safety control logic includes at least one of lane change function safety control logic, parking assist function safety control logic, and automatic parking function safety control logic.

[0134] For example, the intelligent driving function safety control module stores intelligent driving safety control logic for designing intelligent driving control protection mechanisms. In one example, the intelligent driving safety control logic is designed and calibrated based on the technical safety requirements obtained from the functional safety analysis of the vehicle's intelligent driving functions and the actual parameters of the vehicle. The intelligent driving safety control logic may include one or more safety control logics.

[0135] In some embodiments, the lane change function safety control logic in intelligent driving safety control logic refers to the safety management logic for executing vehicle lane change operations. This logic, based on lane change function safety requirements analysis, designs functional safety control logic and protection mechanisms within an autonomous or assisted driving system. It monitors the surrounding environment in real time, assesses the safety of lane changes, and executes lane change commands under appropriate conditions. This includes safety monitoring to detect surrounding vehicles, pedestrians, or other obstacles to ensure there is no danger during lane changes; decision support to determine whether to allow lane change operations based on real-time environmental conditions and vehicle dynamics; and triggering functional safety protection mechanisms in case of function failure to prevent collisions or other hazardous events caused by unintended lane changes due to lane change function failure.

[0136] The parking assist function's safety control logic supports the driver's operation while parking, providing real-time guidance with the help of sensors and corresponding algorithms to help the driver safely park the vehicle in the designated location. Its objectives include environmental perception, collecting data on the surrounding environment through sensors to monitor nearby obstacles and available parking spaces in real time; assisted guidance, providing visual or auditory cues to guide the driver on how to perform parking operations, reducing human error; and triggering a functional safety protection mechanism in the event of a function failure to prevent dangerous events such as collisions caused by parking assist function malfunction.

[0137] The automatic parking function's safety control logic enables the vehicle to automatically complete parking operations without driver intervention. The system comprehensively perceives the surrounding environment, identifies parking spaces, and controls the vehicle to perform the parking operation. The goals include: full automation, eliminating the need for driver control; the system autonomously executes parking actions based on environmental information, reducing the risks associated with human-machine interaction; precise control, using high-precision perception and control algorithms to ensure the vehicle accurately and safely parks itself; and triggering a functional safety protection mechanism in case of function failure to prevent collisions or other hazardous events caused by automatic parking failure.

[0138] In this embodiment, the intelligent driving safety control module is designed and calibrated based on the technical safety requirements obtained from the functional safety analysis of the intelligent driving function and the actual parameters of the vehicle. The intelligent driving safety control logic includes at least one of lane change function safety control logic, parking assistance function safety control logic, and automatic parking function safety control logic, thereby enabling lane change function safety protection, parking assistance function safety protection, and automatic parking function safety protection, effectively ensuring the safety and reliability of intelligent driving of the vehicle.

[0139] Figure 5 is a schematic diagram of a vehicle powertrain control system according to an exemplary embodiment. Referring to Figure 5, the powertrain domain controller includes torque management function safety control logic (corresponding to torque safety control logic, set in the torque management safety control module), high-voltage drive system function safety control logic (corresponding to high-voltage drive safety control logic, set in the high-voltage drive safety control module), intelligent driving function safety control logic (corresponding to intelligent driving safety control logic, set in the intelligent driving safety control module), low-voltage lithium battery power supply function safety control logic (corresponding to low-voltage battery safety control logic, set in the low-voltage battery control module), OBC and DC-DC function safety control logic (corresponding to circuit safety control logic, set in the circuit safety control module), high-voltage battery management function safety control logic (corresponding to high-voltage battery safety control logic, set in the high-voltage battery control module), and thermal management function safety control logic (corresponding to thermal management safety control logic, set in the thermal management safety control module). The vehicle powertrain control system is communicatively connected to the motor, the first sub-controller, and the second sub-controller. The first sub-controller includes a high-voltage battery management and thermal management control module, which includes a high-voltage battery voltage, current, and temperature sampling and execution module, high-voltage battery function control logic, and thermal management system function control logic. The second sub-controller includes a low-voltage battery management module, an OBC control module, and a DC-DC control module, which includes a low-voltage functional safety sampling and execution module, low-voltage lithium battery function control logic, OBC function control logic, and DC-DC function control logic.

[0140] The power domain controller uses a functional safety MCU chip and power management chip that meet ASIL D standards. The first sub-controller and the second sub-controller use functional safety chips that meet ASIL B standards as sampling inputs and actuators for the functional safety control logic of the power domain controller. They also transmit and verify signals with the power domain controller via CAN signals.

[0141] In some embodiments, the high-voltage battery control module and the thermal management control module employ an ASIL B-compliant functional safety MCU control chip to sample the high-voltage battery voltage, current, and temperature, and detect the coolant temperature. They transmit signals to the power domain controller via CAN communication and execute the power domain controller's functional safety control logic. Specifically, the high-voltage battery control module is responsible for acquiring the voltage, current, and temperature signals of the high-voltage battery and sending these signals to the power domain controller for processing. The power domain controller performs functional and functional safety control based on the input voltage, current, and temperature signals, and the high-voltage battery control module executes the control logic from the power domain controller. The thermal management control module is responsible for coolant temperature detection, coolant heating, and switching between cooling and heating circuits. It transmits the detection signals to the power domain controller, which performs functional and functional safety control based on the input coolant temperature, and the thermal management control module executes the functional safety control logic from the power domain controller.

[0142] The low-voltage lithium battery control module, OBC control module, and DCDC control module are integrated using a functional safety MCU control chip that meets ASIL B standards. This chip is responsible for acquiring relevant signals within the integrated module, transmitting signals to the power domain controller, and executing functional safety control logic from the power domain controller. The low-voltage lithium battery control module is responsible for acquiring the voltage, current, and temperature signals of the low-voltage lithium battery and sending these signals to the power domain controller for processing. The power domain controller performs functional and functional safety control based on the input voltage, current, and temperature signals, and the low-voltage lithium battery control module executes the control logic from the power domain controller. The OBC control module is responsible for detecting charging and discharging voltage, charging and discharging current, charging and discharging interface temperature, and charging and discharging relay status, and transmits the detection signals to the power domain controller. The power domain controller performs functional and functional safety control based on the input voltage, current, temperature, and relay status signals, and the OBC control module executes the functional safety control logic from the power domain controller. The DC-DC control module is responsible for high-voltage detection, low-voltage detection, and reverse current protection detection, and transmits the detection signals to the power domain controller. The power domain controller performs functional safety control based on the input high-voltage and low-voltage signals, and the DC-DC control module executes the functional safety control logic from the power domain controller.

[0143] In this embodiment, the functional safety control logic of each discrete electronic control unit is centralized into the power domain controller, improving the integration of the functional safety software and reducing the functional safety level and development difficulty of the distributed control modules. Furthermore, high-level functional safety requirements are decomposed, and the power domain controller uses an ASIL D-compliant MCU chip and power management chip, reducing the development cost and difficulty of other modules in the power control system. The high-voltage battery management module and thermal management module are integrated into a single controller for development, using an ASIL B-compliant functional safety MCU control chip for sampling, signal interaction with the power domain controller, and execution of functional safety control logic from the power domain controller. The low-voltage lithium battery control module, OBC control module, and DC-DC control module are also integrated into a single controller for development, using an ASIL B-compliant functional safety MCU control chip for sampling, signal interaction with the power domain controller, and execution of functional safety control logic from the power domain controller. Clear functional safety requirements that the power domain controller needs to implement and meet are proposed, providing a feasible solution for the functional safety development of the power domain controller, applicable to a wider range of application scenarios.

[0144] Based on the same inventive concept, a vehicle power control method applied to the vehicle power control system mentioned above is also provided. The solution provided by this vehicle power control method is similar to the solution described in the above embodiments. Therefore, the specific limitations in the method embodiments provided below can be found in the limitations of the vehicle power control system above, and will not be repeated here.

[0145] In one embodiment, as shown in FIG6, a vehicle power control method is provided. The method is applied to a power domain controller in a vehicle power control system. The power domain controller is communicatively connected to a sub-controller, and includes step S610.

[0146] Step S610: Receive the high-voltage battery signal, the low-voltage battery signal, and the power parameters of the charging / discharging circuit sent by the sub-controller, and send a functional safety control signal to the sub-controller so that the sub-controller performs the safety control function according to the functional safety control signal.

[0147] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0148] Based on the same inventive concept, this application also provides a vehicle power control device for implementing the vehicle power control method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations of the one or more vehicle power control device embodiments provided below can be found in the limitations of the vehicle power control method described above, and will not be repeated here.

[0149] In an exemplary embodiment, as shown in FIG7, a vehicle power control device 700 is provided. The device is applied to a power domain controller in a vehicle power control system. The power domain controller is communicatively connected to a sub-controller and includes a receiving module 710.

[0150] The receiving module 710 is used to receive the signals from the high-voltage battery, the low-voltage battery, and the power parameters of the charging / discharging circuit sent by the sub-controller, and to send the functional safety control signal to the sub-controller so that the sub-controller performs the safety control function according to the functional safety control signal.

[0151] For example, each module in the aforementioned vehicle powertrain control device is embedded in the powertrain domain controller in hardware form, and stored in software form in one or more MCU control chips of the powertrain domain controller for processing and executing the functional safety control logic corresponding to each module. In other words, the physical hardware of each module in the aforementioned vehicle powertrain control device is embedded in the powertrain domain controller, while the functional safety control logic corresponding to these modules is stored and runs in software code within one or more MCU control chips of the powertrain domain controller. In some embodiments, to reduce the load on the MCU control chip, two or more MCU control chips can be used. For example, two MCU control chips can be used: one MCU control chip handles the functional safety control logic related to intelligent driving and torque, and the other MCU control chip handles the control logic related to the charging system, high-voltage battery, and thermal management. The control chips may include, but are not limited to, TC397, TC387, etc.

[0152] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0153] The embodiments described above are merely illustrative of some implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A vehicle powertrain control system, applied to a vehicle, comprising: The power domain controller, which is communicatively connected to the sub-controller, is used to receive signals from the high-voltage battery, the low-voltage battery, and the power parameters of the charging / discharging circuit sent by the sub-controller, and to send functional safety control signals to the sub-controller so that the sub-controller performs safety control functions according to the functional safety control signals.

2. The vehicle power control system of claim 1, wherein, The functional safety level of the power domain controller is higher than that of the sub-controller.

3. The vehicle power control system according to claim 1, wherein, The sub-controller includes a first sub-controller and a second sub-controller, wherein the first sub-controller is used to acquire signals from the high-voltage battery; and the second sub-controller is used to acquire signals from the low-voltage battery and acquire power parameters of the charging / discharging circuit. Sending the functional safety control signal to the sub-controller includes sending the functional safety control signal to the first sub-controller and the second sub-controller.

4. The vehicle power control system according to claim 3, wherein, The dynamic domain controller includes: The battery functional safety control module is used to receive signals from the high-voltage battery and the low-voltage battery, and send battery safety control signals to the first sub-controller and the second sub-controller; The circuit safety control module is used to receive the power parameters of the charging / discharging circuit and send the circuit safety control signal to the second sub-controller.

5. The vehicle power control system according to claim 4, wherein, The circuit safety control signal is generated based on circuit safety control logic, which includes at least one of the following: charging overvoltage safety control logic, discharging overvoltage safety control logic, charging port cover overheating safety control logic, overvoltage safety control logic, undervoltage safety control logic, and current backflow prevention safety control logic.

6. The vehicle powertrain control system according to claim 4 or 5, wherein, The battery functional safety control module includes: a high-voltage battery control module, which is communicatively connected to the first sub-controller and is used to receive signals from the high-voltage battery and send high-voltage battery functional safety control signals to the first sub-controller; and a low-voltage battery control module, which is communicatively connected to the second sub-controller and is used to receive signals from the low-voltage battery and send low-voltage battery power supply control signals to the second sub-controller.

7. The vehicle powertrain control system according to any one of claims 4-6, wherein, The second sub-controller is also used to collect temperature data of the hot and cold circuits in the vehicle and send the temperature data to the power domain controller; The power domain controller also includes a thermal management safety control module, which is communicatively connected to the second sub-controller and is used to receive the temperature data and send the cold and hot loop safety control signal to the second sub-controller.

8. The vehicle powertrain control system according to any one of claims 5-7, wherein, The high-voltage battery functional safety control signal is generated based on high-voltage battery safety control logic, which includes at least one of the following: collision safety control logic, first cell overvoltage safety control logic, first cell undervoltage safety control logic, first cell overtemperature safety control logic, charging / discharging overcurrent safety control logic, relay status detection safety control logic, and stop heating request safety control logic; and / or, The low-voltage battery power supply control signal is generated based on the low-voltage battery safety control logic, which includes at least one of the following: second cell overvoltage safety control logic, second cell undervoltage safety control logic, second cell overtemperature safety control logic, and short circuit protection safety control logic.

9. The vehicle power control system according to claim 8, wherein, The first cell overvoltage safety control logic includes: when the high-voltage battery signal includes a first cell sampling voltage, in response to the first cell sampling voltage being greater than a first preset overvoltage threshold, generating a high-voltage battery functional safety control signal that matches the first cell overvoltage safety control logic; and / or, when the high-voltage battery signal includes a hardware overvoltage comparison signal, when the hardware overvoltage comparison signal meets a preset overvoltage condition, generating a high-voltage battery functional safety control signal that matches the first cell overvoltage safety control logic; The first cell undervoltage safety control logic includes: when the high-voltage battery signal includes a first cell sampling voltage, in response to the first cell sampling voltage being less than a first preset undervoltage threshold, generating a high-voltage battery functional safety control signal that matches the first cell undervoltage safety control logic; and / or, when the high-voltage battery signal includes a hardware undervoltage comparison signal, when the hardware undervoltage comparison signal meets a preset undervoltage condition, generating a high-voltage battery functional safety control signal that matches the first cell undervoltage safety control logic; The first cell over-temperature safety control logic includes: when the sampling temperature of the first cell exceeds the set functional safety threshold, generating a functional safety control signal that matches the first cell over-temperature safety control logic; The charging / discharging overcurrent safety control logic includes: monitoring the current during the charging / discharging process, and generating a functional safety control signal that matches the charging / discharging overcurrent safety control logic when the current exceeds the functional safety threshold; The relay status detection safety control logic includes: monitoring the status of relays in the battery management system; and generating a functional safety control signal that matches the relay status detection safety control logic when the relay cannot be reliably turned off. The stop heating request safety control logic includes monitoring the battery's temperature status, and generating a functional safety control signal that matches the stop heating request safety control logic when the battery temperature exceeds the functional safety protection threshold.

10. The vehicle power control system according to claim 9, wherein, The methods for obtaining the sampling voltage of the first battery cell include: The first sub-controller obtains the sampling voltage of the first cell through the voltage sampling circuit corresponding to the high-voltage battery.

11. The vehicle powertrain control system according to claim 8, wherein, The second cell overvoltage safety control logic includes: when the low-voltage battery signal includes a second sampling voltage, in response to the second sampling voltage being greater than a second preset overvoltage threshold, generating a low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic; the second cell undervoltage safety control logic includes: when the low-voltage battery signal includes a second sampling voltage, in response to the second sampling voltage being less than a second preset undervoltage threshold, generating a low-voltage battery power supply control signal that matches the second cell undervoltage safety control logic.

12. The vehicle powertrain control system according to claim 11, wherein, When the second sampling voltage includes the low-voltage battery voltage, after generating the low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic / second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to the second sub-controller so that the second sub-controller disconnects the power supply relay of the low-voltage battery.

13. The vehicle powertrain control system according to claim 11 or 12, wherein, When the second sampling voltage includes a low-voltage output voltage, after generating a low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic / second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller shuts down the DC-DC converter module corresponding to the low-voltage battery.

14. The vehicle powertrain control system according to any one of claims 11-13, wherein, When the second sampling voltage includes a high voltage, after generating a low-voltage battery power supply control signal that matches the second cell overvoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the charging relay corresponding to the low-voltage battery; after generating a low-voltage battery power supply control signal that matches the second cell undervoltage safety control logic, the method further includes: sending the low-voltage battery power supply control signal to a second sub-controller so that the second sub-controller disconnects the discharging relay corresponding to the low-voltage battery.

15. The vehicle power control system according to claim 1, wherein, The power domain controller further includes a motor functional safety control module, which includes at least one of a torque management functional safety control module and a high-voltage drive safety control module. The torque management function safety control module designs torque safety control logic, functional safety protection thresholds, and safety states after fault triggering based on the torque management control function. The torque safety control logic includes at least one of torque allowance functional safety control logic, actual torque estimation functional safety control logic, and torque request functional safety control logic; and / or, The high-voltage drive safety control module is used to design high-voltage drive safety control logic, functional safety protection thresholds, and safety status after fault triggering based on the high-voltage drive function. The high-voltage drive safety control logic includes at least one of the following: electric drive torque estimation functional safety control logic, electric drive torque accuracy functional safety control logic, electric drive torque direction functional safety control logic, torque allowable signal timeout functional safety control logic, collision functional safety control logic, and active discharge functional safety control logic.

16. The vehicle powertrain control system according to claim 1 or 15, wherein, The power domain controller also includes an intelligent driving safety control module; The intelligent driving safety control module is used to design intelligent driving function safety control logic, function safety protection thresholds, and safety status after fault triggering. The intelligent driving function safety control logic includes at least one of lane change function safety control logic, parking assist function safety control logic, and automatic parking function safety control logic.

Images