CN116795013A - Microcontroller monitoring circuit, method, device, medium, vehicle-mounted computer and vehicle - Google Patents
Microcontroller monitoring circuit, method, device, medium, vehicle-mounted computer and vehicle Download PDFInfo
- Publication number
- CN116795013A CN116795013A CN202210264814.0A CN202210264814A CN116795013A CN 116795013 A CN116795013 A CN 116795013A CN 202210264814 A CN202210264814 A CN 202210264814A CN 116795013 A CN116795013 A CN 116795013A
- Authority
- CN
- China
- Prior art keywords
- microcontroller
- mcu
- microcontrollers
- monitoring
- power management
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 148
- 238000000034 method Methods 0.000 title claims abstract description 32
- 238000004891 communication Methods 0.000 claims abstract description 81
- 230000001681 protective effect Effects 0.000 claims description 24
- 238000012806 monitoring device Methods 0.000 claims description 9
- 238000013461 design Methods 0.000 abstract description 13
- 238000005516 engineering process Methods 0.000 abstract description 8
- 241000282472 Canis lupus familiaris Species 0.000 description 34
- 238000010586 diagram Methods 0.000 description 10
- 239000013078 crystal Substances 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 3
- 238000011161 development Methods 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000009977 dual effect Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The present disclosure relates to microcontroller monitoring circuits, methods, devices, media, vehicle-mounted computers, and vehicles. Wherein, this monitoring circuit includes: at least two microcontrollers, each microcontroller is electrically connected with a power management chip, and the power management chip is used for supplying power to the corresponding microcontroller; wherein one microcontroller is in communication connection with at least one of the remaining other microcontrollers; the microcontrollers in communication with each other are virtual security monitoring domains of each other. The microcontrollers in communication connection are virtual safety monitoring domains of each other, so that the safety monitoring function of the built-in safety monitoring domain of the power management chip in the related technology is realized; the power management chip does not need to be internally provided with a safety monitoring domain, and the safety level is set to be the QM level so as to meet the requirement of independent safety monitoring, thereby reducing the cost of the power management chip and improving the design freedom of the board-level circuit.
Description
Technical Field
The disclosure relates to the technical field of vehicles, and in particular relates to a microcontroller monitoring circuit, a method, a device, a medium, a vehicle-mounted computer and a vehicle.
Background
In the related art, a functional safety hardware architecture of a vehicle generally employs a power management chip (Power Management Integrated Circuit, PMIC) with an independent functional safety monitoring Domain (FSD), and combines with a Micro-Controller Unit (MCU) meeting the functional safety design requirements to meet the requirements of the functional safety design of the overall vehicle safety integrity level (Automotive Safety Integrity Level, ASIL). As shown in fig. 1, for a single microcontroller, the architecture needs to meet the following functional safety design requirements: the power supply is monitored independently, the microcontroller is monitored by a Watchdog (Watchdog), the fault collection and control unit (Fault Collection and Control Unit, FCCU) is monitored, and the microcontroller is in a Safe state (Reset, RST) and a Fail Safe off PIN (Fail Safe PIN, FS 0B).
With the development of vehicle electrification and automatic driving technologies, a single microcontroller cannot meet the calculation power and Fail operation requirements of an electronic control unit (Electronic Control Unit, ECU), and a hardware architecture of the electronic control unit with double microcontrollers is generated. If the design scheme of a single microcontroller is continuously adopted, as shown in fig. 2, two sets of power management chips with independent functional safety monitoring domains are required to be configured for the double microcontrollers, and the safety monitoring domains and the microcontrollers of the power management chips are required to meet the corresponding ASILX (x= A, B, C or D) grades, so that the cost of the power management chip devices is increased, the power management chips and the microcontrollers are often in a binding scheme, and the degree of freedom of board-level circuit design is reduced.
Disclosure of Invention
In order to solve the technical problems, the disclosure provides a microcontroller monitoring circuit, a method, a device, a medium, a vehicle-mounted computer and a vehicle.
The present disclosure provides a microcontroller monitoring circuit, the monitoring circuit comprising:
at least two microcontrollers, each of the microcontrollers is electrically connected with a power management chip, and the power management chip is used for supplying power to the corresponding microcontroller;
wherein one of the microcontrollers is communicatively connected with at least one of the remaining other microcontrollers; the microcontrollers in communication with each other are virtual security monitoring domains of each other.
Optionally, one of the microcontrollers is communicatively connected to the remaining other microcontrollers.
Optionally, each of the microcontrollers is provided with a voltage dividing circuit; the power management chip is electrically connected with the microcontroller and is connected with the input end of the voltage dividing circuit, and the microcontroller in communication connection with the microcontroller is connected with the output end of the voltage dividing circuit.
Optionally, each of the microcontrollers comprises an analog to digital converter; the analog-digital converter is used for receiving the partial pressure transmitted by the partial pressure circuit;
the analog-digital converter is connected with the output end of the voltage dividing circuit.
Optionally, each microcontroller further comprises an output interface, wherein the output interface is used for controlling the connection and disconnection of a power supply path between the microcontroller in communication with the microcontroller and the corresponding power management chip.
Optionally, the device further comprises a gating switch; the gating switch is arranged on a power supply path between the microcontroller and a corresponding power management chip, is integrated on the microcontroller or is integrated on any one of the power management chips; the output interface is electrically connected with the gating switch.
Optionally, each of the microcontrollers further comprises a watchdog interface; and the watchdog interface is connected with a microcontroller in communication connection.
Optionally, each of the microcontrollers further comprises a fault collection and control unit monitoring input interface and a fault collection and control unit;
the fault collecting and controlling unit monitors that the input interface is connected with the fault collecting and controlling unit of the microcontroller in communication connection;
the fault collection and control unit is connected with the fault collection and control unit monitoring input interface of the microcontroller in communication connection.
Optionally, each of the microcontrollers further comprises a reset output interface and a reset;
The reset output interface is in reset connection with the microcontroller in communication connection;
and the reset is connected with a reset output interface of the microcontroller in communication connection.
Optionally, each of the microcontrollers further comprises a fail safe shutdown pin output interface;
the fail safe shutdown pin output interface is used for controlling a load driven by the communication connected microcontroller to enter a safe state.
Optionally, each of the microcontrollers is connected to a clock crystal oscillator.
The disclosure also provides a microcontroller monitoring method, which is applicable to any one of the above monitoring circuits, and the method comprises the following steps:
receiving working parameters sent by a microcontroller in communication connection;
determining a protective measure trigger instruction based on the working parameters, and sending the protective measure trigger instruction to the microcontroller connected with the communication; the protection measure triggering instruction is used for controlling the microcontroller connected with the communication to execute corresponding protection measures;
sending working parameters to the microcontroller in communication connection;
receiving a protective measure triggering instruction sent by the microcontroller in communication connection; wherein the protective measure trigger instruction is determined by the communicatively connected microcontroller based on the operating parameter it receives.
The present disclosure also provides a microcontroller monitoring device, the monitoring device comprising:
the parameter receiving module is used for receiving working parameters sent by the microcontroller in communication connection;
the instruction determining module is used for determining a protective measure triggering instruction based on the working parameters and sending the protective measure triggering instruction to the microcontroller in communication connection; the protection measure triggering instruction is used for controlling the microcontroller connected with the communication to execute corresponding protection measures;
the parameter sending module is used for sending working parameters to the microcontroller in communication connection;
the instruction receiving module is used for receiving a protective measure triggering instruction sent by the microcontroller in communication connection; wherein the protective measure trigger instruction is determined by the communicatively connected microcontroller based on the operating parameter it receives.
The present disclosure also provides a computer-readable storage medium storing a program or instructions that cause a computer to perform the steps of the above-described method.
The present disclosure also provides a vehicle-mounted computer, comprising: any of the above monitoring circuits;
and/or the monitoring device.
The present disclosure also provides a vehicle including: the vehicle-mounted computer.
Compared with the prior art, the technical scheme provided by the disclosure has the following advantages:
in the technical scheme provided by the disclosure, the monitoring circuit comprises: at least two microcontrollers, each microcontroller is electrically connected with a power management chip, and the power management chip is used for supplying power to the corresponding microcontroller; wherein one microcontroller is in communication connection with at least one of the remaining other microcontrollers; the microcontrollers in communication with each other are virtual security monitoring domains of each other. The microcontrollers in communication connection are virtual safety monitoring domains of each other, so that the safety monitoring function of the built-in safety monitoring domain of the power management chip in the related technology is realized; the power management chip does not need to be internally provided with a safety monitoring domain, and the safety level is set to be the QM level so as to meet the requirement of independent safety monitoring, thereby reducing the cost of the power management chip and improving the design freedom of the board-level circuit.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description, serve to explain the principles of the disclosure.
In order to more clearly illustrate the embodiments of the present disclosure or the solutions in the prior art, the drawings that are required for the description of the embodiments or the prior art will be briefly described below, and it will be obvious to those skilled in the art that other drawings can be obtained from these drawings without inventive effort.
FIG. 1 is a schematic diagram of a related art single-microcontroller architecture;
FIG. 2 is a schematic diagram of a dual-microcontroller architecture in the related art;
fig. 3 is a schematic structural diagram of a monitoring circuit of a microcontroller according to an embodiment of the disclosure;
FIG. 4 is a schematic diagram of another monitoring circuit of a microcontroller according to an embodiment of the present disclosure;
FIG. 5 is a schematic diagram of a monitoring circuit of a microcontroller according to an embodiment of the present disclosure;
fig. 6 is a schematic flow chart of a method for monitoring a microcontroller according to an embodiment of the disclosure;
fig. 7 is a schematic structural diagram of a monitoring device of a microcontroller according to an embodiment of the disclosure.
Wherein, 11, a microcontroller; 12. a power management chip; 13. a security monitoring domain; 14. a gating switch; 15. a voltage dividing circuit; 16. a clock crystal oscillator; 111. an output interface; 112. an analog-to-digital converter; 113. a watchdog interface; 114. the fault collecting and controlling unit monitors the input interface; 115. a fault collection and control unit; 116. resetting an output interface; 117. resetting; 118. a fail safe shutdown pin output interface; 21. a parameter receiving module; 22. an instruction determination module; 23. a parameter sending module; 24. an instruction receiving module; S110-S140 are steps of the method flow.
Detailed Description
In order that the above objects, features and advantages of the present disclosure may be more clearly understood, a further description of aspects of the present disclosure will be provided below. It should be noted that, without conflict, the embodiments of the present disclosure and features in the embodiments may be combined with each other.
In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure, but the present disclosure may be practiced otherwise than as described herein; it will be apparent that the embodiments in the specification are only some, but not all, embodiments of the disclosure.
In the related art, as shown in fig. 1, the single microcontroller architecture includes a microcontroller 11, a power management chip 12, and a security monitoring domain 13 built in the power management chip; the security levels of the microcontroller 11 and the security monitoring domain 13 built in the power management chip all need to meet the level of ASILX (x= A, B, C or D), so as to ensure that the requirements of the ASILX function security level are met as a whole.
With the development of vehicle electrification and automatic driving technologies, a single microcontroller cannot meet the requirements of calculation power and Fail operation of an electronic control unit, and a hardware architecture of the electronic control unit with double microcontrollers is generated. As shown in fig. 2, a design scheme of a single microcontroller is still adopted, two sets of power management chips with independent functional safety monitoring domains are required to be configured for the dual microcontrollers, and the safety monitoring domain 13 of the power management chip 12 and the microcontroller 11 are required to meet the corresponding ASIL X level, so that the cost of the device of the power management chip 12 is increased, and the power management chip 12 and the microcontroller 11 are in a one-to-one binding scheme, so that the degree of freedom of board-level circuit design is reduced.
In order to solve the above problems, embodiments of the present disclosure provide a microcontroller monitoring circuit, a method, a device, a medium, a vehicle-mounted computer, and a vehicle. Wherein, this monitoring circuit includes: at least two microcontrollers, each microcontroller is electrically connected with a power management chip, and the power management chip is used for supplying power to the corresponding microcontroller; wherein one microcontroller is in communication connection with at least one of the remaining other microcontrollers; the microcontrollers in communication with each other are virtual security monitoring domains of each other. The microcontrollers in communication connection are virtual safety monitoring domains of each other, so that the safety monitoring function of the built-in safety monitoring domain of the power management chip in the related technology is realized; the power management chip does not need to be internally provided with a safety monitoring domain, and the safety level is set to be the QM level so as to meet the requirement of independent safety monitoring, thereby reducing the cost of the power management chip and improving the design freedom of the board-level circuit.
The following describes exemplary embodiments of a microcontroller monitoring circuit, method, apparatus, medium, vehicle-mounted computer, and vehicle according to the embodiments of the present disclosure with reference to fig. 3 to 7.
Fig. 3 is a schematic structural diagram of a monitoring circuit of a microcontroller according to an embodiment of the disclosure. Referring to fig. 3, the monitoring circuit includes: at least two microcontrollers 11, each microcontroller 11 is electrically connected to a power management chip 12, and the power management chip 12 is used for supplying power to the corresponding microcontroller 11; wherein one microcontroller 11 is in communication with at least one of the remaining other microcontrollers 11; the microcontrollers 11 which are in communication with each other are virtual security monitoring domains of each other.
The microcontroller 11 may be a single-chip microcomputer or a single-chip microcomputer, i.e. a chip-level computer, and may perform control in different combinations for different applications.
The power management chip 12 does not include a security monitoring domain, and its security level may be set to QM, lower than ASILX (x= A, B, C or D).
Illustratively, as shown in FIG. 3, the control circuit includes three microcontrollers 11, each MCU 1 、MCU 2 、MCU 3 The method comprises the steps of carrying out a first treatment on the surface of the Each microcontroller 11 is electrically connected to a power management chip 12 (PMIC 1 And PMIC 2 PMIC 3 ) The power management chips 12 are in one-to-one correspondence with the microcontrollers 11, and each power management chip 12 supplies power to the corresponding microcontroller 11, and PMIC 1 Is MCU (micro-controller unit) 1 Power supply, PMIC 2 Is MCU (micro-controller unit) 2 Power supply, PMIC 3 Is MCU (micro-controller unit) 3 Supplying power; wherein, MCU 1 And MCU (micro controller Unit) 2 The virtual security monitoring domains are in communication connection and are mutually opposite; the method comprises the following steps: MCU (micro control Unit) 1 As MCU 2 Virtual security monitoring domain of (2) to MCU 2 The safety monitoring function of the built-in safety monitoring domain of the power management chip in the related technology is realized by monitoring; similarly, MCU 2 As MCU 1 Virtual security monitoring domain of (2) to MCU 1 Monitoring; MCU (micro control Unit) 3 The microcontroller, which is not communicatively connected to it, is monitored using a security monitoring domain 13 built in the power management chip.
It should be noted that fig. 3 only schematically illustrates a communication linkConnected MCU 1 And MCU (micro controller Unit) 2 Mutually monitored MCU 3 Is monitored by the security monitoring domain 13, but does not constitute a limitation of the microcontroller monitoring circuitry provided by embodiments of the present disclosure. In other embodiments, the connection relationship and number between microcontrollers may be set according to the requirement of the monitoring circuit of the microcontrollers, such as one-to-one communication connection of all microcontrollers, which is not limited herein.
The disclosed embodiments provide a microcontroller monitoring circuit, the monitoring circuit comprising: at least two microcontrollers 11, each microcontroller 11 is electrically connected to a power management chip 12, and the power management chip 12 is used for supplying power to the corresponding microcontroller 11; wherein one microcontroller 11 is in communication with at least one of the remaining other microcontrollers 11; the microcontrollers 11 which are in communication with each other are virtual security monitoring domains of each other. The microcontrollers in communication connection are virtual safety monitoring domains of each other, so that the safety monitoring function of the built-in safety monitoring domain of the power management chip in the related technology is realized; the power management chip does not need to be internally provided with a safety monitoring domain, and the safety level is set to be the QM level so as to meet the requirement of independent safety monitoring, thereby reducing the cost of the power management chip and improving the design freedom of the board-level circuit.
In some embodiments, as shown in fig. 4, another schematic structural diagram of a monitoring circuit of a microcontroller is provided in an embodiment of the disclosure. Referring to fig. 4, in the monitoring circuit, one microcontroller 11 is communicatively connected to the remaining other microcontrollers 11.
Illustratively, as shown in FIG. 4, the monitoring circuit includes four microcontrollers 11, each MCU 1 、MCU 2 、MCU 3 And MCU (micro controller Unit) 4 The method comprises the steps of carrying out a first treatment on the surface of the Each microcontroller 11 is electrically connected to a power management chip 12 (PMIC 1 、PMIC 2 、PMIC 3 And PMIC 4 ) The power management chips 12 are in one-to-one correspondence with the microcontrollers 11, and each power management chip 12 is divided into corresponding microcontrollers 11 for supplying power and PMIC 1 Is MCU (micro-controller unit) 1 Power supply, PMIC 2 Is MCU (micro-controller unit) 2 Power supply, PMIC 3 Is MCU (micro-controller unit) 3 Power supply, PMIC 4 Is MCU (micro-controller unit) 4 Supplying power; wherein, MCU 1 And MCU (micro controller Unit) 2 、MCU 3 And MCU (micro controller Unit) 4 All three microcontrollers are in communication connection, and MCU 1 As MCU 2 、MCU 3 And MCU (micro controller Unit) 4 Virtual security monitoring domain of (2) to MCU 2 、MCU 3 And MCU (micro controller Unit) 4 Three microcontrollers monitor; MCU (micro control Unit) 2 As MCU 1 Virtual security monitoring domain of (2) to MCU 1 And monitoring.
It should be noted that fig. 3 or fig. 4 only exemplarily illustrates that the microcontroller monitoring circuit includes three or four microcontrollers, but does not constitute a limitation of the microcontroller monitoring circuit provided by the embodiments of the present disclosure. In other embodiments, the number of microcontrollers in the microcontroller monitoring circuit may be two or more, or flexibly set according to the requirements of the microcontroller monitoring circuit, which is not limited herein.
It will be appreciated that FIG. 4 shows an MCU by way of example only 2 As MCU 1 Virtual security monitoring domain of (2) to MCU 1 Monitoring is performed, but is not limiting of the microcontroller monitoring circuitry provided by embodiments of the present disclosure. In other embodiments, an MCU may be selected 2 、MCU 3 And MCU (micro controller Unit) 4 Any one of the three microcontrollers serves as an MCU 1 Is not limited herein.
It can be appreciated that the correspondence of the communication connection between the microcontrollers 11 can be set to be the mutual communication connection between the two microcontrollers 11, such as the MCU in FIG. 3 1 And MCU (micro controller Unit) 2 The virtual security monitoring domains are mutually connected in a communication way and are mutually opposite; it is also possible to provide that one of the microcontrollers 11 monitors two or more microcontrollers 11, such as the MCU in FIG. 4 1 And MCU (micro controller Unit) 2 、MCU 3 And MCU (micro controller Unit) 4 Three microcontrollers are in communication connection and serve as MCU 2 、MCU 3 And MCU (micro controller Unit) 4 Is a security monitoring domain of (1); or as a combination of both arrangements, not limited herein.
In some embodiments, as shown in fig. 5, a schematic diagram of a further microcontroller monitoring circuit according to an embodiment of the disclosure is provided. Referring to fig. 5, in the microcontroller monitoring circuit, each microcontroller 11 is provided with a voltage dividing circuit (Divider) 15; the power management chip 12 electrically connected with the microcontroller 11 is connected with the input end of the voltage dividing circuit 15, and the microcontroller 11 in communication connection with the microcontroller 11 is connected with the output end of the voltage dividing circuit 15.
The voltage dividing circuit 15 is used for dividing the output voltage of the corresponding power management chip 12, and sending the divided voltage to the microcontroller 11 in communication with the corresponding microcontroller 11 to monitor the supply voltage for over-voltage and under-voltage.
The reason for dividing the output voltage of the power management chip 12 is that: the voltage range that can be monitored by the microcontroller 11 is limited, and in most cases, the output voltage of the power management chip 12 is greater than the maximum value of the voltage range that can be monitored by the microcontroller 11, so that the output voltage of the power management chip 12 is divided, and the divided voltage is distributed in the voltage range that can be monitored by the microcontroller 11.
Wherein the voltage dividing circuit is set as a resistor voltage dividing circuit; the voltage division is determined by the proportion of the voltage division resistance in the voltage division circuit to the total resistance, and the larger the voltage division resistance in the voltage division circuit is, the higher the voltage division is; according to the power supply voltage division and the voltage division resistance, the power supply voltage provided by the power management chip to the microcontroller can be obtained through calculation.
By this arrangement, the microcontrollers 11 mutually monitor the power supply voltage supplied to the microcontrollers 11 by the other power management chip 12.
Illustratively, as shown in FIG. 5, the microcontroller monitoring circuit includes two microcontrollers 11, each MCU 1 And MCU (micro controller Unit) 2 The method comprises the steps of carrying out a first treatment on the surface of the Each microcontroller 11 is electrically connected to a power management chip 12 (PMIC 1 And PMIC 2 )，PMIC 1 Is MCU (micro-controller unit) 1 Power supply, PMIC 2 Is MCU (micro-controller unit) 2 Supplying power; MCU (micro control Unit) 1 And MCU (micro controller Unit) 2 Communication connection, virtual monitoring domains of each other; each microcontroller 11 is provided with a voltage divider circuit 15; wherein, MCU 1 A voltage divider circuit 15 with its input terminal and PMIC 1 Is connected with the MCU at the output end 2 Is connected by MCU 2 Monitoring PMIC 1 To MCU 1 A supplied supply voltage; MCU (micro control Unit) 2 A voltage divider circuit 15 with its input terminal and PMIC 2 Is connected with the MCU at the output end 1 Is connected by MCU 2 Monitoring PMIC 1 To MCU 1 A supplied supply voltage.
In some embodiments, as shown in fig. 5, each microcontroller 11 includes an analog-to-digital converter (Analogto Digital Converter, ADC) 112; the analog-to-digital converter 112 is used for receiving the divided voltage transmitted by the voltage dividing circuit; the analog-digital converter 112 is connected to an output terminal of the voltage dividing circuit 15.
Illustratively, as shown in FIG. 5, each microcontroller 11 includes an analog-to-digital converter 112; MCU (micro control Unit) 1 Analog-to-digital converter 112 and MCU of (C-A) for a digital-to-analog converter 2 The output of the voltage divider circuit 15 is connected to the input of the PMIC 2 Is connected by MCU 1 Analog to digital converter 112 to PMIC 2 To MCU 2 Monitoring the provided power supply voltage to monitor whether an overvoltage and undervoltage fault exists; similarly, MCU 2 Analog-to-digital converter 112 and MCU of (C-A) for a digital-to-analog converter 1 The output of the voltage divider circuit 15 is connected to the input of the PMIC 1 Is connected by MCU 2 Analog to digital converter 112 to PMIC 1 To MCU 1 The provided power supply voltage is monitored to monitor whether an overvoltage and undervoltage fault exists.
In some embodiments, in the microcontroller monitoring circuit, each microcontroller 11 further includes an output interface 111, and the output interface 111 is used to control the conduction and the closing of the power supply path between the microcontroller 11 communicatively connected to the microcontroller 11 and the corresponding power management chip 12.
When the analog-digital converter 112 monitors that the corresponding power management chip 12 supplies power to the monitored microcontroller 11 in an overvoltage manner, the power supply path between the corresponding power management chip 12 and the monitored microcontroller 11 is closed through the output interface 111, and the power management chip 12 stops supplying power to the microcontroller 11 to prevent the microcontroller from being damaged; when the analog-to-digital converter 112 monitors that the voltage supplied from the corresponding power management chip 12 to the monitored microcontroller 11 is restored to the normal range, the power supply path between the corresponding power management chip 12 and the monitored microcontroller 11 is conducted through the output interface 111, and the power management chip 12 starts supplying power to the microcontroller 11.
Illustratively, as shown in FIG. 5, the MCU 1 Also includes an output interface 111, when the MCU 1 The analog to digital converter 112 of (c) monitors the PMIC 2 To MCU 2 When overvoltage power is supplied, PMIC is turned off through output interface 111 2 And MCU (micro controller Unit) 2 Power supply path between them, PMIC 2 Stop to MCU 2 Power supply preventing MCU 2 Damage; when MCU 1 The analog to digital converter 112 of (c) monitors the PMIC 2 To MCU 2 When the power supply voltage is recovered to the normal range, the PMIC is turned on through the output interface 111 2 And MCU (micro controller Unit) 2 Power supply path between them, PMIC 2 Start to MCU 2 Supplying power; MCU (micro control Unit) 2 Including an output interface 111, when the MCU 2 The analog to digital converter 112 monitors the PMIC 1 To MCU 1 When overvoltage power is supplied, PMIC is turned off through output interface 111 1 And MCU (micro controller Unit) 1 Power supply path between them, PMIC 1 Stop to MCU 1 Power supply preventing MCU 1 Damage; when MCU 2 The analog to digital converter 112 monitors the PMIC 1 To MCU 1 When the power supply voltage is recovered to the normal range, the PMIC is turned on through the output interface 111 1 And MCU (micro controller Unit) 1 Power supply path between them, PMIC 1 Start to MCU 1 And (5) supplying power.
In some embodiments, the microcontroller monitoring circuit further includes a gating Switch (Switch) 14; the gating switch 14 is arranged on a power supply path between the microcontroller 11 and the corresponding power management chip 12, is integrated with the microcontroller 11, or is integrated with any one of the power management chips 12; the output interface 111 is electrically connected to the gate switch 14.
The gating switch 14 is used for controlling the on and off of a power supply path between the power management chip 12 and the corresponding microcontroller 11, and the gating switch 14 may be disposed in any one of the power supply path between the microcontroller 11 and the corresponding power management chip 12, integrated in the microcontroller 11, or integrated in the power management chip 12.
Exemplary, as shown in FIG. 5, PMIC 1 And MCU (micro controller Unit) 1 Electrical connection, PMIC 1 To MCU 1 A gating switch 14 is arranged on the power supply paths of the two power supplies; when MCU 2 The analog to digital converter 112 monitors the PMIC 1 To MCU 1 When overvoltage power is supplied, PMIC is turned off through output interface 111 1 And MCU (micro controller Unit) 1 Power supply path between them, PMIC 1 Stop to MCU 1 Power supply preventing MCU 1 Damage; when MCU 2 The analog to digital converter 112 monitors the PMIC 1 To MCU 1 When the power supply voltage is recovered to the normal range, the PMIC is turned on through the output interface 111 1 And MCU (micro controller Unit) 1 Power supply path between them, PMIC 1 Start to MCU 1 And (5) supplying power. Similarly, PMIC 2 And MCU (micro controller Unit) 2 Electrical connection, PMIC 2 To MCU 2 A gating switch 14 is arranged on the power supply paths of the two power supplies; when MCU 1 The analog to digital converter 112 of (c) monitors the PMIC 2 To MCU 2 When overvoltage power is supplied, PMIC is turned off through output interface 111 2 And MCU (micro controller Unit) 2 Gate switch 14, PMIC for power supply path between 2 Stop to MCU 2 Power supply preventing MCU 2 Damage; when MCU 1 The analog to digital converter 112 of (c) monitors the PMIC 2 To MCU 2 When the power supply voltage is recovered to the normal range, the PMIC is turned on through the output interface 111 2 And MCU (micro controller Unit) 2 Gate switch 14, PMIC for power supply path between 2 Start to MCU 2 And (5) supplying power.
In some embodiments, as shown in fig. 5, each microcontroller 11 further includes a Watchdog (Watchdog) interface 113; connection of the watchdog interface 113 to the communicatively connected microcontroller 11.
Wherein the microcontrollers 11 can be connected through SPI or I 2 And C bus is in communication connection and simulates watchdog monitoring. The microcontroller 11 sends a dog feeding signal to the microcontroller 11 in communication connection with the microcontroller in a preset time (window opening period), the microcontroller 11 in communication connection with the microcontroller receives the dog feeding signal, analyzes the dog feeding time and the dog feeding answer, and judges whether the program set on the monitored microcontroller runs normally or not.
Illustratively, as shown in FIG. 5, the MCU 1 And MCU (micro controller Unit) 2 Through SPI or I between watchdog interfaces 113 2 C bus is connected in communication, MCU 1 And MCU (micro controller Unit) 2 A Watchdog (watch) 113 is simulated to monitor the normal operation of the program set on the other side; MCU (micro control Unit) 1 The watchdog interface 113 of (1) may connect the MCU 1 The generated feeding dog signal is sent to the MCU 2 Can also receive MCU 2 And sending the dog feeding information.
It should be noted that fig. 5 only exemplarily shows the communication between microcontrollers 11 via SPI or I 2 The C bus is communicatively connected, and the sending and receiving of the watchdog signal is via the same watchdog interface 113, but is not limited to the microcontroller monitoring circuit provided by the embodiments of the present disclosure. In other embodiments, the connection between the microcontrollers 11 may be configured in other ways known to those skilled in the art, and the feeding dog signal transmitting interface and the receiving interface may be configured separately, which is not limited herein.
In some embodiments, as shown in fig. 5, in the microcontroller monitoring circuit, each microcontroller 11 further includes a fault collection and control unit monitoring input Interface (Fault Collection and Control Unit Monitor Input/Output Interface, FCCU Monitor (IO)) 114 and a fault collection and control unit (Fault Collection and Control Unit, FCCU) 115; the fault collection and control unit monitors the fault collection and control unit connection 115 of the input interface 114 with the communicatively connected microcontroller 11; the fault collection and control unit 115 is connected to the fault collection and control unit monitoring input interface 114 of the communicatively connected microcontroller 11.
Illustratively, as shown in FIG. 5, the MCU 1 And MCU (micro controller Unit) 2 Each including a fault collection and control unit monitoring input interface 114 and a fault collection and control unit 115; MCU (micro control Unit) 1 Is provided for monitoring the input interface 114 and the MCU 2 Is connected to the fault collection and control unit 115, MCU 1 Is used for monitoring the MCU by the fault collection and control unit monitoring input interface 114 2 An output of the fault collection and control unit 115; MCU (micro control Unit) 2 Is provided for monitoring the input interface 114 and the MCU 1 Is connected to the fault collection and control unit 115, MCU 2 Is used for monitoring the MCU by the fault collection and control unit monitoring input interface 114 1 The output of the fault collection and control unit 115.
In some embodiments, as shown in FIG. 5, each microcontroller 11 further includes a Reset Input/Output Interface (RST) 116 and a Reset (RST) 117 in the microcontroller monitor circuit; the reset output interface 116 is connected with a reset 117 of the communicatively connected microcontroller 11; reset 117 is connected to a reset output interface 116 of the communicatively connected microcontroller 11.
Wherein the reset output interface 116 is used to control the monitored microcontroller 11 to enter a safe state.
Wherein, when the power management chip 12 is monitored to supply overvoltage or undervoltage to the microcontroller 11, or the microcontroller is monitored to feed dog faults (feeding dog time errors and/or feeding dog answer errors), or when the fault collecting and controlling unit 115 of the microcontroller 11 is monitored to break down, the corresponding microcontroller 11 is controlled to enter a safe state through the reset output interface 116.
Illustratively, as shown in FIG. 5, the MCU 1 And MCU (micro controller Unit) 2 Each comprising a reset output interface 116 and a reset 117; MCU (micro control Unit) 1 Is connected to the MCU via the reset output interface 116 2 Is connected to the reset 117 of (c); when MCU 1 Monitoring PMIC 2 To MCU 2 When the power supply is over-voltage or under-voltage, or when MCU 1 Monitoring MCU 2 Failure to feed dogs (incorrect time to feed dogs and/or incorrect answer to feed dogs), or when MCU 1 Monitoring MCU 2 Through MCU when the failure collection and control unit 115 fails 1 Control MCU of reset output interface 116 of (C) 2 Entering a safe state; MCU (micro control Unit) 2 Is connected to the MCU via the reset output interface 116 1 Is connected to the reset 117 of (B), when the MCU 2 Monitoring PMIC 1 To MCU 1 When the power supply is over-voltage or under-voltage, or when MCU 2 Monitoring MCU 2 Failure to feed dogs (incorrect time to feed dogs and/or incorrect answer to feed dogs), or when MCU 2 Monitoring MCU 1 Fault collection and control of (a)When the control unit 115 fails, the MCU is used for 2 Control MCU of reset output interface 116 of (C) 1 Entering a safe state.
In some embodiments, as shown in FIG. 5, each microcontroller 11 further includes a fail safe shutdown pin out Interface (Fail Safe PINInput/Output Interface, FS0B (IO) 118 in the microcontroller monitoring circuit.
When the power management chip 12 is monitored to supply overvoltage or undervoltage to the microcontroller 11, or the microcontroller 11 is monitored to be in fault (in fault of feeding dog time and/or fault of feeding dog answer), or when the fault collection and control unit 115 of the microcontroller 11 is monitored to be in fault, the corresponding load on the microcontroller 11 is turned off through the fail-safe off pin output interface 118.
Illustratively, as shown in FIG. 5, the MCU 1 And MCU (micro controller Unit) 2 Each including a fail-safe shutdown pin-out interface 118; when MCU 1 Monitoring PMIC 2 To MCU 2 When the power supply is over-voltage or under-voltage, or when MCU 1 Monitoring MCU 2 Failure to feed dogs (incorrect time to feed dogs and/or incorrect answer to feed dogs), or when MCU 1 Monitoring MCU 2 Through MCU when the failure collection and control unit 115 fails 1 The fail-safe shutdown pin-out interface 118 of (1) shuts down the MCU 2 Load on; when MCU 2 Monitoring PMIC 1 To MCU 1 When the power supply is over-voltage or under-voltage, or when MCU 2 Monitoring MCU 1 Through MCU when the failure collection and control unit 115 fails 2 The fail-safe shutdown pin-out interface 118 of (1) shuts down the MCU 1 Load on the load cell.
In some embodiments, as shown in fig. 5, each microcontroller 11 is connected to a clock crystal (External Crystal Oscillator, XTAL) 16 in the microcontroller monitoring circuit.
When the microcontroller 11 is used for monitoring, the clock sources of the microcontroller 11 as the monitored party and the monitored party have independence.
The microcontroller monitoring circuit provided by the embodiment of the disclosure realizes the safety monitoring function of the built-in safety monitoring domain of the power management chip in the related technology by the fact that the microcontrollers connected in a communication way are virtual safety monitoring domains of each other; the power management chip is not required to be internally provided with a safety monitoring domain, and the safety level is set to be the QM level so as to meet the requirement of independent safety monitoring, thereby reducing the cost of the power management chip and improving the design freedom of the board-level circuit; in addition, the microcontroller monitoring circuit also meets the functional safety design requirements of independent monitoring of power supply voltage of a power management chip, watchdog monitoring, internal fault monitoring, safety state, failure safety shutdown and the like.
In other embodiments, the microcontroller monitoring circuit may also include other devices known to those skilled in the art, and are not described in detail herein.
On the basis of the implementation manner, the embodiment of the disclosure also provides a microcontroller monitoring method, which is applicable to any monitoring circuit. Fig. 6 is a schematic flow chart of a monitoring method of a microcontroller according to an embodiment of the disclosure. Referring to fig. 6, the method includes:
s110, receiving working parameters sent by a microcontroller in communication connection.
The working parameters comprise power supply partial pressure, a dog feeding signal and internal operation parameters.
And S120, determining a protective measure trigger instruction based on the working parameters, and sending the protective measure trigger instruction to a microcontroller in communication connection.
The protection measure triggering instruction is used for controlling the microcontroller connected with the communication to execute the corresponding protection measure.
The protection measures include closing a power supply path between the fault microcontroller and the corresponding power management chip, resetting the fault microcontroller, and turning off a load on the fault microcontroller. The method comprises the steps that a mapping relation exists between a fault type and a protection measure, if the fault type is overvoltage power supply, the protection measure is to close a power supply path between a fault microcontroller and a corresponding power management chip, reset the fault microcontroller and turn off a load on the fault microcontroller; if the fault type is at least one of an under-voltage power supply, a watchdog fault, and an internal operation fault, the protection measure is to reset the faulty microcontroller and turn off the load on the faulty microcontroller.
Wherein S120 "determines a protection measure trigger instruction based on the working parameter, and sends the protection measure trigger instruction to the microcontroller in communication connection", including:
s121, determining the fault type when the preset condition is met based on the working parameters.
Wherein the fault types include supply voltage faults (overvoltage or undervoltage), dog feeding faults and internal operation faults; the judging conditions for determining the fault type are respectively as follows:
(1) When the power supply partial pressure is larger than a first voltage threshold value, determining that the fault type is overvoltage power supply;
(2) When the power supply partial pressure is smaller than the second voltage threshold value, determining that the fault type is under-voltage power supply;
wherein the first voltage threshold is greater than the second voltage threshold.
The analog-digital converter of the microcontroller collects primary power supply partial pressure data in a preset time interval (such as 1 millisecond), the collected power supply partial pressure is respectively compared with a first voltage threshold value and a second voltage threshold value, and if the collected power supply partial pressure is larger than the first voltage threshold value, the fault type is determined to be power supply overvoltage; if the acquired power supply partial pressure is smaller than the second voltage threshold value, determining that the fault type is power supply undervoltage; if the collected power supply voltage is between the first voltage threshold and the second voltage threshold, the power supply voltage is normal and has no fault.
Wherein the power supply voltage division comprises one of real-time voltage division and average value; for example, the supply voltage is a real-time voltage, and the fault type of the supply voltage is determined based on the collected supply voltage; the power supply partial pressure is an average value, the average value of all the power supply partial pressures acquired in a preset time period or the average value of the power supply partial pressures of a preset number is calculated, the power supply partial pressure is determined based on the average value of the power supply partial pressures, or N pieces of similar abnormal power supply partial pressure data, such as 3 power supply partial pressures which are larger than a first voltage threshold value and are continuously acquired, and the fault type is determined to be overvoltage power supply.
(3) And when the feeding time is wrong or the feeding answer is wrong, determining that the fault type is a watchdog fault.
Wherein, the dog feeding signal is not received in a preset time interval or the sending time of the dog feeding signal is not in a preset period, which belong to the dog feeding time error; for example, the feeding dog signal is preset to be sent once every 20 milliseconds, the first 10 milliseconds are the windowing period, the second 10 milliseconds are the window closing period, and only the feeding dog signal sent in the windowing period can be received; if the time interval of each feeding exceeds 20 ms (i.e. the feeding signal is not received within the preset time interval), or if the sending time of the feeding signal belongs to the window closer (i.e. the sending time of the feeding signal is not within the preset period).
The method comprises the steps that a dog feeding mode comprises two modes of fixed answers and random answers, information included in a dog feeding signal in the fixed answer mode is fixed, and if an answer contained in the received dog feeding signal is inconsistent with the fixed answer, a dog feeding answer error is determined; the information of the dog feeding in the random answer mode is changed, and the working principle is as follows: MCU (micro control Unit) 2 First slave MCU 1 Acquisition problem, MCU 2 Calculating according to the questions and sending answers to the MCU in the windowing period 1 ，MCU 1 And comparing the received answer with the local answer, and if the answer is inconsistent, feeding the dog with the answer is wrong.
In other embodiments, the feeding form may also be configured in other modes known to those skilled in the art, and is not limited herein.
(4) And when the internal operation parameters exceed the preset parameter threshold, determining the fault type as the internal fault.
The preset parameter threshold is an internal operation parameter range when the microcontroller operates normally; if the collected internal operating parameters of the microcontroller exceed the range, determining the fault type as an internal fault.
S122, determining protection measures based on the fault type.
Wherein, based on the mapping relation of the fault type and the protection measures, when the fault type is overvoltage power supply, determining the protection measures to close a power supply path between the fault microcontroller and the corresponding power management chip, resetting the fault microcontroller, and turning off the load on the fault microcontroller; when the fault type is at least one of an under-voltage power supply, a watchdog fault, and an internal operating fault, the protection measure is determined to be resetting the faulty microcontroller, and the load on the faulty microcontroller is turned off.
S123, determining a protective measure trigger instruction based on the protective measure, and sending the protective measure trigger instruction to a microcontroller in communication connection.
The protection measure triggering instruction comprises a fault type and protection measures, the protection measure triggering instruction is sent to the microcontroller connected with the communication, and the microcontroller connected with the communication executes the corresponding protection measures, so that the microcontroller connected with the communication is prevented from being damaged.
S130, sending working parameters to a microcontroller in communication connection.
And S140, receiving a protective measure triggering instruction sent by the microcontroller in communication connection.
The protective measure triggering instruction is determined by the microcontroller connected with the communication based on the received working parameters.
After receiving the protection measure triggering instruction, the microcontroller executes the corresponding protection measure to avoid the damage of the microcontroller.
It should be noted that, the method for monitoring the microcontroller is executed by the microcontroller, because the microcontrollers in communication connection are virtual safety monitoring domains of each other, that is, the microcontrollers in communication connection monitor each other, the microcontrollers can monitor other microcontrollers as well as other microcontrollers, therefore, S110-S120 and S130-S140 are mutually independent two steps branches, S110-S120 is a monitoring step, and S130-S140 is a monitored step; wherein, S110-S120 need to be executed in sequence, S130-S140 need to be executed in sequence, but S110-S120 and S130-S140 need not to be executed in sequence, and can be executed simultaneously (for example, S110 and S130 are executed simultaneously, and S120 and S140 are executed simultaneously); or may be sequentially executed (e.g., S110 to S120 are executed first and S130 to S140 are executed later, or S130 to S140 are executed first and S110 to S120 are executed later); or cross-execution (e.g., in the order of s110→s120 and s130→s140 and s110→s120 and S130; or in the order of s130→s110 and s140→s120 and 130→s110 and S140; or in the order of s110→s130→s120→s140, or in the order of s130→s110→s140→s120, or in the order of s110→s130→s140→s120→s140), is not limited herein.
On the basis of the implementation manner, the embodiment of the disclosure also provides a microcontroller monitoring device, which is arranged in the microcontroller. Fig. 7 is a schematic structural diagram of a monitoring device of a microcontroller according to an embodiment of the disclosure. Referring to fig. 7, the monitoring apparatus includes: a parameter receiving module 21 for receiving the working parameters sent by the microcontroller in communication connection; the instruction determining module 22 is configured to determine a protection measure triggering instruction based on the working parameter, and send the protection measure triggering instruction to the microcontroller connected with the communication link; the protection measure triggering instruction is used for controlling the microcontroller connected with the communication to execute corresponding protection measures; a parameter sending module 23, configured to send working parameters to a microcontroller connected to the communication device; the instruction receiving module 24 is used for receiving a protection measure triggering instruction sent by the microcontroller in communication connection; the protective measure triggering instruction is determined by the microcontroller connected with the communication based on the received working parameters.
On the basis of the foregoing implementation manner, the embodiment of the present disclosure further provides a computer-readable storage medium, where a program or instructions are stored, where the program or instructions cause a computer to perform the steps of the foregoing method; has the same or corresponding beneficial effects and is not repeated here.
On the basis of the foregoing implementation manner, the embodiment of the present disclosure further provides a vehicle-mounted computer, where the vehicle-mounted computer includes: any one of the above monitoring circuits, and/or the above monitoring device; has the same or corresponding beneficial effects and is not repeated here.
On the basis of the foregoing implementation manner, the embodiment of the present disclosure provides a vehicle, including: the above vehicle-mounted computer has the same or corresponding beneficial effects, and is not repeated here.
It should be noted that in this document, relational terms such as "first" and "second" and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
The foregoing is merely a specific embodiment of the disclosure to enable one skilled in the art to understand or practice the disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the disclosure. Thus, the present disclosure is not intended to be limited to the embodiments shown and described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (11)
1. A microcontroller monitoring circuit, comprising:
at least two microcontrollers, each of the microcontrollers is electrically connected with a power management chip, and the power management chip is used for supplying power to the corresponding microcontroller;
wherein one of the microcontrollers is communicatively connected with at least one of the remaining other microcontrollers; the microcontrollers in communication with each other are virtual security monitoring domains of each other.
2. The monitoring circuit of claim 1, wherein one of the microcontrollers is communicatively coupled to the remaining other microcontrollers.
3. The monitoring circuit of claim 2, wherein each of said microcontrollers is configured with a voltage divider circuit; the power management chip is electrically connected with the microcontroller and is connected with the input end of the voltage dividing circuit, and the microcontroller in communication connection with the microcontroller is connected with the output end of the voltage dividing circuit.
4. A monitoring circuit according to claim 3, wherein each of the microcontrollers comprises an analog to digital converter; the analog-digital converter is used for receiving the partial pressure transmitted by the partial pressure circuit;
the analog-digital converter is connected with the output end of the voltage dividing circuit.
5. A monitoring circuit according to claim 3, wherein each of the microcontrollers further comprises an output interface for controlling the conduction and closure of a power supply path between a microcontroller communicatively connected to the microcontroller and a corresponding power management chip.
6. The monitoring circuit of claim 5, further comprising a gating switch; the gating switch is arranged on a power supply path between the microcontroller and a corresponding power management chip, is integrated on the microcontroller or is integrated on any one of the power management chips; the output interface is electrically connected with the gating switch.
7. A method of monitoring a microcontroller, adapted for use in a monitoring circuit as claimed in any one of claims 1 to 6, the method comprising:
receiving working parameters sent by a microcontroller in communication connection;
Determining a protective measure trigger instruction based on the working parameters, and sending the protective measure trigger instruction to the microcontroller connected with the communication; the protection measure triggering instruction is used for controlling the microcontroller connected with the communication to execute corresponding protection measures;
sending working parameters to the microcontroller in communication connection;
receiving a protective measure triggering instruction sent by the microcontroller in communication connection; wherein the protective measure trigger instruction is determined by the communicatively connected microcontroller based on the operating parameter it receives.
8. A microcontroller monitoring device, comprising:
the parameter receiving module is used for receiving working parameters sent by the microcontroller in communication connection;
the instruction determining module is used for determining a protective measure triggering instruction based on the working parameters and sending the protective measure triggering instruction to the microcontroller in communication connection; the protection measure triggering instruction is used for controlling the microcontroller connected with the communication to execute corresponding protection measures;
the parameter sending module is used for sending working parameters to the microcontroller in communication connection;
the instruction receiving module is used for receiving a protective measure triggering instruction sent by the microcontroller in communication connection; wherein the protective measure trigger instruction is determined by the communicatively connected microcontroller based on the operating parameter it receives.
9. A computer-readable storage medium storing a program or instructions that cause a computer to perform the steps of the method of claim 7.
10. A vehicle-mounted computer comprising the monitor circuit according to any one of claims 1 to 6;
and/or a monitoring device as claimed in claim 8.
11. A vehicle comprising the vehicle-mounted computer of claim 10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210264814.0A CN116795013A (en) | 2022-03-17 | 2022-03-17 | Microcontroller monitoring circuit, method, device, medium, vehicle-mounted computer and vehicle |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210264814.0A CN116795013A (en) | 2022-03-17 | 2022-03-17 | Microcontroller monitoring circuit, method, device, medium, vehicle-mounted computer and vehicle |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116795013A true CN116795013A (en) | 2023-09-22 |
Family
ID=88033217
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210264814.0A Pending CN116795013A (en) | 2022-03-17 | 2022-03-17 | Microcontroller monitoring circuit, method, device, medium, vehicle-mounted computer and vehicle |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116795013A (en) |
-
2022
- 2022-03-17 CN CN202210264814.0A patent/CN116795013A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US6883123B2 (en) | Microprocessor runaway monitoring control circuit | |
| US10576990B2 (en) | Method and device for handling safety critical errors | |
| US7251551B2 (en) | On-vehicle electronic control device | |
| KR101625864B1 (en) | Apparatus and method of providing integrated fault diagnosis control for low voltage DC-DC converter, and computer-readable recording medium for the same | |
| US7555353B2 (en) | Input device of safety unit | |
| CN109541457A (en) | Power battery high-voltage relay control circuit and method for diagnosing faults | |
| CN111007713A (en) | Heterogeneous redundant vehicle control unit conforming to functional safety | |
| CN104423374B (en) | Controller for automobile and the automobile with it, monitoring method | |
| US20100109430A1 (en) | Modular power distribution system, method, and apparatus having configurable outputs | |
| US6297569B1 (en) | Power switching system | |
| CN107433977B (en) | Electric power steering system with watchdog monitoring function and control method thereof | |
| CN116795013A (en) | Microcontroller monitoring circuit, method, device, medium, vehicle-mounted computer and vehicle | |
| CN213337963U (en) | Fill electric pile intellectual detection system | |
| CN206133294U (en) | Controller fault protection system | |
| CN105425773A (en) | Relay output channel diagnosis device and method for control system | |
| CN116165875A (en) | Cold backup control system and method for vehicle chassis controller | |
| CN216851277U (en) | Anti-misoperation circuit for relay protection device and relay protection device | |
| JPH01298446A (en) | Double microcomputer system runaway preventing circuit | |
| CN203224778U (en) | High-safety-performance ECU architecture for electric car | |
| EP0486222A2 (en) | Improvements in and relating to microprocessor based systems | |
| CN114184992A (en) | Method, apparatus and computer program for verifying power supply monitoring | |
| CN112721639B (en) | Relay control method and device | |
| EP3252486B1 (en) | A safety circuit | |
| EP3616027B1 (en) | Method for controlling a low consumption mode of an electronic circuit unit, control device, and motor vehicle | |
| DE19624140A1 (en) | System for transferring data |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |