WO2023010250A1 - 控制装置、电子控制系统及车辆 - Google Patents

控制装置、电子控制系统及车辆 Download PDF

Info

Publication number
WO2023010250A1
WO2023010250A1 PCT/CN2021/110122 CN2021110122W WO2023010250A1 WO 2023010250 A1 WO2023010250 A1 WO 2023010250A1 CN 2021110122 W CN2021110122 W CN 2021110122W WO 2023010250 A1 WO2023010250 A1 WO 2023010250A1
Authority
WO
WIPO (PCT)
Prior art keywords
signal
control circuit
control
circuit
clock
Prior art date
Application number
PCT/CN2021/110122
Other languages
English (en)
French (fr)
Inventor
陈学锋
李�杰
覃涛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202180002095.9A priority Critical patent/CN113767340A/zh
Priority to PCT/CN2021/110122 priority patent/WO2023010250A1/zh
Publication of WO2023010250A1 publication Critical patent/WO2023010250A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0423—Input/output
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/20—Pc systems
    • G05B2219/25—Pc structure of the system
    • G05B2219/25257—Microcontroller

Definitions

  • the embodiments of the present application relate to the technical field of electric control, and specifically relate to a control device, an electronic control system, and a vehicle.
  • the microcontroller or microcontroller unit With the rapid development of power electronics and power devices, the microcontroller or microcontroller unit (MCU) software and hardware control capabilities have been greatly enhanced. More and more devices use electronic control systems to control functions. Different from the traditional mechanical functional system, the electronic control system uses MCU to realize fast and fine control of power devices, and then can more accurately assist equipment to achieve the required functions. Taking the steering function of the vehicle as an example, compared with the traditional mechanical hydraulic power steering system, the electric power steering system (electric power steering, EPS) uses the MCU to achieve fast and fine control of the power device, which can assist the vehicle steering more accurately .
  • EPS electric power steering
  • Embodiments of the present application provide a control device, an electronic control system, and a vehicle, which can improve the functional safety of the electronic control system.
  • An embodiment of the present application provides a control device, configured to provide a control signal to a driving device, and the driving device is used to drive a function executing component.
  • the control device includes: a first control circuit, a second control circuit, and a selection unit.
  • the first control circuit is used to output the first control signal under the action of the first clock signal;
  • the second control circuit is used to output the second control signal under the action of the second clock signal;
  • the selection unit is used to output the first control signal
  • the output of the first control signal or the second control signal is the control signal of the driving device.
  • the first clock signal and the second clock signal have the same frequency, and the time zero of the first control circuit and the second control circuit are the same.
  • the selection unit may output the control signal output by the first control circuit as the control signal of the driving device, or output the control signal output by the second control circuit as the control signal of the driving device. Since the frequency of the clock signal used by the second control circuit and the first control circuit is the same, the operating frequency of the second control circuit and the first control circuit are the same. The time zero point of the first control circuit is the same as the time zero point of the second control circuit, so that the second control circuit and the first control circuit start working at the same time.
  • control signal output by the first control circuit and the control signal output by the second control circuit are the same or close to each other, so that the driving device is switched to the state controlled by the control signal output by the first control circuit to the control signal output by the second control circuit. 2.
  • the driving of the driving device may not change or fluctuate greatly, thereby improving the functional safety of the electronic control system.
  • the first clock signal and the second clock signal come from the same clock source.
  • the first control circuit and the second control circuit use the same clock source, which ensures that the operating frequencies of the first control circuit and the second control circuit are the same.
  • the first control circuit is connected to the same clock source, receives the first clock signal from the same clock source, and outputs the second clock signal to the second control circuit.
  • the second clock signal may be generated by the first control circuit according to the first clock signal.
  • the clock source can send a clock signal to the first control circuit, and the first control circuit can send a second clock signal to the second control circuit, so that the first control circuit and the second control circuit can Operates under the action of a clock signal of the same frequency.
  • the first control circuit and the second control circuit are respectively connected to the same clock source, respectively receive the first clock signal and the second clock signal from the same clock source, and the first clock signal and the second clock signal are the same clock signal.
  • both the first control circuit and the second control circuit can be directly connected to the clock source, so as to receive the clock signal sent by the clock source at the same time, so that the first control circuit and the second control circuit can be Operates under the action of a clock signal of the same frequency.
  • the device further includes: a detection unit, configured to detect the validity of at least two clock sources, and control the first clock signal and the second clock signal from at least two clock sources A valid clock source in source.
  • a detection unit configured to detect the validity of at least two clock sources, and control the first clock signal and the second clock signal from at least two clock sources A valid clock source in source.
  • the validity of the at least two clock sources can be detected by the detection unit, which can ensure that the control circuit can work under the effect of the effective clock source.
  • the detection unit is located in the first control circuit and/or the second control circuit.
  • the first control circuit and/or the second control circuit can detect the validity of the at least two clock sources, so that no special detection unit is required, which reduces the cost of the control device.
  • the selection unit is located in the first control circuit and/or the second control circuit.
  • the first control circuit and/or the second control circuit can select the control signal of the driving device, so that no special selection unit is required, which reduces the cost of the control device.
  • At least one element is disposed between the first control circuit and the second control circuit, and the at least one element includes a resistive element or a capacitive element, or includes a resistive element and a capacitive element.
  • the embodiment of the present application provides an electronic control system, including the control device and the drive device provided in the first aspect; wherein, the drive device includes: a first drive circuit, used to receive the output of the selection unit of the control device The control signal, and under the action of the control signal, output the first driving signal; the second driving circuit is used to receive the control signal output by the selection unit of the control device, and under the action of the control signal, output the second driving signal.
  • the drive device includes: a first drive circuit, used to receive the output of the selection unit of the control device The control signal, and under the action of the control signal, output the first driving signal;
  • the second driving circuit is used to receive the control signal output by the selection unit of the control device, and under the action of the control signal, output the second driving signal.
  • This scheme realizes the backup redundancy of the driving circuit by setting the first driving circuit and the second driving circuit; and the first driving circuit and the second driving circuit are controlled by the same control signal, and can generate the same or similar driving signals.
  • the other drive circuit ensures the functional safety of the electronic control system.
  • the first driving signal and the second driving signal are used to drive the first function executing component
  • the system further includes: a first phase-opening circuit, which is provided between the first driving circuit and the second Between a function execution part, it is used to enter the disconnected state when the first drive circuit fails; the second phase-opening circuit is arranged between the second drive circuit and the first function execution part, and is used to switch on the second drive circuit In the event of a fault, enter the disconnected state.
  • a phase failure can be set between the drive circuit and the function execution component.
  • the phase failure enters the disconnected state, which can avoid the influence of the faulty drive circuit on the function execution component.
  • the first driving signal and the second driving signal are also used to drive the second function executing component
  • the system further includes: a third phase-opening circuit, which is provided between the first driving circuit and the Between the second function execution parts, it is used to enter the disconnected state when the first drive circuit fails; the fourth open phase circuit is arranged between the second drive circuit and the second function execution part, and is used for When the second drive circuit fails, it enters the disconnected state.
  • a phase failure can be set between the drive circuit and the function execution component.
  • the phase failure enters the disconnected state, which can avoid the influence of the faulty drive circuit on the function execution component.
  • a driving circuit selection unit configured to, according to the first power supply voltage of the first driving circuit and the second power supply voltage of the second driving circuit, select the first driving signal, Or the second driving signal, or the first driving signal and the second driving signal are output to the function executing part.
  • an appropriate drive signal can be selected from the first drive signal and the second drive signal to drive the function executing component.
  • the first power supply voltage is greater than the second power supply voltage, and when the voltage difference between the first power supply voltage and the second power supply voltage is within a preset range, the first Outputting the driving signal and the second driving signal to the function executing part; or, outputting the first driving signal to the function executing part when the voltage difference between the first power supply voltage and the second power supply voltage is outside a preset range ; Or, when the voltage difference between the first power supply voltage and the second power supply voltage is greater than the threshold value, the first drive signal and the second drive signal are output to the function execution component; or between the first power supply voltage and the second power supply voltage When the voltage difference between is less than the threshold value, the first driving signal is output to the function executing part; or, when the voltage difference between the first power supply voltage and the second power supply voltage is equal to the threshold value, the first driving signal and the second driving signal Outputting to the function execution part, or outputting the first drive signal to the function execution part.
  • the driving signal output to the function execution component can be selected according to the power supply voltages corresponding to different driving devices, which further improves the functional safety of the electronic control system.
  • the system further includes: a first clock source and a second clock source; where the first clock signal and the second clock signal come from the first clock source or the second clock source.
  • the clock sources are redundantly set, and when one of the clock sources fails, the other clock source sends a clock signal to the control circuit, which reduces the probability of failure of the control device function caused by the failure of the clock source , further improving the functional safety and failure operability of the electronic control system.
  • clock frequencies of the first clock source and the second clock source are the same.
  • the detection unit of the control device is configured to detect the clock signal output by the first clock source and the clock signal output by the second clock source, and when the clock signal output by the first clock source Invalid, and the clock signal output by the second clock source is valid, control the first clock signal and the second clock signal from the second clock source, or, when the clock signal output by the second clock source fails, and the output of the first clock source When the clock signal is valid, the first clock signal and the second clock signal are controlled to come from the first clock source.
  • the clock signal of the valid clock source can be applied to the control circuit to ensure the normal operation of the control circuit .
  • the at least one element there is at least one element between the first driving circuit and the second driving circuit, and the at least one element includes a resistive element or a capacitive element, or includes a resistive element and a capacitive element.
  • an embodiment of the present application provides an abnormality detection method for an electronic control system, including: acquiring a first signal from a first component and a second signal from a second component, and the first component and the second component are mutually Redundancy; based on the first signal and the second signal, determining that the electronic control system fails.
  • the first component is a first control circuit, and the first signal is a control signal output by the first control circuit under the action of a first clock signal;
  • the second component is a second control circuit, and the second The signal is a control signal output by the second control circuit under the action of the second clock signal; wherein, the first clock signal and the second clock signal have the same frequency, and the time zero of the first control circuit and the second control circuit are the same.
  • the first component is a first drive circuit, and the first signal is a drive signal output by the first drive circuit under the action of a control signal;
  • the second component is a second drive circuit, and the second signal is The driving signal output by the second driving circuit under the action of the control signal.
  • the driving signals output by the two driving circuits under the action of the same control signal are the same or close; in this implementation, by comparing the two driving circuits under the action of the same control signal The output driving signal can determine whether the electronic control system fails.
  • the first component is a first function execution component, and the first signal is a signal generated by the first function execution component driven by a driving signal;
  • the second component is a second function execution component, and the second signal It is a signal generated under the driving of the second function executing component.
  • an embodiment of the present application provides an abnormality detection device, including: an acquisition unit, configured to acquire a first signal from a first component and a second signal from a second component, and the first component and the second component are mutually It is redundant; the determination unit is configured to determine the failure of the electronic control system according to the first signal and the second signal.
  • the first component is a first control circuit, and the first signal is a control signal output by the first control circuit under the action of a first clock signal;
  • the second component is a second control circuit, and the second The signal is a control signal output by the second control circuit under the action of the second clock signal; wherein, the first clock signal and the second clock signal have the same frequency, and the time zero of the first control circuit and the second control circuit are the same.
  • the first component is a first drive circuit, and the first signal is a drive signal output by the first drive circuit under the action of a control signal;
  • the second component is a second drive circuit, and the second signal is The driving signal output by the second driving circuit under the action of the control signal.
  • the first component is a first function execution component, and the first signal is a signal generated by the first function execution component driven by a driving signal;
  • the second component is a second function execution component, and the second signal It is a signal generated under the driving of the second function executing component.
  • the embodiment of the present application provides an anomaly detection device, including a processor, a memory, and a communication interface; wherein the memory is used to store computer instructions, and when the computer instructions are executed by the processor, the anomaly detection device executes the third method provided.
  • the embodiment of the present application provides a vehicle, including the system and the function execution component provided in the second aspect.
  • the embodiment of the present application provides a vehicle, including the device and the function executing component provided in the first aspect.
  • the embodiment of the present application provides a vehicle, including the device and the function execution component provided in the fourth aspect.
  • a vehicle provided in an embodiment of the present application includes the device and the function executing component provided in the fifth aspect.
  • the clock signals of the first control circuit and the second control circuit have the same frequency, and the time zero of the first control circuit and the second control circuit are the same, so that the first control circuit
  • the control signals output by the circuit and the second control circuit are as identical as possible, so that when the selection circuit successively outputs the control signal output by the first control circuit and the control signal output by the second control circuit as the control signal of the drive device, the drive device The drive can not undergo large changes or fluctuations, thereby improving the functional safety of the electronic control system.
  • FIG. 1A is a schematic structural diagram of a vehicle provided in an embodiment of the present application.
  • FIG. 1B is a schematic structural diagram of a vehicle provided in an embodiment of the present application.
  • Fig. 1C is a schematic structural diagram of a vehicle provided in an embodiment of the present application.
  • FIG. 1D is a schematic structural diagram of a vehicle provided in an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of an electronic control system provided by an embodiment of the present application.
  • FIG. 3A is a schematic structural diagram of an electronic control system provided by an embodiment of the present application.
  • FIG. 3B is a schematic structural diagram of an electronic control system provided by an embodiment of the present application.
  • FIG. 4A is a relationship diagram between a power supply voltage and a motor input voltage provided by an embodiment of the present application
  • FIG. 4B is a relationship diagram between a power supply voltage and a motor input voltage provided in an embodiment of the present application.
  • FIG. 5A is a schematic diagram of a winding arrangement of a redundant motor provided in an embodiment of the present application.
  • FIG. 5B is a schematic diagram of a winding arrangement of a redundant motor provided in an embodiment of the present application.
  • FIG. 6 is a flow chart of an abnormality detection method provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a current output by a three-phase inverter circuit provided in an embodiment of the present application.
  • FIG. 8 is a schematic diagram of a waveform of a current output by a redundant inverter circuit provided in an embodiment of the present application.
  • FIG. 9 is a functional safety monitoring framework diagram provided by an embodiment of the present application.
  • FIG. 10 is another functional safety monitoring framework diagram provided by the embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of an abnormality detection device provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of another abnormality detection device provided by an embodiment of the present application.
  • first and second are only used for conveniently distinguishing the described objects, and have no limiting meaning, for example, there is no limitation on the order, importance and quantity of the described objects.
  • plural means two or more.
  • the naming or numbering of the steps in this application does not mean that the steps in the method flow must be executed in the time/logic sequence indicated by the naming or numbering. The execution order of the technical purpose is changed, as long as the same or similar technical effect can be achieved.
  • vehicle 100 includes a drive system, a chassis 120 and a body 130 .
  • the drive system includes a power device 110 and a drive controller.
  • the drive controller can control the power device 110 to provide power for the vehicle 100 .
  • the power device 110 may be a fuel engine, a battery device, or both an engine and a battery device.
  • the power device 110 in FIG. 1 takes an engine as an example. In other implementations, the power device may be a battery pack and an electric drive device, which are installed on the chassis 120 and located under the cabin 140 .
  • the chassis 120 is used to support and install the power unit 110 and other components of the vehicle 100 to form the overall shape of the vehicle, and receives power from the power unit 110 to make the vehicle 100 move and ensure the normal running of the vehicle 110 .
  • the chassis 120 includes, for example, a drive train 121 , a running train 122 , a steering train 123 and a brake train 124 .
  • the drive train 121 is used to transmit the power generated by the power plant of the vehicle to the driving wheels, including the power transmission device between the power plant of the vehicle and the driving wheels.
  • the power transmission device between the power plant of the vehicle and the driving wheels.
  • the driving wheels including clutches, transmissions, drive shafts, drive axles and other devices.
  • the driving system 122 is used to cooperate with other systems to ensure the normal driving of the vehicle.
  • the running system 122 includes parts such as vehicle frame, vehicle axle, wheel and suspension.
  • the front and rear wheels are respectively supported on the axles (front axle, rear axle).
  • the axles can be connected to the vehicle body through elastic suspensions.
  • the driving system 122 receives the power of the transmission system 121, generates traction through the action of the driving wheel and the road surface, so that the vehicle can run normally; and bears the weight of the vehicle and the reaction force of the ground; eases the impact of the uneven road on the vehicle body, and attenuates the driving force of the vehicle. Vibration, to maintain the ride comfort; and cooperate with the steering system 123, to ensure vehicle handling stability.
  • the steering system 123 is used to change or maintain the driving or reverse direction of the vehicle, and the steering system 123 mainly includes a steering mechanism, a steering gear and a steering transmission mechanism.
  • Steering mechanisms may include devices such as a steering wheel (eg, a steering wheel), a steering shaft, and a steering column.
  • the steering gear converts the rotation of the steering wheel into the swing of the steering rocker arm or the linear reciprocating motion of the rack shaft, and amplifies the steering force.
  • the steering transmission mechanism transmits the force and motion output by the steering gear to the wheels, and makes the left and right wheels deflect.
  • the brake system 124 is used to apply a certain force to a certain part of the vehicle (for example, the wheels), so that the running vehicle is forced to decelerate or even stop; ) steady parking; keep the speed of the vehicle running downhill at a stable speed.
  • the brake system 124 mainly includes a brake operating mechanism (eg, including a brake pedal) and a brake actuator (eg, including a brake disc).
  • a function executing component refers to a component that can realize a certain function under the action of a driving signal (such as a voltage), and the function refers to a function used by the electronic control system for control or auxiliary realization.
  • a driving signal such as a voltage
  • an electronic control system may be used in a power plant, transmission system, steering system, or brake system to control or assist in the realization of driving, transmission, steering, or braking functions.
  • the function execution component may be an electric motor, and the electric motor may output torque under the action of a driving signal to realize related functions, such as driving, transmission, steering, or braking functions.
  • the electronic control system can be used in the steering system 123, which is an electric power steering (EPS) control system, and the function execution component can be an electric motor for driving the steering function in the steering system 123.
  • the electronic control system can be used in the braking system 124, which is an electromechanical braking (electric mechanical braking, EMB) control system, and the function execution component can be used in the braking system 124 to drive the brake function. electric motor.
  • the electronic control system can be used in the transmission system 121 to assist or control the realization of the transmission function, and the function executing component can be an electric motor in the transmission system 121 for driving the transmission function.
  • the electronic control system can be understood as the drive controller of the vehicle 100
  • the function executing components can be understood as the power unit 110 of the vehicle 100 , which will not be listed here.
  • An abnormality of the MCU may lead to the failure of the function of the electronic control system, and the occurrence of an abnormality of the MCU is often sudden, so that the electronic control system may suddenly fail. If the electronic control system suddenly fails while the vehicle is running, causing related functions (such as power steering function) to fail, it may endanger the personal safety of the vehicle occupants or people around the vehicle.
  • the electronic control system can be redundantly backed up, and the redundant backup can be double-redundantly backed up (including one auxiliary system), or more redundantly backed up (including at least two auxiliary systems), and the main system and the auxiliary system are relatively independent work.
  • redundant backup is not enough to make full use of the redundancy capability of the electronic control system, especially in vehicles, which have extremely high safety requirements, redundant backup is not enough in timeliness. Require.
  • An embodiment of the present application provides a control device, which includes redundant control circuits to output redundant control signals; that is, the control device includes at least two control circuits, one of which is the basic part (or main control circuit), other control circuits are redundant parts (auxiliary control circuit), and the main control circuit and auxiliary control circuit can be interchanged, that is, the main control circuit can be used as an auxiliary control circuit, and the auxiliary control circuit can be used as a main control circuit.
  • the main control circuit and the auxiliary control circuit work under the clock signal of the same frequency, and the time synchronization between the active circuit and the auxiliary control circuit means that the clock signal of the control circuit has the same frequency and the same zero point of time, so that the synchronous operation of the control circuit can be realized.
  • seamless switching between control circuits is realized to improve the utilization efficiency of the redundant system.
  • it can provide synchronous redundant signal monitoring for the hardware and software signals of the redundant system, especially the monitoring ability for fast alternating signals, which can greatly improve system-level functional safety ability.
  • FIG. 2 is a schematic structural diagram of an electronic control system provided by an embodiment of the present application.
  • the electronic control system 200 includes a control part 210 and a power part (or drive part) 220, the control part 210 is used to provide a control signal for the power part 220, and the power part 220 generates a drive signal under the control of the control signal , work with the driving function execution part, so the power part 220 can also be called a power circuit or a drive circuit;
  • the function execution part is the same as the above description, and is used in the system where it is applied under the action of the drive signal of the drive circuit to realize the corresponding function, the function executing component may also be referred to as a function executing system or a function executing device.
  • the electronic control system has redundant backups, including redundant backups of the control part 210 and/or redundant backups of the power part 220 .
  • control part 210 of the electronic control system is redundantly backed up, and a control device 210 is provided, that is, as the control part of the electronic control system.
  • the control device 210 includes at least two control circuits for outputting control signals under the action of clock signals, wherein the clock signals provided to these control circuits have the same frequency, and the control circuits have the same time zero.
  • the control device includes a control circuit 211, a control circuit 212 and a selection unit 213, wherein the control circuit 211 outputs the control signal S1 under the action of the clock signal C1, and the control circuit 212 outputs the control signal S1 under the action of the clock signal C2.
  • the output control signal S2, the selection unit 213 is used to output the control signal S1 or the control signal S2 as the control signal of the power part (driver circuit) 220, the clock signal C1 and the clock signal C2 have the same frequency, and the control circuit 211 and the control circuit Time zero at 212 is the same.
  • the control circuit 211 and the control circuit Time zero at 212 is the same.
  • only two control circuits are shown in the figure. In actual use, more redundant backups can be performed, that is, more control circuits are included. The present application does not limit the number of redundant control circuits.
  • the frequency of the clock signal represents or weighs the operating frequency of the control circuit.
  • the frequency of the clock signal of the control circuit of the control device is the same, so that the operating frequency of the control circuit is the same; the zero point of time represents the working start time of the control circuit; then the above
  • the working frequency of at least two control circuits of the control device is the same, and the working start time is also the same, so that the working time of the at least two control circuits is synchronized, so that at least two synchronous control signals can be generated.
  • the failed control signal can be quickly replaced by another control signal to realize seamless switching between control circuits, which further improves the functional safety of the electronic control system while realizing fail operational.
  • Failure operability can also be referred to as failure operability or failure operability, which belongs to the category of functional safety. Failover can maintain functional availability through redundant support functions. Specifically, two or more functional modules that can support function A can be set, and when a certain functional module fails, function A will not fail because of the support of other functional modules. Taking over can be understood as taking over the work of other modules.
  • the above control signal may be a pulse signal (also called a duty cycle signal), such as a pulse width modulation (pulse width modulation, PWM) signal.
  • the above control circuit includes a counting part, counting from time zero, counting once in each clock cycle of the clock signal, that is, counting each clock pulse, when the count value reaches the preset value, the control circuit outputs a pulse signal,
  • the embodiment of the present application does not limit the pulse width of the pulse signal.
  • the control circuits have the same time zero point, which can be understood as the same counting starting point of the control circuits.
  • the function of the counting part of the control circuit can be implemented by software or by hardware, which is not limited in this application.
  • the counting part of the control circuit can be called a frequency counting unit, a counter or a timer, and the time zero (working start time) of the frequency counting unit of the control circuit, the counter or the timer is the same.
  • the counting part of the control circuit may include a system timing module (system time module, STM), a general timing module (generic time module, GTM), a pulse width modulation (pulse width modulation, PWM) generating unit one or more of .
  • STM system time module
  • GTM general timing module
  • PWM pulse width modulation
  • the time zero point of the control circuit is the same, which means that the start time of the control circuit is the same or the time difference of the start time is less than the tolerance value.
  • the tolerance value can be a preset fixed value, or can be determined according to the clock signal of the control circuit, or according to the electronic control system.
  • the bus clock is determined.
  • the clock signal of the control circuit can come from the bus clock of the electronic control system, or can be set independently for it.
  • the clock can also be called a clock source.
  • the tolerance value is the clock signal of the control circuit or the pulse period of the bus clock.
  • the time zero of the control circuit 211 and the control circuit 212 are at the same time or the time difference between the time zero is less than the pulse period of the bus clock.
  • the bus clock refers to the peripheral bus clock of the control circuit (such as MCU). In one implementation, driven by the clock signal sent by the bus clock, the counting parts of the control circuit 211 and the control circuit 212 respectively perform counting.
  • the bus clock may be a common clock source of the control circuit 211 and the control circuit 212 , such as a clock source CK1 or a clock source CK2 .
  • the pulse period of the clock refers to the time difference between the generation moments of two adjacent clock pulses of the clock signal, which is the reciprocal of the clock frequency.
  • the time zero of the control circuit 211 and the control circuit 212 can be made the same by means of a table. Tables can be implemented in a number of ways.
  • the control circuit 211 may send a zero-time trigger signal to the control circuit 212 at a certain moment (for example, when the control circuit 211 is powered on and starts to work).
  • the time zero trigger signal may be a preset signal or a signal negotiated between the control circuit 211 and the control circuit 212 .
  • it may be a gating hardware signal or other hardware trigger signal, or a software trigger signal, which will not be repeated here.
  • control circuit 211 When the control circuit 211 sends out the time zero trigger signal, it can reset the counting part of the control circuit 211 to zero, that is, set the time when the time zero trigger signal is sent as the time zero.
  • control circuit 212 receives the zero-time trigger signal, it can reset the counting part of the control circuit 212 to zero, that is, set the moment when the zero-time trigger signal is received as the zero-time time.
  • the table matching can be realized by other components other than the control circuit. This component sends the time zero point trigger signal to the control circuit 211 and the control circuit 212, and the control circuit 211 and the control circuit 212 will respectively receive the time zero point trigger signal. are set to the respective time zero.
  • the component is, for example, a component with control capability in the device where the control device is located.
  • the component is, for example, a vehicle control unit (vehicle control unit, VCU) or an electronic control unit (electronic control unit, ECU).
  • VCU vehicle control unit
  • ECU electronic control unit
  • other table alignment methods may also be used to make the time zero of the control circuit 211 and the control circuit 212 the same, which will not be repeated here.
  • control circuits of the control device may be powered by the same power supply, and the control circuits may respectively set the power supply time as their own time zero.
  • the control circuit 211 and the control circuit 212 can respectively set the power supply time as their own time zero. In this way, the time zero point of the control circuit 211 is the same as the time zero point of the control circuit 212 .
  • the zero points of time of the control circuits of the control device are the same, so that the control circuits can start counting from the same time starting point or initial time. In addition, the control circuits count according to the same frequency, so that the working time of the control circuits is synchronized.
  • the control circuit of the control device When the control circuit of the control device is working, it can generate a pulse signal based on the collected sensing signal (or sensing signal), and the synchronization of working time can make the control circuit synchronously acquire the same sensing signal (for example, the same sensing signal in the same time period).
  • the signal sensed by the sensor and based on the same sensing signal and the same algorithm, a synchronous (or the same) pulse signal is generated.
  • the time at which the control circuit 211 and the control circuit 212 collect sensing signals is also synchronous.
  • the control circuit to collect sensing signals through data reporting instructions as an example, the control circuit 211 and the control circuit 212 send data reporting instructions to the sensor synchronously, so that the sensor can receive the data sent by the control circuit 211 and the control circuit 212 within approximately or at the same time A report instruction, and then synchronously send the sensing signal obtained by the sensor monitoring to the control circuit 211 and the control circuit 212 according to the data report instruction.
  • synchronous acquisition of sensing signals is realized.
  • the control circuit 211 and the control circuit 212 may synchronously pass the same An algorithm, such as a field oriented control (FOC) algorithm, generates a pulse signal (eg, a PWM signal). Since the control circuit 211 and the control circuit 212 collect the sensing signals synchronously, and based on the collected sensing signals through the same algorithm, a synchronous pulse signal can be obtained.
  • the pulse signal can control the direction and magnitude of the output current of the power part, so the pulse signal can also be called a control signal for controlling the power part.
  • the embodiment of the present application does not limit the type of the sensing signal and the type of the algorithm, and the type of the sensing signal and the type of the algorithm are determined by the functions of the electronic control system.
  • control circuit 211 and control circuit 212 can be used as a main control circuit, and the other can be used as an auxiliary control circuit.
  • the control signal S1 generated by the main control circuit can be used as the control signal of the power part 220, and is used to control the driving circuit 221 and the driving circuit 222 to generate the driving function executing components. drive signal.
  • the control circuit 211 can output the control signal S1 to the driving circuit 221 through the selection unit 213 (see the solid line L1 in the figure), or directly output the control signal S1 to the driving circuit 221 (see the dotted line L2 in the figure).
  • the control signal S2 generated by the auxiliary control circuit may not be output to the power section 220, that is, the selection unit 213 outputs the control signal S1 to the drive circuit 222, or the control signal S2 generated by the auxiliary control circuit
  • the control signal S2 is directly output to the power section 220 , and the selection unit 213 selects a valid control signal S1 or S2 to output to the power section 220 when one of the control circuits fails.
  • the control signal S2 generated by the auxiliary control circuit is output to the power part 220 for controlling the driving circuit 221 and the driving circuit 222 to generate a driving signal for driving the function execution component; that is, the selection unit 213 will
  • the control signal S2 is output to the driving circuit 221 and the driving circuit 222 .
  • the auxiliary control circuit becomes a new main control circuit to control the power part 220 .
  • the operating frequency and start time of the new main control circuit and the original main control circuit are the same, thereby generating synchronous (or identical) control signals, so that the new main control circuit can seamlessly replace the original main control circuit, Controlling the power part 220 greatly improves the functional safety and failure operability of the electronic control system.
  • the control circuit in the control device can be integrated in one physical entity, or physically separated, for example, integrated in a chip, which serves as the main control chip of the electronic control system.
  • the control circuit may be physically separated, for example, the control circuit 211 includes a first MCU, and the control circuit 212 includes a second MCU, and the first MCU and the second MCU may be MCUs with the same or similar computing capabilities.
  • the control circuit 211 and the control circuit 212 respectively include two MCUs of the same model.
  • the selection unit 213 receives the control signal of the control circuit, and selects a valid control signal to output to the power part 220 .
  • the function of the selection unit 213 may be implemented by hardware or software, which is not limited in this application.
  • the selection unit 213 may be located in one or more control circuits of the control device, or be set independently of the control circuits.
  • the selection unit 213 may be implemented as a hardware module independent of the control circuit 211 and the control circuit 212 .
  • the selection unit 213 may be an MCU.
  • the selection unit 213 may be configured in the control circuit 211 or the control circuit 212 .
  • the selection unit 213 may be a software module running in the control circuit 211 or the control circuit 212 .
  • the selection unit 213 may include a software module configured in the control circuit 211 and a software module in the control circuit 212 . That is to say, the software modules in the control circuit 211 and the software modules in the control circuit 212 can work together to realize the function of the selection unit 213 .
  • the implementation form of the selection unit 213 is described above as an example, and does not constitute a limitation. In other embodiments, the selection unit 213 may also be implemented in other forms, which will not be listed here.
  • the selection unit 213 can control whether the control circuit 211 and the control circuit 212 output control signals to the power part 220 .
  • the control circuit 211 can output the control signal S1 to the selection unit 213
  • the control circuit 212 can also output the control signal S2 to the selection unit 213 .
  • the selection unit 213 can select between the control signal S1 and the control signal S2 , and output the selected control signal as the control signal of the power section 220 .
  • the selection unit 213 can realize the selection of the control signal by closing or opening the signal output port of the control circuit.
  • the selection unit 213 can open the signal output port of the control circuit 211, so that the control circuit 211 can output a control signal to the power part 220 to drive the function executing part. That is, the selection unit 213 outputs the control signal of the control circuit 211 as the control signal of the power part 220 by opening the signal output port of the control circuit 211 .
  • the selection unit 213 opens the signal output port of the control circuit 211 , it can close the signal output port of the control circuit 212 .
  • the selection unit 213 can open the signal output port of the control circuit 212 and close the signal output port of the control circuit 211, so as to realize the selection of the control signal S2.
  • the selection unit 213 can be further used to determine whether the control circuit (or control signal) of the control device 210 is invalid, and select the control signal output by the effective control circuit as the input of the power section 220 .
  • Control circuit failure can also be called control circuit failure, which means that the control circuit cannot provide correct control signals, for example, it is difficult (or impossible) for the control circuit to work or operate according to the set rules. It is assumed that the setting rule is: the control circuit generates the control signal according to the sensing signal and based on a preset algorithm. When the control circuit fails, the control circuit may not be able to receive the sensing signal; or after receiving the sensing signal, it may not be able to perform correct calculations based on the sensing signal, and the like. This application is not limited, as long as the control circuit fails to provide a correct control signal, it can be understood as a failure of the control circuit.
  • control circuit itself is provided with a fault detection circuit, which can detect whether the control circuit is faulty.
  • the selection unit 213 can determine an effective control circuit (or control signal) according to the detection result of the fault detection circuit, and select an effective control signal to output to the power section 220 .
  • the selection unit 213 can detect the validity of the control circuit (or control signal), for example, the selection unit 213 compares the received control signal S1 with a preset valid range, and if the control signal S1 is within the valid range , the control signal S1 is valid; similarly, the selection unit 213 compares the received control signal S2 with the preset valid range, and if the control signal S2 is within the valid range, the control signal S2 is valid; the selection unit 213 can control When the signal S1 fails, the validity of the control signal S2 is detected, which can save power consumption.
  • the effective range includes, for example, the range of the pulse width and the range of the pulse period of the pulse signal.
  • the control signal of the main control circuit is preferentially used by default.
  • the main control circuit When the control signals generated by the main control circuit and the auxiliary control circuit are different, the main control circuit is considered to be invalid, and the control signal of the auxiliary control circuit is selected to be output to the power part. .
  • the selection unit 213 determines whether the main control circuit fails by comparing the control signal S1 and the control signal S2. When the control signal S1 and the control signal S2 are different, the selection control signal S2 is output to the power section 220.
  • the main control circuit may send the output control signal to the auxiliary control circuit.
  • the auxiliary control circuit can detect whether the control signal generated by the main control circuit fails to determine whether the main control circuit fails.
  • the auxiliary control circuit has the function of monitoring the main control circuit.
  • the method for the auxiliary control circuit to detect whether the control signal generated by the main control circuit is invalid is the same as the description of the selection unit 213 above, and all or part of the functions of the selection unit 213 can be integrated in the auxiliary control circuit.
  • the auxiliary control circuit can detect whether the control signal generated by the auxiliary control circuit is the same as the control signal generated by the main control circuit.
  • the auxiliary control circuit can send the control signal generated by the auxiliary control circuit to the main control circuit, and the main control circuit can determine whether the auxiliary control circuit is faulty according to the control signal generated by the auxiliary control circuit. The description of whether the control circuit detects whether the main control circuit is invalid will not be repeated here.
  • the main control circuit and the auxiliary control circuit can jointly determine whether the main control circuit fails.
  • Control circuits such as MCU can have their own fault detection function, and can detect whether they have a fault.
  • the main control circuit detects that the main control circuit itself has a fault
  • the auxiliary control circuit detects that the control signal generated by the auxiliary control circuit is different from the control signal generated by the main control circuit, it determines that the main control circuit is faulty, and the main control circuit
  • the detection of the circuit itself and the detection of the main control circuit by the auxiliary control circuit, these two detection functions are effective at the same time, which can make the fault detection more accurate. In this example, it is possible to accurately determine whether the control circuit is faulty without having a strong self-checking performance of the control circuit, thereby reducing the cost of the control circuit.
  • the auxiliary control circuit can take over the main control circuit and become a new main control circuit when the main control circuit fails.
  • the original main control circuit may become the new auxiliary control circuit. That is to say, the functional roles of the main control circuit and the auxiliary control circuit can be switched mutually.
  • the same clock source (or clock) provides the clock signal for the control circuit of the control device, that is, the above clock signal C1 and clock signal C2 come from the same clock source.
  • the implementation cost of this method is low, and the control circuit of the control device can be operated under the action of the clock signal of the same frequency, and the control signal of the same frequency is provided while reducing the cost.
  • different clock sources may also be used to provide the control circuit of the control device with a clock signal of the same frequency.
  • the same clock source outputs a clock signal to each control circuit of the control device, and the clock signals output to the control circuits are the same clock signal.
  • the same clock source is, for example, a clock source CK1, which is connected to the first control circuit 211 and the second control circuit 212 to output the first clock signal C1 and a second clock signal C2.
  • the same clock source outputs a clock signal to a part of the control circuit (such as the main control circuit) of the control device, and the part of the control circuit outputs a clock signal to other control circuits according to the received clock signal.
  • this part of the control circuit can output clock signals to other control circuits by means of frequency division.
  • the same clock source is, for example, a clock source CK1, which is connected to the control circuit 211 to output the first clock signal C1 to the control circuit 211, that is, the control circuit 211 is connected to the clock source CK1 to receive the first clock signal C1.
  • a clock signal C1, and the control circuit 211 outputs a clock signal C2 to the control circuit 212 according to the clock signal C1 (shown by the dotted line L3 in FIG. 2 ).
  • the clock signal C2 can be obtained by frequency division and output to the control circuit 212 .
  • the control circuit 211 outputs a clock signal to the control circuit 212 every time it receives X clock signals, where X is an integer greater than or equal to 1. Then, when the control circuit 212 receives the clock signal sent by the control circuit 211 , it can perform frequency multiplication by X times, and operate under the drive of the multiplied clock signal.
  • the control circuit 211 may duplicate the clock signal and send the duplicated clock signal to the control circuit 212 .
  • the embodiment of the present application can also provide a redundant clock source, that is, at least two clock sources are provided, and the above clock signal comes from one of the at least two clock sources, and the clock signal provided by the current clock source can be based on the state of the clock source When it fails, switch the clock source.
  • the clock signal frequencies of the at least two clock sources are proportional, and in one implementation, the clock signal frequencies of the at least two clock sources are the same. In this way, the system failure caused by the failure of the clock source can be further reduced, and the probability of failure of the function of the electronic control system caused by the failure of the clock can be further reduced, thereby further improving the failure operability of the electronic control system.
  • the clock source CK1 and the clock source CK2 provide two independent clock signals for the control circuits 211 and 212, wherein one of the clock source CK1 and the clock source CK2 is used as the main clock source, and the other clock source is used as Secondary clock source (or backup clock source).
  • the control circuits 211 and 212 can operate under the effect of a clock signal output from a master clock source.
  • the main clock source cannot provide an effective clock signal
  • the auxiliary clock source takes over from the main clock source, so that the control circuits 211 and 212 continue to run under the clock signal output by the auxiliary clock source.
  • the clock source CK1 Take the clock source CK1 as the primary clock source and the clock source CK2 as the secondary clock source as an example.
  • the control circuit 211 and the control circuit 212 work (or run) driven by the same clock source CK1, and the clock source CK1 and the clock source CK2 are mutually redundant.
  • the clock source CK1 fails, the clock source CK2 takes over from the clock source CK1 and serves as a common clock source for the control circuit 211 and the control circuit 212 .
  • the clock source CK1 is used as the main clock source of the control circuit 211 and the control circuit 212.
  • the clock source CK1 is used as the auxiliary clock source.
  • the clock source CK1 can replace the clock source CK2 and be used as the control circuit 211. and the common clock source of the control circuit 212.
  • the frequency of the clock signal generated and sent out by the clock source CK1 and the clock source CK2 may be proportional, and the ratio may be M:N, where M and N are integers greater than or equal to 1.
  • the clock source CK2 may generate and send out N clock pulses.
  • the proportional relationship is a proportional relationship, and in an example, the clock source CK1 and the clock source CK2 generate and send clock signals at the same frequency.
  • control circuit 211 has a line connecting the clock source CK1 and the clock source CK2
  • control circuit 212 has a line connecting the clock source CK1 and the clock source CK2.
  • the clock source CK1 can output clock signals to the control circuit 211 and the control circuit 212
  • the clock source CK2 can also output clock signals to the control circuit 211 and the control circuit 212 .
  • the control circuit 211 and the control circuit 212 can agree to use the clock source CK1 (or clock source CK2) as the main clock source, and control the conduction of the main clock source to the control circuit 211 and the control circuit 212, and when the main clock source fails, control Turning off the lines from the main clock source to the control circuit 211 and the control circuit 212 turns on the lines from the auxiliary clock source to the control circuit 211 and the control circuit 212 .
  • the clock source CK1 or clock source CK2
  • the control circuit 211 and the control circuit 212 respectively select an effective clock source.
  • the control circuit 211 outputs the control signal E1 for controlling the input control circuit 211
  • the control circuit 212 outputs a control signal E2 for controlling the source of the clock signal input to the control circuit 212
  • the control circuit 211 and the control circuit 212 can interact to select the same clock source.
  • the control circuit 211 selects an effective clock source for the control circuits 211 and 212
  • the control signals E1 and E2 both come from the same control circuit.
  • the effective clock source can be selected by a control unit independent of the control circuit, and the control unit can be implemented by software or by hardware.
  • the effective clock source is the clock source used to drive the operation of the control circuit.
  • the control circuit 211 may detect whether the main clock source CK1 is valid (for example, whether a fault occurs). When it is detected that the main clock source CK1 fails, the auxiliary clock source CK2 can be used as the new main clock source, and the clock signal sent by the new main clock source can be used as the clock signal of the control part 210 .
  • switches are provided between the control circuit 211 and the clock source CK1 and the clock source CK2 respectively, and switches are provided between the control circuit 212 and the clock source CK1 and the clock source CK2 respectively.
  • the output control signal E1 opens the switch between the control circuit 211 and the clock source CK1, and closes the switch between the control circuit 211 and the clock source CK2, thereby using the clock source CK2 as The clock source of the control circuit 211.
  • control signal E1 can be further used to open the switch between the control circuit 212 and the clock source CK1, and close the switch between the control circuit 212 and the clock source CK2, so that the clock source CK2 is used as the clock source of the control circuit 212 .
  • control circuit 211 notifies the control circuit 212 to output the control signal E2, and the control signal E2 can be used to disconnect the switch between the control circuit 212 and the clock source CK1, and close the switch between the control circuit 212 and the clock source CK2, so that the clock The source CK2 is used as a clock source for the control circuit 212 .
  • control circuit 212 can detect the validity of the clock source, and independently control the opening and closing of switches between the clock source CK1 and the clock source CK2 to the control circuit 212, that is, the control signal E2 can be independently generated by the control circuit 212;
  • control circuit 212 has similar functions to the above control circuit 211 , and the control circuit 211 is triggered to generate the control signal E1 or the control circuit 212 generates the control signal E1 .
  • the control device 210 may further include a detection unit 214, which is used to detect the validity of at least two clock sources, and input the clock signal of the effective clock source to the control circuit according to the detection result 211 and 212, for example, the control clock signal C1 and the clock signal C2 come from an effective clock source among the at least two clock sources.
  • the detection unit 214 is located in the control circuit 211 and/or the control circuit 212, that is, the selection of the clock source is realized through the control circuit; in other embodiments, the detection unit 214 can also be set independently of the control circuit.
  • the implementation of the detection unit 214 is the same as that of the selection unit 213 , which can be implemented by hardware or software, and can refer to the above description of the selection unit 213 , which will not be repeated here.
  • the detection unit 214 can detect the validity of the clock source by detecting the clock signal. For example, the detection unit 214 detects that the frequency of the clock signal sent by the clock source is lost or the frequency deviation is within a preset When outside the range, the clock source is determined to be invalid (or malfunctioning).
  • the preset range may be a frequency interval. Exemplarily, the preset range may be set according to the theoretical frequency f of the clock source.
  • the theoretical frequency of the clock source refers to the set frequency of the clock source. In theory, the clock source should generate and send out a clock signal according to the theoretical frequency; the actual frequency corresponds to the theoretical frequency. The actual frequency is the frequency at which the clock source actually generates and sends out a clock signal when the clock source is working. For another example, when the detection unit 214 detects that the pulse of the clock signal sent by the clock source is missing or the pulse period is outside the preset range, it determines that the clock source is invalid (or fails).
  • the detection unit 214 can record the frequency of the clock signal received by the control circuit 211 (or the control circuit 212) from the clock source, when the frequency of the clock signal received by the control circuit 211 (or the control circuit 212) from the clock source and When the frequency of the clock signal received from the clock source has a large difference (for example, exceeds a threshold), it can be determined that the clock source is invalid; optionally, the frequency of the clock signal can be replaced by the pulse period of the clock signal.
  • the detection unit 214 may record the time at which the control circuit 211 (or the control circuit 212) receives the clock signal from the clock source, and within a preset period after the time, the control circuit 211 (or the control circuit 212) does not receive any more clock signals.
  • the clock signal from the clock source can determine that the clock source fails.
  • the detection unit 214 may determine whether the clock source is invalid according to the period change of the clock pulse, for example, when the control circuit 211 (or the control circuit 212 ) receives a plurality of clock pulses from the clock source within a period of time between adjacent clock pulses If the difference between the time interval between clock pulses and the time interval between adjacent clock pulses in history is greater than or equal to a preset threshold, it may be determined that the clock source fails.
  • the detection unit 214 may switch the secondary clock source to a new primary clock source when detecting that the primary clock source fails and the secondary clock source is valid. Further, when it is detected that the auxiliary clock source is valid, it is determined that the main clock source fails, which can reduce misjudgment of failure of the main clock source.
  • the failure of a clock source can also be understood as the failure of the clock signal of the clock source.
  • connection in this embodiment of the present application refers to a signal connection, which may be a direct connection or an indirect connection.
  • the interconnected circuits or devices can exchange signals, it can be understood as a connection.
  • the embodiment of the present application does not limit the manner of providing the clock signal, for example, it may be an external clock (EXTCLK).
  • the clock source CK1 and the clock source CK1 may be internal clock sources of the control device 210 , that is, belong to the control device 210 , or may be external clock sources of the control device, that is, not belong to the control device 210 .
  • the power part 220 is redundantly backed up, that is, the power part 220 includes at least two driving circuits for driving at least one function executing component, and the at least two driving circuits can be used for driving different function execution components, or can be used to drive the same function execution components, and each driving circuit can drive one or more function execution components.
  • the driving circuit 221 and the driving circuit 222 take the driving circuit 221 and the driving circuit 222 as an example here, wherein the driving circuit 221 is used to drive the function executing component A, or to drive the function executing component A and the function executing component B (as shown by the dotted line in FIG.
  • the drive circuit 222 is used to drive the function execution unit B, or to drive the function execution unit A and the function execution unit B (as shown by the dotted line L4 in FIG. 2 ). Similar to the above description of the control circuit, the embodiment of the present application does not limit the number of redundant driving circuits.
  • the redundant backup of the function executing components can be realized.
  • the drive circuit 221 can be used to drive the function execution unit A
  • the drive circuit 222 can be used to drive the function execution unit B, which provides a redundant backup of the function execution unit.
  • the function execution unit A cannot continue to work due to the drive signal or its own problems
  • the function execution unit B can take over the function execution unit A and continue to work, thus further improving the failure operability of the system.
  • the drive circuit of the power part drives the same function execution part, it can realize higher efficiency function execution, for example, the drive circuit 221 can be used to drive the function execution part A and the function execution part B, and the drive circuit 222 can also be used to drive Function execution unit A and function execution unit B (as shown by the dotted line L4 in Figure 2), this cross-backup method can provide more efficient redundancy capabilities, and can still maintain the efficient output of the system when some components fail, such as When the driving circuit 221 and the driving circuit 222 were all working normally, the function executing part A could work under the driving signals of the driving circuit 221 and the driving circuit 222; The driving signal enables the function executing component A to operate normally, further improving the failure operability of the system.
  • the drive circuit of the power part 220 outputs a pulse signal, and the function executing component is driven by the pulse signal.
  • the control signal can control the duty cycle of the output signal of the power part 220, so that the output of the power part 220 conforms to the expected alternating current.
  • the duty cycle may refer to the ratio of the power-on duration in a pulse cycle to the total duration of the pulse cycle.
  • a pulse cycle refers to the duration between the start of one power-on and the next power-on in the case of intermittent or periodic power-on.
  • the current magnitude of the alternating current can be the average value of the current within a pulse period. Thus, by controlling the magnitude of the duty cycle, the magnitude of the alternating current can be controlled.
  • the output current of the power supply is 100A; energized for the rest of the 75% of the time. Then, in one pulse period, the magnitude of the current output by the driving circuit is 25A.
  • the drive circuit can be a multi-phase inverter circuit with multiple bridge arms, and can control the on and off of the switching elements on different bridge arms of the drive circuit to generate a current that meets the requirements. At the same time, currents in different directions can also be generated, so that an alternating current of a required magnitude can be output to the function execution unit.
  • the electronic control system provided by the embodiment of the present application is further described below in conjunction with FIG. 3A and FIG. 3B .
  • the electronic control system has redundant backups for both the control part and the power part.
  • the electronic control system includes mutual Redundant subsystem 310 and subsystem 320 .
  • the subsystem 310 includes a control circuit 311 and a driving circuit 312
  • the subsystem 320 includes a control circuit 321 and a driving circuit 322 .
  • control circuit 311 and the control circuit 321 are the same as the descriptions of the control circuit 211 and the control circuit 212 above, and when they are in the working state, they can respectively collect the sensing signals monitored by the sensors.
  • the control circuit 311 and the control circuit 321 may each send a data reporting instruction to the sensor.
  • the sensor may respond to the data reporting instruction and send the sensing signal monitored by the sensor to the control circuit that sends the data reporting instruction.
  • control circuit 311 and the control circuit 321 can respectively collect the sensing signals monitored by the same sensor, that is, the sensing signals monitored by the same sensor (such as sensor Sr1) can be sent to the control circuit 311 and the control circuit 321 respectively.
  • the control circuit 311 and the control circuit 321 can collect the same sensing signal, so that the same decision can be made subsequently.
  • the sensors can also be redundantly backed up.
  • the control circuit 311 collects the sensing signal of the sensor Sr1
  • the control circuit 321 collects the sensing signal of the sensor Sr2 .
  • the sensor Sr1 and the sensor Sr2 may be the same type of sensor, or include the same type of sensor.
  • the sensor Sr1 may include TAS and MPS
  • the sensor Sr2 may also include TAS and MPS.
  • the sensor Sr1 and the sensor Sr2 can work at the same time, that is, both are used to monitor the sensing signal.
  • the control circuit 311 can collect the sensing signals monitored by the sensor Sr1 and the sensor Sr2 , and the control circuit 321 can collect the sensing signals monitored by the sensor Sr1 and the sensor Sr2 .
  • the control circuit 311 and the control circuit 321 can collect the same sensing signal.
  • the sensor Sr1 and the sensor Sr2 work simultaneously, and when one of them fails, the other can continue to provide sensing signals for the control circuit.
  • the sensors Sr1 and Sr2 can provide sensing signals to the control circuit at the same time, so that the control circuit can output control signals according to the sensing signals to control the driving circuit of the function executing component, thereby realizing the functions of the electronic control system.
  • the other non-failure sensor can still provide a sensing signal for the control circuit, which reduces the inability of the control circuit to provide an accurate control signal due to the absence of a sensing signal, which in turn leads to the failure of the electronic control system. Probability of function failure. The failure operability of the electronic control system is further improved.
  • the sensors Sr1 and Sr2 may belong to components of the electronic control system, or may be located outside the electronic control system to provide sensing signals for the electronic control system.
  • control circuit can simultaneously control the one or more driving circuits through a control signal.
  • the drive circuit can be used to output alternating current.
  • the driving circuit (for example, the driving circuit 312 and the driving circuit 322) can be a multi-phase inverter circuit including multiple bridge arms, for example, a three-phase inverter circuit that can generate U-phase, V-phase, and W-phase .
  • Two switching elements can be arranged in series on each of the plurality of bridge arms, and direct current can be converted into alternating current by controlling on and off of the switching elements on different bridge arms.
  • the switching element on the bridge arm may be an insulated gate bipolar transistor (insulated gate bipolar transistor, IGBT), a metal-oxide-semiconductor field effect transistor (metal-oxide-semiconductor field effect transistor, MOSFET) and the like.
  • the circuit power for outputting AC power may be an AC drive unit.
  • a three-phase bridge drive unit For example a three-phase bridge drive unit.
  • the driving circuit may be a three-phase inverter circuit
  • the control signal may be six PWM signals for controlling six switching elements in the three-phase inverter circuit. That is, the control signals used to control the driving circuit include 6 PWM signals.
  • each channel of PWM signal is used to control the conduction or disconnection of a switching element in the three-phase inverter circuit, and different channels of PWM signals respectively control different switching elements.
  • the driving circuit may be a circuit for outputting direct current.
  • it may be a DC H-bridge driving unit.
  • the control circuit 311 can be connected to the driving circuit 312 and connected to the driving circuit 322 . Therefore, when the control circuit 311 is used as the main control circuit, the control signal generated by the control circuit 311 can be sent to the driving circuit 312 and the driving circuit 322 at the same time, so as to realize the synchronous control of the driving circuit 312 and the driving circuit 322 .
  • the control circuit 321 can be connected to the driving circuit 322 and to the driving circuit 312 .
  • control circuit 321 when used as the main control circuit, the control signal generated by the control circuit 321 can be sent to the driving circuit 312 and the driving circuit 322 at the same time, so as to realize synchronous control of the driving circuit 312 and the driving circuit 322 .
  • the waveforms of the voltages output by the driving circuit 312 and the driving circuit 322 are consistent (that is, the frequency and duty cycle are the same).
  • the driving circuit 312 and the driving circuit 322 can simultaneously output voltages to the function executing component (eg, a motor) to jointly drive the function executing component to work.
  • the function executing component eg, a motor
  • the frequency and duty cycle of the voltage received by the function executing parts do not change or do not change greatly, thereby further improving the functional safety and security of the electronic control system. Fail operability.
  • the electronic control system further includes a pre-driver circuit (abbreviated as pre-driver), which is arranged between the control circuit and the drive circuit.
  • pre-driver a pre-driver circuit
  • a pre-driver 313 is provided between the control circuit 311 and the driving circuit 312
  • the pre-driver 313 may also be provided between the control circuit 321 and the driving circuit 312
  • a pre-driver 323 is provided between the control circuit 321 and the drive circuit 322 , and further, the pre-driver 323 may also be provided between the control circuit 311 and the drive circuit 322 .
  • the pre-driver can amplify a low-voltage signal (for example, a logic signal) into a high-voltage (for example, greater than or equal to 15V) signal that can drive the switching element to turn off or on.
  • a low-voltage signal for example, a logic signal
  • a high-voltage signal for example, greater than or equal to 15V
  • the pre-driver converts the low-voltage signal into a high-voltage signal to control the switching element on the bridge arm of the drive circuit to be turned off or on, so that the drive circuit can output a signal of corresponding size and direction. current or voltage.
  • the driving circuit can be powered by an internal power supply, or can be powered by an external power supply.
  • the power supply P1 provides power for the driving circuit 312 .
  • the power source P1 may be a battery, such as a storage battery, a lithium battery, and the like.
  • the driving circuit 312 converts the voltage output by the power supply P1 into a voltage with a specific direction and magnitude. Take the driving circuit 312 as an inverter circuit as an example.
  • the power supply P1 can output DC power to the driving circuit 312 .
  • the drive circuit 312 can turn on or turn off the corresponding switching element under the action of the control signal, and convert the direct current into alternating current.
  • the power supply P2 provides power for the driving circuit 322 .
  • the form of the power supply P2 and the working mode of the driving circuit 322 are similar to those described above, and will not be repeated here.
  • Both the driving circuit 312 and the driving circuit 322 can apply a driving signal to the function execution component, so as to drive the function execution component to perform related functions.
  • the function executing component may be a motor, and the driving signal may be a voltage.
  • the motor can output torque under the drive of voltage.
  • the driving circuit 312 and the driving circuit 322 may use the same power supply, so the output voltages of the driving circuit 312 and the driving circuit 322 are the same. In one example, when the driving circuit 312 and the driving circuit 322 use different power sources, the output voltages of the driving circuit 312 and the driving circuit 322 may be different. After the filter circuits of the drive circuit 312 and the drive circuit 322 automatically equalize the impedance voltage drops on the bus currents of different sizes, the input to the function executing parts is the same voltage (including similar voltages to achieve the same driving effect).
  • the power supply P1 can also supply power to the control circuit 311 to maintain the operation of the control circuit 311 .
  • the power supply P2 can also supply power to the control circuit 321 to maintain the operation of the control circuit 321 . That is to say, the control circuit 311 and the control circuit 321 can be powered by different power sources, thereby avoiding or reducing the situation that the control circuits fail at the same time due to power failure.
  • the function execution components driven by the subsystem 310 and the subsystem 320 may be the same or different. As shown in FIG. 3A, taking the function execution component as a motor, and the subsystem 310 and the subsystem 320 cross-driving the same function execution component as an example, the motor (M1 or M2) can be connected to the drive circuit 312 and the drive circuit 322, so that The driving circuit 312 and the driving circuit 322 are jointly driven to rotate, and when one of the driving circuits fails, the motor can still continue to run.
  • the motor M1 or M2
  • the connection between the driving circuit and the function executing component can be controlled by a phase-open circuit (referred to as phase-break).
  • phase-break a phase-open circuit
  • a phase failure 314 is provided between the function execution unit M1 and the drive circuit 312
  • a phase failure 324 is provided between the function execution unit M1 and the drive circuit 322 .
  • the drive circuit 312 fails, the open phase 314 can be disconnected, and the drive circuit 322 drives the function executing component M1.
  • the driving circuit 322 fails, the open phase 324 can be disconnected, and the driving circuit 312 drives the function executing component M1.
  • the function executing component M2 can be connected to the driving circuit 312 and the driving circuit 322 so as to be driven to rotate by the driving circuit 312 and the driving circuit 322 .
  • a phase failure 315 is provided between the function execution unit M2 and the driving circuit 312
  • a phase failure 325 is provided between the function execution unit M2 and the driving circuit 322 .
  • phase failure 314, phase failure 315, phase failure 324, and phase failure 325 can be connected to control circuit 311 and/or control circuit 321, so as to receive instructions from control circuit 311 and/or control circuit 321 , and close or open according to the command.
  • phase failure 314 and phase failure 315 can be controlled by the control circuit 311
  • phase failure 324 and phase failure 325 can be controlled by the control circuit 321 .
  • phase failure 314, phase failure 315, phase failure 324, and phase failure 325 can be controlled by the same control circuit, such as the control circuit 311 or the control circuit 321.
  • the sensor may include a current sensor for detecting the current of each phase of the motor to obtain a phase current detection signal.
  • current sensors subsystems 310 and 320 can multiplex the same current sensor, or use independent current sensors, are used to detect the phase currents of motors M1 and M2, and obtain phase current detection signals Ps1 and Ps2, and provide them to the control The circuit 311 and the control circuit 312, so that the control circuit 311 and the control circuit 312 generate control signals for controlling the driving circuit according to the phase current detection signals Ps1 and Ps2. Further, the control circuit 311 and the control circuit 312 can also generate control signals according to other sensing signals.
  • the signal interaction between the subsystem 310 and the subsystem 320 can be performed through the signal line, for example, the interaction of the clock signal (for example, the control circuit 311 sends the clock signal to the control circuit 321), or the interaction of the control signal (for example, the control circuit 311 sends a control signal to the control circuit 321), etc. Therefore, when the signal line between the subsystem 310 and the subsystem 320 is open or short circuited, common cause failure may occur in the subsystem 310 and the subsystem 320 .
  • resistor elements and/or capacitor elements can be connected in series on the signal line between the subsystem 310 and the subsystem 320, so that when the signal line is normal, normal signal interaction can be performed between the subsystem 310 and the subsystem 320, When the signal lines are open or short circuited, common cause failures of the subsystem 310 and the subsystem 320 are avoided or reduced.
  • at least one element is set between the control circuit 311 and the control circuit 321; for another example, at least one element is set between the drive circuit 312 and the drive circuit 322, the element can be a resistive element or a capacitive element, or at least one element includes resistive and capacitive elements.
  • the control circuit when the signal line is open or short-circuited and the signal fails, the control circuit (for example, the main control circuit or the auxiliary control circuit) can decide whether to perform a functional role switch between the main control circuit and the auxiliary control circuit according to the failed signal (ie, The original auxiliary control circuit becomes the new main control circuit, and the original main control circuit becomes the new auxiliary control circuit). For example, when the control signal generated by the auxiliary control circuit fails, the main control circuit and the auxiliary control circuit do not perform functional role switching. For another example, when the control signal generated by the main control circuit fails, the main control circuit and the auxiliary control circuit perform functional role switching.
  • the power supply P1 outputs a DC voltage 401 to the driving circuit 312 so that the driving circuit 312 converts the DC voltage 401 into an AC voltage.
  • the power supply P2 is used to output the DC voltage 402 to the driving circuit 322 so that the driving circuit 322 converts the DC voltage 402 into an AC voltage.
  • the drive circuit 312 and the drive circuit 322 jointly output an AC voltage to the motor.
  • the AC voltages output by the driving circuit 312 and the driving circuit 322 can be automatically balanced, so that the peak value of the voltage 403 output to the function execution unit is between the DC voltage 401 and the DC voltage 402 .
  • the preset range can be set based on experience or experiments. For example, the preset range can be the interval [-2V, 2V] or [-5V, 5V], etc., and will not be listed here, and the preset range is not specified limit.
  • the difference between the voltage output by the power supply P1 and the voltage output by the power supply P2 is within the preset range, it means that the voltage difference between the power supply P1 and the power supply P2 is small, and the drive circuit 312 and the drive circuit 322 jointly perform the driving function. Components, so that the driving voltage of the driving function execution component is not insufficient; if the voltage difference between the power supply P1 and the power supply P2 is too large, it is usually caused by one of the voltages being too low. In this case, the driving circuit 312 and the driving circuit 322 drives the motor together, which may lead to insufficient driving voltage of a certain power supply.
  • the voltage of the alternating current input to the function execution unit is between the voltage of the power supply P1 and the voltage of the power supply P2, that is, the voltage difference between the alternating current input to the function execution unit and the power supply P1 is smaller than the voltage difference between the power supply P1 and the power supply P2 value, and the voltage difference between the AC power input to the function execution unit and the power source P2 is also smaller than the voltage difference between the power source P1 and the power source P2. Therefore, when one of the driving circuit 312 and the driving circuit 322 fails and the other drives the function executing component alone, the voltages input to the function executing component will not differ too much, thereby improving the functional safety of the electronic control system.
  • the power supply P1 outputs a DC voltage 501 to the driving circuit 312 so that the driving circuit 312 converts the DC voltage 501 into an AC voltage.
  • the power supply P2 outputs the DC voltage 502 to the driving circuit 322 so that the driving circuit 322 converts the DC voltage 502 into an AC voltage.
  • the connection between the drive circuit corresponding to the power supply with a lower voltage and the function executing component can be disconnected, so that The drive circuit corresponding to the power supply with higher voltage independently drives the motor.
  • the voltage of the power source P1 is normal, but the voltage of the power source P2 is too low, so that the voltage difference between the DC voltage 501 and the DC voltage 502 is too large.
  • the open phase 324 and the open phase 325 can be disconnected, and the driving circuit 312 can independently drive the function executing components M1 and M2 .
  • the driving circuit of the subsystem with normal voltage can be used to drive the function executing components in another subsystem, thereby reducing or avoiding the difficulty of driving the function executing components caused by insufficient power output of the subsystem with lower power supply voltage occur.
  • the electronic control system further includes a drive circuit selection unit, and the drive circuit selection unit is used to select a turned-on drive circuit according to the power supply voltage of the drive circuit 312 and the power supply voltage of the drive circuit 322, that is, the drive circuit The driving signal of 312, or the driving signal of the driving circuit 322, or the signal of the driving circuit 311 and the driving signal of the driving circuit 322 are output to the function executing part.
  • the driving circuit 312 and the drive signal of the drive circuit with higher power supply voltage in the drive circuit 322 is provided to the function execution unit, for example, the power supply voltage of the drive circuit 312 is higher than the power supply voltage of the drive circuit 322, then the phase failure 324 and the phase failure 325 enter the disconnected state .
  • the driving circuit 312 When the voltage difference between the power supply voltages of the driving circuit 312 and the driving circuit 322 is within a preset range, or when the voltage difference between the power supply voltages of the driving circuit 312 and the driving circuit 322 is greater than a threshold, the driving circuit 312
  • the driving signals of the driving circuit and the driving circuit 322 are provided to the function executing components, for example, the phase failure 314 , the phase failure 315 , the phase failure 324 and the phase failure 325 enter the disconnected state.
  • the driving signal of the driving circuit with the higher power supply voltage among the driving circuit 312 and the driving circuit 322 is provided to the function execution part, or the driving circuit 312
  • the driving signals of the driving circuit 322 and the driving circuit 322 are both supplied to the function executing part.
  • the preset range is the same as that described above, and will not be repeated here.
  • the function of the driving circuit selection unit can be integrated in the control circuit, such as integrated in the control circuit 311 or the control circuit 321, or integrated in the control circuit 311 and the control circuit 321, and the realization of the driving circuit selection unit can be realized by hardware, or can be achieved by It is implemented by software, and the implementation method refers to the above description of the selection unit 213, and the drive circuit selection unit and the selection unit 213 can be integrated together for implementation.
  • the function executing component is, for example, a motor, which may be a three-phase motor with U-phase, V-phase, and W-phase.
  • the motor may be a permanent magnet synchronous motor with dual redundant windings
  • the motor M1 has a U-phase winding Ua, a V-phase winding Va, and a W-phase winding Wa.
  • the motor M2 has one U-phase winding Ub, one V-phase winding Vb, and one W-phase winding Wb.
  • the winding Ua and the winding Ub form the U-phase redundant winding
  • the winding Va and the winding Vb form the V-phase redundant winding
  • the winding Wa and the winding Wb form the W-phase redundant winding.
  • the windings of motor M1 and motor M2 may be arranged left-right symmetrically, as shown in Figure 5A.
  • the directions of the torque vectors corresponding to the redundant windings are the same.
  • the torque vector directions of winding Ua and Ub are the same (the direction indicated by the black arrow)
  • the torque vector directions of winding Va and Vb are the same (the direction indicated by the light gray arrow)
  • the torque vector directions of winding Wa and Wb are Same (direction indicated by dark gray arrow).
  • the torques of the same phase output by the motor M1 and the motor M2 can be scalar added, and the obtained torque sum is the final output of the redundant motors.
  • the windings of the motor M1 and the motor M2 may be arranged alternately, as shown in FIG. 5B . At this time, there is an included angle in the direction of the torque vector corresponding to the redundant winding. In this case, the torques of the same phase output by the motor M1 and the motor M2 can be added according to the vector combination rule, and the obtained torque vector sum is the final output of the motors.
  • the electronic control system provided in the embodiment of the present application may be configured in the vehicle 100 .
  • the vehicle can be a car, off-road vehicle (off-road vehicle, ORV), sports utility vehicle (sport utility vehicle, SUV) bus, truck, agricultural locomotive, parade float, game car in an amusement park, etc. form of vehicles.
  • the electronic control system can also be used in other vehicles, which is not limited in this embodiment of the present application.
  • the following description takes the electronic control system as an electric power steering system as an example, and other systems are similar.
  • the electric power steering system acts on the steering system 123 to provide auxiliary torque for the steering of the vehicle 100 to drive the steering components of the vehicle 100 to move or rotate.
  • the electric power steering system can act on any steering component of the steering system 123 to assist steering of the vehicle 100 , such as a steering mechanism, a steering gear, or a component of a steering transmission.
  • the steering system 123 includes, for example, a steering rod 1231 , a steering column 1232 , and a steering wheel 1233 .
  • the auxiliary torque provided by the electric power steering system can act on the steering rod 1231 to push the steering rod 1231 , thereby pushing the wheels 1234 to deflect, and assisting the steering of the vehicle 100 .
  • the auxiliary torque provided by the electric power steering system can act on the steering column 1232 to make the steering wheel 1233 rotate, thereby assisting the steering of the vehicle 100 .
  • the electric power steering system may include the control section and the power section as described in the above embodiments.
  • the function executing component may be a booster motor.
  • the control part acquires a sensing signal from the sensor, and outputs a control signal to the power part according to the sensing signal. Under the action of the control signal, the power part outputs current to the booster motor to drive the booster motor to run.
  • the sensor may include one or more types of sensors, so that the control part acquires one or more sensing signals.
  • the sensor may include a torque and angle sensor (TAS), which is used to collect the torque and rotation angle of the steering wheel.
  • the sensor may include a motor position sensor (motor position sensor, MPS), to collect the motor rotor position of the power assist motor.
  • the sensor may include a current sensor (such as a Hall current sensor) to collect the current of each phase in the assist motor.
  • a current sensor such as a Hall current sensor
  • the sensors of the electric power steering system are illustrated, not limited.
  • the sensor may include one or more of the above sensors, and in other embodiments, may also include other types of sensors to collect corresponding sensing signals.
  • the sensing signal refers to the signal or information monitored or collected by the sensor, such as the torque and rotation angle of the steering wheel mentioned above, the position of the motor rotor and other information. Additionally, the sensor may or may not be part of the electric power steering system.
  • the motor may be a motor driven by alternating current.
  • alternating current for example, permanent magnet synchronous motor (permanent-magnet synchronous motor, PMSM), or AC servo motor, etc.
  • PMSM permanent magnet synchronous motor
  • AC servo motor etc.
  • the motor may be a motor driven by direct current.
  • direct current for example DC brushed motor, or DC brushless motor etc.
  • control part and the power part is the same as the description in the electronic control system above, and will not be repeated here.
  • the booster motor is an electric motor, which may also be called a motor, and its core components include a stator (also called a stator winding, or an energized coil) and a rotor.
  • the stator can generate a magnetic field when electrified. Under the action of the magnetic field, the rotor rotates, generating torque. Steering of the vehicle 100 may be assisted when torque is applied to steering components of the vehicle 100 .
  • the abnormal part of the system can be identified in time for the abnormal detection of the system, so that the redundant part can be used to replace the current working part in time, or when the mutually redundant parts are in working state , cut off the work of the abnormal part in time, so that the stability of the electronic control system can be improved. Therefore, the embodiment of the present application also provides an abnormality detection method, which can be used to detect whether a fault occurs in one or some parts of the above electronic control system. In some embodiments, the method may be performed by a control circuit, such as the control circuit 211 (or 311 ), and/or, the control circuit 212 (or 312 ).
  • the method may be performed by components independent of the control circuit, for example, may be performed by other components other than the control circuit 211 (or 311 ) and the control circuit 212 (or 312 ).
  • the component that executes the abnormality detection method may be referred to as an abnormality detection device (or circuit). Anomalies can also be called failures or failures.
  • the abnormality detection method can include one or more failure or failure detection methods described in the above embodiments, for example, including the detection of control circuit failures in the above embodiments, and the detection of drive circuit failures. Detection, one or more of the detection of clock source failure, the detection of sensor failure, and the failure detection of function execution components.
  • the method includes the following steps.
  • Step 601 acquire a first signal from a first component and a second signal from a second component, and the first component and the second component are redundant to each other.
  • Step 602 according to the first signal and the second signal, determine that the electronic control system fails (or malfunctions). And, it is further possible to determine that the first component or the second component fails (or malfunctions).
  • the above redundant components are, for example, control circuits
  • the first component is, for example, the control circuit 211
  • the second component is the control circuit 212 .
  • the working time of the control circuit 211 and the control circuit 212 are synchronized, and the collected sensing signals are the same. Therefore, under normal circumstances, the control signal generated by the control circuit 211 and the control signal generated by the control circuit 212 are the same. If the abnormality detection circuit finds that the control signal generated by the control circuit 211 is inconsistent with the control signal generated by the control circuit 212, it can be explained that at least one of the control circuit 211 and the control circuit 212 may be faulty, thus, it can be determined that the electronic control system is faulty .
  • the driving circuit 312 and the driving circuit 322 may be three-phase inverter circuits.
  • the driving circuit 312 and the driving circuit 322 respectively output alternating current under the action of the control signal of the main control circuit (the control circuit currently used to provide the control signal).
  • the alternating current output by the driving circuit 312 includes U-phase current Iua, V-phase current Iva, and W-phase current Iwa.
  • the alternating current output by the drive circuit 322 includes U-phase current Iub, V-phase current Ivb, and W-phase current Iwb.
  • the driving circuit 312 and the driving circuit 322 work under the drive of the same control signal, therefore, under normal circumstances, the waveform of the alternating current output by the driving circuit 312 and the waveform of the alternating current output by the driving circuit 322 It should look like Figure 8.
  • the abnormality detection circuit can compare the detection current of the same phase at the same time, for example, compare the detection current of U-phase current Iua at time T1 with the detection current of U-phase current Iub at time T1. If the detection current of the U-phase current Iua at the time T1 is zero, and the detection current of the U-phase current Iub at the time T1 is not zero, it indicates that at least one of the drive circuit 312 and the drive circuit 322 may have a fault, and then it can be Determine the abnormality of the electronic control system.
  • the abnormality detection circuit may use a current detection circuit (such as a current sensor) to obtain a detection current, for example, the actual current detected by the current detection circuit is used as the detection current.
  • a current detection circuit is provided at the output end of each phase bridge arm of the drive circuit to detect the corresponding phase current to obtain the phase detection current.
  • the abnormality detection circuit can acquire the phase detection current from the current detection circuit.
  • control signal used to control the driving circuit 312 to output the alternating current and the control signal used to control the driving circuit 322 to output the alternating current are the same signal, and when the voltage difference between the power supply P1 and the power supply P2 is small, the driving circuit The difference between the current of the same phase output by 312 and the driving circuit 322 at the same time should also be small.
  • the current difference threshold can be preset according to experience or experiments, for example, it can be 2A, 5A, or a percentage, and so on. When the abnormality detection circuit detects that the difference between the currents of the same phase output by the driving circuit 312 and the driving circuit 322 at the same time is greater than the current difference threshold, it can determine that the electronic control system is faulty.
  • the function executing component is, for example, a motor
  • the motors are redundantly configured, including a motor M1 and a motor M2.
  • the motor M1 and the motor M2 may be motors driven by alternating current. According to the above, the motor M1 and the motor M2 can be driven by the same or different driving circuits, and can be driven by independent driving circuits, or jointly driven by multiple driving circuits.
  • the motor M1 and the motor M2 can be jointly driven by the drive circuit 312 and the drive circuit 322, the motor M1 and the motor M2 can also be driven separately by the drive circuit 312 (in the case of a failure of the drive circuit 322), and the motor M1 and the motor M2 can also be Driven by the drive circuit 322 alone (when the drive circuit 312 fails). Therefore, the waveforms of the currents of the same-phase windings of the motor M1 and the motor M2 should be consistent, that is, the currents of the same-phase windings of the motor M1 and the motor M2 should be at the same zero moment.
  • the current Iua' of the U-phase winding of the motor M1 when the current Iua' of the U-phase winding of the motor M1 is zero, the current Iub' of the U-phase winding of the motor M2 should also be zero.
  • the current Iva' of the V-phase winding of the motor M1 when the current Iva' of the V-phase winding of the motor M1 is zero, the current Ivb' of the V-phase winding of the motor M2 should also be zero.
  • the current Iwa' of the W-phase winding of the motor M1 When the current Iwb' of the W-phase winding of the motor M2 should also be zero.
  • the abnormality detection circuit can compare the currents of the same-phase windings of the motor M1 and the motor M2, and if the currents of the same-phase windings of the motor M1 and the motor M2 are different at zero time, it can be determined that the electronic control system is faulty. For example, the abnormality detection circuit can compare the current Iua' of the U-phase winding of the motor M1 with the current Iub' of the U-phase winding of the motor M2. If the current Iub' is not zero when the current Iua' is zero, it can be determined that the electronic control system is faulty.
  • the motor M1 may be provided with a phase current detection circuit A (not shown in the figure), which is used to detect the current in each phase winding of the motor M1.
  • the motor M2 may be provided with a phase current detection circuit B (not shown in the figure) for detecting the current in each phase winding of the motor M2.
  • the abnormal detection circuit can collect the current of one or more phase windings of the motor M1 from the phase current detection circuit A, and collect the current of one or more phase windings of the motor M2 from the phase current detection circuit B. Then, the abnormality detection circuit can compare the current of one or more phase windings of the motor M1 with the current of one or more phase windings of the motor M2. If the zero moment of the same-phase current is different, it can be determined that the electronic control system is faulty.
  • the motor M1 and the motor M2 may be motors driven by alternating current. That is, the motor M1 and the motor M2 can respectively rotate under the drive of the AC voltage or the AC current to output torque to drive the steering mechanism of the vehicle to rotate. It can be understood that, for motors with two mutually redundant rotors with coaxial output, under normal circumstances, the rotor positions of the two motors should be consistent. Keeping consistent may refer to being the same or conforming to a preset relationship. For details, reference may be made to the introduction about motor control in the prior art, which will not be repeated here. Wherein, the rotor position can be collected by the motor position sensor.
  • the abnormality detection circuit can collect the motor rotor position signal L1 from the motor position sensor of the motor M1, and the motor rotor position signal L1 is used to represent the rotor position of the motor M1.
  • the abnormality detection circuit can collect the motor rotor position signal L2 from the motor position sensor of the motor M2, and the motor rotor position signal L2 is used to represent the rotor position of the motor M2. Then, the abnormality detection circuit can compare the motor rotor position signal L1 and the motor rotor position signal L2. If the two are inconsistent, it can be determined that the electric power steering system is malfunctioning.
  • the motor rotor position signal and the steering wheel angle of the vehicle should conform to a certain relationship, or in other words, the motor rotor position signal and the vehicle's steering wheel angle should match.
  • the steering wheel angle refers to the angle at which the steering wheel rotates, and may also be referred to simply as the steering wheel angle.
  • the abnormality detection circuit may collect the motor rotor position signal from the motor position sensor of the motor M1, and collect the steering wheel angle signal from the steering wheel rotation angle sensor (such as TAS).
  • TAS steering wheel rotation angle sensor
  • the abnormality detection circuit may collect the motor rotor position signal from the motor position sensor of the motor M2, and collect the steering wheel angle signal from the steering wheel rotation angle sensor. And judge whether the motor rotor position signal matches the steering wheel angle signal. If it does not match, it can be determined that the electric power steering system is malfunctioning.
  • the sensor Sr1 shown in FIG. 3A may include a first torque sensor, and the sensor Sr2 may include a second torque sensor.
  • the first torque sensor and the second torque sensor can measure the torque of the steering wheel of the vehicle to obtain torque signals.
  • the abnormality detection circuit may acquire a first torque signal from the first torque sensor, and acquire a second torque signal from the second torque sensor.
  • the anomaly detection circuit may then compare the first torque signal and the second torque signal. If the first torque signal is inconsistent with the second torque signal, it can be determined that the electric power steering system is faulty.
  • the sensor Sr1 shown in FIG. 3A may include a first rotation angle sensor, and the sensor Sr2 may include a second rotation angle sensor.
  • the first rotation angle sensor and the second rotation angle sensor can measure the rotation angle of the steering wheel of the vehicle to obtain an angle signal.
  • the abnormality detection circuit can collect a first angle signal from the first rotation angle sensor, and a second angle signal from the second rotation angle sensor. The anomaly detection circuit may then compare the first angle signal and the second angle signal. If the first angle signal is inconsistent with the second angle signal, it can be determined that the electric power steering system is malfunctioning.
  • the above control circuit 211 or control circuit 212 can be used as an abnormality detection circuit.
  • the control circuit 211 is used as a main control circuit
  • the control circuit 212 is an auxiliary control circuit
  • the auxiliary control circuit is used as an abnormality detection circuit for performing an abnormality detection method as an example for description.
  • the auxiliary control circuit may include a monitoring module (or unit) 900 for detecting whether the control function of the function execution component fails.
  • the function execution component is a motor as an example.
  • the phase current detection circuit of the motor M1 can send the detected currents (current Iua', current Iva', current Iwa') of each phase winding of the motor M1 to the monitoring module 900, and the phase current detection circuit of the motor M2 can send The detected currents (current Iub′, current Ivb′, current Iwb′) of each phase winding of the motor M2 are sent to the monitoring module 900 .
  • the monitoring module 900 can compare the currents of the same-phase windings of the motor M1 and the motor M2 to determine whether the motor control function fails.
  • the motor position sensor of the motor M1 can send the detected motor rotor position signal 901 to the monitoring module 900
  • the motor position sensor of the motor M2 can send the detected motor rotor position signal 902 to the monitoring module 900 .
  • the monitoring module 900 can compare the motor rotor position signal 902 with the motor rotor position signal 901 . If the two are inconsistent, it can be determined that the motor control function is faulty, for example, the electric power steering system is faulty. For details, reference may be made to the foregoing, and details are not repeated here.
  • the monitoring module 900 uses a preset algorithm or model to determine the electronic control system according to the current of each phase winding of the motor M1, the current of each phase winding of the motor M2, and the motor rotor position signal 901 and the motor rotor position signal 902. The failed or failed component in the system, and the type of failure, etc. And according to the determined failure component and failure type, it is determined whether to switch the function roles of the main control circuit and the auxiliary control circuit, and whether to control the output of the driving circuit M1 or the driving circuit M2.
  • the monitoring module 900 when the monitoring module 900 decides to control the output of the driving circuit 312 or the driving circuit 322, it can notify the main control circuit through the interactive communication channel between the subsystem 310 and the subsystem 320, so that the main control circuit can control the driving circuit 312 or the driving circuit 322 output.
  • the main control circuit can obtain the sum of the currents of the same-phase windings of the motor M1 and the motor M2, specifically, the sum of the current Iua' and the current Iub', the sum of the current Iva' and the current Ivb' And, the sum of the current Iwa' and the current Iwb'.
  • the main control circuit can also obtain the motor rotor position signal 901 and the motor rotor position signal 902 .
  • the main control circuit can be based on the sum of the current Iua' and the current Iub', the sum of the current Iva' and the current Ivb', the sum of the current Iwa' and the current Iwb', the motor rotor position signal 901, the motor rotor position signal 902 and Sensing signals such as vehicle speed signal, steering wheel torque signal, steering wheel angle signal, etc., use the FOC algorithm to determine the control signal (duty ratio signal or duty ratio command), and output the control signal to control the driving circuit 312 and the driving circuit 322, to Drive motor M1 and motor M2.
  • the auxiliary control circuit (control circuit 211/311 or control circuit 212/321) is used as an abnormality detection circuit for executing the abnormality detection method as an example.
  • the auxiliary control circuit may include a monitoring module 1000 for detecting whether the functions of torque and steering wheel angle fail.
  • the subsystem 310 can respectively collect the steering wheel torque signal 1001 and the steering wheel torque signal 1002 through two torque sensors.
  • the subsystem 320 can respectively collect the steering wheel torque signal 1003 and the steering wheel torque signal 1004 through two torque sensors.
  • the monitoring module 1000 can compare the four torque signals to determine whether the torque function safety is faulty, or whether the electric power steering system is faulty. Under normal circumstances, these four torque signals should be the same. If the four torque signals are compared and one or two of them are found to be different from the others, it can be determined that the torque function may fail, or the electric power steering system may fail.
  • the subsystem 310 can monitor the rotation angle of the steering wheel through the rotation angle sensor, and collect the steering wheel angle signal 1005 .
  • the subsystem 320 can monitor the rotation angle of the steering wheel through the rotation angle sensor, and collect the steering wheel angle signal 1006 .
  • the monitoring module 1000 can collect the steering wheel angle signal 1005 and the steering wheel angle signal 1006 , and compare the steering wheel angle signal 1005 and the steering wheel angle signal 1006 . When the two are not the same, it can be determined that the steering wheel angle function may be malfunctioning, or that the electric power steering system may be malfunctioning.
  • the auxiliary control circuit may further include a monitoring module 900 , and the function of the monitoring module 900 may refer to the introduction of the embodiment shown in FIG. 9 above, and details are not repeated here.
  • the torque signal 1001, the torque signal 1002, the torque signal 1003, and the torque signal 1004 can be used by the main control circuit after torque processing (for example, averaging these four, or selecting one) , to output the control signal.
  • the steering wheel angle signal 1005 and the steering wheel angle signal 1006 can be used by the main control circuit after angle processing (for example, averaging the two, or selecting one) to output a control signal.
  • the anomaly detection method provided in the embodiment of the present application is based on the synchronization of redundant subsystems (synchronization of the control circuit 211 and the control circuit 212, synchronization of the drive circuit 221 and the drive circuit 222, etc.), by comparing the sensing signals of the redundant subsystems (such as comparison of the same-phase winding current, motor rotor position signal comparison, steering wheel torque signal comparison, etc.), to monitor whether the electronic control system fails, and can accurately detect whether the electronic control system fails.
  • it can be used without components. In the case of functional safety integrity, the functional safety capability of the electronic control system is improved and the cost is saved.
  • the control process of the electronic control system on the function execution components is introduced in detail.
  • Other electronic control systems can also adopt the same or similar configuration, and control the functional execution components according to the same or similar control method.
  • other electronic control systems electromechanical brake control systems for braking functions, drive controllers for vehicle driving functions, electronic control systems for transmission functions, etc.
  • the electronic control system may also include at least two drive circuits.
  • the at least two driving circuits can be realized with reference to the driving circuit 221/312 and the driving circuit 222/322 above.
  • the corresponding function executing components of the electronic control system may include at least two motors.
  • the embodiment of the present application provides an abnormality detection device 1100, which can be used to implement any of the above abnormality detection methods, and the device 1100 includes:
  • an acquiring unit 1110 configured to acquire a first signal from a first component and a second signal from a second component, where the first component and the second component are mutually redundant;
  • the determination unit 1120 is configured to determine failure (or failure) of the electronic control system according to the first signal and the second signal; further, failure (or failure) of the first component or the second component may be determined.
  • the abnormality detection device 1100 may be the above control circuit 211 or 212, that is, the above control circuit 211 or 212 is integrated with an abnormality detection function. Alternatively, the abnormality detection device 1100 may be a device independent of the control circuit.
  • the device provided in the embodiment of the present application is based on the synchronization of redundant subsystems (synchronization of control circuit 211 and control circuit 212, synchronization of drive circuit 221 and drive circuit 222, etc.), by comparing the control signal and drive signal of the redundant subsystem Or sensing signals (such as comparison of the same-phase winding current, motor rotor position signal comparison, steering wheel torque signal comparison, etc.) to monitor whether the electronic control system is faulty, and can accurately detect whether the electronic control system is faulty.
  • it can be used without components In the case of high functional safety integrity, the functional safety capability of the electronic control system is improved and the cost is saved.
  • an embodiment of the present application provides an anomaly detection device 1200 , including a processor 1210 , a memory 1220 and a communication interface 1230 .
  • the memory 1220 stores computer instructions.
  • the apparatus 1200 can execute any one of the above anomaly detection methods.
  • Each functional unit in each embodiment of the embodiment of the present application may be integrated into one processing unit, or each unit may physically exist separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage
  • the medium includes several instructions to enable a computer device (which may be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, and other various media capable of storing program codes.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may also be distributed to multiple networks on the unit. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Control Of Electric Motors In General (AREA)
  • Safety Devices In Control Systems (AREA)

Abstract

公开了一种控制装置、电子控制系统及车辆。该控制装置用于为驱动装置提供控制信号，该驱动装置用于驱动功能执行部件；其中，该装置包括：第一控制电路（211），用于在第一时钟信号的作用下，输出第一控制信号（E1）；第二控制电路（212），用于在第二时钟信号的作用下，输出第二控制信号（E2）；选择单元（213），用于将第一控制信号或第二控制信号输出为驱动装置的控制信号；第一时钟信号和第二时钟信号具有相同的频率，且第一控制电路和第二控制电路的时间零点相同。该装置可提高电子控制系统的功能安全。

Description

控制装置、电子控制系统及车辆 技术领域
本申请实施例涉及电动控制技术领域，具体涉及一种控制装置、电子控制系统及车辆。
背景技术
在电力电子和功率器件获得长足发展，使得微控制器或者说微控制单元(microcontroller unit，MCU)软硬件控制能力大大增强的背景下，越来越多的设备采用电子控制系统对功能进行控制，与传统的机械式功能系统不同，电子控制系统利用MCU实现对功率器件的快速、精细控制，进而可以更精确地辅助设备，实现所需功能。以车辆的转向功能为例，相对于传统的机械式液压动力转向系统，电动助力转向系统(electric power steering，EPS)利用MCU实现对功率器件的快速、精细控制，进而可以更精确地辅助车辆转向。
传统的机械式功能系统的元件失效主要由磨损，强度等机械因素导致，元件失效有一个逐渐积累的过程。而电子控制系统中的电子元件的失效往往没有任何预兆，并且电子元件失效的后果也难以预计。
发明内容
本申请实施例提供了一种控制装置、电子控制系统及车辆，可提高电子控制系统的功能安全。
本申请实施例提供了一种控制装置，用于为驱动装置提供控制信号，该驱动装置用于驱动功能执行部件。该控制装置包括:第一控制电路，第二控制电路，以及选择单元。其中，第一控制电路用于在第一时钟信号的作用下，输出第一控制信号；第二控制电路用于在第二时钟信号的作用下，输出第二控制信号；选择单元用于将第一控信号或第二控制信号输出为驱动装置的控制信号。其中，第一时钟信号和第二时钟信号具有相同的频率，且第一控制电路和第二控制电路的时间零点相同。
在本申请实施例提供的控制装置中，选择单元可以将第一控制电路输出的控制信号输出为驱动装置的控制信号，或者将第二控制电路输出的控制信号输出为驱动装置的控制信号。由于第二控制电路和第一控制电路采用的时钟信号的频率相同，使得第二控制电路和第一控制电路的工作频率相同。第一控制电路的时间零点和第二控制电路的时间零点相同，使得第二控制电路和第一控制电路的工作开始时间相同。由此，使得第一控制电路输出的控制信号和第二控制电路输出的控制信号使相同或接近的，进而使得驱动装置在由第一控制电路输出的控制信号所控制的状态，切换到由第二控制电路输出的控制信号所控制的状态时，对驱动装置的驱动可不发生较大变化或波动，从而提高了电子控制系统的功能安全性。
在第一方面的一种可能实现方式中，第一时钟信号和第二时钟信号来自同一时钟 源。
也就是说，在该实现方式中，第一控制电路和第二控制电路采用同一时钟源，保障了第一控制电路和第二控制电路的工作频率相同。
在第一方面的一种可能实现方式中，第一控制电路与该同一时钟源连接，接收来自该同一时钟源的第一时钟信号，并向第二控制电路输出第二时钟信号。其中，第二时钟信号可以是第一控制电路根据第一时钟信号产生的。
也就是说，在该实现方式中，时钟源可以向第一控制电路发送时钟信号，第一控制电路可以向第二控制电路发送第二时钟信号，以使得第一控制电路和第二控制电路可在相同频率的时钟信号的作用下运行。
在第一方面的一种可能实现方式中，第一控制电路和第二控制电路分别与该同一时钟源连接，分别接收来自该同一时钟源的第一时钟信号和第二时钟信号，第一时钟信号和第二时钟信号为同一时钟信号。
也就是说，在该实现方式中，第一控制电路和第二控制电路均可与时钟源直接连接，从而可以同时接收时钟源发送的时钟信号，使得第一控制电路和第二控制电路可在相同频率的时钟信号的作用下运行。
在第一方面的一种可能实现方式中，该装置还包括：检测单元，用于检测至少两个时钟源的有效性，且控制第一时钟信号和所述第二时钟信号来自至少两个时钟源中的有效时钟源。
也就是说，在该实现方式中，通过检测单元可以检测该至少两个时钟源的有效性，可保证控制电路能够在有效时钟源的作用下工作。
在第一方面的一种可能实现方式中，该检测单元位于第一控制电路和/或第二控制电路。
也就是说，在该实现方式中，第一控制电路和/或第二控制电路可以检测该至少两个时钟源的有效性，从而无需专门设置检测单元，降低了控制装置的成本。
在第一方面的一种可能实现方式中，该选择单元位于第一控制电路和/或第二控制电路。
也就是说，在该实现方式中，第一控制电路和/或第二控制电路可以选择驱动装置的控制信号，从而无需专门设置选择单元，降低了控制装置的成本。
在第一方面的一种可能实现方式中，第一控制电路和第二控制电路之间设置有至少一个元件，至少一个元件包括电阻元件、或电容元件，或包括电阻元件和电容元件。
在该实现方式中，通过在第一控制电路和第二控制电路之间设置至少一个元件，可以在信号线开路或短路时，避免第一控制电路和第二控制电路发生共因失效。
第二方面，本申请实施例提供了一种电子控制系统，包括第一方面所提供的控制装置和驱动装置；其中，该驱动装置包括：第一驱动电路，用于接收控制装置的选择单元输出的控制信号，且在控制信号的作用下，输出第一驱动信号；第二驱动电路，用于接收控制装置的选择单元输出的控制信号，且在控制信号的作用下，输出第二驱动信号。
该方案通过设置第一驱动电路和第二驱动电路，实现了驱动电路的备份冗余；并且第一驱动电路和第二驱动电路由相同的控制信号控制，可以产生相同或相近的驱动 信号，在其中一个驱动电路故障时，另一个驱动电路可以保障电子控制系统的功能安全。
在第二方面的一种可能的实现方式中，第一驱动信号和第二驱动信号用于驱动第一功能执行部件，该系统还包括：第一断相电路，设置于第一驱动电路和第一功能执行部件之间，用于在第一驱动电路故障时，进入断开状态；第二断相电路，设置于第二驱动电路和第一功能执行部件之间，用于在第二驱动电路故障时，进入断开状态。
也就是说，在该实现方式中，可以在驱动电路和功能执行部件之间设置断相，当驱动电路故障时，断相进入断开状态，可以避免故障驱动电路对功能执行部件的影响。
在第二方面的一种可能的实现方式中，第一驱动信号和第二驱动信号还用于驱动第二功能执行部件，该系统还包括：第三断相电路，设置于第一驱动电路和所述第二功能执行部件之间，用于在第一驱动电路故障时，进入断开状态；第四断相电路，设置于第二驱动电路和第二功能执行部件之间，用于在第二驱动电路故障时，进入断开状态。
也就是说，在该实现方式中，可以在驱动电路和功能执行部件之间设置断相，当驱动电路故障时，断相进入断开状态，可以避免故障驱动电路对功能执行部件的影响。
在第二方面的一种可能的实现方式中，还包括：驱动电路选择单元，用于根据第一驱动电路的第一供电电压和第二驱动电路的第二供电电压，将第一驱动信号，或第二驱动信号，或第一驱动信号和第二驱动信号输出至功能执行部件。
也就是说，在该实现方式中，通过设置驱动电路选择单元，可以从第一驱动信号和第二驱动信号中选择合适的驱动信号，来驱动功能执行部件。
在第二方面的一种可能的实现方式中，第一供电电压大于第二供电电压，且在第一供电电压和第二供电电压之间的电压差位于预设范围之内时，将第一驱动信号和第二驱动信号输出至功能执行部件；或者，在第一供电电压和所述第二供电电压之间的电压差位于预设范围之外时，将第一驱动信号输出至功能执行部件；或者，在第一供电电压和第二供电电压之间的电压差大于阈值时，将第一驱动信号和第二驱动信号输出至功能执行部件；或者在第一供电电压和第二供电电压之间的电压差小于阈值时，将第一驱动信号输出至功能执行部件；或者，在第一供电电压和第二供电电压之间的电压差等于阈值时，将第一驱动信号和第二驱动信号输出至功能执行部件，或，将第一驱动信号输出至功能执行部件。
也就是说，在该实现方式中，可以根据不同驱动装置对应的供电电压，选择输出至功能执行部件的驱动信号，进一步提高了电子控制系统的功能安全。
在第二方面的一种可能的实现方式中，该系统还包括：第一时钟源和第二时钟源；其中，第一时钟信号和第二时钟信号来自第一时钟源或第二时钟源。
也就是说，在该实现方式中，对时钟源进行冗余设置，在其中一个时钟源失效时，另一个时钟源向控制电路发送时钟信号，降低了时钟源故障导致的控制装置功能失效的概率，进一步提高了电子控制系统的功能安全以及失效可操作性。
在第二方面的一种可能的实现方式中，第一时钟源和第二时钟源的时钟频率相同。
也就是说，在该实现方式中，设置两个时钟频率相同的时钟源，从而当两个时钟源相互接替时，可保证控制电路可以在相同的时钟频率下运行。
在第二方面的一种可能的实现方式中，控制装置的检测单元，用于检测第一时钟源输出的时钟信号和第二时钟源输出的时钟信号，且当第一时钟源输出的时钟信号失效，且第二时钟源输出的时钟信号有效时，控制第一时钟信号和第二时钟信号来自第二时钟源，或者，当第二时钟源输出的时钟信号失效，且第一时钟源输出的时钟信号有效时，控制第一时钟信号和第二时钟信号来自第一时钟源。
也就是说，在该实现方式中，当两个时钟源中的一个时钟源失效，而另一个时钟源有效时，可以将有效时钟源的时钟信号作用于控制电路，以保障控制电路的正常运行。
在第二方面的一种可能的实现方式中，第一驱动电路和第二驱动电路之间有至少一个元件，至少一个元件包括电阻元件、或电容元件，或包括电阻元件和电容元件。
在该实现方式中，通过在第一驱动电路和第二驱动电路之间设置至少一个元件，可以在信号线开路或短路时，避免第一驱动电路和第二驱动电路发生共因失效。
第三方面，本申请实施例提供了一种电子控制系统的异常检测方法，包括：获取来自第一部件的第一信号和来自第二部件的第二信号，第一部件和第二部件互为冗余；根据第一信号和第二信号，确定电子控制系统失效。
在一种可能的实现方式中，第一部件为第一控制电路，第一信号为第一控制电路在第一时钟信号的作用下输出的控制信号；第二部件为第二控制电路，第二信号为第二控制电路在第二时钟信号的作用下输出的控制信号；其中，第一时钟信号和第二时钟信号具有相同的频率，且第一控制电路和第二控制电路的时间零点相同。
可以理解，正常情况下，时间零点相同的两个控制电路分别在具有相同频率的时钟信号的作用下产生控制信号，是相同或接近的；在该实现方式中，通过比较这两个控制电路产生的控制信号，可以确定电子控制系统是否失效。
在一种可能的实现方式中，第一部件为第一驱动电路，第一信号为第一驱动电路在控制信号的作用下输出的驱动信号；第二部件为第二驱动电路，第二信号为第二驱动电路在该控制信号的作用下输出的驱动信号。
可以理解，正常情况下，在两个驱动电路在相同控制信号的作用下输出的驱动信号，是相同或接近的；在该实现方式中，通过比较这两个驱动电路在相同控制信号的作用下输出的驱动信号，可以确定电子控制系统是否失效。
在一个可能的实现方式中，第一部件为第一功能执行部件，第一信号为第一功能执行部件在驱动信号的驱动下产生的信号；第二部件为第二功能执行部件，第二信号为第二功能执行部件的驱动下产生的信号。
可以理解，正常情况下，在两个功能执行部件在同一驱动信号的驱动下产生的信号，是相同或接近的；在该实现方式中，通过比较这两个功能执行部件在同一驱动信号的驱动下产生的信号，可以确定电子控制系统是否失效。
第四方面，本申请实施例提供了一种异常检测装置，包括：获取单元，用于获取来自第一部件的第一信号和来自第二部件的第二信号，第一部件和第二部件互为冗余；确定单元，用于根据第一信号和第二信号，确定电子控制系统失效。
在一种可能的实现方式中，第一部件为第一控制电路，第一信号为第一控制电路在第一时钟信号的作用下输出的控制信号；第二部件为第二控制电路，第二信号为第 二控制电路在第二时钟信号的作用下输出的控制信号；其中，第一时钟信号和第二时钟信号具有相同的频率，且第一控制电路和第二控制电路的时间零点相同。
在一种可能的实现方式中，第一部件为第一驱动电路，第一信号为第一驱动电路在控制信号的作用下输出的驱动信号；第二部件为第二驱动电路，第二信号为第二驱动电路在该控制信号的作用下输出的驱动信号。
在一个可能的实现方式中，第一部件为第一功能执行部件，第一信号为第一功能执行部件在驱动信号的驱动下产生的信号；第二部件为第二功能执行部件，第二信号为第二功能执行部件的驱动下产生的信号。
第五方面，本申请实施例提供了一种异常检测装置，包括处理器、存储器和通信接口；其中，存储器用于存储计算机指令，当该计算机指令被处理器执行时，异常检测装置执行第三方面提供的方法。
第六方面，本申请实施例提供了一种车辆，包括第二方面所提供的系统和功能执行部件。
第七方面，本申请实施例提供了一种车辆，包括第一方面所提供的装置和功能执行部件。
第八方面，本申请实施例提供了一种车辆，包括第四方面所提供的装置和功能执行部件。
第九方面，本申请实施例提供的一种车辆，包括第五方面所提供的装置和功能执行部件。
在本申请实施例提供的控制装置以及电子控制系统中，第一控制电路和第二控制电路的时钟信号的频率相同，且第一控制电路和第二控制电路的时间零点相同，使得第一控制电路和第二控制电路输出的控制信号尽可能地相同，从而当选择电路先后将第一控制电路输出的控制信号、第二控制电路输出的控制信号输出为驱动装置的控制信号时，对驱动装置的驱动可不发生较大变化或波动，从而提高了电子控制系统的功能安全性。
附图说明
图1A为本申请实施例提供的一种车辆的结构示意图；
图1B为本申请实施例提供的一种车辆的结构示意图；
图1C为本申请实施例提供的一种车辆的结构示意图；
图1D为本申请实施例提供的一种车辆的结构示意图；
图2为本申请实施例提供的一种电子控制系统的结构示意图；
图3A为本申请实施例提供的一种电子控制系统的结构示意图；
图3B为本申请实施例提供的一种电子控制系统的结构示意图；
图4A为本申请实施例提供的一种电源电压和电机输入电压的关系图；
图4B为本申请实施例提供的一种电源电压和电机输入电压的关系图；
图5A为本申请实施例提供的一种冗余电机的绕组布置示意图；
图5B为本申请实施例提供的一种冗余电机的绕组布置示意图；
图6为本申请实施例提供的一种异常检测方法流程图；
图7为本申请实施例提供的一种三相逆变电路输出的电流示意图；
图8为本申请实施例提供的一种冗余逆变电路输出的电流的波形示意图；
图9为本申请实施例提供的一种功能安全监控框架图；
图10为本申请实施例提供的另一种功能安全监控框架图；
图11为本申请实施例提供的一种异常检测装置的结构示意图；
图12为本申请实施例提供的另一种异常检测装置的结构示意图。
具体实施方式
下面将结合附图，对本申请实施例所提供的技术方案进行描述。显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
以下，术语“第一”、“第二”仅用于方便区别描述的对象，并没有限制意义，例如，不对描述对象的顺序、重要性和数量做出限制。在本实施例的描述中，除非另有说明，“多个”的含义是两个或两个以上。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间/逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行次序，只要能达到相同或者相类似的技术效果即可。
图1A-图1D示出了本申请实施例提供的一种车辆100的结构示意图。如图1A-1D所示，车辆100包括驱动系统、底盘120和车身130。其中，驱动系统包括动力装置110和驱动控制器。其中，驱动控制器可以控制动力装置110为为车辆100提供动力。其中动力装置110可以为燃油发动机、电池装置，或既包括发动机又包括电池装置。图1的动力装置110以发动机为例，在其它实现中，动力装置可以为电池包和电驱动装置，安装于底盘120上，且位于座舱140下方。底盘120用于支撑、安装车辆100的动力装置110及其他部件，形成汽车的整体造型，并接受动力装置110的动力，使车辆100产生运动，保证车辆110的正常行驶。底盘120例如包括传动系121、行驶系122、转向系123和制动系124。
传动系121用于将车辆的动力装置所产生的动力传递到驱动车轮，包括车辆动力装置与驱动轮之间的动力传递装置。例如，包括离合器、变速器、传动轴、驱动桥等装置。
行驶系122用于与其它系配合，保证车辆的正常行驶。行驶系122包括车架、车桥、车轮和悬架等部分。前后车轮分别支承在各车桥(前桥、后桥)上，为了减少车辆在不平路面上行驶时受到的振动，车桥可以通过弹性悬架与车身连接。行驶系122接受传动系121的动力，通过驱动轮与路面的作用产生牵引力，使车辆正常行驶；且承受车辆的重量和地面的反力；缓和不平路面对车身造成的冲击，衰减车辆行驶中的振动，保持行驶的平顺性；且与转向系123配合，保证车辆操纵稳定性。
转向系123用于改变或保持车辆行驶或倒退方向，转向系123主要包括转向操纵机构、转向器和转向传动机构。转向操纵机构可以包括转向盘(例如，方向盘)、转向轴和转向管柱等装置。转向器将转向盘的转动变为转向摇臂的摆动或齿条轴的直线往复运动，并对转向操纵力进行放大。转向传动机构将转向器输出的力和运动传给车轮，并使左右车轮进行偏转。
制动系124用于对车辆的某部分(例如，车轮)施加一定的力，使行驶中的车辆进行强制减速甚至停车；使已停驶的车辆在各种道路条件下(例如，在坡道上)稳定驻车；使下坡行驶的车辆速度保持稳定。制动系124主要包括制动操纵机构(例如包括制动踏板)和制动执行器(例如，包括刹车盘)。
随着电力电子和功率器件的发展，电子控制系统用于控制或辅助越来越多功能的实现，与传统的机械式功能系统不同，电子控制系统利用微控制单元(microcontroller unit，MCU)实现对功率器件的快速、精细控制，进而可以更精确地控制功能执行部件，实现所需功能。功能执行部件是指能够在驱动信号(例如电压)的作用下，实现某一功能的部件，该功能是指该电子控制系统用于控制或辅助实现的功能。例如，在车辆控制领域，电子控制系统可以用于动力装置，传动系，转向系，或制动系中，以控制或辅助驱动、传动、转向、或制动功能的实现。相应的，功能执行部件可以为电动机，电动机可以在驱动信号的作用下，输出力矩，以实现相关功能，例如驱动、传动、转向、或制动功能。在一些实施例中，电子控制系统可以用于转向系123，为电动助力转向(electric power steering，EPS)控制系统，功能执行部件可以为用于带动转向系123中转向功能实现的电动机。在一些实施例中，电子控制系统可以用于制动系124，为电子机械制动(electric mechanical braking，EMB)控制系统，功能执行部件可以为制动系124中用于带动制动功能实现的电动机。在一些实施例中，电子控制系统可以用于传动系121，辅助或控制传动功能的实现，功能执行部件可以为传动系121中用于带动传动功能实现的电动机。在每一种系统中，以车辆100的驱动系统为例，电子控制系统可以理解为车辆100的驱动控制器，功能执行部件可以理解为车辆100的动力装置110，此处不再一一列举。
MCU的异常可能导致电子控制系统的功能失效，而且MCU异常的发生往往具有突然性，使得电子控制系统可能突然失效。若在车辆行驶期间，电子控制系统突然失效导致相关功能(例如助力转向功能)失效，可能危及车辆乘员或车辆周围人员的人身安全。
为此，电子控制系统可以进行冗余备份，冗余备份可以进行双冗余备份(包括一个辅系统)，或更多冗余备份(包括至少两个辅系统)，主系统和辅系统相对独立的工作。然而仅仅考虑冗余备份，还不足以让电子控制系统的冗余能力得以足够的发挥，尤其是交通工具这种对安全性要求极高的设备中，冗余备份在及时性上还不足以满足要求。
为了提升电子控制系统在关键时刻发挥冗余能力的效率，使得某系统(主系统或辅系统)的全部或部分功能失效时，有效的系统可以快速接替，并继续保障电子控制系统的输出，提供电子控制系统稳定的控制能力。本申请实施例提供一种控制装置，该控制装置包括冗余的控制电路，以输出冗余的控制信号；即该控制装置包括至少两个控制电路，其中一个控制电路为基础部分(或主控电路)，其它控制电路为冗余部分(辅控电路)，且主控电路与辅控电路可以互换，即主控电路可以作为辅控电路，辅控电路可以作为主控电路。主控电路和辅控电路在相同频率的时钟信号下工作，且主动电路和辅控电路时间同步，即控制电路的时钟信号同频，且时间零点相同，从而可以实现控制电路同步工作，当其中一个控制电路失效(或故障)时，实现控制电路 间的无缝切换，提升冗余系统的利用效率。此外，通过相同频率的时钟信号和时间同步的控制，可对冗余系统的硬件、软件信号提供同步冗余信号监测，尤其是对快速交变信号的监测能力，可大幅度提高系统级功能安全能力。
请参考图2，其为本申请实施例提供的一种电子控制系统的结构示意图。如图2所示，该电子控制系统200包括控制部分210和功率部分(或驱动部分)220，控制部分210用于为功率部分220提供控制信号，功率部分220在控制信号的控制下产生驱动信号，以驱动功能执行部件工作，故功率部分220又可以称为功率电路或驱动电路；功能执行部件同以上描述，在其所应用的系统中用于在驱动电路的驱动信号的作用下，实现对应的功能，功能执行部件也可以称为功能执行系统或功能执行装置。
该电子控制系统进行了冗余备份，包括控制部分210的冗余备份和/或功率部分220的冗余备份。
在一些实施例中，对电子控制系统的控制部分210进行了冗余备份，提供一种控制装置210，即作为电子控制系统的控制部分。该控制装置210包括至少两个控制电路，用于在时钟信号的作用下，输出控制信号，其中，提供给这些控制电路的时钟信号频率相同，且控制电路具有相同的时间零点。如图2所示，该控制装置包括控制电路211、控制电路212和选择单元213，其中控制电路211在时钟信号C1的作用下，输出控制信号S1，控制电路212在时钟信号C2的作用下，输出控制信号S2，选择单元213用于将控制信号S1或控制信号S2输出为功率部分(驱动电路)220的控制信号，时钟信号C1和时钟信号C2具有相同的频率，且控制电路211和控制电路212的时间零点相同。为了方便描述，图中仅示出了两个控制电路，实际使用中可以进行更多冗余备份，即包括更多的控制电路，本申请对冗余控制电路的数量不作限制。
时钟信号的频率代表或者说衡量了控制电路的工作频率的高低，控制装置的控制电路的时钟信号的频率相同，使得控制电路的工作频率相同；时间零点代表了控制电路的工作开始时间；则以上控制装置的至少两个控制电路的工作频率相同，工作开始时间也相同，使得该至少两个控制电路的工作时间同步，从而可以产生至少两路同步的控制信号，当其中一路控制信号失效时，可以由另一路控制信号迅速接替失效的控制信号，实现控制电路间的无缝切换，在实现失效可操作(fail operational)的同时，也进一步提高了电子控制系统的功能安全。
失效可操作也可以称为失效可操作性或故障可操作性，属于功能安全(functional safety)范畴。失效可操作可以通过冗余支持功能来保持功能可用性。具体而言，可以设置两个或更多个可以支持功能A的功能模块，当某个功能模块故障时，功能A因为有其他功能模块的支持而不至于失效。接替可理解为承接其他模块的工作。
在一些实施例中，以上控制信号可以为脉冲信号(又可以称为占空比信号)，例如脉冲宽度调制(pulse width modulation，PWM)信号。以上控制电路包括计数部分，从时间零点开始计数，在时钟信号的每个时钟周期进行一次计数，即对每个时钟脉冲进行计数，当计数值达到预设值时，控制电路输出一个脉冲信号，本申请实施例对该脉冲信号的脉冲宽度不作限制。控制电路具有相同的时间零点，可以理解为控制电路的计数起点相同。该控制电路的计数部分的功能可以通过软件实现，也可以通过硬件实现，本申请不作限制。该控制电路的计数部分可以称为频率计数单元，计数器或定 时器，则控制电路的频率计数单元，计数器或定时器的时间零点(工作起始时间)相同。
在一些实施例中，控制电路的计数部分可以包括系统定时模组(system time module，STM)、通用定时模组(generic time module，GTM)、脉冲宽度调制(pulse width modulation，PWM)发生单元中的一种或多种。
控制电路的时间零点相同是指控制电路的启动时刻相同或起始时刻时间差小于容忍值，该容忍值可以为预设的固定值，或者可以根据控制电路的时钟信号确定，或者根据电子控制系统的总线时钟确定，控制电路的时钟信号可以来自于电子控制系统的总线时钟，也可以为其独立设置时钟，其中，时钟又可以称为时钟源。例如容忍值为控制电路的时钟信号或总线时钟的脉冲周期。例如，控制电路211和控制电路212的时间零点在同一时刻或者时间零点之间的时间差小于总线时钟的脉冲周期。总线时钟是指控制电路(例如MCU)的外围总线时钟。在一种实现中，在总线时钟发出的时钟信号的驱动下，控制电路211和控制电路212的计数部分各自进行计数。总线时钟可以是控制电路211和控制电路212的共同时钟源，例如时钟源CK1或时钟源CK2。时钟的脉冲周期是指该时钟信号的相邻两个时钟脉冲的产生时刻之间的时间差，为时钟频率的倒数。
在一些实施例中，可以通过对表的方式，使控制电路211和控制电路212的时间零点相同。对表可以有多种实现方式。在一个例子中，控制电路211可以在某一时刻(例如控制电路211上电，开始工作时)向控制电路212发送时间零点触发信号。时间零点触发信号可以为预设的或者控制电路211和控制电路212之间商定的信号。例如可以为一种门控硬件信号或其他硬件触发信号，也可以为一种软件触发信号，在此不再一一赘述。控制电路211在发出时间零点触发信号时，可以将控制电路211的计数部分归零，即将发出时间零点触发信号的时刻设置为时间零点。控制电路212在接收到时间零点触发信号时，可以将控制电路212的计数部分归零，即将接收到时间零点触发信号的时刻设置为时间零点。在另一个例子中，可以通过控制电路以外的其它部件实现对表，该部件向控制电路211和控制电路212发送时间零点触发信号，控制电路211和控制电路212分别将各自接收到时间零点触发信号的时刻设置为各自的时间零点。该部件例如为控制装置所在设备中的具有控制能力的部件，以车辆为例，该部件例如为整车控制器(vehicle control unit，VCU)、电子控制单元(electronic control unit，ECU)。在其他实施例中，还可以采用其他的对表方式，使控制电路211和控制电路212的时间零点相同，在此不再一一赘述。
在一些实施例中，控制装置的控制电路可以由同一电源供电，且控制电路可以各自设置供电时刻为各自的时间零点。例如，同一电源开始为控制电路211和控制电路212供电时，控制电路211和控制电路212可以各自设置供电时刻为各自的时间零点。由此实现控制电路211的时间零点和控制电路212的时间零点相同。
控制装置的控制电路的时间零点相同，使得控制电路可以从同一时间起点或初始时间开始计数，此外，控制电路按照相同的频率进行计数，实现了控制电路的工作时间同步。
控制装置的控制电路在工作时，可以基于采集到的感测信号(或传感信号)，产 生脉冲信号，工作时间同步可以使得控制电路同步获取相同的感测信号(例如，相同时间段内相同传感器感测到的信号)，且基于相同的感测信号和相同的算法，产生同步的(或相同的)脉冲信号。
例如，在工作时间同步的情况下，控制电路211和控制电路212采集感测信号的时间也是同步的。以控制电路通过数据上报指令采集感测信号为例，控制电路211和控制电路212同步向传感器发送数据上报指令，使得传感器可以在近似或相同时间内接收到控制电路211和控制电路212发送的数据上报指令，进而根据数据上报指令将传感器监测得到的感测信号同步发送给控制电路211和控制电路212。由此，实现了感测信号的同步采集。
此外，在工作时间同步的情况下，控制电路211和控制电路212的数据处理过程也同步。示例性的，控制电路211和控制电路212可以同步根据采集到的感测信号(例如方向盘扭矩信号、方向盘角度信号、电机转子位置信号、相电流检测信号中的一种或多种)，通过相同的算法，例如磁场定向控制(field oriented control,FOC)算法，产生脉冲信号(例如，PWM信号)。由于控制电路211和控制电路212同步采集感测信号，且基于采集到的感测信号通过相同的算法，可以得到同步的脉冲信号。脉冲信号可以控制功率部分输出电流的方向和大小，因此也可以将该脉冲信号称为用于控制功率部分的控制信号。本申请实施例不限制感测信号的类型和算法类型，且该感测信号的类型和算法类型由电子控制系统的功能决定。
以上控制电路211和控制电路212中的一个可以用作主控电路，另一个可以用作辅控电路。默认情况下，即主控电路有效的情况下，主控电路产生的控制信号S1，可以用作功率部分220的控制信号，用于控制驱动电路221和驱动电路222产生用于驱动功能执行部件的驱动信号。控制电路211可以通过选择单元213将控制信号S1输出至驱动电路221(如图中实线L1)，或者可以直接将控制信号S1输出至驱动电路221(如图中虚线L2)。可选的，在主控电路有效的情况下，辅控电路产生的控制信号S2可以不被输出到功率部分220，即选择单元213将控制信号S1输出至驱动电路222，或者辅控电路产生的控制信号S2被直接输出到功率部分220，选择单元213在其中一路控制电路失效时，才选择有效的控制信号S1或S2输出至功率部分220。在主控电路失效的情况下，辅控电路产生的控制信号S2被输出到功率部分220，用于控制驱动电路221和驱动电路222产生用于驱动功能执行部件的驱动信号；即选择单元213将控制信号S2输出至驱动电路221和驱动电路222。此时，该辅控电路成为新的主控电路，以控制功率部分220。如上所述，新的主控电路和原主控电路的工作频率和工作开始时间相同，从而产生同步的(或相同的)控制信号，使得新的主控电路可以无缝接替原主控电路，对功率部分220进行控制，极大提高了电子控制系统的功能安全和失效可操作性。
控制装置中的控制电路可以集成在一个物理实体中，也可以物理上分开，例如集成在一个芯片中，该芯片作为电子控制系统的主控芯片。或者，控制电路可以物理上分开，例如控制电路211包括第一MCU，控制电路212包括第二MCU，第一MCU和第二MCU可以是计算能力相同或相近的MCU。例如，控制电路211和控制电路212分别包括两个型号相同的MCU。
选择单元213接收控制电路的控制信号，并选择有效的控制信号输出至功率部分220。选择单元213的功能可以通过硬件实现，也可以通过软件实现，本申请不做限制。选择单元213可以位于控制装置的一个或多个控制电路中，或者独立于控制电路设置。例如，选择单元213可以实现为独立于控制电路211和控制电路212之外的硬件模块。例如，选择单元213可以为MCU。再如，选择单元213可以配置在控制电路211或控制电路212中。示例性，选择单元213可以为运行在控制电路211或控制电路212中的软件模块。再如，选择单元213可以包括配置在控制电路211的软件模块和控制电路212的软件模块。也就是说，控制电路211中的软件模块和控制电路212中的软件模块可以协同工作，实现选择单元213的功能。前文示例性的描述了选择单元213的实现形式，并不构成限定。在其他实施例中，选择单元213还可以由其他形式实现，此处不再一一列举。
如图2所示，选择单元213可以对控制电路211和控制电路212是否向功率部分220输出控制信号进行控制。控制电路211可以向选择单元213输出控制信号S1，控制电路212也可以向选择单元213输出控制信号S2。选择单元213可以在控制信号S1和控制信号S2中进行选择，将选择的控制信号输出为功率部分220的控制信号。
在一些实施例中，选择单元213可以通过关闭或打开控制电路的信号输出端口来实现对控制信号的选择。例如，选择单元213可以打开控制电路211的信号输出端口，使得控制电路211可以向功率部分220输出控制信号，以驱动功能执行部件。即选择单元213通过打开控制电路211的信号输出端口，将控制电路211的控制信号输出为功率部分220的控制信号。选择单元213在打开控制电路211的信号输出端口时，可以关闭控制电路212的信号输出端口。同理，选择单元213可以打开控制电路212的信号输出端口，并关闭控制电路211的信号输出端口，以实现对控制信号S2的选择。
选择单元213可以进一步用于确定控制装置210的控制电路(或控制信号)是否失效，且选择有效的控制电路输出的控制信号作为功率部分220的输入。控制电路失效又可以称为控制电路故障，是指该控制电路无法提供正确的控制信号，例如控制电路难以(或不能)按照设定规则来进行工作或者运算。假设设定规则是：控制电路根据感测信号，且基于预设的算法生成控制信号。当该控制电路失效时，该控制电路可能无法接收感测信号；或者接收到感测信号后，根据感测信号无法进行正确计算等等。本申请不做限制，只要是控制电路无法提供正确的控制信号均可以理解为控制电路失效。
在一些实施例中，控制电路自身设置有故障检测电路，可以检测该控制电路是否故障。选择单元213可以根据故障检测电路的检测结果，确定有效的控制电路(或控制信号)，选择有效的控制信号输出至功率部分220。在一些实施例中，选择单元213可以检测控制电路(或控制信号)的有效性，例如选择单元213将接收到的控制信号S1与预设的有效范围进行比较，如果控制信号S1在有效范围内，则控制信号S1有效；类似的，选择单元213将接收到的控制信号S2与预设的有效范围进行比较，如果控制信号S2在有效范围内，则控制信号S2有效；选择单元213可以在控制信号S1失效时，才检测控制信号S2的有效性，如此可以节省功耗。该有效范围例如包括脉冲信号的脉冲宽度范围和脉冲周期范围。在一些实施例中，默认优先使用主控电路的控制 信号，在主控电路与辅控电路产生的控制信号不同时，则认为主控电路失效，则选择辅控电路的控制信号输出至功率部分。假设控制电路211为主控电路，选择单元213通过比较控制信号S1和控制信号S2来确定主控电路是否失效，当控制信号S1和控制信号S2不同时，选择控制信号S2输出至功率部分220。
在一些实施例中，主控电路可以将输出的控制信号，发送给辅控电路。辅控电路可以检测主控电路所产生的控制信号是否失效，来确定主控电路是否发生故障。在这种情况下，辅控电路具备监控主控电路的功能。例如，辅控电路检测主控电路产生的控制信号是否失效的方法同以上选择单元213的描述，则选择单元213的全部或部分功能可以集成在辅控电路中。例如，辅控电路可以检测辅控电路所产生的控制信号和主控电路所产生的控制信号是否相同。若辅控电路所产生的控制信号和主控电路所产生的控制信号相同，则可以认为主控电路所产生的控制信号没有失效；若不相同，则可以认为主控电路所产生的控制信号失效。类似的，辅控电路可以将辅控电路所产生的控制信号发送给主控电路，由主控电路根据辅控电路所产生的控制信号，确定辅控电路是否发生故障，具体可以参考以上对辅控电路检测主控电路是否失效的描述，在此不再赘述。
在一些实施例中，主控电路和辅控电路可以联合确定主控电路是否失效。MCU等控制电路可以具有自身故障检测功能，可以检测自身是否发生故障。主控电路在检测到主控电路自身发生了故障，并且辅控电路检测到辅控电路所产生的控制信号和主控电路所产生的控制信号不相同时，确定主控电路发生故障，主控电路自身的检测和辅控电路对主控电路的检测，这两个检测功能同时生效，可以使得故障检测更为精准。在该示例中，无需控制电路具有较强的自检性能，就可以准确地确定出控制电路是否发生了故障，从而降低了控制电路的成本。
辅控电路可以在主控电路失效时，接替主控电路，成为新的主控电路。在一些实施例中，在辅控电路成为新的主控电路时或之后，原主控电路可以成为新的辅控电路。也就是说，主控电路和辅控电路的功能角色可以相互切换。
在一些实施例中，由同一时钟源(或时钟)为控制装置的控制电路提供时钟信号，即以上时钟信号C1和时钟信号C2来自同一时钟源。此种方式实现成本较低，且可以使得控制装置的控制电路在相同频率的时钟信号的作用下工作，降低成本的同时给出了同频的控制信号。在其它实现中，也可以通过不同的时钟源为控制装置的控制电路提供相同频率的时钟信号。
在一种实现中，该同一时钟源向控制装置的每个控制电路输出时钟信号，且输出给控制电路的时钟信号为相同的时钟信号。请继续参考图2，该同一时钟源例如为时钟源CK1，该时钟源CK1与第一控制电路211和第二控制电路212连接，以向第一控制电路211和第二控制电路212输出第一时钟信号C1和第二时钟信号C2。
在另一种实现中，该同一时钟源向控制装置的部分控制电路(例如主控电路)输出时钟信号，由该部分控制电路根据接收到的时钟信号向其它控制电路输出时钟信号。例如，该部分控制电路可以通过分频的方式向其它控制电路输出时钟信号。请继续参考图2，该同一时钟源例如为时钟源CK1，该时钟源CK1与控制电路211连接，以向控制电路211输出第一时钟信号C1，即控制电路211与时钟源CK1连接，接收第一 时钟信号C1，且控制电路211根据该时钟信号C1向控制电路212输出时钟信号C2(如图2中虚线L3所示)。在一个例子中，时钟源CK1发送的时钟信号在输入到控制电路211之后，可以通过分频的方式得到时钟信号C2，输出给控制电路212。例如，控制电路211每接收到X个时钟信号时，向控制电路212输出一个时钟信号，X为大于或等于1的整数。然后，控制电路212在接收到控制电路211发送的时钟信号时，可以进行按照X倍的倍率进行倍频，并在倍频后的时钟信号的驱动下运行。在又一个例子中，时钟源CK1发送的时钟信号在输入到控制电路211之后，控制电路211可以将复制该时钟信号，并将复制后的时钟信号发送给控制电路212。
本申请实施例还可以提供冗余的时钟源，即提供至少两个时钟源，以上时钟信号来源于该至少两个时钟源之一，进而可以根据时钟源的状态在当前时钟源提供的时钟信号失效时，切换时钟源。该至少两个时钟源的时钟信号频率成比例，且在一种实现中，该至少两个时钟源的时钟信号频率相同。如此，可以进一步减少因时钟源故障所引发的系统故障，降低了时钟失效所导致的电子控制系统功能失效的概率，从而进一步提高电子控制系统的失效可操作性。
请继续参考图2，时钟源CK1和时钟源CK2为控制电路211和212提供了两个独立的时钟信号，其中，时钟源CK1和时钟源CK2之一作为主时钟源，另一个时钟源用作辅时钟源(或备份时钟源)。控制电路211和212可以在主时钟源输出的时钟信号的作用下运行。当主时钟源无法提供有效的时钟信号时，辅时钟源接替主时钟源，使得控制电路211和212在辅时钟源输出的时钟信号的作用下继续运行。
以时钟源CK1作为主时钟源，时钟源CK2为辅时钟源为例。起初，控制电路211和控制电路212在同一时钟源CK1的驱动下工作(或者运行)，时钟源CK1和时钟源CK2互为冗余。在时钟源CK1故障时，时钟源CK2接替时钟源CK1，用作控制电路211和控制电路212的共同时钟源。同理，当时钟源CK2用作控制电路211和控制电路212主时钟源时，时钟源CK1作为辅时钟源，可以在时钟源CK2故障时，时钟源CK1接替时钟源CK2，用作控制电路211和控制电路212的共同时钟源。
在一些实施例中，时钟源CK1和时钟源CK2产生并发出时钟信号(clock signal)的频率可以成比例，该比例可以为M:N，其中M和N为大于或等于1的整数。例如，时钟源CK1每产生并发出M个时钟脉冲时，时钟源CK2可以产生并发出N个时钟脉冲。可选的，该比例关系为正比关系，且在一个示例中，时钟源CK1和时钟源CK2产生并发出时钟信号的频率相同。
在一些实施例中，控制电路211具有连接时钟源CK1和时钟源CK2的线路，控制电路212具有连接时钟源CK1和时钟源CK2的线路。由此，时钟源CK1可以向控制电路211和控制电路212输出时钟信号，时钟源CK2也可以向控制电路211和控制电路212输出时钟信号。控制电路211和控制电路212可以约定采用时钟源CK1(或时钟源CK2)作为主时钟源，并控制主时钟源到控制电路211和控制电路212线路的导通，且当主时钟源故障时，控制主时钟源到控制电路211和控制电路212线路的关闭，导通辅时钟源到控制电路211和控制电路212的线路。
关于时钟源的选择，可以通过控制电路来实现，例如，由控制电路211和控制电路212各自选择有效的时钟源，如图2所示，控制电路211输出控制信号E1，用于控 制输入控制电路211的时钟信号的来源，控制电路212输出控制信号E2，用于控制输入控制电路212的时钟信号的来源，且控制电路211和控制电路212之间可以进行交互，以选择相同的时钟源。再如，由控制电路211(或控制电路212)为控制电路211和212选择有效的时钟源，则控制信号E1和E2均来自同一个控制电路。再如，可以由独立于控制电路的控制单元选择有效的时钟源，该控制单元可以通过软件实现，也可以通过硬件实现。有效的时钟源即为用于驱动控制电路运行的时钟源。
以时钟源CK1为主时钟源，控制电路211选择时钟源为例，控制电路211可以检测主时钟源CK1是否有效(例如是否发生故障)。在检测到主时钟源CK1失效时，可以将辅时钟源CK2作为新的主时钟源，并采用新的主时钟源发送的时钟信号作为控制部分210的时钟信号。
在一些实施例中，控制电路211分别与时钟源CK1和时钟源CK2之间设置有开关，且控制电路212分别与时钟源CK1和时钟源CK2之间设置有开关。控制电路211在检测到时钟源CK1失效时，输出控制信号E1断开控制电路211与时钟源CK1之间开关，并闭合控制电路211和时钟源CK2之间的开关，从而将时钟源CK2用作控制电路211的时钟源。类似的，控制信号E1可以进一步用于断开控制电路212与时钟源CK1之间开关，并闭合控制电路212和时钟源CK2之间的开关，从而将时钟源CK2用作控制电路212的时钟源。或者，控制电路211通知控制电路212输出控制信号E2，控制信号E2可以用于断开控制电路212与时钟源CK1之间开关，并闭合控制电路212和时钟源CK2之间的开关，从而将时钟源CK2用作控制电路212的时钟源。类似的，可以由控制电路212检测时钟源的有效性，并独立控制时钟源CK1和时钟源CK2到控制电路212之间开关的断开与闭合，即控制信号E2可以由控制电路212独立产生；或者控制电路212具有以上控制电路211类似的功能，且触发控制电路211产生控制信号E1或由控制电路212产生控制信号E1。
因此，在一些实施例中，控制装置210还可以包括检测单元214，该检测单元214用于检测至少两个时钟源的有效性，且根据检测结果将有效的时钟源的时钟信号输入至控制电路211和212，例如，控制时钟信号C1和时钟信号C2来自该至少两个时钟源中的有效时钟源。在以上实施例中，检测单元214位于控制电路211和/或控制电路212，即通过控制电路来实现时钟源的选择；在其它实施例中，检测单元214也可以独立控制电路而设置。关于检测单元214的实现方式同选择单元213，可以为硬件实现，也可以为软件实现，可以参照以上关于选择单元213的描述，在此不再赘述。
在一些实施例中，检测单元214可以通过对时钟信号的检测来实现对时钟源的有效性的检测，例如，检测单元214在检测到时钟源发送的时钟信号的频率丢失或者频率偏差在预设范围之外时，确定时钟源失效(或发生故障)。该预设范围可以为一个频率区间。示例性的，该预设范围可以是根据时钟源的理论频率f而设置。例如，可以设置该预设范围为频率区间[f1，f2]，其中f1和f2根据f设置，例如f1＝f-Δf1，f2＝f+Δf2，其中Δf1和Δf2为大于或等于0的偏移频率值，且Δf1和Δf2可以相同或者不同。时钟源的理论频率是指该时钟源的设定频率，时钟源在理论上应该按照理论频率产生并发出时钟信号；与理论频率对应的是实际频率。实际频率是时钟源在工作时，实际产生并发出时钟信号的频率。再如，检测单元214在检测到时钟源发送的时钟信 号的脉冲丢失或者脉冲周期在预设范围之外时，确定时钟源失效(或发生故障)。
在一些实施例中，检测单元214可以记录控制电路211(或控制电路212)从时钟源接收的时钟信号的频率，当控制电路211(或控制电路212)从时钟源接收的时钟信号的频率和历史上从该时钟源接收的时钟信号的频率差异较大(例如超过阈值)时，可以确定该时钟源失效；可选的，时钟信号的频率可以替换为时钟信号的脉冲周期。或者，检测单元214可以记录控制电路211(或控制电路212)从时钟源接收的时钟信号的时间，且在该时间之后的预设时长内，控制电路211(或控制电路212)没有再接收到来自该时钟源的时钟信号，可以确定该时钟源失效。或者，检测单元214可以根据时钟脉冲的周期变化，确定时钟源是否失效，例如，当一段时间内控制电路211(或控制电路212)从时钟源接收到的多个时钟脉冲中相邻时钟脉冲之间的时间间隔和历史上的相邻时钟脉冲之间的时间间隔之间的差值大于或等于预设阈值，则可以确定该时钟源失效。
检测单元214可以在检测到主时钟源失效，且辅时钟源有效时，将辅时钟源切换为新的主时钟源。进一步的，在检测辅时钟源有效的情况下，确定主时钟源失效，可降低对主时钟源发生故障的误判。时钟源失效也可以理解为该时钟源的时钟信号失效。
本申请实施例中的连接是指信号连接，可以是直接连接，也可以是间接连接，只要相互连接的电路或设备之间可以交互信号，即可以理解为连接。此外，本申请实施例对时钟信号的提供方式不作限制，例如可以是外部时钟(EXTCLK)的方式。
此外，时钟源CK1和时钟源CK1可以是控制装置210的内部时钟源，即属于控制装置210，或者可以是控制装置的外部时钟源，即不属于控制装置210。
在本申请一些实施例中，对功率部分220进行了冗余备份，即功率部分220包括至少两个驱动电路，用于驱动至少一个功能执行部件，该至少两个驱动电路可以分别用于驱动不同的功能执行部件，或者可以用于驱动相同的功能执行部件，且每个驱动电路可以驱动一个或多个功能执行部件。如图2所示，在此以驱动电路221和驱动电路222为例，其中驱动电路221用于驱动功能执行部件A，或者用于驱动功能执行部件A和功能执行部件B(如图2中虚线L4所示)；驱动电路222用于驱动功能执行部件B，或者用于驱动功能执行部件A和功能执行部件B(如图2中虚线L4所示)。同以上对控制电路的描述，本申请实施例对冗余驱动电路的数量不作限制。
当功率部分的驱动电路驱动不同的功能执行部件时，可以实现功能执行部件的冗余备份。例如驱动电路221可以用于驱动功能执行部件A，驱动电路222可以用于驱动功能执行部件B，则提供了功能执行部件的冗余备份，当功能执行部件A由于驱动信号或自身问题无法继续工作时，功能执行部件B可以接替功能执行部件A继续工作，从而进一步提高了系统的失效可操作性。当功率部分的驱动电路驱动相同的功能执行部件时，可以实现更高效率的功能执行，例如，驱动电路221可以用于驱动功能执行部件A和功能执行部件B，驱动电路222也可以用于驱动功能执行部件A和功能执行部件B(如图2中虚线L4所示)，这种交叉备份的方式可以提供更加高效的冗余能力，在局部部件失效时，仍可以保持系统的高效输出，例如当驱动电路221和驱动电路222均正常工作时，功能执行部件A可以在驱动电路221和驱动电路222的驱动信号下工作；当驱动电路221故障时，驱动电路222仍然可以为功能执行部件A提供 驱动信号，使得功能执行部件A正常运行，进一步提升了系统的失效可操作性。
功率部分220的驱动电路输出脉冲信号，通过脉冲信号驱动功能执行部件。控制信号可以控制功率部分220输出信号的占空比，使得功率部分220输出符合预期的交变电流。占空比可以是指一个脉冲周期中通电时长比上该脉冲周期总时长得到的比例。一个脉冲周期是指间歇性或者周期性通电的情况下，一次通电的开始时刻到下一次通电的开始时刻之间的时长。交变电流的电流大小可以是一个脉冲周期内的电流平均值。由此，通过控制占空比的大小，可以控制交变电流的大小。举例而言，可以设定在电源在向功率部分220输出电流时，电源输出的电流大小为100A；还可以设定驱动电路的占空比为25％，即在一个脉冲周期中，25％的时长通电，其余的75％时长不通电。则在一个脉冲周期中，该驱动电路输出的电流的大小为25A。
在一些实施例中，驱动电路可以为具有多个桥臂的多相逆变电路，可以通过控制驱动电路的不同桥臂上的开关元件的导通和断开，在产生符合要求大小的电流的同时，还可以产生不同方向的电流，由此，可以向功能执行部件输出所需大小的交变电流。
下面结合图3A和图3B，进一步描述本申请实施例提供的电子控制系统，该电子控制系统对控制部分和功率部分均进行了冗余备份，如图3所示，该电子控制系统包括互为冗余的子系统310和子系统320。其中，子系统310包括控制电路311和驱动电路312，子系统320包括控制电路321和驱动电路322。
控制电路311和控制电路321同以上控制电路211和控制电路212的描述，在处于工作状态时，可以各自采集传感器所监测的感测信号。示例性的，控制电路311和控制电路321可以各自向传感器发送数据上报指令。传感器可以响应于数据上报指令，向发送该数据上报指令的控制电路发送该传感器监测到的感测信号。
示例性的，控制电路311和控制电路321可以各自采集相同传感器所监测的感测信号，即同一传感器(例如传感器Sr1)所监测的感测信号可以分别发送给控制电路311和控制电路321。由此，使得控制电路311和控制电路321可以采集到相同的感测信号，以便后续可以据此做出相同的决策。
可选的，传感器也可以进行冗余备份，如图3所示，控制电路311采集传感器Sr1的感测信号，控制电路321采集传感器Sr2的感测信号。其中，传感器Sr1和传感器Sr2可以为相同类型的传感器，或者包括相同类型传感器。例如，在电动助力转向系统中，传感器Sr1可以包括TAS和MPS，传感器Sr2也可以包括TAS和MPS。传感器Sr1和传感器Sr2可以同时工作，即均用于监测感测信号。控制电路311可以采集传感器Sr1和传感器Sr2所监测到的感测信号，控制电路321可以采集传感器Sr1和传感器Sr2所监测的感测信号。由此，控制电路311和控制电路321可以采集到相同的感测信号。并且，传感器Sr1和传感器Sr2同时工作，当其中一个失效时，另一个可以继续为控制电路提供感测信号。换言之，传感器Sr1和传感器Sr2可以同时为控制电路提供感测信号，以便控制电路根据感测信号，输出控制信号，以控制功能执行部件的驱动电路，从而实现电子控制系统的功能。当传感器Sr1和传感器Sr2中的一个失效时，另一个未失效的传感器仍然可以为控制电路提供感测信号，降低了控制电路因没有感测信号而无法提供准确的控制信号，进而导致电子控制系统功能失效的概率。进一步提高了电子控制系统的失效可操作性。
传感器Sr1和传感器Sr2可以属于电子控制系统的部件，或者，可以位于电子控制系统之外，为电子控制系统提供感测信号。
接下来，示例介绍本申请实施例提供的具有冗余备份的一种功率部分，控制电路可以通过控制信号，同时控制该一个或多个驱动电路。
在一些实施例中，驱动电路可以为用于输出交流电。在一个说明性示例中，驱动电路(例如驱动电路312和驱动电路322)可以为包括多个桥臂的多相逆变电路，例如可以产生U相、V相、W相的三相逆变电路。该多个桥臂中的每个桥臂上可以串联设置两个开关元件，通过控制不同桥臂上开关元件的导通和断开，可以将直流电转换为交流电。示例性的，桥臂上的开关元件可以为绝缘栅型双极晶体管(insulated gate bipolar transistor，IGBT)、金属氧化物半导体场效应晶体管(metal-oxide-semiconductor field effect transistor，MOSFET)等等。在一个说明性示例中，该用于输出交流电的电路功率可以为交流驱动单元。例如三相桥驱动单元。
在一个例子中，如图3B所示，驱动电路可以为三相逆变电路，则控制信号可以为用于控制三相逆变电路中六个开关元件的6路PWM信号。即用于控制驱动电路的控制信号包括6路PWM信号。其中，每一路PWM信号用于控制三相逆变电路中一个开关元件的导通或断开，不同路PWM信号分别控制不同的开关元件。
在一些实施例中，驱动电路可以为用于输出直流电的电路。例如，可以为直流H桥驱动单元。
请继续参考图3A和图3B，控制电路311可以连接驱动电路312，以及连接驱动电路322。由此，当控制电路311用作主控电路时，可以将控制电路311所产生的控制信号同时发送给驱动电路312和驱动电路322，以实现对驱动电路312和驱动电路322的同步控制。控制电路321可以连接驱动电路322，以及连接驱动电路312。由此，当控制电路321用作主控电路时，可以将控制电路321所产生的控制信号同时发送给驱动电路312和驱动电路322，以实现对驱动电路312和驱动电路322的同步控制。
通过上述设置，使得驱动电路312和驱动电路322输出的电压的波形一致(即频率和占空比相同)。由此，驱动电路312和驱动电路322可以同时向功能执行部件(例如，电机)输出电压，以共同驱动功能执行部件工作。并且，当其中一个驱动电路故障或被关闭时，功能执行部件所接收到的电压的频率和占空比不发生改变或者说不发生较大的改变，从而进一步提高了电子控制系统的功能安全和失效可操作性。
在一些实施例中，电子控制系统还包括预驱电路(简称预驱)，设置于控制电路和驱动电路之间。如图3A所示，在控制电路311与驱动电路312之间设置有预驱313，进一步的，预驱313也可以设置在控制电路321与驱动电路312之间。在控制电路321与驱动电路322之间设置有预驱323，进一步的，预驱323也可以设置在控制电路311与驱动电路322之间。预驱可以将低压信号(例如，逻辑信号)，放大成可以驱动开关元件断开或导通的高压(例如大于或等于15V)信号。控制电路所产生的控制信号为低压信号时，预驱将低压信号转换为高压信号，以控制驱动电路的桥臂上的开关元件断开或导通，进而使驱动电路可以输出相应大小和方向的电流或者电压。
驱动电路可以通过系统内电源供电，或者可以通过系统外电源供电。如图3A所示，电源P1为驱动电路312提供电能。示例性的，电源P1可以为电池，例如蓄电池、 锂电池等。驱动电路312在控制信号的作用下，将电源P1输出的电压，转换为具有特定方向和大小的电压。以驱动电路312为逆变电路为例。电源P1可以向驱动电路312输出直流电。驱动电路312可以在控制信号的作用下，导通或关闭相应的开关元件，将直流电转换为可以交流电。类似的，电源P2为驱动电路322提供电能。电源P2的形式，驱动电路322的工作方式等类似以上描述，在此不再赘述。
驱动电路312和驱动电路322均可以向功能执行部件，施加驱动信号，以驱动功能执行部件执行相关功能。具体而言，功能执行部件可以为电机，驱动信号可为电压。电机可以在电压的驱动下，输出力矩。在一个例子中，驱动电路312和驱动电路322可以采用相同的电源，由此驱动电路312和驱动电路322输出的电压相同。在一个例子中，驱动电路312和驱动电路322采用不同电源的情况下，驱动电路312和驱动电路322输出的电压可能不同。经过驱动电路312和驱动电路322各自滤波电路在不同大小母线电流上的阻抗压降自动均衡后，输入到功能执行部件的是相同的电压(包括相近以达到相同驱动效果的电压)。
电源P1还可以为控制电路311供电，以维持控制电路311的运行。电源P2还可以为控制电路321供电，以维持控制电路321的运行。也就是说，控制电路311和控制电路321可以由不同的电源供电，从而避免或减少了控制电路因电源故障，而同时失效的情况。
子系统310和子系统320驱动的功能执行部件可以相同或不同。如图3A所示，以功能执行部件为电机，且子系统310和子系统320交叉驱动相同的功能执行部件为例，电机(M1或M2)可以连接到驱动电路312和驱动电路322，从而可以在驱动电路312和驱动电路322共同驱动下旋转，且在其中一个驱动电路故障时，电机仍可以继续运行。
在一些实施例中，驱动电路和功能执行部件之间的连接可以通过断相电路(简称断相)进行控制。例如在功能执行部件M1和驱动电路312之间设置有断相314，在功能执行部件M1和驱动电路322之间设置有断相324。当驱动电路312故障时，断相314可以断开，由驱动电路322驱动功能执行部件M1。类似的，当驱动电路322故障时，断相324可以断开，由驱动电路312驱动功能执行部件M1。
类似的，功能执行部件M2可以连接到驱动电路312和驱动电路322，从而可以在驱动电路312和驱动电路322共同驱动下旋转。其中，在功能执行部件M2和驱动电路312之间设置有断相315，在功能执行部件M2和驱动电路322之间设置有断相325。当驱动电路312故障时，断相315可以断开，由驱动电路312驱动功能执行部件M2。当驱动电路322故障时，断相325可以断开，由驱动电路322驱动功能执行部件M2。
断相可以理解为开关，当断相闭合时，断相所在的线路导通；当断相断开时，断相所在的线路不导通。断相的闭合和断开可以由控制电路控制。如图3A和3B所示，断相314、断相315、断相324、断相325可以连接到控制电路311和/或控制电路321，从而可以接收控制电路311和/或控制电路321的指令，并根据该指令进行闭合或断开。例如，断相314和断相315可由控制电路311控制，断相324和断相325可由控制电路321控制。再如，断相314、断相315、断相324、断相325可以由同一控制电 路控制，例如控制电路311或控制电路321。
在电机为多相电机(例如三相电机)的情况下，传感器可以包括电流传感器，用于检测电机的各相电流，得到相电流检测信号。例如电流传感器(子系统310和320可以复用同一个电流传感器，或者使用独立的电流传感器)，用于检测电机M1和M2的各相电流，得到相电流检测信号Ps1和Ps2，并提供给控制电路311和控制电路312，以便控制电路311和控制电路312根据相电流检测信号Ps1和Ps2，产生用于控制驱动电路的控制信号。进一步的，控制电路311和控制电路312还可以根据其他感测信号产生控制信号。
子系统310和子系统320之间可以通过信号线进行信号交互，例如，进行时钟信号的交互(示例的，控制电路311向控制电路321发送时钟信号)、或控制信号的交互(示例的，控制电路311向控制电路321发送控制信号)等。由此，当子系统310和子系统320之间的信号线，发生开路或短路时，可能造成子系统310和子系统320发生共因失效。为此，可以在子系统310和子系统320之间的信号线上串联电阻器元件和/或电容器元件，以使得在信号线正常时，子系统310和子系统320之间可以进行正常的信号交互，在信号线开路或短路时，避免或减少子系统310和子系统320发生共因失效。例如，在控制电路311和控制电路321之间设置至少一个元件；再如，在驱动电路312和驱动电路322之间设置至少一个元件，该元件可以是电阻元件或电容元件，或至少一个元件包括电阻元件和电容元件。
示例性的，信号线开路或短路导致信号失效时，控制电路(例如，主控电路或辅控电路)可以根据失效的信号，决定是否在主控电路和辅控电路间进行功能角色切换(即原来的辅控电路成为新的主控电路，原来的主控电路成为新的辅控电路)。例如，当辅控电路所产生的控制信号失效时，主控电路和辅控电路不进行功能角色切换。再例如，当主控电路所产生的控制信号失效时，主控电路和辅控电路进行功能角色切换。
在一些实施例中，请参考图4A，电源P1向驱动电路312输出直流电压401，以便驱动电路312将直流电压401转换为交流电压。电源P2用于向驱动电路322输出直流电压402，以便驱动电路322将直流电压402转换为交流电压。当直流电压401和直流电压402之间的电压差值处于预设范围时，驱动电路312和驱动电路322共同向电机输出交流电压。其中，驱动电路312和驱动电路322输出的交流电压可以自动均衡，使得输出到功能执行部件的电压403的峰值介于直流电压401和直流电压402之间。该预设范围可以根据经验或实验设置的范围，例如预设范围可以为区间[-2V，2V]或[-5V，5V]等等，此处不再一一列举，且不对预设范围作限制。
当电源P1输出的电压和电源P2输出的电压之间的差值处于预设范围时，说明电源P1和电源P2之间的电压差较小，此时驱动电路312和驱动电路322共同驱动功能执行部件，不至于驱动功能执行部件的驱动电压不足；若电源P1和电源P2之间的电压差过大，通常是由于其中一个电压过低导致的，在这种情况下，驱动电路312和驱动电路322共同驱动电机，可能导致某一路电源驱动电压不足。此外，输入到功能执行部件的交流电的电压处于电源P1的电压和电源P2的电压之间，即输入到功能执行部件的交流电与电源P1的电压差值小于电源P1和电源P2之间的电压差值，并且输入到功能执行部件的交流电与电源P2的电压差值也小于电源P1和电源P2之间的电 压差值。由此，当驱动电路312和驱动电路322中的一个失效，另一个单独驱动功能执行部件时，使得前后输入到功能执行部件的电压不会相差过大，从而提高了电子控制系统的功能安全。
在一些实施例中，请参考图4B，电源P1向驱动电路312输出直流电压501，以便驱动电路312将直流电压501转换为交流电压。电源P2向驱动电路322输出直流电压502，以便驱动电路322将直流电压502转换为交流电压。当直流电压501和直流电压502之间的电压差值超出预设范围(具体可参见上文介绍)时，可以断开电压较低的电源对应的驱动电路和功能执行部件之间的连接，使得电压较高的电源对应的驱动电路独立驱动电机。例如，电源P1的电压正常，而电源P2的电压过低，使得直流电压501和直流电压502之间的电压差过大。此时，可以断开断相324和断相325，由驱动电路312独立驱动功能执行部件M1和M2。由此，可以利用电压正常的子系统的驱动电路来驱动另一子系统中的功能执行部件，从而减少或避免了电源电压较低的子系统的电源输出不足导致的功能执行部件难以驱动的情况发生。
因此，在一些实施例中，电子控制系统还包括驱动电路选择单元，该驱动电路选择单元用于根据驱动电路312的供电电压和驱动电路322的供电电压，选择导通的驱动电路，即将驱动电路312的驱动信号，或驱动电路322的驱动信号，或驱动电路311的信号和驱动电路322的驱动信号输出至功能执行部件。
在驱动电路312和驱动电路322的供电电压之间的电压差位于预设范围之外时，或者，在驱动电路312和驱动电路322的供电电压之间的电压差小于阈值时，将驱动电路312和驱动电路322中供电电压较高的驱动电路的驱动信号提供给功能执行部件，例如，驱动电路312的供电电压高于驱动电路322的供电电压，则断相324和断相325进入断开状态。在驱动电路312和驱动电路322的供电电压之间的电压差位于预设范围之内时，或者，在驱动电路312和驱动电路322的供电电压之间的电压差大于阈值时，将驱动电路312和驱动电路322的驱动信号均提供给功能执行部件，例如，断相314、断相315、断相324和断相325进入断开状态。在驱动电路312和驱动电路322的供电电压之间的电压差等于阈值时，将驱动电路312和驱动电路322中供电电压较高的驱动电路的驱动信号提供给功能执行部件，或将驱动电路312和驱动电路322的驱动信号均提供给功能执行部件。预设范围同以上描述，不再赘述。
驱动电路选择单元的功能可以集成于控制电路中，例如集成于控制电路311或控制电路321，或集成于控制电路311和控制电路321，且驱动电路选择单元的实现可以通过硬件实现，或者可以通过软件实现，实现方式参照以上对选择单元213的描述，且驱动电路选择单元和选择单元213可以集成在一起实现。
在一些实施例中，功能执行部件例如为电机，该电机可以为三相电机，具有U相、V相、W相。示例性的，参阅图5A和图5B，电机可以为具有双冗余绕组的永磁同步电机，电机M1具有一个U相绕组Ua、一个V相绕组Va、一个W相绕组Wa。电机M2具有一个U相绕组Ub、一个V相绕组Vb、一个W相绕组Wb。其中，绕组Ua和绕组Ub组成U相冗余绕组，绕组Va和绕组Vb组成V相冗余绕组，绕组Wa和绕组Wb组成W相冗余绕组。
在一个说明性示例中，电机M1和电机M2的绕组可以左右对称布置，如图5A所 示。此时，冗余绕组对应的扭矩矢量方向相同。具体而言，绕组Ua和绕组Ub的扭矩矢量方向相同(黑色箭头指示的方向)，绕组Va和绕组Vb的扭矩矢量方向相同(浅灰色箭头指示的方向)，绕组Wa和绕组Wb的扭矩矢量方向相同(深灰色箭头指示的方向)。如此，电机M1和电机M2输出的同一相的扭矩可以进行标量相加，得到的扭矩和为冗余电机最终输出。
在一个说明性示例中，电机M1和电机M2的绕组可以交错布置，具体可以如图5B所示。此时，冗余绕组对应的扭矩矢量方向存在夹角。在这种情况下，电机M1和电机M2输出的同一相的扭矩可以按照矢量合成规则进行相加，得到的扭矩矢量和为电机最终输出。
本申请实施例提供的电子控制系统可以配置于车辆100。示例性的，车辆可以为轿车、越野车(off-road vehicle，ORV)、运动型多用途车(sport utility vehicle，SUV)公交车、卡车、农用机车、游行花车、游乐园中的游戏车等形式的车辆。此外，该电子控制系统也可以用于其它交通工具，本申请实施例不做限制。以下以电子控制系统为电动助力转向系统为例进行描述，其它系统与之类似。
请继续参考图1C，电动助力转向系统作用于转向系123，为车辆100转向提供辅助扭矩，以带动车辆100的转向部件移动或转动，电动助力转向系统可以作用于转向系123的任一转向部件上，例如转向操纵机构、转向器或转向传动机构的部件上，以辅助车辆100的转向。以图1C为例，该转向系123例如包括转向拉杆1231、转向管柱1232、方向盘1233。在一种设计中，电动助力转向系统所提供的辅助扭矩可以作用在转向拉杆1231上，推动转向拉杆1231，进而推动车轮1234偏转，辅助车辆100转向。在另一种设计中，电动助力转向系统所提供的辅助扭矩可以作用在转向管柱1232上，以促使方向盘1233转动，进而辅助车辆100转向。
电动助力转向系统可以包括如以上实施例所述的控制部分和功率部分。功能执行部件可以为助力电机。控制部分从传感器获取感测信号，并根据感测信号，向功率部分输出控制信号。功率部分在控制信号的作用下，向助力电机输出电流，以驱动助力电机运转。其中，传感器可以包括一种或多种类型的传感器，以便控制部分获取一种或多种感测信号。示例性的，传感器可以包括扭矩转角传感器(torque and angle sensor，TAS)，用于采集方向盘的扭矩和转动角度。示例性的，传感器可以包括电机位置传感器(motor position sensor，MPS)，以采集助力电机的电机转子位置。示例性的，传感器可以包括电流传感器(例如霍尔电流传感器)，以采集助力电机中各相的电流。在此对电动助力转向系统的传感器进行了示例说明，并非限定。传感器可以包括以上多种传感器中的一种或多种，且在其它实施例中，还可以包括其他类型的传感器，以采集相应的感测信号。其中，在本申请实施例中，感测信号是指传感器所监测或采集的信号或者说信息，例如前文所述的方向盘的扭矩和转动角度，电机转子位置等信息。此外，传感器可以作为电动助力转向系统的一部分，或者可以不属于电动助力转向系统。
在驱动电路输出交流电的情况下，电机可以为由交流电驱动的电机。例如，永磁同步电机(permanent-magnet synchronous motor，PMSM)、或交流伺服电机等。在驱动电路输出直流电的情况下，电机可以为由直流电驱动的电机。例如直流有刷电机、 或直流无刷电机等。
关于控制部分和功率部分的描述同以上电子控制系统中的描述，在此不再赘述。
助力电机为电动机，也可以称为马达(motor)，其核心部件包括定子(也可以称为定子绕组、或通电线圈)和转子。其中，定子在通电时可以产生磁场。在磁场的作用下，转子旋转，产生扭矩。当扭矩作用于车辆100的转向部件时，可以辅助车辆100转向。
上文以电动助力转向系统对功能执行部件进行控制，以实现电动助力转向功能为例，介绍了电子控制系统对功能执行部件的控制过程。其他电子控制系统对相应的功能执行部件的控制过程与之类似，此处不再一一赘述。
在进行冗余备份的电子控制系统中，对于系统的异常检测可以及时识别出发生异常的部分，从而及时利用冗余部分来接替当前工作的部分，或者当互为冗余的部分均处于工作状态时，及时切断异常部分的工作，如此，可以提高电子控制系统的稳定性。因此，本申请实施例还提供了一种异常检测方法，可以用于检测以上电子控制系统的某个或某些部分是否发生故障。在一些实施例中，该方法可以由控制电路执行，例如控制电路211(或311)，和/或，控制电路212(或312)。在一些实施例中，该方法可以由独立于控制电路之外的部件执行，例如可以由控制电路211(或311)和控制电路212(或312)之外的其他部件执行。在下文中，为方便描述，可以将执行该异常检测方法的部件称为异常检测装置(或电路)。异常又可以称为失效或故障，该异常检测方法可以包括以上实施例中描述的一种或多种失效或故障检测方法，例如包括以上实施例中对控制电路失效的检测，对驱动电路故障的检测，对时钟源失效的检测、对传感器失效的检测，对功能执行部件的失效检测中的一种或多种。
接下来，以对图2或图3A所示的电子控制系统进行异常检测为例，对本申请实施例提供的电子控制系统的异常检测方法进行示例说明。
参阅图6，该方法包括如下步骤。
步骤601，获取来自第一部件的第一信号和来自第二部件的第二信号，第一部件和第二部件互为冗余。
步骤602，根据第一信号和第二信号，确定电子控制系统失效(或故障)。且，进一步的可以确定第一部件或第二部件失效(或故障)。
以上冗余的部件例如为控制电路，第一部件例如为控制电路211，第二部件为控制电路212。如上文所述，控制电路211和控制电路212的工作时间同步，并且采集的感测信号相同。因此，在正常情况下，控制电路211产生的控制信号和控制电路212产生的控制信号是相同。若异常检测电路发现控制电路211产生的控制信号和控制电路212产生的控制信号不一致，可以说明控制电路211和控制电路212中的至少一个可能发生了故障，由此，可以确定电子控制系统发生故障。
以上冗余的部件例如为驱动电路，第一部件例如为驱动电路312，第二部件为驱动电路322。参阅图3B和图7，驱动电路312和驱动电路322可以为三相逆变电路。其中，驱动电路312和驱动电路322分别在主控电路(当前用于提供控制信号的控制电路)的控制信号的作用下，各自输出交变电流。其中，驱动电路312输出的交变电流包括U相电流Iua、V相电流Iva、W相电流Iwa。驱动电路322输出的交变电流包 括U相电流Iub、V相电流Ivb、W相电流Iwb。
如上文所述，驱动电路312和驱动电路322在相同的控制信号的驱动下工作，因此，在正常情况下，驱动电路312输出的交变电流的波形和驱动电路322输出的交变电流的波形应该如图8所示。
由图8可知，在正常情况下，同一相的电流应该同时为零。即U相电流Iua和U相电流Iub应该同时为零，V相电流Iva和V相电流Ivb应该同时为零，W相电流Iwa和W相电流Iwb应该同时为零。
异常检测电路可以比较同一相在同一时刻的检测电流，例如比较U相电流Iua在时刻T1的检测电流和U相电流Iub在时刻T1的检测电流。若在U相电流Iua在时刻T1的检测电流为零时，U相电流Iub在时刻T1的检测电流不为零，则说明驱动电路312和驱动电路322中的至少一个可能发生了故障，进而可以确定电子控制系统异常。其中，异常检测电路可以利用电流检测电路(例如电流传感器)获取检测电流，例如将电流检测电路检测到的实际电流作为检测电流。例如，在驱动电路的各相桥臂的输出端设置电流检测电路，用于检测相应的相电流，得到相检测电流。异常检测电路可以从电流检测电路采集相检测电流。具体可以参考上文所述，在此不再一一赘述。
另外，用于控制驱动电路312输出交变电流的控制信号和用于控制驱动电路322输出交变电流的控制信号为同一信号，并且电源P1和电源P2的电压差异较小的情况下，驱动电路312和驱动电路322在同一时刻输出的同一相电流之间的差值也应该较小。可以根据经验或实验，预设电流差阈值，例如可以为2A、5A或百分比等等。异常检测电路在检测到驱动电路312和驱动电路322在同一时刻输出的同一相电流之间的差值大于该电流差阈值时，可以确定电子控制系统发生故障。
在一些实施例中，功能执行部件例如为电机，且电机进行冗余设置，包括电机M1和电机M2。电机M1和电机M2可以为由交变电流驱动的电机。根据上文所述，电机M1和电机M2可以由相同或不同的驱动电路驱动，且可以由独立的驱动电路驱动，或者由多个驱动电路共同驱动。例如，电机M1和电机M2可以由驱动电路312和驱动电路322共同驱动，电机M1和电机M2也可以由驱动电路312单独驱动(驱动电路322发生故障的情况下)，电机M1和电机M2也可以由驱动电路322单独驱动(驱动电路312发生故障的情况下)。由此，电机M1和电机M2的同相绕组的电流的波形应该是一致的，也就是说，电机M1和电机M2的同相绕组的电流的为零时刻应该是相同的。以电机M1和电机M2为三相电机为例，电机M1的U相绕组的电流Iua’为零时，电机M2的U相绕组的电流Iub’也应为零。电机M1的V相绕组的电流Iva’为零时，电机M2的V相绕组的电流Ivb’也应为零。电机M1的W相绕组的电流Iwa’为零时，电机M2的W相绕组的电流Iwb’也应为零。
基于此，异常检测电路可以比较电机M1和电机M2的同相绕组的电流，若电机M1和电机M2的同相绕组的电流为零时刻不同时，可以确定电子控制系统发生故障。举例而言，异常检测电路可以比较电机M1的U相绕组的电流Iua’和电机M2的U相绕组的电流Iub’。若当电流Iua’为零时，电流Iub’不为零，则可以确定电子控制系统发生故障。
示例性的，电机M1可以设置有相电流检测电路A(图中未示出)，用于检测电 机M1的各相绕组中的电流。电机M2可以设置有相电流检测电路B(图中未示出)，用于检测电机M2的各相绕组中的电流。异常检测电路可以从相电流检测电路A采集电机M1的一相或多相绕组的电流，以及从相电流检测电路B采集电机M2的一相或多相绕组的电流。然后，异常检测电路可以将电机M1的一相或多相绕组的电流和电机M2的一相或多相绕组的电流的进行比较。若同相电流的为零时刻不相同，则可以确定电子控制系统发生故障。
在一些实施例中，以电动助力转向系统为例，电机M1和电机M2可以为由交流电驱动的电机。即电机M1和电机M2可以各自在交流电压或者说交变电流的驱动下旋转，以输出扭矩，带动车辆的转向机构转动。可以理解，对于互为冗余的两个转子同轴输出的电机而言，在正常情况下，这两个电机的转子位置应该保持一致。保持一致可以是指相同或者符合预设的关系，具体可以参考现有技术中，关于电机控制的介绍，在此不再赘述。其中，转子位置可以通过电机位置传感器采集得到。异常检测电路可以从电机M1的电机位置传感器采集电机转子位置信号L1，电机转子位置信号L1用于表示电机M1的转子位置。异常检测电路可以从电机M2的电机位置传感器采集电机转子位置信号L2，电机转子位置信号L2用于表示电机M2的转子位置。然后，异常检测电路可以比较电机转子位置信号L1和电机转子位置信号L2。若两者不一致，则可以确定电动助力转向系统发生故障。
例如，对于电动助力转向系统而言，电机转子位置信号和车辆的方向盘转角应该符合一定的关系，或者说，电机转子位置信号和车辆的方向盘转角应该匹配。其中方向盘转角是指方向盘转动的角度，也可以简称为方向盘角度。电机转子位置信号和方向盘转角的匹配关系具体可以参考现有技术中关于电机控制的介绍。其中，示例性，异常检测电路可以从电机M1的电机位置传感器采集电机转子位置信号，以及从方向盘的转角传感器(例如TAS)采集方向盘角度信号。方向盘角度信号用于表示方向盘转角。并判断电机转子位置信号和方向盘角度信号是否匹配。若不匹配，可以确定电动助力转向系统异常。示例性，异常检测电路可以从电机M2的电机位置传感器采集电机转子位置信号，以及从方向盘的转角传感器采集方向盘角度信号。并判断电机转子位置信号和方向盘角度信号是否匹配。若不匹配，可以确定电动助力转向系统发生故障。
再如，图3A所示的传感器Sr1可以包括第一扭矩传感器，传感器Sr2可以包括第二扭矩传感器。其中，第一扭矩传感器和第二扭矩传感器可以测量车辆的方向盘的扭矩，得到扭矩信号。异常检测电路可以从第一扭矩传感器采集第一扭矩信号，以及从第二扭矩传感器采集第二扭矩信号。然后，异常检测电路可以比较第一扭矩信号和第二扭矩信号。若第一扭矩信号和第二扭矩信号不一致，则可以确定电动助力转向系统发生故障。
再如，图3A所示的传感器Sr1可以包括第一转角传感器，传感器Sr2可以包括第二转角传感器。其中，第一转角传感器和第二转角传感器可以测量车辆的方向盘的转动角度，得到角度信号。异常检测电路可以从第一转角传感器采集第一角度信号，以及从第二转角传感器采集第二角度信号。然后，异常检测电路可以比较第一角度信号和第二角度信号。若第一角度信号和第二角度信号不一致，则可以确定电动助力转向 系统发生故障。
接下来，结合图9，对本申请实施例提供的一种异常检测方法进行举例说明。
以上控制电路211或控制电路212可以作为异常检测电路。以控制电路211为主控电路，控制电路212为辅控电路，且辅控电路作为异常检测电路，用于执行异常检测方法为例进行描述。示例性的，如图9所示，辅控电路可以包括监控模块(或单元)900，用于检测功能执行部件的控制功能是否发生故障，在此以功能执行部件为电机为例。
例如，电机M1的相电流检测电路可以将检测到的电机M1的各相绕组的电流(电流Iua’、电流Iva’、电流Iwa’)发送给监控模块900，电机M2的相电流检测电路可以将检测到的电机M2的各相绕组的电流(电流Iub’、电流Ivb’、电流Iwb’)发送给监控模块900。监控模块900可以将电机M1和电机M2的同相绕组的电流进行比较，以判断电机控制功能是否发生故障。若电机M1和电机M2的同相绕组的电流的时间零点不一致，则可以确定电机控制功能发生故障，例如，电动助力转向系统发生故障。具体可以参考上文所述，在此不再赘述。
再如，电机M1的电机位置传感器可以将检测到的电机转子位置信号901发送给监控模块900，电机M2的电机位置传感器可以将检测到的电机转子位置信号902发送给监控模块900。监控模块900可以将电机转子位置信号902和电机转子位置信号901进行比较。若两者不一致，可以确定电机控制功能发生故障，例如，电动助力转向系统发生故障。具体可以参考上文所述，在此不再赘述。
示例性的，监控模块900采用预设的算法或模型，根据电机M1的各相绕组的电流、电机M2的各相绕组的电流以及电机转子位置信号901和电机转子位置信号902，确定电子控制系统系统中发生故障的部件或者说失效部件，以及失效的类型等。并根据确定出的失效部件以及失效类型，决定是否进行主控电路和辅控电路的功能角色切换，以及决定是否控制驱动电路M1或驱动电路M2的输出。其中，当监控模块900决定控制驱动电路312或驱动电路322的输出时，可以通过子系统310和子系统320之间的交互通信通道通知主控电路，使主控电路可以控制驱动电路312或驱动电路322的输出。
示例性的，如图9所示，主控电路可以获取电机M1和电机M2同相绕组电流的加和，具体可以获取电流Iua’和电流Iub’的加和，电流Iva’和电流Ivb’的加和，电流Iwa’和电流Iwb’的加和。主控电路还可以获取电机转子位置信号901和电机转子位置信号902。主控电路可以根据电流Iua’和电流Iub’的加和，电流Iva’和电流Ivb’的加和，电流Iwa’和电流Iwb’的加和，电机转子位置信号901，电机转子位置信号902以及车速信号，方向盘扭矩信号，方向盘角度信号等感测信号，利用FOC算法，确定控制信号(占空比信号或占空比指令)，并输出控制信号，来控制驱动电路312和驱动电路322，以驱动电机M1和电机M2。
接下来，以电动助力转向系统为例，结合图10，对本申请实施例提供的另一种异常检测方法进行举例说明。
同样以辅控电路(控制电路211/311或控制电路212/321)作为异常检测电路，用于执行异常检测方法为例。如图10所示，辅控电路可以包括监控模块1000，用于检 测扭矩和方向盘角度功能是否发生故障。
子系统310可以通过两个扭矩传感器分别采集到方向盘扭矩信号1001和方向盘扭矩信号1002。子系统320可以通过两个扭矩传感器分别采集到方向盘扭矩信号1003和方向盘扭矩信号1004。如图10所示，监控模块1000可以比较这四路扭矩信号，以确定扭矩功能安全是否故障，或电动助力转向系统是否故障。在正常情况下，这四路扭矩信号应相同。若这四路扭矩信号经过比较，发现其中的一路或两路，与其他路不相同时，可以确定扭矩功能安全可能发生故障，或者说电动助力转向系统发生故障。
子系统310可以通过转角传感器监测方向盘的转动角度，采集得到方向盘角度信号1005。子系统320可以通过转角传感器监测方向盘的转动角度，采集得到方向盘角度信号1006。如图10所示，监控模块1000可以采集到方向盘角度信号1005和方向盘角度信号1006，并比较方向盘角度信号1005和方向盘角度信号1006。当两者不相同时，可以确定方向盘角度功能可能发生故障，或者说电动助力转向系统发生故障。
示例性的，如图10所示，辅控电路还可以包括监控模块900，该监控模块900的功能可以参考上文图9所示实施例的介绍，在此不再赘述。进一步的，如图10所示，扭矩信号1001、扭矩信号1002、扭矩信号1003、扭矩信号1004可以将经扭矩处理(例如对这四者求平均，或者择一选择)后，供主控电路采用，以输出控制信号。方向盘角度信号1005和方向盘角度信号1006可以经角度处理(例如对这两者求平均，或者择一选择)后供主控电路采用，以输出控制信号。
本申请实施例提供的异常检测方法，在冗余子系统同步(控制电路211和控制电路212同步、驱动电路221和驱动电路222同步等)的基础上，通过比较冗余子系统的感测信号(例如同相绕组电流比较、电机转子位置信号比较、方向盘扭矩信号比较等等)，来监测电子控制系统是否发生故障，可以准确检测电子控制系统是否发生故障，此外，可在无需部件具有较高的功能安全完整性的情况下，提高了电子控制系统的功能安全能力，节省了成本。
上文以电动助力转向系统为例，详细介绍了电子控制系统对功能执行部件的控制过程。其他电子控制系统也可以采用相同或类似的配置，按照相同或类似的控制方式，控制功能执行部件。概括而言，其他的电子控制系统(用于实现制动功能的电子机械制动控制系统、用于实现车辆驱动功能的驱动控制器、用于实现传动功能的电子控制系统等)可以配置有至少两个控制电路和选择单元，其中，该至少两个控制电路可以参考上文对控制电路211和控制电路212的介绍实现，选择电路可以参考上文对选择单元213的介绍实现。该电子控制系统还可以包括至少两个驱动电路。该至少两个驱动电路可以参考上文对驱动电路221/312、驱动电路222/322实现。该电子控制系统对应的功能执行部件可以包括至少两个电机。
参阅图11，本申请实施例提供了一种异常检测装置1100，可以用于执行以上任一种异常检测方法，该装置1100包括：
获取单元1110，用于获取来自第一部件的第一信号和来自第二部件的第二信号，第一部件和第二部件互为冗余；
确定单元1120，用于根据第一信号和第二信号，确定电子控制系统失效(或故障)；进一步的，可以确定第一部件或第二部件失效(或故障)。
该异常检测装置1100可以为以上控制电路211或212，即以上控制电路211或212集成有异常检测功能。或者，异常检测装置1100可以为独立于控制电路的装置。
本申请实施例提供的装置，在冗余子系统同步(控制电路211和控制电路212同步、驱动电路221和驱动电路222同步等)的基础上，通过比较冗余子系统的控制信号、驱动信号或感测信号(例如同相绕组电流比较、电机转子位置信号比较、方向盘扭矩信号比较等等)，来监测电子控制系统是否发生故障，可以准确检测电子控制系统是否发生故障，此外，可在无需部件具有较高的功能安全完整性的情况下，提高了电子控制系统的功能安全能力，节省了成本。
参阅图12，本申请实施例提供了一种异常检测装置1200，包括处理器1210、存储器1220以及通信接口1230。其中，存储器1220存储有计算机指令。当该计算机指令被处理器1210执行时，装置1200可以执行以上任一种异常检测方法。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：快闪存储器、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
可以理解的是，作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保 护范围为准。

Claims (17)

  1. 一种控制装置，用于为驱动装置提供控制信号，所述驱动装置用于驱动功能执行部件，其特征在于，包括：
    第一控制电路，用于在第一时钟信号的作用下，输出第一控制信号；
    第二控制电路，用于在第二时钟信号的作用下，输出第二控制信号；
    选择单元，用于将所述第一控制信号或所述第二控制信号输出为所述驱动装置的控制信号；
    所述第一时钟信号和所述第二时钟信号具有相同的频率，且所述第一控制电路和所述第二控制电路的时间零点相同。
  2. 根据权利要求1所述的装置，其特征在于，所述第一时钟信号和所述第二时钟信号来自同一时钟源。
  3. 根据权利要求2所述的装置，其特征在于，所述第一控制电路与所述同一时钟源连接，接收来自所述同一时钟源的所述第一时钟信号，并向所述第二控制电路输出所述第二时钟信号；或者，
    所述第一控制电路和所述第二控制电路分别与所述同一时钟源连接，分别接收来自所述同一时钟源的所述第一时钟信号和所述第二时钟信号，所述第一时钟信号和所述第二时钟信号为同一时钟信号。
  4. 根据权利要求2或3所述的装置，其特征在于，还包括：
    检测单元，用于检测至少两个时钟源的有效性，且控制所述第一时钟信号和所述第二时钟信号来自所述至少两个时钟源中的有效时钟源。
  5. 根据权利要求4所述装置，其特征在于，所述检测单元位于所述第一控制电路和/或所述第二控制电路。
  6. 根据权利要求1-5任一项所述装置，其特征在于，所述选择单元位于所述第一控制电路和/或所述第二控制电路。
  7. 根据权利要求1-6任一项所述装置，其特征在于，所述第一控制电路和所述第二控制电路之间设置有至少一个元件，所述至少一个元件包括电阻元件、或电容元件，或包括电阻元件和电容元件。
  8. 一种电子控制系统，其特征在于，包括：如权利要求1-7任一项所述的控制装置和驱动装置，所述驱动装置包括：
    第一驱动电路，用于接收所述控制装置的选择单元输出的控制信号，且在所述控制信号的作用下，输出第一驱动信号；
    第二驱动电路，用于接收所述控制装置的选择单元输出的控制信号，且在所述控制信号的作用下，输出第二驱动信号。
  9. 根据权利要求8所述的系统，其特征在于，所述第一驱动信号和所述第二驱动信号用于驱动第一功能执行部件，所述系统还包括：
    第一断相电路，设置于所述第一驱动电路和所述第一功能执行部件之间，用于在所述第一驱动电路故障时，进入断开状态；
    第二断相电路，设置于所述第二驱动电路和所述第一功能执行部件之间，用于在所述第二驱动电路故障时，进入断开状态。
  10. 根据权利要求9所述的系统，其特征在于，所述第一驱动信号和所述第二驱动信号还用于驱动第二功能执行部件，所述系统还包括：
    第三断相电路，设置于所述第一驱动电路和所述第二功能执行部件之间，用于在所述第一驱动电路故障时，进入断开状态；
    第四断相电路，设置于所述第二驱动电路和所述第二功能执行部件之间，用于在所述第二驱动电路故障时，进入断开状态。
  11. 根据权利要求8-10任一项所述的系统，其特征在于，还包括：
    驱动电路选择单元，用于根据所述第一驱动电路的第一供电电压和所述第二驱动电路的第二供电电压，将所述第一驱动信号，或所述第二驱动信号，或所述第一驱动信号和所述第二驱动信号输出至功能执行部件。
  12. 根据权利要求11所述的系统，其中，所述第一供电电压大于所述第二供电电压，且
    在所述第一供电电压和所述第二供电电压之间的电压差位于预设范围之内时，将所述第一驱动信号和所述第二驱动信号输出至功能执行部件；或者，
    在所述第一供电电压和所述第二供电电压之间的电压差位于预设范围之外时，将所述第一驱动信号输出至功能执行部件；或者，
    在所述第一供电电压和所述第二供电电压之间的电压差大于阈值时，将所述第一驱动信号和所述第二驱动信号输出至功能执行部件；或者
    在所述第一供电电压和所述第二供电电压之间的电压差小于阈值时，将所述第一驱动信号输出至功能执行部件；或者，
    在所述第一供电电压和所述第二供电电压之间的电压差等于阈值时，将所述第一驱动信号和所述第二驱动信号输出至功能执行部件，或，将所述第一驱动信号输出至功能执行部件。
  13. 根据权利要求8-12任一项所述的系统，其特征在于，所述系统还包括：第一时钟源和第二时钟源；其中，所述第一时钟信号和所述第二时钟信号来自所述第一时钟源或所述第二时钟源。
  14. 根据权利要求13所述的系统，其特征在于，所述第一时钟源和所第二时钟源的时钟频率相同。
  15. 根据权利要求13或14所述的系统，其特征在于，所述控制装置的检测单元，用于检测所述第一时钟源输出的时钟信号和所述第二时钟源输出的时钟信号，且
    当所述第一时钟源输出的时钟信号失效，且所述第二时钟源输出的时钟信号有效时，控制所述第一时钟信号和所述第二时钟信号来自所述第二时钟源，或者，
    当所述第二时钟源输出的时钟信号失效，且所述第一时钟源输出的时钟信号有效时，控制所述第一时钟信号和所述第二时钟信号来自所述第一时钟源。
  16. 根据权利要求8-15任一项所述的系统，其特征在于，所述第一驱动电路和所述第二驱动电路之间有至少一个元件，所述至少一个元件包括电阻元件、或电容元件，或包括电阻元件和电容元件。
  17. 一种车辆，其特征在于，包括功能执行部件和权利要求1-8任一项所述的装置。
PCT/CN2021/110122 2021-08-02 2021-08-02 控制装置、电子控制系统及车辆 WO2023010250A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202180002095.9A CN113767340A (zh) 2021-08-02 2021-08-02 控制装置、电子控制系统及车辆
PCT/CN2021/110122 WO2023010250A1 (zh) 2021-08-02 2021-08-02 控制装置、电子控制系统及车辆

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/110122 WO2023010250A1 (zh) 2021-08-02 2021-08-02 控制装置、电子控制系统及车辆

Publications (1)

Publication Number Publication Date
WO2023010250A1 true WO2023010250A1 (zh) 2023-02-09

Family

ID=78784897

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/110122 WO2023010250A1 (zh) 2021-08-02 2021-08-02 控制装置、电子控制系统及车辆

Country Status (2)

Country Link
CN (1) CN113767340A (zh)
WO (1) WO2023010250A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240030740A1 (en) * 2022-07-22 2024-01-25 Universal City Studios Llc Single battery switchable float power system

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5036528A (en) * 1990-01-29 1991-07-30 Tandem Computers Incorporated Self-calibrating clock synchronization system
US5146585A (en) * 1988-10-25 1992-09-08 International Business Machines Corporation Synchronized fault tolerant clocks for multiprocessor systems
US5422915A (en) * 1993-12-23 1995-06-06 Unisys Corporation Fault tolerant clock distribution system
US20160098077A1 (en) * 2014-10-06 2016-04-07 Denso Corporation Electronic control unit
US20170207050A1 (en) * 2016-01-14 2017-07-20 Anden Co., Ltd. Load drive apparatus
CN112083755A (zh) * 2020-08-10 2020-12-15 合肥市芯海电子科技有限公司 一种时钟控制电路、芯片及时钟控制方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10205416B2 (en) * 2015-02-24 2019-02-12 Mitsubishi Electric Corporation Electric driving apparatus and electric power steering apparatus
JP6701847B2 (ja) * 2016-03-17 2020-05-27 株式会社デンソー モータ制御装置
US10128783B2 (en) * 2016-05-31 2018-11-13 Infineon Technologies Ag Synchronization of internal oscillators of components sharing a communications bus
JP6662721B2 (ja) * 2016-06-22 2020-03-11 株式会社ジェイテクト 制御装置、モータ制御装置、及び電動パワーステアリング装置
CN109496017A (zh) * 2018-12-26 2019-03-19 矽力杰半导体技术(杭州)有限公司 Led负载驱动电路及其驱动方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5146585A (en) * 1988-10-25 1992-09-08 International Business Machines Corporation Synchronized fault tolerant clocks for multiprocessor systems
US5036528A (en) * 1990-01-29 1991-07-30 Tandem Computers Incorporated Self-calibrating clock synchronization system
US5422915A (en) * 1993-12-23 1995-06-06 Unisys Corporation Fault tolerant clock distribution system
US20160098077A1 (en) * 2014-10-06 2016-04-07 Denso Corporation Electronic control unit
US20170207050A1 (en) * 2016-01-14 2017-07-20 Anden Co., Ltd. Load drive apparatus
CN112083755A (zh) * 2020-08-10 2020-12-15 合肥市芯海电子科技有限公司 一种时钟控制电路、芯片及时钟控制方法

Also Published As

Publication number Publication date
CN113767340A (zh) 2021-12-07

Similar Documents

Publication Publication Date Title
CN104736413B (zh) 马达控制装置、使用该马达控制装置的电动动力转向装置以及车辆
US10322748B2 (en) Motor controller and steering device
JP5855167B2 (ja) 電子制御装置
EP3403904B1 (en) Electrical power steering device
CN108696226B (zh) 一种电机控制器
US9043089B2 (en) Actuator control apparatus
US10501063B2 (en) Brake-by-wire system
CN103153757A (zh) 电动助力转向系统
US10144402B2 (en) Brake-by-wire system
JP2011234517A (ja) 動力駆動制御装置および動力装置
CN109733460A (zh) 冗余电子转向制动系统
US20020057070A1 (en) Electrical steering system
WO2023010250A1 (zh) 控制装置、电子控制系统及车辆
JP6526291B1 (ja) 電動パワーステアリング装置
US20180056964A1 (en) Brake-by-wire system
US20210146786A1 (en) Method and system to control at least two electric motors driving a vehicle
JP6026899B2 (ja) モータ制御システム
CN109327166B (zh) 用于以单个马达位置信号操作马达的系统和方法
US11787293B2 (en) Electric motor control device and method of electric motor control
EP3854623A1 (en) Motor control unit
JP7101307B2 (ja) ブレーキ制御装置
JP2010132095A (ja) 車両制御システム
JP2015089292A (ja) 負荷駆動装置
JP2013253796A (ja) レゾルバ励磁回路及び電動パワーステアリング装置の制御装置
CN207089409U (zh) 新能源商用车eps电机控制系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21952160

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE