WO2024065509A1 - 控制装置、控制系统及运载工具 - Google Patents

控制装置、控制系统及运载工具 Download PDF

Info

Publication number
WO2024065509A1
WO2024065509A1 PCT/CN2022/122884 CN2022122884W WO2024065509A1 WO 2024065509 A1 WO2024065509 A1 WO 2024065509A1 CN 2022122884 W CN2022122884 W CN 2022122884W WO 2024065509 A1 WO2024065509 A1 WO 2024065509A1
Authority
WO
WIPO (PCT)
Prior art keywords
unit
control
output
signal
input
Prior art date
Application number
PCT/CN2022/122884
Other languages
English (en)
French (fr)
Inventor
李增山
王红智
骆鹏
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2022/122884 priority Critical patent/WO2024065509A1/zh
Publication of WO2024065509A1 publication Critical patent/WO2024065509A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05F—SYSTEMS FOR REGULATING ELECTRIC OR MAGNETIC VARIABLES
    • G05F1/00—Automatic systems in which deviations of an electric quantity from one or more predetermined values are detected at the output of the system and fed back to a device within the system to restore the detected quantity to its predetermined value or values, i.e. retroactive systems
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05F—SYSTEMS FOR REGULATING ELECTRIC OR MAGNETIC VARIABLES
    • G05F1/00—Automatic systems in which deviations of an electric quantity from one or more predetermined values are detected at the output of the system and fed back to a device within the system to restore the detected quantity to its predetermined value or values, i.e. retroactive systems
    • G05F1/10—Regulating voltage or current
    • G05F1/46—Regulating voltage or current wherein the variable actually regulated by the final control device is dc
    • G05F1/56—Regulating voltage or current wherein the variable actually regulated by the final control device is dc using semiconductor devices in series with the load as final control devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F1/00—Details not covered by groups G06F3/00 - G06F13/00 and G06F21/00
    • G06F1/26—Power supply means, e.g. regulation thereof
    • H—ELECTRICITY
    • H03—ELECTRONIC CIRCUITRY
    • H03K—PULSE TECHNIQUE
    • H03K17/00—Electronic switching or gating, i.e. not by contact-making and –breaking
    • H03K17/16—Modifications for eliminating interference voltages or currents
    • H—ELECTRICITY
    • H03—ELECTRONIC CIRCUITRY
    • H03K—PULSE TECHNIQUE
    • H03K17/00—Electronic switching or gating, i.e. not by contact-making and –breaking
    • H03K17/22—Modifications for ensuring a predetermined initial state when the supply voltage has been applied
    • H03K17/24—Storing the actual state when the supply voltage fails

Definitions

  • the present application relates to the field of electronic technology, and in particular to a control device, a control system and a vehicle.
  • board-level design usually has modules such as computing unit, management unit, and power supply unit, while the timing management, diagnostic detection, etc. of the single board are uniformly handled by the control unit (or management unit).
  • the control unit or management unit.
  • the control unit When the control unit is abnormal, it will lead to loss of product function, so it is necessary to improve the reliability of the product.
  • the present application provides a control device, a control system and a vehicle to improve the reliability of the product.
  • a control system comprising: a first control unit, a first isolation unit and a first controlled unit.
  • the first control unit is connected to the first isolation unit and is used to output a first level signal to the first isolation unit.
  • the first isolation unit has a first input terminal, a second input terminal and an output terminal, and the first isolation unit is used to receive the first level signal and the second level signal through its first input terminal and the second input terminal, respectively, and output a first control signal to the first controlled unit through its output terminal.
  • the first controlled unit is used to output a second level signal to the second input terminal of the first isolation unit under the action of the first control signal.
  • the first isolation unit can continue to output the first control signal to the first controlled unit based on the second level signal output by the first controlled unit to achieve control of the first controlled unit.
  • the fault of the first control unit is isolated, and the reliability of the control system is effectively improved.
  • the first isolation unit may include: a first switch and a logic operation circuit, the first switch having a first end and a second end, and the logic operation circuit having a first input end, a second input end and an output end.
  • the first input end of the logic operation circuit serves as the first input end of the first isolation unit, and is used to receive a first level signal as the first input signal.
  • the first end of the first switch serves as the second input end of the first isolation unit, and is used to receive the second level signal.
  • the second end of the first switch is connected to the second input end of the logic operation circuit, and is used to output the second input signal to the second input end of the logic operation circuit when the first switch is turned on.
  • the logic operation circuit is used to perform a logic operation on the first input signal and the second input signal, and output a first control signal through the output end.
  • the level of the first control signal output by the logic operation circuit may be a valid level.
  • the level of the first control signal output by the logic operation circuit may be an invalid level.
  • the effective level of the first control signal can be a high level relative to the invalid level, and the effective levels of the first input signal and the second input signal can also be high levels relative to the invalid level.
  • the logic operation circuit can be used to perform an OR operation on the first input signal and the second input signal.
  • the logic operation circuit may be an OR gate.
  • OR gate as the logic operation circuit can effectively reduce the structural complexity and cost of the control system.
  • the effective level of the first control signal can be a low level relative to the invalid level, and the effective levels of the first input signal and the second input signal can be a high level relative to the invalid level.
  • the logic operation circuit can be used to perform an OR operation and a NOT operation on the first input signal and the second input signal in sequence.
  • the first control signal output by the logic operation circuit is at a low level; when both the first input signal and the second input signal are at a low level, the first control signal output by the logic operation circuit is at a high level.
  • the logic operation circuit may include an OR gate and a NOT gate, wherein the two input ends of the OR gate are respectively the first input end and the second input end of the logic operation circuit, the output end of the OR gate is connected to the input end of the NOT gate, and the output end of the NOT gate is the output end of the logic operation circuit.
  • the first switch may include: a triode or a field effect transistor.
  • a triode or a field effect transistor as the first switch can effectively simplify the structural complexity of the control system and reduce the cost of the control system.
  • control system may further include: a second control unit.
  • the logic operation circuit also has a third input terminal, the output terminal of the second control unit is connected to the third input terminal, and is used to output a third level signal to the logic operation circuit as a third input signal of the logic operation circuit.
  • the logic operation circuit can also output the first control signal to the first controlled unit under the action of the third level signal.
  • the flexibility of controlling the first controlled unit is effectively improved.
  • the second control unit can output the third level signal of the effective level so that the logic operation circuit outputs the first control signal of the effective level to the first controlled unit.
  • it is convenient for operation and maintenance personnel or R&D personnel to locate faults in the control system.
  • control system may further include: a second control unit.
  • the first switch also has a third end, and the output end of the second control unit may be connected to the third end of the first switch and used to control the on/off state of the first end and the second end of the first switch.
  • the first switch cannot output the second input signal to the logic operation circuit based on the second level signal output by the first controlled unit. Accordingly, the logic operation circuit will no longer output the first control signal based on the second input signal, thereby unlocking the state of the first controlled unit.
  • control system may further include: a communication unit.
  • the communication unit is connected to the input end of the second control unit and is used to output a fault detection instruction to the second control unit.
  • the communication unit may include a wired connector and/or a wireless communication module.
  • the second control unit may control the first end and the second end of the first switch to be turned off based on the fault detection instruction, and output a third level signal of a valid level to the logic operation circuit.
  • control system may include a first domain and a second domain, wherein the second domain is used to perform redundant backup for part or all of the functions of the first domain, the first control unit belongs to the first domain, and the first controlled unit belongs to the second domain.
  • control system may include a first power domain and a second power domain, the first control unit belongs to the first power domain, the first controlled unit is a power supply unit of the second power domain, and the first control signal is used to control the power supply unit of the second power domain to power on or off.
  • the first control unit may be powered by the power supply unit of the first power domain.
  • the first power domain may also include one or more of a second control unit, a first computing unit and a first storage unit, and the power supply unit of the first power domain is also used to supply power to one or more of the second control unit, the first computing unit and the first storage unit.
  • the first power domain may further include a second control unit, a first computing unit, and a first storage unit, that is, the first control unit and the second control unit both belong to the first power domain.
  • control system may further include a third power domain
  • the second control unit may belong to the third power domain and be powered by a power supply unit of the third power domain. It is understandable that when a power supply unit in any power domain fails, the failed power supply unit will not be able to supply power to other functional units in the power domain, which will cause the other functional units to be abnormally powered off. Since the first control unit and the second control unit belong to two different power domains, it is possible to effectively avoid the situation where the two control units are abnormally powered off at the same time due to a failure of a power supply unit in a power domain.
  • control system may further include: a second computing unit and/or a second storage unit.
  • the power supply unit of the second power domain is used to supply power to the second computing unit and/or the second storage unit.
  • the power supply unit of the second power domain when the first control signal is at an invalid level, the power supply unit of the second power domain remains in a power-off state, and the second computing unit and/or the second storage unit in the second power domain also remain in a power-off state.
  • the power supply unit of the second power domain can be powered on under the control of the first control signal, and supply power to the second computing unit and/or the second storage unit, and the second computing unit and/or the second storage unit can then remain in a power-on state.
  • the power supply unit of the second power domain may include: a first voltage conversion unit and a second voltage conversion unit.
  • the control system may also include: a second isolation unit.
  • the first isolation unit is used to output a first control signal to the first voltage conversion unit; the first control unit is also connected to the second isolation unit and is used to output a fourth level signal to the second isolation unit.
  • the second isolation unit has an input end and an output end, and the second isolation unit is used to receive the fourth level signal through its input end, and output a second control signal to the second voltage conversion unit through its output end under the action of the fourth level signal.
  • the second control signal is used to control the second voltage conversion unit to power on or off.
  • the second control signal output by the second isolation unit can be an invalid level, and the second voltage conversion unit can remain in a power-off state.
  • the fourth level signal is an invalid level
  • the second control signal output by the second isolation unit can be a valid level
  • the second voltage conversion unit can be powered on under the drive of the second control signal of the valid level. Since when the first control unit fails or is abnormally powered off, the fourth level signal output by it is an invalid level, the second isolation unit can continue to output the second control signal of the valid level, thereby keeping the second voltage conversion unit powered on. In this way, it can be avoided that the failure of the first control unit affects the power-on state of the second voltage conversion unit.
  • the first control unit may be configured to output the first level signal and the fourth level signal according to an operation mode of the control system.
  • the first control unit can control the power-on of different voltage conversion units in the third power supply unit when the control system is in different working modes, thereby effectively reducing the power consumption of the control system without affecting the performance of the control system.
  • the second isolation unit may include: a second switch, the second switch having a first end, a second end and a third end.
  • the first end of the second switch serves as an input end of the second isolation unit and is used to receive a fourth level signal;
  • the second end of the second switch serves as an output end of the second isolation unit and is respectively connected to a power supply end and an input end of the second voltage conversion unit;
  • the third end of the second switch is connected to a ground end.
  • the fourth level signal can be used to control the on-off state of the second end and the third end of the second switch. And, when the fourth level signal is a valid level, the second end and the third end of the second switch are turned on. At this time, since the power supply end and the input end of the second voltage conversion unit are both connected to the ground end, the second voltage conversion unit remains in a power-off state. When the fourth level signal is an invalid level, the second end and the third end of the second switch are turned off. At this time, since the input end of the second voltage conversion unit is connected to the power supply end, the second voltage conversion unit can remain in a power-on state under the drive of the power supply end.
  • the first end of the second switch may be grounded via a first resistor, and the second end of the second switch may be connected to a power supply terminal via a second resistor.
  • the second switch may include: a triode or a field effect transistor.
  • a triode or a field effect transistor as the second switch can effectively simplify the structural complexity of the control system and reduce the cost of the control system.
  • the first controlled unit is a computing unit
  • the first control signal may be a reset signal for controlling the computing unit to reset.
  • control system may further include: a third isolation unit and a second controlled unit.
  • the first control unit may also be connected to the third isolation unit and is used to output a fifth level signal to the third isolation unit.
  • the third isolation unit has a first input terminal, a second input terminal and an output terminal.
  • the third isolation unit is used to receive the fifth level signal and the sixth level signal through its first input terminal and second input terminal, respectively, and output a third control signal to the second controlled unit through its output terminal.
  • the second controlled unit is used to output the sixth level signal to the second input terminal of the third isolation unit under the action of the third control signal.
  • the structure and working principle of the third isolation unit can refer to the first isolation unit, and will not be described here.
  • the second controlled unit can be a power supply unit, or a computing unit or other functional unit.
  • a control device comprising: a control unit and an isolation unit.
  • the control unit is connected to the isolation unit and is used to output a first level signal to the isolation unit.
  • the isolation unit has a first input terminal, a second input terminal and an output terminal, and the isolation unit is used to receive the first level signal through its first input terminal, receive the second level signal output by the controlled unit through its second input terminal, and output a control signal to the controlled unit through its output terminal.
  • the control signal is used to control the controlled unit to output the second level signal.
  • the isolation unit may include: a switch and a logic operation circuit, the switch having a first end and a second end, and the logic operation circuit having a first input end, a second input end, and an output end.
  • the first input end of the logic operation circuit serves as the first input end of the isolation unit, and is used to receive a first level signal as the first input signal.
  • the first end of the switch serves as the second input end of the isolation unit, and is used to receive a second level signal.
  • the second end of the switch is connected to the second input end of the logic operation circuit, and is used to output the second input signal to the second input end of the logic operation circuit when the switch is turned on.
  • the logic operation circuit is used to perform a logic operation on the first input signal and the second input signal, and output the control signal through the output end.
  • the effective level of the control signal is a high level relative to the invalid level, and the logic operation circuit is used to perform an OR operation on the first input signal and the second input signal.
  • the effective level of the control signal is a low level relative to the invalid level, and the logic operation circuit is used to perform an OR operation and a NOT operation on the first input signal and the second input signal in sequence.
  • the switch may include: a triode or a field effect transistor.
  • another control device including: a first control unit, a second control unit and a latch unit.
  • the first control unit is connected to the latch unit and is used to output a first level signal to the latch unit;
  • the second control unit is also connected to the latch unit and is used to output a second level signal to the latch unit.
  • the latch unit has a first input terminal, a second input terminal and an output terminal. The latch unit is used to receive the first level signal and the second level signal through its first input terminal and the second input terminal respectively, and under the action of the first level signal, the second level signal is sampled and latched, and the latched signal is output to the controlled unit through the output terminal.
  • the latch unit Based on the working principle of the latch unit, it can be known that even if the first control unit fails, the latch unit can continue to output the latched signal to the first controlled unit, thereby isolating the failure of the first control unit and effectively improving the reliability of the control device.
  • the latch unit can sample and latch the level of the second level signal when there is a jump edge in the first level signal, and output the latched signal. Since there will be no jump edge in the first level signal output by the first control unit when the first control unit fails or is abnormally powered off, the first level signal will not trigger the latch unit to adjust the level of the signal it outputs, and the controlled unit can continue to maintain the previous working state. That is, the latch unit can prevent the failure of the first control unit from affecting the working state of the controlled unit, realize the isolation of the failure of the first control unit, and then realize the state locking of the controlled unit.
  • the latch unit may include: an edge trigger.
  • the first level signal output by the first control unit may include at least one target jump edge, and the target jump edge may be a rising edge or a falling edge.
  • the level of the second level signal output by the second control unit may be a valid level.
  • the edge trigger may sample and latch the level of the second input terminal (i.e., the level of the second level signal) when detecting the presence of a target jump edge at its first input terminal, and output the latched signal.
  • the latch unit may also have a power supply terminal; the second control unit is also connected to the power supply terminal of the latch unit and is used to control the power-on and power-off states of the latch unit.
  • the second control unit can control the latch unit to power off.
  • the control of the latch unit on the controlled unit can be released, that is, the state of the controlled unit can be unlocked.
  • an isolation circuit comprising: a logic operation circuit having a first input terminal, a second input terminal and an output terminal, the first input terminal being used to receive a first level signal as a first input signal, the second input terminal being used to receive a second input signal, and the logic operation circuit being used to perform a logic operation on the first input signal and the second input signal, and output a first control signal through the output terminal; a switch having a first terminal and a second terminal, the first terminal being used to receive a second level signal, the second terminal being connected to the first input terminal of the logic operation circuit, and being used to output the second input signal to the second input terminal of the logic operation circuit when the switch is turned on, wherein the second level signal is the output of the controlled unit under the control of the first control signal.
  • a control system comprising the control device provided in the second aspect or the third aspect, and a controlled unit.
  • a central computing platform comprising: a control system as provided in any of the above aspects, and at least one interface.
  • the at least one interface may include one or more of a power interface, an Ethernet interface, and a sensor interface.
  • the central computing platform may be an intelligent central computing module or a high-performance central computing platform, and the central computing platform may be a box-type device.
  • an autonomous driving system comprising: a central computing platform as provided in the above aspects, a vehicle-mounted sensor component, and a vehicle-mounted controller component.
  • the central computing platform is used to process data collected by the vehicle-mounted sensor component and control the vehicle-mounted actuator component to perform autonomous driving operations.
  • a vehicle comprising: a control system as provided in any of the above aspects.
  • the vehicle may be a vehicle, for example, a vehicle with an automatic driving function.
  • the vehicle further comprises a battery assembly for supplying power to a power supply unit in the control system.
  • the present application provides a control device, a control system and a vehicle, wherein the first isolation unit in the control system can receive a first level signal output by a first control unit and a second level signal output by a first controlled unit, and can output a first control signal to the first controlled unit.
  • the first controlled unit can output a second level signal to the first isolation unit under the action of the first control signal. Based on this, even if the first control unit fails, the first isolation unit can continue to output the first control signal to the first controlled unit based on the second level signal output by the first controlled unit.
  • the isolation of the failure of the first control unit is achieved, and the reliability of the control system is effectively improved.
  • FIG1 is a schematic diagram of the structure of a control system provided in an embodiment of the present application.
  • FIG2 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • FIG3 is a schematic diagram of the structure of a logic operation circuit provided in an embodiment of the present application.
  • FIG4 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • FIG5 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • FIG6 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • FIG7 is a schematic diagram of the structure of a second power supply unit provided in an embodiment of the present application.
  • FIG8 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • FIG9 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • FIG10 is a schematic diagram of the structure of a control device provided in an embodiment of the present application.
  • FIG11 is a schematic diagram of the structure of another control device provided in an embodiment of the present application.
  • FIG12 is a schematic diagram of the structure of a central computing platform provided in an embodiment of the present application.
  • FIG. 13 is a schematic diagram of the structure of a vehicle provided in an embodiment of the present application.
  • the embodiment of the present application provides a control system, which can be applied to a vehicle.
  • the vehicle may include a road vehicle, a water vehicle, an air vehicle, an industrial device, an agricultural device, or an entertainment device, etc.
  • the vehicle may be a vehicle, which is a vehicle in a broad sense, and may be a vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying vehicle, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a lawn mower, a harvester, etc.), an amusement device or a toy vehicle, etc.
  • the embodiment of the present application does not specifically limit the type of vehicle.
  • the vehicle may be a vehicle such as an airplane or a ship.
  • control system can also be applied to other devices, for example, it can also be applied to servers or network devices in the field of information and communication technology (ICT).
  • ICT information and communication technology
  • the control system includes: a first control unit 01 , a first isolation unit 02 and a first controlled unit 03 .
  • the first control unit 01 is connected to the first isolation unit 02 , and the first control unit 01 is used to output a first level signal S1 to the first isolation unit 02 .
  • the first isolation unit 02 has a first input terminal, a second input terminal and an output terminal.
  • the first isolation unit 02 is used to receive a first level signal S1 through the first input terminal, receive a second level signal S2 through the second input terminal, and output a first control signal C1 to the first controlled unit 03 through the output terminal.
  • the first controlled unit 03 is used for outputting a second level signal S2 to the second input terminal of the first isolation unit 02 under the action of the first control signal C1.
  • the first isolation unit 02 can continue to output the first control signal C1 to the first controlled unit 03 based on the second level signal S2 received at its second input terminal.
  • the first isolation unit 02 can be used to output a first control signal C1 of a valid level when the level signal received at any one of the first input terminal and the second input terminal is a valid level.
  • the first isolation unit 02 can be used to output a first control signal C1 of an invalid level when the level signals received at the first input terminal and the second input terminal are both invalid levels.
  • the first controlled unit 03 can maintain a target working state (e.g., a power-on state or a reset state, etc.), and can output a second level signal S2 of a valid level to the second input terminal of the first isolation unit 02. If the first control signal C1 is at an invalid level, the first controlled unit 03 cannot be in the target working state, and the first controlled unit 03 stops outputting the second level signal S2, or the second level signal S2 output by the first controlled unit 03 is at an invalid level.
  • a target working state e.g., a power-on state or a reset state, etc.
  • the first control unit 01 can output a first level signal S1 of an effective level to the first isolation unit 02 after power-on, and the first isolation unit 02 can output a first control signal C1 of an effective level to the first controlled unit 03 under the action of the first level signal S1 of an effective level.
  • the first controlled unit 03 can then be in the target working state under the control of the first control signal C1, and feedback a second level signal S2 of an effective level to the first isolation unit 02. Based on this, even if the first control unit 01 cannot continue to output the first level signal S1 of an effective level due to a fault or abnormal power-off, the second level signal S2 can enable the first isolation unit 02 to continue to output the first control signal C1 of an effective level.
  • the first controlled unit 03 can continue to maintain the target working state. That is, the first isolation unit 01 can isolate the fault of the first control unit 01 under the action of the second level signal S2 output by the first controlled unit 03, and realize the state self-locking of the first controlled unit 03.
  • the first isolation unit 02 may include: a first switch 021 and a logic operation circuit 022.
  • the first switch 021 has a first end and a second end
  • the logic operation circuit 022 has a first input end, a second input end and an output end.
  • the first input terminal of the logic operation circuit 022 serves as the first input terminal of the first isolation unit 02 and can be used to receive the first level signal S1 as the first input signal T1.
  • the first end of the first switch 021 serves as the second input end of the first isolation unit 02 and can be used to receive the second level signal S2.
  • the second end of the first switch 021 is connected to the second input end of the logic operation circuit 022 and can be used to output the second input signal T2 to the second input end of the logic operation circuit 022 when the first switch 021 is turned on.
  • the logic operation circuit 022 can be used to perform logic operations on the received multiple input signals (including the first input signal T1 and the second input signal T2), and output the first control signal C1 through its output terminal.
  • the logic operation circuit 022 can output the first control signal C1 of the valid level when any input signal received by it is at a valid level, and can output the first control signal C1 of the invalid level when all the input signals received by it are at an invalid level.
  • the default on-off state of the first end and the second end of the first switch 021 can be the on state.
  • the first switch 021 can output the second input signal T2 to the second input end of the logic operation circuit 022 based on the second level signal S2 output by the first controlled unit 03.
  • the first switch 021 can transmit the second level signal S2 to the second input end of the logic operation circuit 022 as the second input signal T2.
  • the first controlled unit 03 can exit the target working state. That is, by disconnecting the first end and the second end of the first switch 021 , the state of the first controlled unit 03 can be unlocked.
  • the effective level of the first control signal C1 can be a high level relative to the invalid level, and the effective levels of the first level signal S1 and the second level signal S2 can also be both high levels.
  • the logic operation circuit 022 can be used to perform an OR operation on the first input signal T1 and the second input signal T2. Based on this, when any one of the first input signal T1 and the second input signal T2 is at a high level, the first control signal C1 output by the logic operation circuit 022 is a high level, that is, an effective level. When the first input signal T1 and the second input signal T2 are both at a low level, the first control signal C1 output by the logic operation circuit 022 is a low level, that is, an invalid level.
  • the logic operation circuit 022 may be an OR gate. Using an OR gate as the logic operation circuit 022 can ensure that the structure of the control system is relatively simple and the cost is relatively low. It is understandable that, in addition to the OR gate, the logic operation circuit 022 may also be implemented in the form of other logic gate combinations, as long as it is ensured that the logic operation circuit 022 can perform an OR operation on the input multi-level signals. For example, the logic operation circuit 022 may also include two serially connected NOR gates, or include multiple NAND gates.
  • the effective level of the first control signal C1 can be a low level relative to the invalid level.
  • the logic operation circuit 022 can be used to perform an OR operation and a NOT operation on the first input signal T1 and the second input signal T2 in sequence. Accordingly, when any one of the first input signal T1 and the second input signal T2 is at a high level, the first control signal C1 output by the logic operation circuit 022 can be a low level, that is, an effective level. When both the first input signal T1 and the second input signal T2 are at a low level, the first control signal C1 output by the logic operation circuit 022 can be a high level, that is, an invalid level.
  • the logic operation circuit 022 may include an OR gate and a NOT gate.
  • the input terminals of the OR gate are the input terminals of the logic operation circuit 022
  • the output terminal of the OR gate is connected to the input terminal of the NOT gate
  • the output terminal of the NOT gate is the output terminal of the logic operation circuit 022.
  • logic operation circuit 022 can also be implemented by other logic gate combinations.
  • the OR gate in the logic operation circuit 022 can be replaced by two serially connected NOR gates.
  • the logic operation circuit 022 may be an AND gate, or may include two NAND gates connected in series. Thus, the logic operation circuit 022 may output a low-level first control signal C1 when any input signal received by it is low-level, and may output a high-level first control signal C1 when all input signals received by it are high-level.
  • the first switch 021 may include a triode.
  • the first switch 021 may include a field effect transistor.
  • the transistor is an NPN transistor, whose collector can serve as the first end of the first switch 021 for receiving the second level signal S2 , and whose emitter can serve as the second end of the first switch 021 connected to the second input end of the logic operation circuit 022 .
  • the transistor is a PNP transistor, whose emitter can serve as the first end of the first switch 021 for receiving the second level signal S2, and whose collector can serve as the second end of the first switch 021 connected to the second input end of the logic operation circuit 022.
  • the base of the transistor is used as a control terminal for coupling a control signal to turn on or off the transistor.
  • the base of the transistor can be coupled to the output terminal of another control unit (such as the second control unit 04 described below) to obtain a control voltage to control the conduction or cutoff of the transistor.
  • the field effect transistor can be an N-type metal-oxide-semiconductor field-effect transistor (MOSFET), referred to as NMOS, whose drain can serve as the first end of the first switch 021 for receiving the second level signal S2, and the source can serve as the second end of the first switch 021 connected to the second input end of the logic operation circuit 022.
  • MOSFET N-type metal-oxide-semiconductor field-effect transistor
  • the field effect transistor is a PMOS tube, whose source can serve as the first end of the first switch 021 for receiving the second level signal S2, and whose drain can serve as the second end of the first switch 021 connected to the second input end of the logic operation circuit 022.
  • the gate of the field effect transistor is used as a control terminal for coupling a control signal to turn on or off the field effect transistor.
  • the gate of the field effect transistor can be coupled to the output terminal of another control unit (such as the second control unit 04 described below) to obtain a control voltage to control the conduction or cutoff of the field effect transistor.
  • triodes and field effect transistors have simple structures and low costs, using triodes or field effect transistors as the first switch 021 can effectively avoid increasing the structural complexity and cost of the control system.
  • control system may further include a resistor R0, one end of which is respectively connected to the output end of the logic operation circuit 022 and the input end of the first controlled unit 03, and the other end of which is grounded.
  • the resistor R0 may be used to stabilize the level of the input end of the first controlled unit 03.
  • control system may further include: a second control unit 04.
  • the logic operation circuit 022 may further have a third input terminal, and the output terminal of the second control unit 04 is connected to the third input terminal and is used to output a third level signal S3 to the logic operation circuit 022 as a third input signal T3 of the logic operation circuit 022.
  • the logic operation circuit 022 can also output the first control signal C1 to the first controlled unit 03 under the action of the third level signal S3.
  • the flexibility of controlling the first controlled unit 03 is effectively improved.
  • the logic operation circuit 022 can perform logic operations on the received first input signal T1, the second input signal T2, and the third input signal T3. Moreover, when any input signal among the first input signal T1, the second input signal T2, and the third input signal T3 is at a valid level, the first control signal C1 output by the logic operation circuit 022 can be at a valid level. When the first input signal T1, the second input signal T2, and the third input signal T3 are all at invalid levels, the first control signal C1 output by the logic operation circuit 022 can be at an invalid level.
  • the third level signal S3 outputted by the second control unit 04 after power-on may be an invalid level. That is, when the first control unit 01 is normal, or when the first controlled unit 03 is in a self-locking state, the third level signal S3 will not affect the level of the first control signal C1 outputted by the logic operation circuit 022.
  • the second control unit 04 can output the third level signal S3 of the effective level.
  • the logic operation circuit 022 can output the first control signal C1 of the effective level, and the first controlled unit 03 can be in the target working state (such as the power-on state) under the drive of the first control signal C1. In this way, it is easy to locate the fault in the control system.
  • the second control unit 04 may also be referred to as a processing unit or a management unit, which may be a device having data processing, management and control functions.
  • the first control unit 01 may be a device having a control function, which may control the working state of other controlled units under the control of the second control unit 04.
  • the second control unit 04 may send the power-on and power-off timing of each unit in the control system to the first control unit 01, and the first control unit 01 may control the power-on and power-off status of each unit in the control system based on the power-on and power-off timing, and perform abnormality detection on each unit.
  • the second control unit 04 may be a microprocessor or a microcontroller unit (MCU).
  • the first control unit 01 may be a programmable logic device (PLD) or other control chips with an input/output (I/O) interface.
  • PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.
  • CPLD complex programmable logical device
  • FPGA field-programmable gate array
  • GAL generic array logic
  • the output end of the second control unit 04 may be connected to the third end (i.e., the control end) of the first switch 021, and is used to control the on-off state of the first end and the second end of the first switch 021.
  • the second control unit 04 may output a switch signal SW0 to the third end of the first switch 021, and the first switch 021 may control the on-off state of its first end and the second end under the action of the switch signal SW0.
  • the second control unit 04 can first control the first end and the second end of the first switch 021 to be turned on after power-on, so that the first switch 021 outputs the second input signal T2 to the logic operation circuit 022 based on the second level signal S2 output by the first controlled unit 03.
  • the second control unit 04 can control the first end and the second end of the first switch 021 to be turned off.
  • the first switch 021 cannot output the second input signal T2 to the logic operation circuit 022 based on the second level signal S2 output by the first controlled unit 03.
  • Fig. 4 is a schematic diagram of the structure of another control system provided by an embodiment of the present application.
  • the control system may also include: a communication unit 05.
  • the communication unit 05 may be connected to the input end of the second control unit 04 and used to output a fault detection instruction to the second control unit 04.
  • the second control unit 04 can control the first end and the second end of the first switch 021 to be turned off based on the fault detection instruction, and output the third level signal S3 of the effective level as the third input signal T3 to the logic operation circuit 022 in the first isolation unit 02.
  • the first isolation unit 02 can output the first control signal C1 of the effective level to the first controlled unit 03 based on the third input signal T3, thereby making the first controlled unit 03 in the target working state.
  • the communication unit 05 may include: a wired connector 501, and/or a wireless communication module 502.
  • the wired connector 501 may be a vehicle-mounted connector.
  • the wireless communication module 502 may be a Bluetooth communication module, or may be a wireless fidelity (Wi-Fi) module, etc.
  • the second control unit 04 may be installed with control software, which can control the on/off state of the first switch 021, and control the level of the third level signal S3.
  • the operation and maintenance personnel can upgrade the control software in the second control unit 04 through the communication unit 05, so that the second control unit 04 controls the first end and the second end of the first switch 021 to be turned off, and outputs the third level signal S3 of the effective level.
  • the operation and maintenance personnel can modify the program code in the memory of the second control unit 04 through the communication unit 05 to achieve the upgrade of the control software.
  • the above fault location method does not require disassembly of the control system, and remote fault location can be achieved through a wireless communication module, thereby effectively improving the flexibility and convenience of fault location.
  • the above control units (e.g., the first control unit 01) and the controlled units (e.g., the first controlled unit 03) may belong to different domains (or subsystems), such as the first domain (or subsystem) and the second domain (or subsystem), wherein the second domain is used to perform redundant backup for part or all of the functions of the first domain to improve the reliability of the product.
  • the control unit controls both the functions in the first domain and the backup functions in the second domain.
  • the controlled unit is a functional unit, such as a computing unit, a processing unit, etc.; or the control unit controls the power-on of the functions in the first domain and the power-on of the backup functions in the second domain.
  • the controlled unit is a power supply unit. In this way, when the domain (e.g., the first domain) where the control unit is located fails, a control system including the above isolation unit is used to isolate the impact on the second domain, so that the second domain works normally, thereby improving the stability of the redundant system.
  • the first domain is the first power domain and the second domain is the second power domain:
  • FIG5 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • the control system includes a first power domain and a second power domain.
  • the first control unit 01 belongs to the first power domain and can be powered by a power supply unit in the first power domain (i.e., the first power supply unit 06 shown in FIG5 ).
  • the first controlled unit 03 may be a power supply unit of the second power domain (ie, the second power supply unit 03 ), and the first control signal C1 may be a first enable signal for controlling the second power supply unit 03 to be powered on or off.
  • the first power domain may further include one or more of the second control unit 04, the first computing unit 08, and the first storage unit 09.
  • the first power supply unit 06 of the first power domain is also used to supply power to one or more of the second control unit 04, the first computing unit 08, and the first storage unit 09.
  • the first power domain also includes a first computing unit 08 and a first storage unit 09
  • the first power supply unit 06 is also used to supply power to the first computing unit 08 and the first storage unit 09.
  • the control system also includes a third power domain
  • the second control unit 04 belongs to the third power domain, and can be powered by a power supply unit in the third power domain (i.e., the third power supply unit 07 shown in FIG5 ). That is, in the first implementation, the first control unit 01 and the second control unit 04 belong to different power domains and are powered by two different power supply units.
  • the communication unit 05 may also belong to the third power domain, and accordingly, the third power supply unit 07 may also be used to supply power to the communication unit 05. It is understandable that when any of the first power supply unit 06 and the third power supply unit 07 fails, the failed power supply unit will not be able to supply power to other functional units in the power domain to which it belongs, which will cause abnormal power failure of other functional units. Since in the first implementation, the first control unit 01 and the second control unit 04 are powered by two different power supply units, it is possible to avoid the situation where a failure of a power supply unit causes abnormal power failure of the two control units at the same time.
  • the first power supply unit 06 of the first power domain is also used to supply power to the second control unit 04. That is, the first control unit 01 and the second control unit 04 may both belong to the first power domain.
  • the first power domain to which the first control unit 01 and the second control unit 04 belong may not include a computing unit and a storage unit. That is, the two control units in the control system may be deployed in an independent power domain, and the computing units and storage units in other power domains may be uniformly managed and controlled.
  • the second power domain may further include: a second computing unit 10 and/or a second storage unit 11.
  • the second power domain shown in FIG5 and FIG6 includes a second computing unit 10 and a second storage unit 11.
  • the second power supply unit 03 i.e., the first controlled unit 03
  • the second power domain may also be used to supply power to the second computing unit 10 and/or the second storage unit 11.
  • the second power supply unit 03 when the first enable signal output by the first isolation unit 02 is at a valid level, the second power supply unit 03 is powered on, and supplies power to other functional units in the second power domain (such as the second computing unit 10 and the second storage unit 11), so that each functional unit in the second power domain can be in a working state.
  • the second power supply unit 03 When the first enable signal output by the first isolation unit 02 is at an invalid level, the second power supply unit 03 is powered off, and each functional unit in the second power domain is also powered off.
  • the first power domain may also include other functional units.
  • each functional unit in the first power domain may be powered by the first power supply unit 06
  • each functional unit in the second power domain may be powered by the second power supply unit 03
  • each functional unit in the third power domain may be powered by the third power supply unit 07.
  • each storage unit in the control system can be used to store data
  • each computing unit can be used to process the data stored in the storage unit.
  • the control system is an autonomous driving module in a vehicle
  • the storage unit can be used to store data collected by the on-board sensor assembly
  • the computing unit can be used to process the data collected by the on-board sensor assembly based on the stored autonomous driving examples.
  • Each power supply unit in the control system is used to provide DC voltage to each functional unit in the power domain to which it belongs, and therefore can also be called a DC power supply.
  • the functions of multiple power domains in the control system can be the same and can back up each other. Based on this, when any power domain loses power, or the storage unit and/or computing unit in any power domain fails, the storage units and computing units in other power domains can continue to work normally. As a result, the reliability of the control system is effectively improved.
  • the functions of multiple power domains in the control system may be different.
  • at least one power domain may be a main power domain, and the storage unit and computing unit in the main power domain may implement the main functions of the control system.
  • Other power domains may be auxiliary power domains, and the storage unit and computing unit in the auxiliary power domain may implement the auxiliary functions of the control system.
  • the control system is an automatic driving module in a vehicle
  • the computing unit and storage unit in the main power domain may implement the main automatic driving function
  • the computing unit and storage unit in the auxiliary power domain may implement auxiliary functions such as pull-over parking and lane parking.
  • the first control unit 01 may belong to the main power domain (e.g., the first power domain shown in FIG5 ).
  • the first isolation unit 02 may implement fault isolation between the main power domain and the auxiliary power domain (e.g., the second power domain shown in FIG5 ).
  • the auxiliary power domain may still implement auxiliary functions of the control system (e.g., the function of pulling over to the side of the road may be implemented) to avoid the control system being completely out of control and causing safety hazards.
  • the second control unit 04 can control the first switch 021 in the first isolation unit 02 to turn off, so as to power off the subsidiary power domain.
  • the second control unit 04 can also control the power supply units in other power domains to power off, so as to power off the control system.
  • FIG 7 is a schematic diagram of the structure of a second power supply unit provided in an embodiment of the present application.
  • the second power supply unit 03 may include a first voltage conversion unit 031 and a second voltage conversion unit 032.
  • the first voltage conversion unit 031 can be connected to a battery assembly, and can convert the voltage of the battery assembly and output it
  • the second voltage conversion unit 032 can convert the voltage output by the first voltage conversion unit 031 and output it.
  • the two voltage conversion units can provide different driving voltages for the functional units in the second power domain. For example, assuming that the driving voltage required by the second computing unit 10 in the second power domain is different from the driving voltage required by the second storage unit 11, the second computing unit 10 and the second storage unit 11 can be driven by different voltage conversion units in the second power supply unit 03.
  • the control system may further include: a second isolation unit 12.
  • the first isolation unit 02 is used to output a first control signal C1 (i.e., a first enable signal) to the first voltage conversion unit 031 in the second power supply unit 03, and the first enable signal may be used to control the first voltage conversion unit 031 to power on or off.
  • a first control signal C1 i.e., a first enable signal
  • the first control unit 01 can also be connected to the second isolation unit 12, and is used to output a fourth level signal S4 to the second isolation unit 12.
  • the second isolation unit 12 has an input end and an output end.
  • the second isolation unit 12 is used to receive the fourth level signal S4 through its input end, and under the action of the fourth level signal S4, output a second control signal (also referred to as a second enable signal) to the second voltage conversion unit 032 through its output end.
  • the second enable signal can be used to control the second voltage conversion unit 032 to be powered on or off.
  • the second enable signal output by the second isolation unit 12 may be an effective level. Accordingly, the second voltage conversion unit 032 is in a power-on state. If the fourth level signal S4 is an effective level, the second enable signal output by the second isolation unit 12 may be an invalid level. Accordingly, the second voltage conversion unit 032 is in a power-off state.
  • the effective level of the fourth level signal S4 may be a high level relative to the invalid level.
  • the input end of the second isolation unit 12 will remain at an invalid level.
  • the second isolation unit 12 can continue to output the second enable signal of the valid level to the second voltage conversion unit 032, so that the second voltage conversion unit 032 continues to remain in the powered-on state. In this way, it is possible to avoid the influence of the failure or abnormal power-off of the first control unit 01 on the powered-on state of the second voltage conversion unit 032, that is, the fault isolation between the first control unit 01 and the second voltage conversion unit 032 can be achieved.
  • the first control unit 01 can output a first control signal C1 of a valid level after power-on, and output a fourth level signal S4 of a valid level.
  • the second isolation unit 12 can output a second enable signal of an invalid level under the effect of the fourth level signal S4 of a valid level, so that the second voltage conversion unit 032 remains in a power-off state.
  • the first isolation unit 02 can output a first enable signal of a valid level to the first voltage conversion unit 031 under the effect of the first control signal C1 of a valid level, so as to drive the first voltage conversion unit 031 to power on.
  • the first control unit 01 can also perform power monitoring on the first voltage conversion unit 031, and after monitoring that the first voltage conversion unit 031 is powered on (power good), it can output an invalid level fourth level signal S4 to the second isolation unit 12.
  • the second isolation unit 12 can then output a valid level second enable signal under the action of the invalid level fourth level signal S4 to drive the second voltage conversion unit 032 to power on.
  • the second isolation unit 12 may include: a second switch 121, the second switch 121 having a first end, a second end and a third end.
  • the first end of the second switch 121 is used as an input end of the second isolation unit 12 to receive a fourth level signal S4, and the fourth level signal S4 is used to control the on-off state of the second end and the third end of the second switch 121.
  • the second end of the second switch 121 is used as an output end of the second isolation unit 12 to be connected to the power supply end and the input end of the second voltage conversion unit 032 respectively, and the third end of the second switch 121 is connected to the ground end.
  • the power supply end can be the output end of the first voltage conversion unit 031.
  • the fourth level signal S4 is at a valid level
  • the second end of the second switch 121 is connected to the third end.
  • the second voltage conversion unit 032 is in a power-off state.
  • the fourth level signal S4 is at an invalid level
  • the second end of the second switch 121 is disconnected from the third end.
  • the second voltage conversion unit 032 can remain in a power-on state under the drive of the power supply end.
  • the fourth level signal S4 received by the first end of the second switch 121 can remain at an invalid level. Accordingly, the second end and the third end of the second switch 121 can remain in a turned-off state, thereby ensuring that the second voltage conversion unit 032 can remain powered on under the drive of the power supply end.
  • the second switch 121 may include a field effect transistor, and the field effect transistor may be an NMOS.
  • the gate of the field effect transistor may serve as the first end (i.e., the control end) of the second switch 121, for receiving the fourth level signal S4.
  • the drain of the field effect transistor may serve as the second end of the second switch 121, and may be connected to the power supply end and the input end of the second voltage conversion unit 032, respectively.
  • the source of the field effect transistor may serve as the third end of the second switch 121 and be connected to the ground end.
  • the second switch 121 may include a transistor, and the transistor may be an NPN transistor.
  • the base of the transistor may serve as the first end of the second switch 121, for receiving the fourth level signal S4.
  • the collector of the transistor may serve as the second end of the second switch 121, and may be connected to the power supply end and the input end of the second voltage conversion unit 032, respectively.
  • the emitter of the transistor may serve as the third end of the second switch 121, and may be connected to the ground end.
  • the field effect transistor in the second switch 121 may also be a PMOS, and the transistor in the second switch 121 may also be a PNP transistor, which is not limited in the embodiment of the present application.
  • the second isolation unit 12 may further include a first resistor R1 and a second resistor R2.
  • One end of the first resistor R1 is connected to the first end of the second switch 121, and the other end of the first resistor R1 is connected to the ground end.
  • the first resistor R1 is used to stabilize the level of the first end of the second switch 121.
  • the second resistor R2 is connected in series between the power supply end and the second end of the second switch 121, that is, the second end of the second switch 121 is connected to the power supply end through the second resistor R2.
  • the second resistor R2 is a pull-up resistor, which is used to pull up the level of the second end of the second switch 121.
  • the second isolation unit 12 may further include a third resistor R3, which is connected in series between the output end of the first control unit 01 and the first end of the second switch 121.
  • the third resistor R3 may be used to control the current at the first end of the second switch 121, for example, to control the base current of the transistor.
  • the third resistor R3 and the first resistor R1 may also form a voltage divider circuit to adjust the level of the first end of the second switch 121.
  • connection mode of the field effect transistor in the second isolation unit 12 shown in FIG4 can also be called an open drain (OD) output structure
  • the connection mode of the transistor in the second isolation unit 12 shown in FIG8 can also be called an open collector (OC) output structure. Based on the OD output structure or the OC output structure, fault isolation of the first control unit 01 can be achieved.
  • the second power supply unit 03 includes two voltage conversion units. It is understandable that the number of voltage conversion units included in the second power supply unit 03 can also be greater than 2. As shown in Figure 8, the second power supply unit 03 can include n cascaded voltage conversion units, where n is an integer greater than 1.
  • the first voltage conversion unit (i.e., the first voltage conversion unit 031) of the n voltage conversion units can be connected to a battery assembly and can convert the voltage provided by the battery assembly and output it.
  • Each of the 2nd to nth voltage conversion units can be used to convert and output the voltage output by the previous level or several levels of voltage conversion units.
  • the control system may include a plurality of second isolation units 12 corresponding to the second to nth voltage conversion units, each second isolation unit 12 being connected to a corresponding voltage conversion unit and configured to output a second enable signal to a corresponding voltage conversion unit under the action of the fourth level signal S4 provided by the first control unit 01. It is understandable that the power supply terminal connected to each second isolation unit 12 in FIG8 may be the output terminal of the previous level or previous levels of voltage conversion units.
  • the first control unit 01 can output a fourth level signal S4 of an invalid level to the second isolation unit 12 corresponding to the next voltage conversion unit, so that the next voltage conversion unit is powered on.
  • the n cascaded voltage conversion units in the second power supply unit 03 can be powered on in sequence.
  • the second level signal S2 may be output by any voltage conversion unit among the n voltage conversion units after power-on is completed.
  • the control system may have a plurality of different working modes.
  • the first control unit 01 may be used to output a first level signal S1 and a fourth level signal S4 according to the working mode of the control system.
  • the working mode of the control system may include a normal working mode, a sleep mode, and a shallow sleep mode.
  • the first control unit 01 can control the power-on of different voltage conversion units in the second power supply unit 03 when the control system is in different working modes, thereby effectively reducing the power consumption of the control system without affecting the performance of the control system.
  • the first control unit 01 can output a first level signal S1 of a valid level, and can output a fourth level signal S4 of an invalid level after detecting that the first voltage conversion unit 031 has been powered on.
  • each voltage conversion unit in the second power supply unit 03 can be powered on normally, and then each functional unit (such as the second computing unit 10 and the second storage unit 11) in the second power domain to which the second power supply unit 03 belongs can work normally.
  • the first level signal S1 output by the first control unit 01 may be an invalid level, thereby keeping the first voltage conversion unit 031 in the second power supply unit 03 in a power-off state. Since the first voltage conversion unit 031 is in a power-off state, the other voltage conversion units in the second power supply unit 03 also remain in a power-off state. At this time, all functional units in the second power domain to which the second power supply unit 03 belongs are in a power-off state.
  • the first level signal S1 output by the first control unit 01 may be a valid level
  • the fourth level signal S4 may be a valid level.
  • the first voltage conversion unit 031 in the second power supply unit 03 may be kept in a powered-on state
  • the second voltage conversion unit 032 in the second power supply unit 03 may be kept in a powered-off state.
  • the functional unit driven by the first voltage conversion unit 031 for example, the second storage unit 11
  • the functional unit driven by the second voltage conversion unit 032 for example, the second computing unit 10) may be in a powered-off state.
  • the first control unit 01 can control some of the multiple voltage conversion units to be powered on and control other voltage conversion units to be powered off according to the requirements of the application scenario. In this way, only some functional units in the second power domain to which the second power supply unit 03 belongs can be in a working state.
  • each power domain of the control system can be in a powered-on state.
  • the first power supply unit 06, the second power supply unit 03 and the third power supply unit 07 are all in a powered-on state, and accordingly, each functional unit in the first power domain, the second power domain and the third power domain is in a normal working state.
  • the third power domain to which the second control unit 04 belongs may also include a wake-up unit 13.
  • the wake-up unit 13 may be a controller area network (CAN) wake-up module.
  • CAN controller area network
  • the wake-up unit 13, the first control unit 01, and the storage units in each power domain may all be in a powered-on state, and other functional units may all be in a powered-off state. Accordingly, in the shallow sleep mode, the voltage conversion unit in the third power supply unit 07 for driving the wake-up unit 13 may be controlled to be powered on, the voltage conversion unit in the first power supply unit 06 for driving the first control unit 01 may be controlled to be powered on, and the voltage conversion units in each power supply unit for driving the storage units may be controlled to be powered on.
  • the first controlled unit 03 is the second power supply unit in the second power domain.
  • the first controlled unit 03 may also be a computing unit, and the first control signal C1 may be a reset signal for controlling the resetting of the computing unit.
  • the computing unit and the first control unit 01 may belong to the same power domain or different power domains.
  • the first controlled unit 03 may be the first computing unit 08 belonging to the first power domain together with the first control unit 01.
  • the first controlled unit 03 may also be the second computing unit 10 in the second power domain.
  • control system may further include: a third isolation unit 14 and a second controlled unit 15.
  • the first control unit 01 may also be connected to the third isolation unit 14 and configured to output a fifth level signal S5 to the third isolation unit 14.
  • the third isolation unit 14 has a first input terminal, a second input terminal and an output terminal.
  • the third isolation unit 14 is used to receive the fifth level signal S5 and the sixth level signal S6 through its first input terminal and the second input terminal respectively, and output the third control signal C3 to the second controlled unit 15 through its output terminal.
  • the second controlled unit 15 is used for outputting the sixth level signal S6 to the second input end of the third isolation unit 14 under the action of the third control signal C3.
  • the structure and working principle of the third isolation unit 14 can be the same as those of the first isolation unit 02, and will not be described in detail here.
  • the second control unit 04 can also be connected to the third isolation unit 14, and can output the seventh level signal S7 to the logic operation circuit in the third isolation unit 14, and output the switch signal SW1 to the first switch in the third isolation unit 14.
  • the switch signal SW1 can control the on-off state of the first end and the second end of the first switch in the third isolation unit 14.
  • the second controlled unit 15 and the first controlled unit 03 may belong to different power domains.
  • the first controlled unit 03 i.e., the second power supply unit 03
  • the second controlled unit 15 belongs to the third power domain.
  • the two controlled units may also belong to the same power domain, which is not limited in the embodiments of the present application.
  • the second controlled unit 15 may be a power supply unit in a third power domain, and the third power domain may further include a third computing unit 16 and/or a third storage unit 17.
  • the second controlled unit 15 may be used to supply power to the third computing unit 16 and/or the third storage unit 17.
  • control system may further include at least one fourth isolation unit, each of which is used to implement fault isolation between the first control unit 01 and a voltage conversion unit.
  • the structure and working principle of the fourth isolation unit may be the same as those of the second isolation unit 12 described above, and will not be described in detail here.
  • the number of controlled units included in the control system can also be greater than 2.
  • a corresponding isolation unit is configured in the control system to achieve fault isolation of the first control unit 01.
  • the structure and working principle of the isolation unit corresponding to each controlled unit can refer to the first isolation unit 02, and the embodiments of the present application will not be repeated here.
  • FIG9 is a schematic diagram of the structure of another control system provided in an embodiment of the present application.
  • each unit in the control system can be integrated on a single board, for example, on a printed circuit board (PCB). That is, the control system provided in an embodiment of the present application can be a single board.
  • PCB printed circuit board
  • each power supply unit in the control system may include a buck boost circuit.
  • the voltage conversion unit described above may include the buck boost circuit.
  • each power supply unit may also include a combining chip for combining voltages provided by multiple batteries in the battery assembly, and a slow start chip for implementing a slow start.
  • the communication unit 05 in the third power domain to which the second control unit 04 belongs may be a network switching chip
  • the second control unit 04 may be a microprocessor
  • the wake-up unit 13 may be a CAN chip.
  • the first control unit 01 may be a CPLD.
  • the computing units in each power domain e.g., the first computing unit 08 and the second computing unit 10) may all be system-on-chip (SOC), and the storage units (e.g., the first storage unit 09 and the second storage unit 11) may all include double data rate synchronous dynamic random access memory (DDR SDRAM), and embedded multi-media card (EMMC), etc.
  • DDR SDRAM double data rate synchronous dynamic random access memory
  • EMMC embedded multi-media card
  • the first power domain and the second power domain may also include a CAN chip.
  • the first power domain may also include a video adder/deserializer.
  • an embodiment of the present application provides a control system, in which a first isolation unit can receive a first level signal output by a first control unit and a second level signal output by a first controlled unit, and can output a first control signal to the first controlled unit.
  • the first controlled unit can output a second level signal to the first isolation unit under the action of the first control signal. Based on this, even if the first control unit fails, the first isolation unit can continue to output the first control signal to the first controlled unit based on the second level signal output by the first controlled unit.
  • the isolation of the failure of the first control unit is achieved, that is, the decoupling of the first control unit and the first controlled unit is achieved, thereby effectively improving the reliability of the control system.
  • the embodiment of the present application further provides a control device.
  • the control device includes a control unit 21 and an isolation unit 22.
  • the control unit 21 is connected to the isolation unit 22 and is used to output a first level signal S1 to the isolation unit 22.
  • the isolation unit 22 has a first input terminal, a second input terminal and an output terminal.
  • the isolation unit 22 is used to receive a first level signal S1 through its first input terminal, receive a second level signal S2 output by a controlled unit (not shown in FIG. 10 ) through its second input terminal, and output a first control signal C1 to the controlled unit through the output terminal.
  • the first control signal C1 is used to control the controlled unit to output the second level signal S2.
  • control unit 21 can refer to the relevant description of the first control unit 01 in the previous text
  • structure and working principle of the isolation unit 22 can refer to the relevant description of the first isolation unit 02 in the previous text, and the embodiments of this application will not repeat them again.
  • the first isolation unit 02 and the first control unit 01 can be independent of each other. That is, the first isolation unit 02 can be a discrete device.
  • the second isolation unit 12 and the third isolation unit 14 in the control system can also be discrete devices.
  • the isolation unit 22 and the control unit 21 can be integrated, for example, both can be integrated in a CPLD.
  • FIG11 is a schematic diagram of the structure of another control device provided in an embodiment of the present application.
  • the control device includes a first control unit 31, a second control unit 32 and a latch unit 33.
  • the first control unit 31 is connected to the latch unit 33 and is used to output a first level signal X1 to the latch unit 33.
  • the second control unit 32 is also connected to the latch unit 33 and is used to output a second level signal X2 to the latch unit 33.
  • the latch unit 33 has a first input terminal, a second input terminal and an output terminal.
  • the latch unit 33 is used to receive the first level signal X1 and the second level signal X2 through its first input terminal and the second input terminal respectively, and under the action of the first level signal X1, the second level signal X2 is sampled and latched, and the latched signal is output to the controlled unit (not shown in Figure 11) through its output terminal.
  • the first level signal X1 output by the first control unit 31 may include at least one target jump edge.
  • the target jump edge may be a rising edge from a low level to a high level, or a falling edge from a high level to a low level.
  • the level of the second level signal X2 output by the second control unit 32 may be a valid level.
  • the latch unit 33 can sample and latch the level of the second level signal X2 when the first level signal X1 has a target jump edge, and output the latched second level signal X2. Since the first level signal X1 output by the first control unit 31 will not have a target jump edge when the first control unit 31 fails or is abnormally powered off, the first level signal X1 will not trigger the latch unit 33 to adjust the level of the signal it outputs, and the controlled unit can continue to maintain the previous working state. That is, the latch unit 33 can prevent the failure of the first control unit 31 from affecting the working state of the controlled unit, and achieves the isolation of the failure of the first control unit 31.
  • the first level signal X1 can continue to remain at a low level. If the target jump edge is a rising edge that jumps from a low level to a high level, then when the first control unit 31 fails or is abnormally powered off, the first level signal X1 can first jump from a high level to a low level (i.e., a falling edge appears in the first level signal X1), and then continue to remain at the low level. Among them, the low-level first level signal X1 and the falling edge in the first level signal X1 will not trigger the latch unit 33 to adjust the level of the signal it outputs, that is, the latch unit 33 will not respond to the low level and the falling edge.
  • the controlled unit can maintain the target working state under the effect of the valid level, for example, the controlled unit can maintain the power-on state or the reset state. If the signal output by the latch unit 33 is an invalid level, the controlled unit can exit the target working state, for example, the controlled unit can be in the power-off state.
  • the latch unit 33 may include an edge trigger 331.
  • the edge trigger 331 may sample and latch the level (valid level) of the second level signal X2 when the first level signal X1 has a target jump edge, and output the latched signal.
  • the edge trigger 331 may be a D trigger, an edge JK trigger, or a complementary metal oxide semiconductor (CMOS) edge trigger, etc.
  • CMOS complementary metal oxide semiconductor
  • the latch unit 33 can also have a power supply end, and the second control unit 32 is also connected to the power supply end of the latch unit 33, and is used to output a power control signal X0 (also called an enable signal) to the latch unit 33 to control the power on and off states of the latch unit 33.
  • a power control signal X0 also called an enable signal
  • the second control unit 32 can output a power control signal X0 of an effective level to the latch unit 33 to control the latch unit 33 to power on, and output a second level signal X2 of an effective level to the latch unit 33.
  • the first control unit 31 can output a first level signal X1 with a target jump edge (e.g., a rising edge) to the latch unit 33.
  • the latch unit 33 can then output a signal of an effective level to keep the controlled unit in the target working state.
  • the latch unit 33 can continue to output a signal of an effective level, and the controlled unit can then continue to maintain the target working state.
  • the second control unit 32 can output a power control signal X0 of an invalid level to the latch unit 33 to control the latch unit 33 to power off.
  • the latch unit 33 can no longer output a signal of an effective level, and the controlled unit can then exit the target working state, for example, the controlled unit can be powered off.
  • the structures and working principles of the first control unit 31, the second control unit 32 and the controlled unit can all refer to the relevant descriptions in the aforementioned embodiments, and will not be repeated here.
  • the control device may also include an isolation unit, which can achieve fault isolation between the first control unit 31 and the voltage conversion unit.
  • the structure and working principle of the isolation unit can refer to the relevant description of the second isolation unit 12 in the aforementioned embodiment, and will not be repeated here.
  • control device may include a plurality of controlled units.
  • control device is configured with a corresponding latch unit 33 to isolate the fault of the first control unit 31 .
  • the latch unit 33 of the control device can be set independently of the first control unit 31 and the second control unit 32, that is, the latch unit 33 can be a discrete device.
  • the latch unit 33 can also be integrated with the first control unit 31, for example, the two can be integrated into a CPLD.
  • the above control unit (for example, the first control unit 31) and the controlled unit may belong to different domains (or subsystems), for example, the first domain (or subsystem) and the second domain (or subsystem), wherein the second domain is used to perform redundant backup for part or all of the functions of the first domain to improve the reliability of the product.
  • the control unit controls both the functions in the first domain and the backup functions in the second domain.
  • the controlled unit is a functional unit, such as a computing unit, a processing unit, etc.; or the control unit controls the power-on of the functions in the first domain and the power-on of the backup functions in the second domain.
  • the controlled unit is a power supply unit. In this way, when the domain (for example, the first domain) where the control unit is located fails, a control system including the above isolation unit is used to isolate the impact on the second domain, so that the second domain works normally, thereby improving the stability of the redundant system.
  • the embodiment of the present application provides a control device, in which a latch unit can sample and latch a second level signal output by a second control unit under the action of a first level signal output by a first control unit, and can output the latched signal to a controlled unit. Based on this, even if the first control unit fails, the latch unit can continue to output the latched signal to the first controlled unit. Thus, the fault of the first control unit is isolated, and the reliability of the control device is effectively improved.
  • the embodiment of the present application further provides a control system, which may include the control device provided in the above embodiment and a controlled unit.
  • the structure of the control device may be as shown in FIG10 or FIG11.
  • the embodiment of the present application also provides a central computing platform, which includes: a control system as provided in the above embodiment, and at least one interface.
  • the at least one interface may include one or more of a power interface, an Ethernet interface, and a sensor interface.
  • the central computing platform may be an intelligent central computing module (ICCM), and the central computing platform may be a box-type device.
  • ICCM intelligent central computing module
  • the central computing platform may be, for example, a high-performance central computer platform (HCCP). As shown in FIG12 , the central computing platform 100 may include: an intelligent central computing module 101 and an intelligent enhanced entertainment model (IEEM) 102.
  • HCCP high-performance central computer platform
  • IEEM intelligent enhanced entertainment model
  • the intelligent enhanced entertainment module 102 may also be a box-type device.
  • the intelligent central computing module 101 and the intelligent enhanced entertainment module 102 may be integrated into a box-type device.
  • the embodiment of the present application also provides an autonomous driving system, as shown in FIG13 , the autonomous driving system 1000 may include: the central computing platform 100 provided in the above embodiment, the vehicle-mounted sensor component 200 and the vehicle-mounted actuator component 300. Among them, the central computing platform 100 is used to process the data collected by the vehicle-mounted sensor component 200, and control the vehicle-mounted actuator component 300 to perform the autonomous driving operation.
  • the autonomous driving system 1000 can realize any level of autonomous driving function from level 2 (L2) to level 5 (L5).
  • the vehicle-mounted sensor assembly 200 may include at least one of the following sensors: a camera, a laser radar, a millimeter-wave radar, an ultrasonic radar, etc.
  • the vehicle-mounted actuator assembly 300 may include at least one of the following devices: an accelerator pedal, a brake pedal, a steering system, a motor, a valve, a switch, a relay, etc.
  • the autonomous driving system is generally implemented in a multi-control domain (also called a power domain).
  • the control domains in the autonomous driving system are independent of each other. When any control domain fails or loses power, it will not affect the normal operation of other control domains.
  • each control domain can include a power supply unit, a storage unit, a computing unit, a control unit, and a processing unit.
  • the above-mentioned multi-control domain implementation method has high reliability, it has a complex structure, a large size, and a high cost.
  • the control system of the autonomous driving system can realize the control of at least two domains through a control unit, such as a first control unit 01, so as to save costs and not affect the reliability of the product.
  • a control unit such as a first control unit 01
  • the first control unit 01 and/or the second control unit 04 can uniformly control the controlled units in multiple power domains, that is, each power domain can share a first control unit 01 and/or a second control unit 04. In this way, the deployment of the control unit can be reduced, and the size, structural complexity and cost of the control system can be effectively reduced.
  • control system provided in the embodiment of the present application also includes an isolation unit or a latch unit, the failure of the first control unit can be isolated from the controlled unit, thereby effectively ensuring the reliability of the control system during operation.
  • the embodiment of the present application also provides a vehicle, which may include the control system provided by the above embodiment, for example, it may include an automatic driving system 1000 such as shown in Figure 13.
  • the vehicle may include road vehicles, water vehicles, air vehicles, industrial equipment, agricultural equipment or entertainment equipment, etc.
  • the vehicle may be a vehicle, which is a vehicle in a broad sense, and may be a vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), agricultural equipment (such as a lawn mower, a harvester, etc.), amusement equipment or a toy vehicle, etc.
  • the embodiment of the present application does not specifically limit the type of vehicle.
  • the vehicle may be a vehicle such as an airplane or a ship.
  • the vehicle may further include a battery assembly 2000 , and the battery assembly 2000 is used to supply power to a power supply unit in the control system.
  • the battery assembly 2000 may include multiple batteries, for example, FIG. 5 and FIG. 6 show two batteries, namely, battery 1 and battery 2.
  • the multiple batteries may be used to supply power to each power supply unit in the control system. By providing multiple batteries, it can be ensured that after any battery fails, other batteries can continue to supply power to the control system, thereby effectively improving reliability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Radar, Positioning & Navigation (AREA)
  • Automation & Control Theory (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Safety Devices In Control Systems (AREA)

Abstract

一种控制装置、控制系统及运载工具，属于电子技术领域。该控制系统中的第一隔离单元能够接收第一控制单元输出的第一电平信号和第一被控单元输出的第二电平信号，并能够向第一被控单元输出第一控制信号。该第一被控单元能够在第一控制信号的作用下，向第一隔离单元输出第二电平信号。基于此，即使第一控制单元故障，该第一隔离单元也能基于该第一被控单元输出的第二电平信号，继续向第一被控单元输出第一控制信号。由此，实现了对第一控制单元的故障的隔离，有效提高了该控制系统的可靠性。

Description

控制装置、控制系统及运载工具 技术领域
本申请涉及电子技术领域，特别涉及一种控制装置、控制系统及运载工具。
背景技术
在电子技术领域，板级设计通常具有计算单元、管理单元、供电单元等模块，而单板的时序管理、诊断检测等则由控制单元(或管理单元)统一处理，当控制单元异常时，会导致产品功能损失，因此需要提高产品的可靠性。
发明内容
本申请提供了一种控制装置，控制系统及运载工具，以提高产品的可靠性。
第一方面，提供了一种控制系统，包括：第一控制单元、第一隔离单元和第一被控单元。其中，第一控制单元与第一隔离单元连接，用于向该第一隔离单元输出第一电平信号。该第一隔离单元具有第一输入端、第二输入端和输出端，该第一隔离单元用于通过其第一输入端和第二输入端分别接收第一电平信号和第二电平信号，并通过其输出端向第一被控单元输出第一控制信号。该第一被控单元用于在第一控制信号的作用下向第一隔离单元的第二输入端输出第二电平信号。
在本申请提供的方案中，即使第一控制单元故障，该第一隔离单元也能够基于第一被控单元输出的第二电平信号，继续向第一被控单元输出第一控制信号，以实现对第一被控单元的控制。由此，实现了对第一控制单元的故障的隔离，有效提高了该控制系统的可靠性。
可选地，该第一隔离单元可以包括：第一开关和逻辑运算电路，该第一开关具有第一端和第二端，该逻辑运算电路具有第一输入端、第二输入端和输出端。其中，逻辑运算电路的第一输入端作为第一隔离单元的第一输入端，用于接收第一电平信号作为第一输入信号。第一开关的第一端作为第一隔离单元的第二输入端，用于接收该第二电平信号，该第一开关的第二端与逻辑运算电路的第二输入端连接，并用于在第一开关导通时，向逻辑运算电路的第二输入端输出第二输入信号。该逻辑运算电路用于对第一输入信号和第二输入信号进行逻辑运算，并通过输出端输出第一控制信号。
其中，在该第一输入信号和第二输入信号中的任一输入信号为有效电平时，该逻辑运算电路输出的第一控制信号的电平可以为有效电平。在该第一输入信号和第二输入信号均为无效电平时，该逻辑运算电路输出的第一控制信号的电平可以为无效电平。
可选地，该第一控制信号的有效电平相对于无效电平可以为高电平，该第一输入信号和第二输入信号的有效电平相对于无效电平也可以为高电平。相应的，该逻辑运算电路可以用于对该第一输入信号和第二输入信号执行或运算。
基于或运算的运算逻辑可知，当第一输入信号和第二输入信号中的任一输入信号为高电平时，逻辑运算电路输出的第一控制信号为高电平；当第一输入信号和第二输入信号均为低电平时，该逻辑运算电路输出的第一控制信号为低电平。
可选地，该逻辑运算电路可以为或门。采用或门作为逻辑运算电路，可以有效降低该控制系统的结构复杂度和成本。
可选地，该第一控制信号的有效电平相对于无效电平可以为低电平，该第一输入信号和第二输入信号的有效电平相对于无效电平可以为高电平。相应的，该逻辑运算电路可以用于对该第一输入信号和第二输入信号依次执行或运算和非运算。
基于此，当第一输入信号和第二输入信号中的任一输入信号为高电平时，该逻辑运算电路输出的第一控制信号为低电平；当第一输入信号和第二输入信号均为低电平时，该逻辑运算电路输出的第一控制信号为高电平。
可选地，该逻辑运算电路可以包括或门和非门。其中，该或门的两个输入端分别为该逻辑运算电路的第一输入端和第二输入端，该或门的输出端与非门的输入端连接，该非门的输出端为该逻辑运算电路的输出端。
可选地，该第一开关可以包括：三极管或场效应晶体管。采用三极管或场效应晶体管作为第一开关，可以有效简化控制系统的结构复杂度，并降低该控制系统的成本。
可选地，该控制系统还可以包括：第二控制单元。该逻辑运算电路还具有第三输入端，该第二控制单元的输出端与该第三输入端连接，并用于向该逻辑运算电路输出第三电平信号作为逻辑运算电路的第三输入信号。
由于第二控制单元能够向逻辑运算电路输出第三电平信号，因此逻辑运算电路还可以在该第三电平信号的作用下，向第一被控单元输出第一控制信号。由此，有效提高了对第一被控单元进行控制时的灵活性。例如，第二控制单元可以在第一控制单元故障后，输出有效电平的第三电平信号，以使逻辑运算电路向第一被控单元输出有效电平的第一控制信号。由此，可以便于运维人员或研发人员对控制系统中的故障进行定位。
可选地，该控制系统还可以包括：第二控制单元。第一开关还具有第三端，该第二控制单元的输出端可以与第一开关的第三端连接，并用于控制该第一开关的第一端与第二端的通断状态。
当第二控制单元控制第一开关的第一端与第二端关断后，第一开关无法基于第一被控单元输出的第二电平信号向逻辑运算电路输出第二输入信号。相应的，逻辑运算电路不会再基于该第二输入信号输出第一控制信号，由此可以实现对第一被控单元的状态解锁。
可选地，该控制系统还可以包括：通信单元。该通信单元与第二控制单元的输入端连接，并用于向该第二控制单元输出故障检测指令。
其中，该通信单元可以包括有线连接器，和/或，无线通信模组。第二控制单元可以基于该故障检测指令，控制第一开关的第一端与第二端关断，并向逻辑运算电路输出有效电平的第三电平信号。
可选地，该控制系统可以包括第一域和第二域，其中，第二域用于为第一域的部分或全部功能进行冗余备份，该第一控制单元属于第一域，该第一被控单元属于第二域。
可选地，该控制系统可以包括第一电源域和第二电源域，第一控制单元属于第一电源域，该第一被控单元为第二电源域的供电单元，第一控制信号用于控制该第二电源域的供电单元上电或下电。其中，该第一控制单元可以由该第一电源域的供电单元供电。
可选地，第一电源域还可以包括第二控制单元、第一计算单元以及第一存储单元中的一项或多项，该第一电源域的供电单元还用于为该第二控制单元、第一计算单元以及第一存储单元中的一项或多项供电。
例如，第一电源域还可以包括第二控制单元、第一计算单元和第一存储单元，即第一控制单元和第二控制单元均属于第一电源域。
可选地，该控制系统还可以包括第三电源域，该第二控制单元可以属于该第三电源域，并由该第三电源域的供电单元供电。可以理解的是，当任一电源域中的供电单元故障时，该故障的供电单元将无法为该电源域中的其他功能单元供电，进而会导致其他功能单元均异常下电。由于该第一控制单元和第二控制单元属于两个不同的电源域，因此可以有效避免某个电源域中的供电单元故障而导致该两个控制单元同时异常下电的情况。
可选地，该控制系统还可以包括：第二计算单元和/或第二存储单元。该第二电源域的供电单元用于为该第二计算单元和/或第二存储单元供电。
其中，当第一控制信号为无效电平时，第二电源域的供电单元保持下电状态，第二电源域中的第二计算单元和/或第二存储单元也均保持下电状态。当第一控制信号为有效电平时，第二电源域的供电单元能够在该第一控制信号的控制下上电，并为第二计算单元和/或第二存储单元供电，该第二计算单元和/或第二存储单元进而能保持上电状态。
可选地，该第二电源域的供电单元可以包括：第一电压转换单元和第二电压转换单元。该控制系统还可以包括：第二隔离单元。该第一隔离单元用于向该第一电压转换单元输出第一控制信号；该第一控制单元还与第二隔离单元连接，并用于向该第二隔离单元输出第四电平信号。该第二隔离单元具有输入端和输出端，该第二隔离单元用于通过其输入端接收该第四电平信号，并在该第四电平信号作用下通过其输出端向第二电压转换单元输出第二控制信号。该第二控制信号用于控制该第二电压转换单元上电或下电。
其中，当第四电平信号为有效电平时，第二隔离单元输出的第二控制信号可以为无效电平，第二电压转换单元可以保持下电状态。当第四电平信号为无效电平时，第二隔离单元输出的第二控制信号可以为有效电平，第二电压转换单元能够在该有效电平的第二控制信号的驱动下上电。由于当第一控制单元故障或异常下电时，其输出的第四电平信号为无效电平，因此可以使第二隔离单元持续输出有效电平的第二控制信号，进而使该第二电压转换单元保持上电状态。由此，可以避免第一控制单元的故障对第二电压转换单元的上电状态造成影响。
可选地，该第一控制单元可以用于根据控制系统的工作模式，输出该第一电平信号和第四电平信号。
可以理解的是，通过控制第一电平信号和第四电平信号的电平高低，可以实现对第一电压转换单元和第二电压转换单元的上下电状态的控制。由此，第一控制单元可以在控制系统处于不同的工作模式时，控制第三供电单元中不同的电压转换单元上电，由此可以在不影响控制系统的性能的前提下，有效降低该控制系统的功耗。
可选地，该第二隔离单元可以包括：第二开关，该第二开关具有第一端、第二端和第三端。其中，该第二开关的第一端作为第二隔离单元的输入端，用于接收第四电平信号；该第二开关的第二端作为第二隔离单元的输出端分别与电源端和第二电压转换单元的输入端连接；该第二开关的第三端与接地端连接。
其中，该第四电平信号可以用于控制第二开关的第二端与第三端的通断状态。并且，当第四电平信号为有效电平时，第二开关的第二端与第三端导通。此时，由于电源端和第二电压转换单元的输入端均与接地端连通，因此该第二电压转换单元保持下电状态。当第四电平信号为无效电平时，第二开关的第二端与第三端关断。此时，由于第二电压转换单元的输入端与电源端连接，因此该第二电压转换单元能够在电源端的驱动下保持上电状态。
可选地，该第二开关的第一端可以通过第一电阻接地，且该第二开关的第二端可以通过第二电阻与电源端连接。
可选地，该第二开关可以包括：三极管或场效应晶体管。采用三极管或场效应晶体管作为第二开关，可以有效简化控制系统的结构复杂度，并降低该控制系统的成本。
可选地，该第一被控单元为计算单元，该第一控制信号可以为用于控制该计算单元复位的复位信号。
可选地，该控制系统还可以包括：第三隔离单元和第二被控单元。其中，第一控制单元还可以与该第三隔离单元连接，并用于向该第三隔离单元输出第五电平信号。该第三隔离单元具有第一输入端、第二输入端和输出端，该第三隔离单元用于通过其第一输入端和第二输入端分别接收第五电平信号和第六电平信号，并通过其输出端向第二被控单元输出第三控制信号。该第二被控单元用于在该第三控制信号的作用下向第三隔离单元的第二输入端输出该第六电平信号。
其中，该第三隔离单元的结构和工作原理均可以参考第一隔离单元，此处不再赘述。并且，该第二被控单元可以是供电单元，也可以是计算单元等其他功能单元。
第二方面，提供了一种控制装置，包括：控制单元和隔离单元。该控制单元与隔离单元连接，用于向隔离单元输出第一电平信号。该隔离单元具有第一输入端、第二输入端和输出端，该隔离单元用于通过其第一输入端接收第一电平信号，通过其第二输入端接收被控单元输出的第二电平信号，并通过其输出端向该被控单元输出控制信号。其中，该控制信号用于控制该被控单元输出第二电平信号。
可选地，该隔离单元可以包括：开关和逻辑运算电路，该开关具有第一端和第二端，该逻辑运算电路具有第一输入端、第二输入端输出端。其中，逻辑运算电路的第一输入端作为隔离单元的第一输入端，用于接收第一电平信号作为第一输入信号。开关的第一端作为隔离单元的第二输入端，用于接收第二电平信号，开关的第二端与逻辑运算电路的第二输入端连接，用于在开关导通时，向该逻辑运算电路的第二输入端输出第二输入信号。逻辑运算电路用于对第一输入信号和第二输入信号进行逻辑运算，并通过输出端输出该控制信号。
可选地，该控制信号的有效电平相对于无效电平为高电平，该逻辑运算电路用于对该第一输入信号和第二输入信号执行或运算。或者，该控制信号的有效电平相对于无效电平为低电平，该逻辑运算电路用于对该第一输入信号和第二输入信号依次执行或运算和非运算。
可选地，该开关可以包括：三极管或场效应晶体管。
第三方面，提供了另一种控制装置，包括：第一控制单元、第二控制单元和锁存单元。其中，第一控制单元与锁存单元连接，用于向锁存单元输出第一电平信号；第二控制单元也与锁存单元连接，用于向锁存单元输出第二电平信号。该锁存单元具有第一输入端、第二输入端和输出端，该锁存单元用于通过其第一输入端和第二输入端分别接收第一电平信号和第二电平信号，在第一电平信号的作用下，对第二电平信号进行采样和锁存，并通过输出端向被控单元输出锁存的信号。
基于上述锁存单元的工作原理可知，即使第一控制单元故障，该锁存单元也能继续向第一被控单元输出锁存的信号。由此，实现了对第一控制单元的故障的隔离，有效提高了该控制装置的可靠性。
其中，该锁存单元可以在第一电平信号存在跳边沿时，对第二电平信号的电平进行采样和锁存，并输出锁存的信号。由于当第一控制单元故障或异常下电时，第一控制单元输出的第一电平信号不会存在跳边沿，因此该第一电平信号不会触发锁存单元调整其输出的信号的电平，被控单元进而可以继续保持之前的工作状态。也即是，该锁存单元可以避免第一控制 单元的故障对被控单元的工作状态造成影响，实现了对第一控制单元的故障的隔离，进而实现了被控单元的状态锁定。
可选地，该锁存单元可以包括：边沿触发器。该第一控制单元输出的第一电平信号可以包括至少一个目标跳边沿，该目标跳边沿可以是上升沿或下降沿。该第二控制单元输出的第二电平信号的电平可以为有效电平。该边沿触发器可以在检测到其第一输入端存在目标跳边沿时，对第二输入端的电平(即第二电平信号的电平)进行采样和锁存，并输出锁存的信号。
可选地，该锁存单元还可以具有电源端；该第二控制单元还与锁存单元的电源端连接，并用于控制该锁存单元的上下电状态。
其中，在第一控制单元故障或异常下电后，若需要锁存单元停止输出控制信号，则该第二控制单元可以控制锁存单元下电。由此，可以解除锁定单元对被控单元的控制，即实现对被控单元的状态解锁。
第四方面，提供了一种隔离电路，包括：逻辑运算电路，具有第一输入端、第二输入端和输出端，该第一输入端用于接收第一电平信号作为第一输入信号，该第二输入端用于接收第二输入信号，且该逻辑运算电路用于对第一输入信号和第二输入信号进行逻辑运算，并通过输出端输出第一控制信号；开关，具有第一端和第二端，该第一端用于接收第二电平信号，该第二端与逻辑运算电路的第一输入端连接，用于在开关导通时，向逻辑运算电路的第二输入端输出第二输入信号，其中第二电平信号为该第一控制信号控制下被控单元的输出。
第五方面，提供了一种控制系统，包括如上述第二方面或第三方面提供的控制装置，以及被控单元。
第六方面，提供了一种中央计算平台，包括：如上述任一方面提供的控制系统，以及至少一个接口。其中，该至少一个接口可以包括电源接口、以太网接口和传感器接口等中的一种或多种。该中央计算平台可以是智能中央计算模块或高性能中央计算平台，并且，该中央计算平台可以是盒式设备。
第七方面，提供了一种自动驾驶系统，包括：如上述方面提供的中央计算平台，车载传感器组件以及车载控制器组件。其中，该中央计算平台用于处理车载传感器组件采集的数据，并控制该车载执行器组件执行自动驾驶操作。
第八方面，提供了一种运载工具，包括：如上述任一方面提供的控制系统。其中，该运载工具可以是车辆，例如可以是具有自动驾驶功能的车辆。
可选地，该运载工具还包括电池组件，用于为该控制系统中的供电单元供电。
综上所述，本申请提供了一种控制装置、控制系统及运载工具，该控制系统中的第一隔离单元能够接收第一控制单元输出的第一电平信号和第一被控单元输出的第二电平信号，并能够向第一被控单元输出第一控制信号。该第一被控单元能够在第一控制信号的作用下，向第一隔离单元输出第二电平信号。基于此，即使第一控制单元故障，该第一隔离单元也能基于该第一被控单元输出的第二电平信号，继续向第一被控单元输出第一控制信号。由此，实现了对第一控制单元的故障的隔离，有效提高了该控制系统的可靠性。
附图说明
图1是本申请实施例提供的一种控制系统的结构示意图；
图2是本申请实施例提供的另一种控制系统的结构示意图；
图3是本申请实施例提供的一种逻辑运算电路的结构示意图；
图4是本申请实施例提供的又一种控制系统的结构示意图；
图5是本申请实施例提供的再一种控制系统的结构示意图；
图6是本申请实施例提供的再一种控制系统的结构示意图；
图7是本申请实施例提供的一种第二供电单元的结构示意图；
图8是本申请实施例提供的再一种控制系统的结构示意图；
图9是本申请实施例提供的再一种控制系统的结构示意图；
图10是本申请实施例提供的一种控制装置的结构示意图；
图11是本申请实施例提供的另一种控制装置的结构示意图；
图12是本申请实施例提供的一种中央计算平台的结构示意图；
图13是本申请实施例提供的一种运载工具的结构示意图。
具体实施方式
下面结合附图详细介绍本申请实施例提供的控制装置、控制系统及运载工具。
本申请实施例提供了一种控制系统，该控制系统可以应用于运载工具中。该运载工具可以包括路上交通工具、水上交通工具、空中交通工具、工业设备、农业设备或娱乐设备等。例如运载工具可以为车辆，该车辆为广义概念上的车辆，可以是交通工具(如商用车、乘用车、摩托车、飞行车、火车等)，工业车辆(如：叉车、挂车、牵引车等)，工程车辆(如挖掘机、推土车、吊车等)，农用设备(如割草机、收割机等)，游乐设备或玩具车辆等，本申请实施例对车辆的类型不作具体限定。再如，运载工具可以为飞机、或轮船等交通工具。
可选地，该控制系统还可以应用于其他设备中，例如还可以应用于信息与通信技术(information and communications technology，ICT)领域中的服务器或网络设备中。可以理解的是，本申请实施例提供的控制系统可以应用于具有故障隔离需求的各类设备中，例如可以应用于具有多个电源域，且需要实现各电源域之间的故障隔离的设备中。
如图1所示，该控制系统包括：第一控制单元01、第一隔离单元02和第一被控单元03。其中，第一控制单元01与第一隔离单元02连接，该第一控制单元01用于向第一隔离单元02输出第一电平信号S1。
该第一隔离单元02具有第一输入端、第二输入端和输出端，该第一隔离单元02用于通过该第一输入端接收第一电平信号S1，通过第二输入端接收第二电平信号S2，并通过输出端向第一被控单元03输出第一控制信号C1。
该第一被控单元03用于在该第一控制信号C1的作用下向第一隔离单元02的第二输入端输出第二电平信号S2。
由于该第一被控单元03能够在第一控制信号C1的作用下输出第二电平信号S2，因此即使该第一控制单元01故障或异常下电，该第一隔离单元02也能够基于其第二输入端接收到的第二电平信号S2，继续向第一被控单元03输出第一控制信号C1。
在本申请实施例中，第一隔离单元02可以用于在其第一输入端和第二输入端中的任一输入端接收到的电平信号为有效电平时，输出有效电平的第一控制信号C1。并且，该第一隔离单元02可以用于在其第一输入端和第二输入端接收到的电平信号均为无效电平时，输出无效电平的第一控制信号C1。
其中，若第一隔离单元02输出的第一控制信号C1为有效电平，则第一被控单元03可以保持目标工作状态(例如上电状态或复位状态等)，并可以向第一隔离单元02的第二输入端输 出有效电平的第二电平信号S2。若该第一控制信号C1为无效电平，则第一被控单元03无法处于目标工作状态，且第一被控单元03停止输出第二电平信号S2，或者第一被控单元03输出的第二电平信号S2为无效电平。
在本申请实施例中，该第一控制单元01可以在上电后向第一隔离单元02输出有效电平的第一电平信号S1，第一隔离单元02可以在该有效电平的第一电平信号S1的作用下，向第一被控单元03输出有效电平的第一控制信号C1。第一被控单元03进而可以在该第一控制信号C1的控制下处于目标工作状态，并向第一隔离单元02反馈有效电平的第二电平信号S2。基于此，即使该第一控制单元01因故障或异常下电等原因而无法继续输出有效电平的第一电平信号S1，该第二电平信号S2也能够使得第一隔离单元02持续输出有效电平的第一控制信号C1。由此，可以使得第一被控单元03持续保持目标工作状态。也即是，该第一隔离单元01能够在第一被控单元03输出的第二电平信号S2的作用下，隔离第一控制单元01的故障，实现该第一被控单元03的状态自锁。
可选地，如图1所示，该第一隔离单元02可以包括：第一开关021和逻辑运算电路022。该第一开关021具有第一端和第二端，该逻辑运算电路022具有第一输入端、第二输入端和输出端。
其中，逻辑运算电路022的第一输入端作为第一隔离单元02的第一输入端，可以用于接收第一电平信号S1作为第一输入信号T1。
第一开关021的第一端作为第一隔离单元02的第二输入端，可以用于接收第二电平信号S2，第一开关021的第二端与逻辑运算电路022的第二输入端连接，并可以用于在该第一开关021导通时，向逻辑运算电路022的第二输入端输出第二输入信号T2。
该逻辑运算电路022可以用于对接收到的多路输入信号(包括第一输入信号T1和第二输入信号T2)执行逻辑运算，并通过其输出端输出该第一控制信号C1。并且，该逻辑运算电路022能够在其接收到的任一输入信号为有效电平时，输出有效电平的第一控制信号C1，以及能够在其接收到的各个输入信号均为无效电平时，输出无效电平的第一控制信号C1。
在本申请实施例中，该第一开关021的第一端与第二端的默认通断状态可以为导通状态。由此，可以使得第一开关021能够基于第一被控单元03输出的第二电平信号S2，向逻辑运算电路022的第二输入端输出第二输入信号T2。或者可以理解为：第一开关021能够将第二电平信号S2传输至逻辑运算电路022的第二输入端，以作为第二输入信号T2。在第一控制单元01故障或异常下电后，若需要使第一被控单元03退出目标工作状态，则可以控制该第一开关021的第一端与第二端关断。此时，由于第一开关021无法向逻辑运算电路022的第二输入端输出第二输入信号T2，且第一控制单元01因故障或异常下电等原因而无法继续输出有效电平的第一电平信号S1(即第一输入信号T1)，因此该逻辑运算电路022输出的第一控制信号C1为无效电平。相应的，该第一被控单元03可以退出目标工作状态。也即是，通过将第一开关021的第一端与第二端关断，可以实现对第一被控单元03的状态的解锁。
作为第一种可选的实现方式，该第一控制信号C1的有效电平相对于无效电平可以为高电平，该第一电平信号S1和第二电平信号S2的有效电平也可以均为高电平。相应的，该逻辑运算电路022可以用于对第一输入信号T1和第二输入信号T2执行或运算。基于此，在第一输入信号T1和第二输入信号T2中的任一输入信号为高电平时，逻辑运算电路022输出的第一控制信号C1为高电平，即有效电平。在第一输入信号T1和第二输入信号T2均为低电平时，逻辑运算电路022输出的第一控制信号C1为低电平，即无效电平。
在该实现方式中，如图2所示，该逻辑运算电路022可以为或门(OR gate)。采用或门作为逻辑运算电路022，可以确保控制系统的结构较为简单，成本较低。可以理解的是，除了或门之外，逻辑运算电路022也可以采用其他逻辑门组合的方式实现，只要确保该逻辑运算电路022能够对输入的多路电平信号执行或运算即可。例如，该逻辑运算电路022也可以包括两个串联的或非门，或者包括多个与非门。
作为第二种可选的实现方式，该第一控制信号C1的有效电平相对于无效电平可以为低电平。该逻辑运算电路022可以用于对第一输入信号T1和第二输入信号T2依次执行或运算和非运算。相应的，在第一输入信号T1和第二输入信号T2中的任一输入信号为高电平时，该逻辑运算电路022输出的第一控制信号C1可以为低电平，即有效电平。在第一输入信号T1和第二输入信号T2均为低电平时，逻辑运算电路022输出的第一控制信号C1可以为高电平，即无效电平。
在该实现方式中，如图3所示，该逻辑运算电路022可以包括或门和非门。其中，或门的各个输入端即为逻辑运算电路022的各个输入端，或门的输出端与非门的输入端连接，非门的输出端即为逻辑运算电路022的输出端。
可以理解的是，除了图3所示的实现方式之外，该逻辑运算电路022也可以采用其他逻辑门组合的方式实现。例如，该逻辑运算电路022中的或门可以采用两个串联的或非门代替。
在该第二种实现方式中，若第一输入信号T1和第二输入信号T2的有效电平也均为低电平，则逻辑运算电路022可以为与门，或者可以包括两个串联的与非门。由此，该逻辑运算电路022可以在其接收到的任一输入信号为低电平时，输出低电平的第一控制信号C1，并可以在其接收到各个输入信号均为高电平时，输出高电平的第一控制信号C1。
可选地，如图4所示，该第一开关021可以包括三极管。或者，如图2所示，该第一开关021可以包括场效应晶体管。
在一种示例中，三极管为NPN型三极管，其集电极可以作为第一开关021的第一端，用于接收第二电平信号S2，发射极可以作为第一开关021的第二端与逻辑运算电路022的第二输入端连接。
在另一种示例中，三极管为PNP型三极管，其发射极可以作为第一开关021的第一端，用于接收第二电平信号S2，集电极可以作为第一开关021的第二端与逻辑运算电路022的第二输入端连接。
在上述两种示例中，三极管的基极作为控制端，用于耦接控制信号，以导通或截断该三极管。例如，三极管的基极可以耦接其它控制单元(如下文所述的第二控制单元04)的输出端，获得控制电压，以控制三级管的导通或截止。
在一种示例中，如图2所示，该场效应晶体管可以为N型金属-氧化物半导体场效应晶体管(metal-oxide-semiconductor field-effect transistor，MOSFET)，简称NMOS，其漏极可以作为第一开关021的第一端，用于接收第二电平信号S2，源极可以作为第一开关021的第二端与逻辑运算电路022的第二输入端连接。
在另一种示例中，该场效应晶体管为PMOS管，其源极可以作为第一开关021的第一端，用于接收第二电平信号S2，漏极可以作为第一开关021的第二端与逻辑运算电路022的第二输入端连接。
在上述两种示例中，场效应晶体管的栅极作为控制端，用于耦接控制信号，以导通或截断该场效应晶体管。例如，场效应晶体管的栅极可以耦接其它控制单元(如下文所述的第二 控制单元04)的输出端，获得控制电压，以控制场效应晶体管的导通或截止。
由于三极管和场效应晶体管的结构简单，且成本较低，因此采用三极管或场效应晶体管作为第一开关021，可以有效避免增加控制系统的结构复杂度和成本。
在本申请实施例中，如图2所示，该控制系统还可以包括电阻R0，该电阻R0的一端分别与逻辑运算电路022的输出端和第一被控单元03的输入端连接，该电阻R0的另一端接地。该电阻R0可以用于稳定第一被控单元03的输入端的电平。
可选地，如图2所示，该控制系统还可以包括：第二控制单元04。该逻辑运算电路022还可以具有第三输入端，该第二控制单元04的输出端与该第三输入端连接，并用于向该逻辑运算电路022输出第三电平信号S3以作为逻辑运算电路022的第三输入信号T3。
由于第二控制单元04能够向逻辑运算电路022输出第三电平信号S3，因此逻辑运算电路022还可以在该第三电平信号S3的作用下，向第一被控单元03输出第一控制信号C1。由此，有效提高了对第一被控单元03进行控制时的灵活性。
可以理解的是，对于逻辑运算电路022还具有第三输入端的场景，逻辑运算电路022可以对接收到的第一输入信号T1、第二输入信号T2和第三输入信号T3执行逻辑运算。并且，在第一输入信号T1、第二输入信号T2和第三输入信号T3中的任一输入信号为有效电平时，逻辑运算电路022输出的第一控制信号C1可以为有效电平。在第一输入信号T1、第二输入信号T2和第三输入信号T3均为无效电平时，逻辑运算电路022输出的第一控制信号C1可以为无效电平。
在本申请实施例中，第二控制单元04在上电后输出的第三电平信号S3可以为无效电平。也即是，在第一控制单元01正常时，或者在第一被控单元03处于自锁状态时，该第三电平信号S3不会影响逻辑运算电路022输出的第一控制信号C1的电平。
在第一控制单元01故障或异常下电，且第一被控单元03下电后，若需要对控制系统中的故障进行定位，则第二控制单元04可以输出有效电平的第三电平信号S3。此时，逻辑运算电路022可以输出有效电平的第一控制信号C1，第一被控单元03进而可以在该第一控制信号C1的驱动下处于目标工作状态(如上电状态)。由此，可以便于对控制系统中的故障进行定位。
其中，该第二控制单元04也可以称为处理单元或管理单元，其可以是具有数据处理功能、管理功能和控制功能的器件。该第一控制单元01则可以是具有控制功能的器件，其可以在第二控制单元04的控制下，控制其他被控单元的工作状态。例如，该第二控制单元04可以向第一控制单元01发送控制系统中各个单元的上下电时序，第一控制单元01可以基于该上下电时序，控制该控制系统中各个单元的上下电状态，以及对各个单元进行异常检测。
示例的，该第二控制单元04可以是微处理器或微控制器(micro-controller unit，MCU)。该第一控制单元01可以是可编程逻辑器件(programmable logic device，PLD)或其他具有输入输出(input/output，I/O)接口的控制类芯片。其中，该PLD可以是复杂程序逻辑器件(complex programmable logical device，CPLD)，现场可编程门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。
对于控制系统还包括第二控制单元04的场景，如图2所示，第二控制单元04的输出端可以与第一开关021的第三端(即控制端)连接，并用于控制该第一开关021的第一端与第二端的通断状态。例如，第二控制单元04可以向第一开关021的第三端输出开关信号SW0，第一开关021可以在该开关信号SW0的作用下，控制其第一端与第二端的通断状态。
在本申请实施例中，第二控制单元04在上电后可以先控制第一开关021的第一端与第二端导通，以使第一开关021基于第一被控单元03输出的第二电平信号S2，向逻辑运算电路022输 出第二输入信号T2。在第一控制单元01故障或异常下电后，若需要使得第一被控单元03退出目标工作状态，或者，若要对控制系统中的故障进行定位，则第二控制单元04可以控制第一开关021的第一端与第二端关断，此时，第一开关021无法基于第一被控单元03输出的第二电平信号S2，向逻辑运算电路022输出第二输入信号T2。
图4是本申请实施例提供的又一种控制系统的结构示意图。如图3所示，该控制系统还可以包括：通信单元05。该通信单元05可以与第二控制单元04的输入端连接，并用于向第二控制单元04输出故障检测指令。
第二控制单元04可以基于该故障检测指令，控制第一开关021的第一端与第二端关断，并向第一隔离单元02中的逻辑运算电路022输出有效电平的第三电平信号S3作为第三输入信号T3。由此，即可使得第一隔离单元02基于该第三输入信号T3，向第一被控单元03输出有效电平的第一控制信号C1，进而使得第一被控单元03处于目标工作状态。
可选地，继续参考图3，该通信单元05可以包括：有线连接器501，和/或，无线通信模组502。其中，该有线连接器501可以是车载连接器。该无线通信模组502可以是蓝牙通信模组，或者可以是无线保真(wireless fidelity，Wi-Fi)模组等。
示例的，该第二控制单元04中可以安装有控制软件，该控制软件可以控制第一开关021的通断状态，以及控制第三电平信号S3的电平高低。在第一控制单元01故障或异常下电后，运维人员可以通过通信单元05对第二控制单元04中的控制软件进行升级，以使得第二控制单元04控制第一开关021的第一端与第二端关断，并输出有效电平的第三电平信号S3。例如，运维人员可以通过通信单元05对第二控制单元04的内存中的程序代码进行修改，以实现对该控制软件的升级。
上述故障定位方式无需拆卸控制系统，且可以通过无线通信模组实现远程故障定位，从而有效提高了故障定位的灵活性和便利性。
以上控制单元(例如第一控制单元01)和被控制单元(例如第一被控单元03)可以属于不同的域(或子系统)，例如第一域(或子系统)和第二域(或子系统)，其中第二域用于为第一域的部分或全部功能进行冗余备份，以提高产品的可靠性。控制单元既控制第一域中的功能，也同时控制第二域中的备份功能，此时被控单元为功能单元，例如计算单元、处理单元等；或者控制单元既控制第一域中的功能上电，也同时控制第二域中的备份功能的上电，此时被控单元为供电单元。如此，控制单元所在的域(例如，第一域)故障时，采用了包括以上隔离单元的控制系统，可以隔离对第二域的影响，使得第二域正常工作，提高了冗余系统的稳定性。
以第一域为第一电源域，第二域为第二电源域为例：
图5是本申请实施例提供的再一种控制系统的结构示意图。如图5所示，该控制系统包括第一电源域和第二电源域。其中，第一控制单元01属于第一电源域，并且可以由该第一电源域中的供电单元(即图5所示的第一供电单元06)供电。
该第一被控单元03可以为第二电源域的供电单元(即第二供电单元03)，该第一控制信号C1可以为用于控制该第二供电单元03上电或下电的第一使能信号。
在本申请实施例中，该第一电源域还可以包括第二控制单元04、第一计算单元08、第一存储单元09中的一项或多项。该第一电源域的第一供电单元06还用于为该第二控制单元04、第一计算单元08、第一存储单元09中的一项或多项供电。
作为第一种可能的实现方式，如图5所示，该第一电源域还包括第一计算单元08和第一存 储单元09，第一供电单元06还用于为该第一计算单元08和第一存储单元09供电。并且，该控制系统还包括第三电源域，第二控制单元04属于该第三电源域，并可以由该第三电源域中的供电单元(即图5所示的第三供电单元07)供电。也即是，在该第一种实现方式中，第一控制单元01和第二控制单元04属于不同的电源域，并由两个不同的供电单元供电，
在该第一种实现方式中，参考图5，通信单元05也可以属于第三电源域，相应的，第三供电单元07还可以用于为该通信单元05供电。可以理解的是，当第一供电单元06和第三供电单元07中的任一供电单元故障时，该故障的供电单元将无法为其所属电源域中的其他功能单元供电，进而会导致其他功能单元异常下电。由于在该第一种实现方式中，第一控制单元01和第二控制单元04由两个不同的供电单元供电，因此可以避免某个供电单元故障而导致该两个控制单元同时异常下电的情况。
作为第二种可能的实现方式，如图6所示，该第一电源域的第一供电单元06还用于为第二控制单元04供电。也即是，该第一控制单元01和第二控制单元04可以均属于第一电源域。
参考图6可以看出，在该第二种实现方式中，第一控制单元01和第二控制单元04所属的第一电源域中可以不包括计算单元和存储单元。也即是，该控制系统中的两个控制单元可以部署在一个独立的电源域中，并可以对其他电源域中的计算单元和存储单元进行统一的管理和控制。
可选地，如图5和图6所示，该第二电源域还可以包括：第二计算单元10和/或第二存储单元11。例如，图5和图6所示的第二电源域包括第二计算单元10和第二存储单元11。该第二电源域中的第二供电单元03(即第一被控单元03)还可以用于为该第二计算单元10和/或第二存储单元11供电。
可以理解的是，当第一隔离单元02输出的第一使能信号为有效电平时，第二供电单元03上电，并为第二电源域中的其他功能单元(例如第二计算单元10和第二存储单元11)供电，以使该第二电源域中的各个功能单元均能够处于工作状态。当第一隔离单元02输出的第一使能信号为无效电平时，第二供电单元03下电，该第二电源域中的各个功能单元也均下电。
还可以理解的是，除了图5和图6所示的各个功能单元之外，该第一电源域、第二电源域和第三电源域还可以包括其他功能单元。并且，第一电源域中的各个功能单元均可以由第一供电单元06供电，第二电源域中的各个功能单元均可以由第二供电单元03供电，第三电源域中的各个功能单元均可以由第三供电单元07供电。
还可以理解的是，该控制系统中的各个存储单元可以用于存储数据，各个计算单元可以用于处理该存储单元中存储的数据。例如，假设该控制系统为车辆中的自动驾驶模块，则该存储单元可以用于存储车载传感器组件采集到的数据，计算单元则可以用于基于存储的自动驾驶算例，处理该车载传感器组件采集到的数据。该控制系统中的各个供电单元用于为其所属电源域中的各个功能单元提供直流电压，因此也可以称为直流电源。
作为第一种可能的示例，该控制系统中的多个电源域的功能可以相同，且可以互为备份。基于此，任一电源域掉电，或任一电源域中的存储单元和/或计算单元故障后，其他电源域中的存储单元和计算单元可以继续正常工作。由此，有效提高了该控制系统的可靠性。
作为第二种可能的示例，该控制系统中的多个电源域的功能可以不同。其中，至少一个电源域可以为主电源域，该主电源域中的存储单元和计算单元可以实现控制系统的主要功能。其他电源域则可以为附属电源域，该附属电源域中的存储单元和计算单元可以实现控制系统的附属功能。例如，假设该控制系统为车辆中的自动驾驶模块，则该主电源域中的计算单元 和存储单元可以实现主要的自动驾驶功能，该附属电源域中的计算单元和存储单元则可以实现诸如靠边停车和本车道停车等附属功能。
在该第二种可能的示例中，若第一控制单元01和第二控制单元04属于不同的电源域，则该第一控制单元01可以属于主电源域(例如图5所示的第一电源域)。相应的，该第一隔离单元02可以实现主电源域与附属电源域(例如图5所示的第二电源域)的故障隔离。由此，在该第一控制单元01故障或异常下电后，该附属电源域还能够实现控制系统的附属功能(例如可以实现靠边停车的功能)，以避免该控制系统完全失控而产生安全隐患。
可以理解的是，在附属电源域执行完附属功能后，第二控制单元04可以控制第一隔离单元02中的第一开关021关断，以使该附属电源域下电。并且，第二控制单元04还可以控制其他电源域中的供电单元下电，以使该控制系统下电。
图7是本申请实施例提供的一种第二供电单元的结构示意图。如图7所示，该第二供电单元03可以包括第一电压转换单元031和第二电压转换单元032。其中，第一电压转换单元031可以与电池组件连接，并能够对电池组件的电压进行转换后输出，第二电压转换单元032能够对第一电压转换单元031输出的电压进行转换后输出。由此，该2个电压转换单元能够为第二电源域中的功能单元提供不同的驱动电压。例如，假设第二电源域中的第二计算单元10所需的驱动电压与第二存储单元11所需的驱动电压不同，则该第二计算单元10和第二存储单元11可以由第二供电单元03中不同的电压转换单元驱动。
参考图4，该控制系统还可以包括：第二隔离单元12。该第一隔离单元02用于向第二供电单元03中的第一电压转换单元031输出第一控制信号C1(即第一使能信号)，该第一使能信号可以用于控制该第一电压转换单元031上电或下电。
该第一控制单元01还可以与第二隔离单元12连接，并用于向第二隔离单元12输出第四电平信号S4。第二隔离单元12具有输入端和输出端，该第二隔离单元12用于通过其输入端接收第四电平信号S4，并在该第四电平信号S4的作用下通过其输出端向第二电压转换单元032输出第二控制信号(也可以称为第二使能信号)。该第二使能信号可以用于控制该第二电压转换单元032上电或下电。
在本申请实施例中，若第一控制单元01输出的第四电平信号S4为无效电平，则第二隔离单元12输出的第二使能信号可以为有效电平。相应的，第二电压转换单元032处于上电状态。若该第四电平信号S4为有效电平，则第二隔离单元12输出的第二使能信号可以为无效电平。相应的，第二电压转换单元032处于下电状态。其中，该第四电平信号S4的有效电平相对于无效电平可以为高电平。
由于当第一控制单元01故障或异常下电时，该第一控制单元01将无法输出有效电平的第四电平信号S4，因此第二隔离单元12的输入端会保持为无效电平。此时，第二隔离单元12能够继续向第二电压转换单元032输出有效电平的第二使能信号，以使第二电压转换单元032继续保持上电状态。由此，可以避免第一控制单元01的故障或异常下电对第二电压转换单元032的上电状态造成影响，也即是，可以实现第一控制单元01与第二电压转换单元032之间的故障隔离。
示例的，第一控制单元01可以在上电后输出有效电平的第一控制信号C1，并输出有效电平的第四电平信号S4。第二隔离单元12能够在该有效电平的第四电平信号S4作用下，输出无效电平的第二使能信号，以使第二电压转换单元032保持下电状态。第一隔离单元02则能够在该有效电平的第一控制信号C1的作用下，向第一电压转换单元031输出有效电平的第一使能 信号，以驱动该第一电压转换单元031上电。
如图4所示，该第一控制单元01还能够对第一电压转换单元031进行电源监测，并可以在监测到该第一电压转换单元031上电完成(power good)后，向第二隔离单元12输出无效电平的第四电平信号S4。第二隔离单元12进而能够在该无效电平的第四电平信号S4作用下，输出有效电平的第二使能信号，以驱动该第二电压转换单元032上电。
可选地，如图4所示，该第二隔离单元12可以包括：第二开关121，该第二开关121具有第一端、第二端和第三端。该第二开关121的第一端作为第二隔离单元12的输入端，用于接收第四电平信号S4，该第四电平信号S4用于控制第二开关121的第二端与第三端的通断状态。第二开关121的第二端作为第二隔离单元12的输出端分别与电源端和第二电压转换单元032的输入端连接，该第二开关121的第三端与接地端连接。
其中，该电源端可以为第一电压转换单元031的输出端。当第四电平信号S4为有效电平时，第二开关121的第二端与第三端导通。此时，由于电源端和第二电压转换单元032的输入端均与接地端导通，因此该第二电压转换单元032处于下电状态。当第四电平信号S4为无效电平时，第二开关121的第二端与第三端关断。此时，由于第二电压转换单元032的输入端与电源端连接，因此该第二电压转换单元032能够在电源端的驱动下保持上电状态。
若第一控制单元01出现故障或异常掉电，则第二开关121的第一端接收到的第四电平信号S4可以保持为无效电平。相应的，第二开关121的第二端与第三端可以保持关断状态，进而可以确保该第二电压转换单元032能够在电源端的驱动下保持上电状态。
在一种示例中，如图4所示，该第二开关121可以包括场效应晶体管，且该场效应晶体管可以是NMOS。该场效应晶体管的栅极可以作为第二开关121的第一端(即控制端)，用于接收第四电平信号S4。该场效应晶体管的漏极可以作为第二开关121的第二端，分别与电源端和第二电压转换单元032的输入端连接。该场效应晶体管的源极可以作为第二开关121的第三端与接地端连接。
在另一种示例中，如图8所示，该第二开关121可以包括三极管，且该三极管可以是NPN型三极管。该三极管的基极可以作为第二开关121的第一端，用于接收第四电平信号S4。该三极管的集电极可以作为第二开关121的第二端，分别与电源端和第二电压转换单元032的输入端连接。该三极管的发射极可以作为第二开关121的第三端与接地端连接。
可选地，该第二开关121中的场效应晶体管也可以是PMOS，该第二开关121中的三极管也可以是PNP型三极管，本申请实施例对此不做限定。
从图4和图8可以看出，该第二隔离单元12还可以包括第一电阻R1和第二电阻R2。其中，第一电阻R1的一端与第二开关121的第一端连接，第一电阻R1的另一端与接地端连接，该第一电阻R1用于稳定第二开关121的第一端的电平。第二电阻R2串联在电源端与第二开关121的第二端之间，即第二开关121的第二端通过第二电阻R2与电源端连接。该第二电阻R2为上拉电阻，用于上拉第二开关121的第二端的电平。
继续参考图8，该第二隔离单元12还可以包括第三电阻R3，该第三电阻R3串联在第一控制单元01的输出端与第二开关121的第一端之间。该第三电阻R3可以用于控制第二开关121的第一端的电流，例如控制三极管的基极电流。该第三电阻R3和第一电阻R1还可以组成分压电路，以调节第二开关121的第一端的电平。
其中，图4所示的第二隔离单元12中的场效应晶体管的连接方式也可以称为开漏(open drain，OD)输出结构，图8所示的第二隔离单元12中的三极管的连接方式也可以称为开集(open  collector，OC)输出结构。基于该OD输出结构或OC输出结构，可以实现对第一控制单元01的故障隔离。
上文是以第二供电单元03包括两个电压转换单元为例进行的说明。可以理解的是，该第二供电单元03所包括的电压转换单元的个数还可以大于2。如图8所示，第二供电单元03可以包括n个级联的电压转换单元，n为大于1的整数。该n个电压转换单元中的第一个电压转换单元(即第一电压转换单元031)可以与电池组件连接，并能够对电池组件提供的电压进行转换后输出。第2至第n个电压转换单元中的每一个电压转换单元可以用于对前一级或前若干级电压转换单元输出的电压进行转换后输出。
并且，参考图8，该控制系统可以包括与该第2至第n个电压转换单元一一对应的多个第二隔离单元12，每个第二隔离单元12与对应的一个电压转换单元连接，并用于在第一控制单元01提供的第四电平信号S4的作用下，向对应的一个电压转换单元输出第二使能信号。可以理解的是，图8中每个第二隔离单元12所连接的电源端可以是前一级或前若干级电压转换单元的输出端。
示例的，该第一控制单元01可以在检测到任一个电压转换单元上电完成后，向下一个电压转换单元所对应的第二隔离单元12输出无效电平的第四电平信号S4，以使该下一个电压转换单元上电。由此，可以使该第二供电单元03中n个级联的电压转换单元依次上电。
还可以理解的是，对于第二供电单元03包括n个电压转换单元的场景，该第二电平信号S2可以是该n个电压转换单元中任一电压转换单元在上电完成后输出的。
在本申请实施例中，该控制系统可以具有多种不同的工作模式。该第一控制单元01可以用于根据该控制系统的工作模式，输出第一电平信号S1和第四电平信号S4。其中，该控制系统的工作模式可以包括正常工作模式、休眠模式和浅休眠模式等。
基于前文分析可知，通过控制第一电平信号S1和第四电平信号S4的电平高低，可以实现对第二供电单元03中各个电压转换单元的上下电状态的控制。因此，第一控制单元01可以在控制系统处于不同的工作模式时，控制第二供电单元03中不同的电压转换单元上电，由此可以在不影响控制系统的性能的前提下，有效降低该控制系统的功耗。
其中，在正常工作模式下，第一控制单元01可以输出有效电平的第一电平信号S1，并可以在检测到第一电压转换单元031上电完成后，输出无效电平的第四电平信号S4。由此，可以使得该第二供电单元03中的各个电压转换单元均正常上电，进而使得第二供电单元03所属的第二电源域中的各个功能单元(例如第二计算单元10和第二存储单元11)均能够正常工作。
在休眠模式下，第一控制单元01输出的第一电平信号S1可以为无效电平，由此可以使得第二供电单元03中的第一电压转换单元031保持下电状态。由于该第一电压转换单元031处于下电状态，因此第二供电单元03中的其他电压转换单元也保持下电状态。此时，该第二供电单元03所属的第二电源域中的各个功能单元均处于下电状态。
在浅休眠模式下，第一控制单元01输出的第一电平信号S1可以为有效电平，第四电平信号S4可以为有效电平。由此，可以使得第二供电单元03中的第一电压转换单元031保持上电状态，且可以使得第二供电单元03中的第二电压转换单元032保持下电状态。此时，该第二供电单元03所属的第二电源域中，由第一电压转换单元031驱动的功能单元(例如第二存储单元11)可以保持工作状态，而由第二电压转换单元032驱动的功能单元(例如第二计算单元10)则可以处于下电状态。
可以理解的是，若第二供电单元03包括的电压转换单元的个数大于2，则在浅休眠模式下， 第一控制单元01可以根据应用场景的需求，控制该多个电压转换单元中的部分电压转换单元上电，并控制其他电压转换单元下电。由此，可以使第二供电单元03所属的第二电源域中仅部分功能单元处于工作状态。
还可以理解的是，在正常工作模式下，该控制系统的各个电源域均可以处于上电状态。例如，参考图5，该第一供电单元06、第二供电单元03以及第三供电单元07均处于上电状态，相应的，第一电源域、第二电源域以及第三电源域中的各个功能单元均处于正常工作的状态。
继续参考图5，第二控制单元04所属的第三电源域中还可以包括唤醒单元13。该唤醒单元13可以是控制器局域网络(controller area network，CAN)唤醒模块。在休眠模式下，可以仅使该唤醒单元13处于上电状态，控制系统中的其他各个功能单元则可以均处于下电状态。相应的，在休眠模式下，仅第三供电单元07中用于驱动唤醒单元13的电压转换单元上电，第三供电单元07中的其他电压转换单元，第一供电单元06，以及第二供电单元03则均可以保持下电状态。
在浅休眠模式下，唤醒单元13、第一控制单元01以及各个电源域中的存储单元可以均处于上电状态，其他各个功能单元则均可以处于下电状态。相应的，在浅休眠模式下，可以控制第三供电单元07中用于驱动唤醒单元13的电压转换单元上电，控制第一供电单元06中用于驱动第一控制单元01的电压转换单元上电，并控制各供电单元中用于驱动存储单元的电压转换单元上电。
上文是以第一被控单元03为第二电源域中的第二供电单元为例进行的说明。在一种可能的示例中，该第一被控单元03还可以为计算单元，该第一控制信号C1可以为用于控制该计算单元复位的复位信号。其中，该计算单元与第一控制单元01可以属于同一个电源域，也可以属于不同的电源域。
例如，参考图5，第一被控单元03可以是与第一控制单元01同属于第一电源域的第一计算单元08。或者，参考图5和图6，第一被控单元03也可以是第二电源域中的第二计算单元10。
可选地，如图6所示，该控制系统还可以包括：第三隔离单元14和第二被控单元15。该第一控制单元01还可以与第三隔离单元14连接，并用于向该第三隔离单14输出第五电平信号S5。
第三隔离单元14具有第一输入端、第二输入端和输出端，该第三隔离单元14用于通过其第一输入端和第二输入端分别接收第五电平信号S5和第六电平信号S6，并通过其输出端向第二被控单元15输出第三控制信号C3。
该第二被控单元15用于在第三控制信号C3的作用下向第三隔离14单元的第二输入端输出该第六电平信号S6。
其中，第三隔离单元14的结构和工作原理均可以与第一隔离单元02相同，此处不再赘述。并且，从图6可以看出，第二控制单元04也可以与第三隔离单元14连接，并可以向第三隔离单元14中的逻辑运算电路输出第七电平信号S7，以及向第三隔离单元14中的第一开关输出开关信号SW1。其中，该开关信号SW1能够控制第三隔离单元14中的第一开关的第一端与第二端的通断状态。
可以理解的是，第二被控单元15与第一被控单元03可以属于不同的电源域。例如，参考图6，该第一被控单元03(即第二供电单元03)属于第二电源域，而第二被控单元15属于第三电源域。或者，该两个被控单元也可以属于同一个电源域，本申请实施例对此不做限定。
可选地，如图6所示，第二被控单元15可以是第三电源域中的供电单元，且该第三电源域中还可以包括第三计算单元16和/或第三存储单元17。该第二被控单元15可以用于为该第三计 算单元16和/或第三存储单元17供电。
若第三电源域中的供电单元也包括多个级联的电压转换单元，则该控制系统还可以包括至少一个第四隔离单元，每个第四隔离单元用于实现第一控制单元01与一个电压转换单元之间的故障隔离。其中，该第四隔离单元的结构和工作原理均可以与上文所述的第二隔离单元12相同，此处不再赘述。
还可以理解的是，该控制系统中包括的被控单元的个数还可以大于2。并且，对于其中每个被控单元，该控制系统中均配置有对应的一个隔离单元，以实现对第一控制单元01的故障隔离。其中，每个被控单元所对应的隔离单元的结构和工作原理均可以参考第一隔离单元02，本申请实施例对此不再赘述。
图9是本申请实施例提供的再一种控制系统的结构示意图。如图9所示，该控制系统中的各个单元可以集成在一个单板上，例如可以集成在一个印制电路板(printed circuit board，PCB)上。也即是，本申请实施例提供的控制系统可以为单板。
参考图9，该控制系统中的每个供电单元均可以包括升压降压(buck boost)电路。例如，前文所述的电压转换单元可以包括该升压降压电路。并且，每个供电单元还可以包括用于对电池组件中的多个电池提供的电压进行合路的合路芯片，以及用于实现缓启动的缓启芯片。
继续参考图9，该第二控制单元04所属的第三电源域中的通信单元05可以为网络交换芯片，该第二控制单元04可以为微处理器，唤醒单元13可以为CAN芯片。第一控制单元01可以为CPLD。各个电源域中的计算单元(例如第一计算单元08和第二计算单元10)可以均为系统级芯片(system on chip，SOC)，存储单元(例如第一存储单元09和第二存储单元11)均可以包括双倍数据率同步动态随机存取存储器(double data rate synchronous dynamic random access memory，DDR SDRAM)，以及嵌入式多媒体卡(embedded multi media card，EMMC)等。
可选地，如图9所示，该第一电源域和第二电源域中也可以包括CAN芯片。并且，该第一电源域中还可以包括视频加/解串器。
综上所述，本申请实施例提供了一种控制系统，该控制系统中的第一隔离单元能够接收第一控制单元输出的第一电平信号和第一被控单元输出的第二电平信号，并能够向第一被控单元输出第一控制信号。该第一被控单元能够在第一控制信号的作用下，向第一隔离单元输出第二电平信号。基于此，即使第一控制单元故障，该第一隔离单元也能基于该第一被控单元输出的第二电平信号，继续向第一被控单元输出第一控制信号。由此，实现了对第一控制单元的故障的隔离，即实现了第一控制单元与第一被控单元的解耦，从而有效提高了该控制系统的可靠性。
本申请实施例还提供了一种控制装置。如图10所示，该控制装置包括控制单元21和隔离单元22。其中，该控制单元21与隔离单元22连接，并用于向隔离单元22输出第一电平信号S1。
隔离单元22具有第一输入端、第二输入端和输出端，该隔离单元22用于通过其第一输入端接收第一电平信号S1，通过其第二输入端接收被控单元(图10中未示出)输出的第二电平信号S2，并通过该输出端向该被控单元输出第一控制信号C1。其中，该第一控制信号C1用于控制该被控单元输出该第二电平信号S2。
其中，控制单元21的结构和工作原理均可以参考前文关于第一控制单元01的相关描述，该隔离单元22的结构和工作原理均可以参考前文关于第一隔离单元02的相关描述，本申请实 施例对此不再赘述。
可以理解的是，在上述实施例提供的控制系统中，第一隔离单元02与第一控制单元01可以是相互独立的。也即是，该第一隔离单元02可以是分立器件。并且，该控制系统中的第二隔离单元12和第三隔离单元14也均可以是分立器件。而在图10所示的控制装置中，该隔离单元22与控制单元21可以集成设置，例如，两者可以集成在CPLD中。
图11是本申请实施例提供的另一种控制装置的结构示意图。如图11所示，该控制装置包括第一控制单元31、第二控制单元32和锁存单元33。其中，第一控制单元31与锁存单元33连接，并用于向锁存单元33输出第一电平信号X1。第二控制单元32也与锁存单元33连接，并用于向锁存单元33输出第二电平信号X2。
锁存单元33具有第一输入端、第二输入端和输出端，该锁存单元33用于通过其第一输入端和第二输入端分别接收第一电平信号X1和第二电平信号X2，在第一电平信号X1的作用下，对第二电平信号X2进行采样和锁存，并通过其输出端向被控单元(图11中未示出)输出锁存的信号。
其中，第一控制单元31输出的第一电平信号X1可以包括至少一个目标跳边沿。该目标跳边沿可以是由低电平跳变至高电平的上升沿，也可以是由高电平跳变至低电平的下降沿。该第二控制单元32输出的第二电平信号X2的电平可以为有效电平。
该锁存单元33可以在第一电平信号X1存在目标跳边沿时，对第二电平信号X2的电平进行采样和锁存，并输出锁存的第二电平信号X2。由于当第一控制单元31故障或异常下电时，该第一控制单元31输出的第一电平信号X1不会存在目标跳边沿，因此该第一电平信号X1不会触发锁存单元33调整其输出的信号的电平，被控单元进而可以继续保持之前的工作状态。也即是，该锁存单元33可以避免第一控制单元31的故障对被控单元的工作状态造成影响，实现了对第一控制单元31的故障的隔离。
可以理解的是，若该目标跳边沿为由高电平跳变至低电平的下降沿，则在第一控制单元31故障或异常下电时，该第一电平信号X1可以持续保持为低电平。若该目标跳边沿为由低电平跳变至高电平的上升沿，则在该第一控制单元31故障或异常下电时，该第一电平信号X1可以先由高电平跳变至低电平(即第一电平信号X1出现下降沿)，然后再持续保持为该低电平。其中，低电平的第一电平信号X1，以及第一电平信号X1中的下降沿均不会触发锁存单元33调整其输出的信号的电平，即锁存单元33不会响应该低电平和下降沿。
在本申请实施例中，若锁存单元33输出的信号为有效电平，则被控单元可以在该有效电平的作用下，保持目标工作状态，例如被控单元可以保持上电状态或复位状态。若锁存单元33输出的信号为无效电平，则被控单元可以退出该目标工作状态，例如被控单元可以处于下电状态。
可选地，如图11所示，该锁存单元33可以包括：边沿触发器331。该边沿触发器331可以在第一电平信号X1存在目标跳边沿时，对第二电平信号X2的电平(有效电平)进行采样和锁存，并输出锁存的信号。示例的，该边沿触发器331可以是D触发器、边沿JK触发器或者互补金属氧化物半导体(complementary metal oxide semiconductor，CMOS)边沿触发器等。
继续参考图11，锁存单元33还可以具有电源端，第二控制单元32还与锁存单元33的电源端连接，并用于向锁存单元33输出电源控制信号X0(也可以称为使能信号)，以控制锁存单元33的上下电状态。
例如，第二控制单元32在上电后可以向锁存单元33输出有效电平的电源控制信号X0，以控制锁存单元33上电，并向锁存单元33输出有效电平的第二电平信号X2。第一控制单元31上电后可以向该锁存单元33输出存在目标跳边沿(例如上升沿)的第一电平信号X1。锁存单元33进而可以输出有效电平的信号，以使被控单元保持为目标工作状态。当第一控制单元31故障或异常下电后，锁存单元33可以持续输出有效电平的信号，被控单元进而可以继续保持目标工作状态。此时，若需要被控单元退出目标工作状态，则第二控制单元32可以向锁存单元33输出无效电平的电源控制信号X0，以控制锁存单元33下电。由此，该锁存单元33无法继续输出有效电平的信号，被控单元进而可以退出目标工作状态，例如，被控单元可以下电。
可以理解的是，该第一控制单元31、第二控制单元32以及被控单元的结构和工作原理，均可以参考前述实施例中的相关描述，此处不再赘述。其中，若被控单元为某个电源域中的供电单元，且该供电单元包括多个电压转换单元，则该控制装置中还可以包括隔离单元，该隔离单元能够实现第一控制单元31与电压转换单元之间的故障隔离。该隔离单元的结构和工作原理，可以参考前述实施例中关于第二隔离单元12的相关描述，此处不再赘述。
还可以理解的是，该控制装置可以包括多个被控单元。对于其中每个被控单元，控制装置中均配置有对应的一个锁存单元33，以实现对第一控制单元31的故障的隔离。
还可以理解的是，该控制装置的锁存单元33可以独立于第一控制单元31和第二控制单元32设置，即该锁存单元33可以是分立器件。或者，该锁存单元33也可以与第一控制单元31集成设置，例如两者可以集成为CPLD。
以上控制单元(例如第一控制单元31)和被控制单元可以属于不同的域(或子系统)，例如第一域(或子系统)和第二域(或子系统)，其中第二域用于为第一域的部分或全部功能进行冗余备份，以提高产品的可靠性。控制单元既控制第一域中的功能，也同时控制第二域中的备份功能，此时被控单元为功能单元，例如计算单元、处理单元等；或者控制单元既控制第一域中的功能上电，也同时控制第二域中的备份功能的上电，此时被控单元为供电单元。如此，控制单元所在的域(例如，第一域)故障时，采用了包括以上隔离单元的控制系统，可以隔离对第二域的影响，使得第二域正常工作，提高了冗余系统的稳定性。
综上所述，本申请实施例提供了一种控制装置，该控制装置中的锁存单元能够在第一控制单元输出的第一电平信号的作用下，对第二控制单元输出的第二电平信号进行采样和锁存，并能够向被控单元输出锁存的信号。基于此，即使第一控制单元故障，该锁存单元也能继续向第一被控单元输出锁存的信号。由此，实现了对第一控制单元的故障的隔离，有效提高了该控制装置的可靠性。
本申请实施例还提供了一种控制系统，该控制系统可以包括上述实施例提供的控制装置，以及被控单元。其中，该控制装置的结构可以如图10或图11所示。
本申请实施例还提供了一种中央计算平台，该中央计算平台包括：如上述实施例提供的控制系统，以及至少一个接口。其中，该至少一个接口可以包括电源接口、以太网接口和传感器接口等中的一种或多种。可选地，该中央计算平台可以是智能中央计算模块(intelligent central computing model，ICCM)，且该中央计算平台可以是一个盒式设备。
该中央计算平台例如可以是高性能中央计算平台(high-performance central computer platform，HCCP)。如图12所示，该中央计算平台100可以包括：智能中央计算模块101，以及智能增强娱乐模块(intelligent enhanced entertainment model，IEEM)102。
可选地，如图12所示，该智能增强娱乐模块102也可以是盒式设备。或者，该智能中央计算模块101和智能增强娱乐模块102可以集成在一个盒式设备中。
以中央计算平台100可以提供自动驾驶功能为例，本申请实施例还提供了一种自动驾驶系统，如图13所示，该自动驾驶系统1000可以包括：如上述实施例提供的中央计算平台100，车载传感器组件200以及车载执行器组件300。其中，该中央计算平台100用于处理车载传感器组件200采集的数据，并控制该车载执行器组件300执行自动驾驶操作。例如，该自动驾驶系统1000可以实现二级(level 2，L2)-五级(level 5，L5)中任一种级别的自动驾驶功能。
可选地，参考图5和图6，该车载传感器组件200可以包括下述传感器中的至少一种：摄像头、激光雷达、毫米波雷达和超声波雷达等。该车载执行器组件300可以包括下述器件中的至少一种：加速踏板、刹车踏板、转向系统、电机、阀门、开关和继电器等。
为了提高车辆中自动驾驶系统的安全性和可靠性，该自动驾驶系统一般采用多控制域(也称为电源域)的方式实现。并且，自动驾驶系统中的各个控制域相互独立，任一控制域故障或掉电后，不会影响其他控制域的正常工作。其中，每个控制域均可以包括供电单元、存储单元、计算单元、控制单元和处理单元。但是，上述多控制域的实现方式虽然可靠性较高，但结构较为复杂，尺寸较大，且成本较高。
而在本申请实施例中，参考图5和图6可知，该自动驾驶系统的控制系统中可以通过一个控制单元，例如第一控制单元01，实现对至少两个域的控制，如此节约成本，且不影响产品的可靠性。例如，该第一控制单元01和/或第二控制单元04可以对多个电源域中的被控单元进行统一控制，即各个电源域可以共用一个第一控制单元01和/或一个第二控制单元04。由此，可以减少控制单元的部署，可以有效降低控制系统的尺寸、结构复杂度和成本。
此外，由于本申请实施例提供的控制系统中还包括隔离单元或锁存单元，因此可以将第一控制单元的故障与被控单元隔离，从而有效确保了该控制系统工作时的可靠性。
本申请实施例还提供了一种运载工具，该运载工具可以包括上述实施例提供的控制系统，例如可以包括诸如图13所示的自动驾驶系统1000。其中，该运载工具可以包括路上交通工具、水上交通工具、空中交通工具、工业设备、农业设备或娱乐设备等。例如运载工具可以为车辆，该车辆为广义概念上的车辆，可以是交通工具(如商用车、乘用车、摩托车、飞行车、火车等)，工业车辆(如：叉车、挂车、牵引车等)，工程车辆(如挖掘机、推土车、吊车等)，农用设备(如割草机、收割机等)，游乐设备或玩具车辆等，本申请实施例对车辆的类型不作具体限定。再如，运载工具可以为飞机、或轮船等交通工具。
可选地，如图5、图6和图13所示，该运载工具还可以包括电池组件2000，该电池组件2000用于为控制系统中的供电单元供电。
可选地，如图5和图6所示，该电池组件2000可以包括多个电池，例如图5和图6中示出了电池1和电池2共2个电池。该多个电池均可以用于为控制系统中的各个供电单元供电。通过设置多个电池，可以确保在任一电池故障后，其他电池还能够继续为控制系统供电，从而有效提高了可靠性。
本申请中术语“至少一个”的含义是指一个或多个，本申请中术语“多个”的含义是指两个或两个以上。在本文中提及的“和/或”，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
以上所述，仅为本申请的实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (25)

  1. 一种控制系统，其特征在于，包括：第一控制单元、第一隔离单元和第一被控单元；
    所述第一控制单元与所述第一隔离单元连接，用于向所述第一隔离单元输出第一电平信号；
    所述第一隔离单元具有第一输入端、第二输入端和输出端，所述第一隔离单元用于通过所述第一输入端和所述第二输入端分别接收所述第一电平信号和第二电平信号，并通过所述输出端向所述第一被控单元输出第一控制信号；
    所述第一被控单元用于在所述第一控制信号的作用下向所述第一隔离单元的第二输入端输出所述第二电平信号。
  2. 根据权利要求1所述的控制系统，其特征在于，所述第一隔离单元包括：第一开关和逻辑运算电路，所述第一开关具有第一端和第二端，所述逻辑运算电路具有第一输入端、第二输入端和输出端；
    所述逻辑运算电路的第一输入端作为所述第一隔离单元的第一输入端，用于接收所述第一电平信号作为第一输入信号；
    所述第一开关的第一端作为所述第一隔离单元的第二输入端，用于接收所述第二电平信号，所述第一开关的第二端与所述逻辑运算电路的第二输入端连接，用于在所述第一开关导通时，向所述逻辑运算电路的第二输入端输出第二输入信号；
    所述逻辑运算电路用于对所述第一输入信号和所述第二输入信号进行逻辑运算，并通过输出端输出所述第一控制信号。
  3. 根据权利要求2所述的控制系统，其特征在于，所述逻辑运算电路用于对所述第一输入信号和所述第二输入信号执行或运算。
  4. 根据权利要求3所述的控制系统，其特征在于，所述逻辑运算电路为或门。
  5. 根据权利要求2至4任一所述的控制系统，其特征在于，所述第一开关包括：三极管或场效应晶体管。
  6. 根据权利要求2至5任一所述的控制系统，其特征在于，还包括：第二控制单元；
    所述逻辑运算电路还具有第三输入端，所述第二控制单元的输出端与所述第三输入端连接，并用于向所述逻辑运算电路输出第三电平信号作为所述逻辑运算电路的第三输入信号。
  7. 根据权利要求2至5任一所述的控制系统，其特征在于，还包括：第二控制单元；
    所述第一开关还具有第三端，所述第二控制单元的输出端与所述第一开关的第三端连接，并用于控制所述第一开关的第一端与第二端的通断状态。
  8. 根据权利要求6或7所述的控制系统，其特征在于，还包括：通信单元；
    所述通信单元与所述第二控制单元的输入端连接，并用于向所述第二控制单元输出故障检测指令。
  9. 根据权利要求1至8任一所述的控制系统，其特征在于，所述控制系统包括第一域和第二域，其中，所述第二域用于为所述第一域的部分或全部功能进行冗余备份，所述第一控制单元属于所述第一域，所述第一被控单元属于第二域。
  10. 根据权利要求1至9任一所述的控制系统，其特征在于，所述控制系统包括第一电源域和第二电源域，其中，所述第一控制单元属于所述第一电源域；
    所述第一被控单元为所述第二电源域的供电单元，所述第一控制信号用于控制所述第二电源域的供电单元上电或下电。
  11. 根据权利要求10所述的控制系统，其特征在于，所述第一控制单元由所述第一电源域的供电单元供电。
  12. 根据权利要求11所述的系统，其特征在于，所述第一电源域还包括第二控制单元、第一计算单元以及第一存储单元中的一项或多项，所述第一电源域的供电单元还用于为所述第二控制单元、第一计算单元、第一存储单元中的一项或多项供电。
  13. 根据权利要求10至12任一所述的控制系统，其特征在于，所述第二电源域还包括：第二计算单元和/或第二存储单元；
    所述第二电源域的供电单元用于为所述第二计算单元和/或所述第二存储单元供电。
  14. 根据权利要求10至13任一项所述的控制系统，其特征在于，所述第二电源域的供电单元包括：第一电压转换单元和第二电压转换单元；所述控制系统还包括：第二隔离单元；
    所述第一隔离单元用于向所述第一电压转换单元输出所述第一控制信号；
    所述第一控制单元还与所述第二隔离单元连接，并用于向所述第二隔离单元输出第四电平信号；
    所述第二隔离单元具有输入端和输出端，所述第二隔离单元用于通过其输入端接收所述第四电平信号，并在所述第四电平信号作用下通过其输出端向所述第二电压转换单元输出第二控制信号，所述第二控制信号用于控制所述第二电压转换单元上电或下电。
  15. 根据权利要求14所述的控制系统，其特征在于，所述第二隔离单元包括：第二开关，所述第二开关具有第一端、第二端和第三端；
    所述第二开关的第一端作为所述第二隔离单元的输入端，用于接收所述第四电平信号，所述第四电平信号用于控制所述第二开关的第二端与第三端的通断状态，所述第二开关的第二端作为所述第二隔离单元的输出端分别与电源端和所述第二电压转换单元的输入端连接，所述第二开关的第三端与接地端连接。
  16. 根据权利要求15所述的控制系统，其特征在于，所述第二开关的第一端通过第一电阻接地，且所述第二开关的第二端通过第二电阻与电源端连接。
  17. 根据权利要求15或16所述的控制系统，其特征在于，所述第二开关包括：三极管或场效应晶体管。
  18. 根据权利要求1至17任一所述的控制系统，其特征在于，还包括：第三隔离单元和第二被控单元；
    所述第一控制单元还与所述第三隔离单元连接，并用于向所述第三隔离单元输出第五电平信号；
    所述第三隔离单元具有第一输入端、第二输入端和输出端，所述第三隔离单元用于通过其第一输入端和第二输入端分别接收所述第五电平信号和第六电平信号，并通过其输出端向所述第二被控单元输出第三控制信号；
    所述第二被控单元用于在所述第三控制信号的作用下向所述第三隔离单元的第二输入端输出所述第六电平信号。
  19. 一种控制装置，其特征在于，包括：控制单元和隔离单元；
    所述控制单元与所述隔离单元连接，用于向所述隔离单元输出第一电平信号；
    所述隔离单元具有第一输入端、第二输入端和输出端，所述隔离单元用于通过所述第一输入端接收所述第一电平信号，通过所述第二输入端接收被控单元输出的第二电平信号，并通过所述输出端向所述被控单元输出控制信号；
    其中，所述控制信号用于控制所述被控单元输出所述第二电平信号。
  20. 根据权利要求19所述的控制装置，其特征在于，所述隔离单元包括：开关和逻辑运算电路，所述开关具有第一端和第二端，所述逻辑运算电路具有第一输入端、第二输入端和输出端；
    所述逻辑运算电路的第一输入端作为所述隔离单元的第一输入端，用于接收所述第一电平信号作为第一输入信号；
    所述开关的第一端作为所述隔离单元的第二输入端，用于接收所述第二电平信号，所述开关的第二端与所述逻辑运算电路的第二输入端连接，用于在所述开关导通时，向所述逻辑运算电路的第二输入端输出第二输入信号；
    所述逻辑运算电路用于对所述第一输入信号和所述第二输入信号进行逻辑运算，并通过输出端输出所述控制信号。
  21. 一种控制装置，其特征在于，包括：第一控制单元、第二控制单元和锁存单元；
    所述第一控制单元与所述锁存单元连接，用于向所述锁存单元输出第一电平信号；
    所述第二控制单元与所述锁存单元连接，用于向所述锁存单元输出第二电平信号；
    所述锁存单元具有第一输入端、第二输入端和输出端，所述锁存单元用于通过所述第一输入端和所述第二输入端分别接收所述第一电平信号和所述第二电平信号，在所述第一电平信号的作用下，对所述第二电平信号进行采样和锁存，并通过所述输出端向被控单元输出锁存的信号。
  22. 根据权利要求21所述的控制装置，其特征在于，所述锁存单元包括：边沿触发器。
  23. 根据权利要求21或22所述的控制装置，其特征在于，所述锁存单元还具有电源端；
    所述第二控制单元还与所述锁存单元的电源端连接，并用于控制所述锁存单元的上下电状态。
  24. 一种控制系统，其特征在于，包括如权利要求19至23任一项所述的控制装置和所述被控单元。
  25. 一种运载工具，其特征在于，包括：如权利要求1至18任一所述的控制系统，或者如权利要求24所述的控制系统。
PCT/CN2022/122884 2022-09-29 2022-09-29 控制装置、控制系统及运载工具 WO2024065509A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/122884 WO2024065509A1 (zh) 2022-09-29 2022-09-29 控制装置、控制系统及运载工具

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/122884 WO2024065509A1 (zh) 2022-09-29 2022-09-29 控制装置、控制系统及运载工具

Publications (1)

Publication Number Publication Date
WO2024065509A1 true WO2024065509A1 (zh) 2024-04-04

Family

ID=90475432

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/122884 WO2024065509A1 (zh) 2022-09-29 2022-09-29 控制装置、控制系统及运载工具

Country Status (1)

Country Link
WO (1) WO2024065509A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN202806629U (zh) * 2012-08-27 2013-03-20 比亚迪股份有限公司 一种高边驱动电路
CN109545158A (zh) * 2018-11-20 2019-03-29 惠科股份有限公司 一种保护信号产生电路和保护装置
CN109857180A (zh) * 2017-11-27 2019-06-07 华为终端有限公司 一种电源系统的控制方法及其设备
CN110311659A (zh) * 2018-03-27 2019-10-08 华为技术有限公司 一种触发器及集成电路
US20210004030A1 (en) * 2019-07-05 2021-01-07 M31 Technology Corporation Power management circuit and method for integrated circuit having multiple power domains

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN202806629U (zh) * 2012-08-27 2013-03-20 比亚迪股份有限公司 一种高边驱动电路
CN109857180A (zh) * 2017-11-27 2019-06-07 华为终端有限公司 一种电源系统的控制方法及其设备
CN110311659A (zh) * 2018-03-27 2019-10-08 华为技术有限公司 一种触发器及集成电路
CN109545158A (zh) * 2018-11-20 2019-03-29 惠科股份有限公司 一种保护信号产生电路和保护装置
US20210004030A1 (en) * 2019-07-05 2021-01-07 M31 Technology Corporation Power management circuit and method for integrated circuit having multiple power domains

Similar Documents

Publication Publication Date Title
CN106933094B (zh) 一种双余度机载飞控计算机
CN111791815B (zh) 车载电子控制装置
US20130231807A1 (en) Electronic control device and vehicle control system
CN101185049A (zh) 在运行和休眠模式中存储数据的电路和方法
JP2016172503A (ja) 車両用制御装置及び車両用制御システム
DE102013201596A1 (de) Fehlerdetektion und -abschwächung für eine verwaltung eines fahrzeuginternen lan-netzes
KR20190135261A (ko) 스위치 제어 회로 및 이를 포함하는 배터리 팩
US20020036520A1 (en) Wake-up circuit
US7295052B2 (en) Regenerative power-on control circuit
US8344541B1 (en) Reverse current protection methods and systems for trailer tow
EP3416231B1 (en) Battery module and storage battery system
CN110745021A (zh) 一种用于电动汽车充电枪电子锁的控制系统及控制方法
WO2024065509A1 (zh) 控制装置、控制系统及运载工具
US9519337B2 (en) Circuitry for controlling an output from an electronic control unit including two processors mutually monitoring each other
KR102617729B1 (ko) 릴레이의 동작 상태를 유지시키는 장치 및 이를 포함하는 전자장치
US20210365101A1 (en) Control system for controlling intelligent system to reduce power consumption based on bluetooth device
CN117002461A (zh) 一种单边epb冗余的制动控制系统及制动控制方法
CN112764699A (zh) 双显示切换装置、方法、服务器及存储介质
CN115051443A (zh) 用于无人车的相机供电装置及无人车
CN111516497B (zh) 负载控制方法及电路、电池管理系统及车辆
CN113422499A (zh) 双mcu隔离驱动mos管的电路
US6822479B1 (en) I/O buffer power up sequence
CN117093403B (zh) 看门狗控制电路及其控制方法、电子设备
CN112141022A (zh) 电子控制系统及交通工具
CN114204809B (zh) 一种动力输出电路的控制装置及供电系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22960145

Country of ref document: EP

Kind code of ref document: A1