Autonomous vehicle critical load backup

A vehicle power management system includes a backup battery and an isolation circuit. The isolation circuit has a switch in parallel with a diode. The isolation circuit is electrically connected to the backup battery. The isolation circuit electrically isolates the backup battery from a non-critical load when the switch is open.

BACKGROUND

The Society of Automotive Engineers (SAE) has defined multiple levels of autonomous vehicle operation. At levels 0-2, a human driver monitors or controls the majority of the driving tasks, often with no help from the vehicle. For example, at level 0 (“no automation”), a human driver is responsible for all vehicle operations. At level 1 (“driver assistance”), the vehicle sometimes assists with steering, acceleration, or braking, but the driver is still responsible for the vast majority of the vehicle control. At level 2 (“partial automation”), the vehicle can control steering, acceleration, and braking under certain circumstances without human interaction. At levels 3-5, the vehicle assumes more driving-related tasks. At level 3 (“conditional automation”), the vehicle can handle steering, acceleration, and braking under certain circumstances, as well as monitoring of the driving environment. Level 3 requires the driver to intervene occasionally, however. At level 4 (“high automation”), the vehicle can handle the same tasks as at level 3 but without relying on the driver to intervene in certain driving modes. At level 5 (“full automation”), the vehicle can handle almost all tasks without any driver intervention.

DETAILED DESCRIPTION

Certain systems require continuous power, especially when no manually powered backup system is available. Examples of systems needing continuous power include life support systems, medical systems, aircraft control systems, certain vehicle control systems, and various alarm systems such as fire, smoke, and noxious gas detection systems. In the automotive context, an autonomous vehicle, while in motion, benefits from continuously powering the steering and braking actuators since a driver may not be available to manually operate the steering wheel and brakes.

Continuous power supplies are designed to be robust to various types of faults. Adding redundancy, which could include using two or more isolated power supply busses, is one way to improve robustness. Backup energy storage systems, such as backup batteries, can provide redundancy to main generators or energy storage systems for a period of time dictated by the installed storage capacity and the actual loads applied. When critical controls (sometimes referred to as “system critical loads”) share stored power with non-critical loads and the energy storage system is unable to fully power both the critical and non-critical loads, shedding the non-critical loads can make more power available to the system critical loads for a longer period of time. Shedding loads can involve sending a network shed request to the non-critical loads commanding the non-critical load to deactivate. Alternatively or in addition, the non-critical load can be disconnected from the energy storage system by, e.g., opening a relay if the non-critical load does not or cannot execute a shed request. Another issue arises when the critical loads, non-critical loads, and backup battery are arranged in parallel in a circuit. In that instance, certain failures of the non-critical load can cause the backup battery to short to ground, taking electrical energy away from the critical loads.

An example vehicle power management system that prevents the failure of non-critical loads from diverting power away from critical loads includes a backup battery and an isolation circuit. The isolation circuit has a switch in parallel with a diode. The isolation circuit is electrically connected to the backup battery. The isolation circuit electrically isolates the backup battery from a non-critical load when the switch is open.

In the vehicle power management system, an anode of the first diode is electrically connected to the first non-critical load and a cathode of the first diode is electrically connected to the first backup battery. The vehicle power management system may include a second backup battery and a second isolation circuit. The second isolation circuit may have a second switch in parallel with a second diode to electrically isolate the second backup battery from a second non-critical load. The second isolation circuit may be electrically connected to the second backup battery to electrically isolate the second backup battery from a second non-critical load when the second switch is open. The vehicle power management system may further include a first voltage converter electrically connected to the first non-critical load, the first isolation circuit, and the first backup battery. The vehicle power management system may further include a second voltage converter electrically connected to the second non-critical load, the second isolation circuit, and the second backup battery. A high output voltage of the first voltage converter to the first isolation circuit may close the first switch of the first isolation circuit. A high output voltage of the second voltage converter to the second isolation circuit may close the second switch of the second isolation circuit. A reduction of voltage at a circuit junction between the first voltage converter and the first isolation circuit may open the first switch of the first isolation circuit. A reduction of voltage at a circuit junction between the second voltage converter and the second isolation circuit may open the second switch of the second isolation circuit.

The first voltage converter may be electrically connected to the second isolation circuit and the second voltage converter may be electrically connected to the first isolation circuit. In that approach, a high output voltage of the second voltage converter to the first isolation circuit may close the first switch of the first isolation circuit. Further, a high output voltage of the first voltage converter to the second isolation circuit may close the second switch of the second isolation circuit. A reduction of voltage at a circuit junction between the second voltage converter and the first isolation circuit may open the first switch of the first isolation circuit. A reduction of voltage at a circuit junction between the first voltage converter and the second isolation circuit may open the second switch of the second isolation circuit.

The second backup battery may be electrically connected to the first isolation circuit. The first backup battery may be electrically connected to the second isolation circuit.

A high voltage power source may be electrically connected through a voltage converter to the first isolation circuit, the first backup battery, the second isolation circuit, and the second backup battery. The first switch of the first isolation circuit may open as a result of an output voltage of the first backup battery to the first isolation circuit exceeding an output voltage of the voltage converter to the first isolation circuit. The second switch of the second isolation circuit may open as a result of an output voltage of the second backup battery to the second isolation circuit exceeding an output voltage of the voltage converter to the second isolation circuit.

The first switch of the first isolation circuit may be closed while an output voltage of the first backup battery to the first isolation circuit is below an output voltage of the voltage converter to the first isolation circuit. The second switch of the second isolation circuit may be closed while an output voltage of the second backup battery to the second isolation circuit is below an output voltage of the voltage converter to the second isolation circuit.

The vehicle power management system may include a memory and a processor programmed to execute instructions stored in the memory. The instructions may include detecting a short-circuit and outputting a control signal to open at least one of the first switch and the second switch as a result of detecting the short-circuit. Detecting the short-circuit may include detecting a failure of the first non-critical load. Outputting the control signal may include outputting the control signal to open the first switch as a result of detecting the failure of the first non-critical load. Detecting the short-circuit may include detecting a failure of the second non-critical load. Outputting the control signal may include outputting the control signal to open the second switch as a result of detecting the failure of the second non-critical load.

Another implementation of the vehicle power management system may include a first backup battery, a first isolation circuit having a first switch in parallel with a first diode where the first isolation circuit is electrically connected to the first backup battery to electrically isolate the first backup battery from a first non-critical load when the first switch is open, a second backup battery, and a second isolation circuit having a second switch in parallel with a second diode to electrically isolate the second backup battery from a second non-critical load where the second isolation circuit is electrically connected to the second backup battery to electrically isolate the second backup battery from a second non-critical load when the second switch is open. The vehicle power management system may further include a first voltage converter electrically connected to the first non-critical load, the first isolation circuit, the first backup battery, the second non-critical load, the second isolation circuit, and the second backup battery. A second voltage converter may be electrically connected to the first non-critical load, the first isolation circuit, the first backup battery, the second non-critical load, the second isolation circuit, and the second backup battery. The vehicle power management system may further include a memory and a processor programmed to execute instructions stored in the memory. The instructions may include detecting a short-circuit and outputting a control signal to open at least one of the first switch and the second switch as a result of detecting the short-circuit.

A reduction of voltage at a circuit junction between the first voltage converter and the first isolation circuit may open the first switch of the first isolation circuit. A reduction of voltage at a circuit junction between the second voltage converter and the second isolation circuit may open the second switch of the second isolation circuit.

A reduction of voltage at a circuit junction between the second voltage converter and the first isolation circuit may open the first switch of the first isolation circuit. A reduction of voltage at a circuit junction between the first voltage converter and the second isolation circuit may open the second switch of the second isolation circuit.

The elements shown may take many different forms and include multiple and/or alternate components and facilities. The example components illustrated are not intended to be limiting. Indeed, additional or alternative components and/or implementations may be used. Further, the elements shown are not necessarily drawn to scale unless explicitly stated as such.

As illustrated inFIG. 1, the autonomous host vehicle100includes a virtual driver system105, an automated vehicle platform (“AVP”)110, and a power management system115. At least some parts of the virtual driver system105, the power management system115, or both, may be implemented by a vehicle computer.

The virtual driver system105is a computing platform, implemented via sensors120, controllers, circuits, chips, and other electronic components, that control various autonomous operations of the host vehicle100. The virtual driver system105includes an autonomous vehicle controller programmed to process the data captured by the sensors120, which may include a lidar sensor, a radar sensor, a camera, ultrasonic sensors, etc. The autonomous vehicle controller is programmed to output control signals to components of the automated vehicle platform110to autonomously control the host vehicle100according to the data captured by the sensors120.

The automated vehicle platform110refers to the components that carry out the autonomous vehicle operation upon instruction from the virtual driver system105, and specifically, from the autonomous vehicle controller. As such, the automated vehicle platform110includes various actuators incorporated into the host vehicle100that control the steering, propulsion, and braking of the host vehicle100. The automated vehicle platform110further includes various platform controllers (sometimes referred to in the art as “modules”), such as a chassis controller, a powertrain controller, a body controller, an electrical controller, etc.

The power management system115, described in greater detail below, electrically isolates a backup battery from non-critical loads when one or more non-critical loads fails, especially in instances where the failure of the non-critical load would otherwise cause the backup battery to short to ground. Electrically isolating the backup battery from non-critical loads means that the non-critical loads are unable to draw energy from the backup battery. The power management system115is described in more detail below with respect toFIG. 2. As shown inFIG. 1, components of the power management system115include a high voltage power source125, voltage converters130, and low-voltage batteries135, all of which are described in more detail below with respect toFIG. 2. Example critical loads140are also shown inFIG. 1and described in greater detail below with respect toFIG. 2.

Although illustrated as a sedan, the host vehicle100may include any passenger or commercial automobile such as a car, a truck, a sport utility vehicle, a crossover vehicle, a van, a minivan, a taxi, a bus, etc. As discussed above, the host vehicle100is an autonomous vehicle that can operate in an autonomous (e.g., driverless) mode (SAE levels 4-5), a partially autonomous mode (e.g., SAE levels 1-3), and/or a non-autonomous mode (e.g., SAE level 0).

Referring now toFIG. 2, a circuit200implementing the power management system115may include the high voltage power source125, voltage converters130such as a first voltage converter130A and a second voltage converter130B, low-voltage batteries135including a first backup battery135A and a second backup battery135B, a first critical load140A, a second critical load140B, a first isolation circuit145A, a second isolation circuit145B, and a battery controller150having a memory155and a processor160. Other components shown inFIG. 2include a powertrain controller165, an engine controller170, and an AVP interface controller175. While described as part of the battery controller150, the memory155and processor160may be incorporated into one or more of the first voltage converter130A, the second voltage converter130B, the powertrain controller165, the engine controller170, the AVP interface controller175, and the battery controller150.

The high voltage power source125is a high voltage battery or high voltage generator in the host vehicle100that provides electrical energy to components of the host vehicle100. The high voltage power source125powers the critical loads140and the non-critical loads under normal circumstances (e.g., when the critical loads140and high voltage power source125are working properly). The output of the high voltage power source125may be on the order of several hundred volts in some instances, such as when the high voltage power source125is used in an electric vehicle or a hybrid vehicle (i.e., a vehicle where propulsion can be powered by the high voltage power source125, an internal combustion engine, or both). The output of the high voltage power source125may be in the form of direct current (DC).

The first voltage converter130A and the second voltage converter130B may be implemented via circuits, chips, or other electronic components that convert the output of the high voltage power source125to a different voltage. For instance, the first voltage converter130A and the second voltage converter130B may include circuits to reduce the DC output of the high voltage power source125to a lower DC output. Thus, the first voltage converter130A and the second voltage converter130B may be DC-to-DC converters. In one possible implementation, the output of the first voltage converter130A and the output of the second voltage converter130B may be on the order of 12 volts DC. The first voltage converter130A and second voltage converter130B may be electrically connected in parallel to the high voltage power source125. The first voltage converter130A and the second voltage converter130B may be further arranged in parallel with various non-critical loads. For instance, the first voltage converter130A may be electrically connected to a first non-critical load180A and the second voltage converter130B may be electrically connected to a second non-critical load180B. The first non-critical load180A and second non-critical load180B may represent vehicle systems that draw electrical energy from the high voltage power source125but are not involved in the movement of the host vehicle100or passenger safety. Examples of non-critical loads may include the infotainment system, climate controls, door lock actuators, power windows, liftgate actuators, among others. The first voltage converter130A and second voltage converter130B are redundant to one another. Thus, the first voltage converter130A may provide power to the second non-critical load180B should the second voltage converter130B fail. Likewise, the second voltage converter130B may provide power to the first non-critical load180A should the first voltage converter130A fail. Further, although the singular form is used for purposes of clarity and convenience, the “first non-critical load180A” may refer to a first group of non-critical loads and the “second non-critical load180B” may refer to a second group of non-critical loads. One or more non-critical loads in the first group of non-critical loads may be the same as one or more non-critical loads in the second group of non-critical loads. In other words, there may be some overlap between the groups of non-critical loads.

The first backup battery135A and second backup battery135B are batteries of the host vehicle100that power the critical loads140. The output of the first backup battery135A and the second backup battery135B may be a DC voltage lower than that of the high voltage power source125. For instance, the output of the first backup battery135A and the second backup battery135B may be on the order of 12 volts DC. The first backup battery135A may be electrically arranged in parallel relative to the first critical load140A and the first non-critical load180A. The second backup battery135B may be electrically arranged in parallel relative to the second critical load140B and the second non-critical load180B. The critical loads140may refer to components of the host vehicle100that draw electrical energy and are involved in the movement of the host vehicle100or passenger safety. Examples of critical loads140may include actuators that control braking, steering, or acceleration of the host vehicle100, actuators involved in the deployment of airbags and restraint devices, etc. The first backup battery135A and second backup battery135B may be redundant to one another. Thus, the first backup battery135A may provide power to the second critical load140B should the second backup battery135B fail or be otherwise unavailable, as discussed below. Likewise, the second backup battery135B may provide power to the first critical load140A should the first backup battery135A fail or be otherwise unavailable, as discussed below. Further, although the singular form is used for purposes of clarity and convenience, the “first critical load140A” may refer to a first group of critical loads140and the “second critical load140B” may refer to a second group of critical loads140. One or more critical loads140in the first group of critical loads140may be the same as one or more critical loads140in the second group of critical loads140. In other words, there may be some overlap between the groups of critical loads140. Moreover, as shown inFIG. 2, the first backup battery135A is electrically connected to the first voltage converter130A. The second backup battery135B is electrically connected to the second voltage converter130B.

The first isolation circuit145A and second isolation circuit145B are each implemented via electronic components. The first isolation circuit145A includes a first diode185A arranged in the circuit200in parallel with a first switch190A. An anode of the first diode185A is electrically connected to the first non-critical load180A and a cathode of the first diode185A is electrically connected to the first backup battery135A. The second isolation circuit145B includes a second diode185B arranged in the circuit200in parallel with a second switch190B. An anode of the second diode185B is electrically connected to the second non-critical load180B and a cathode of the second diode185B is electrically connected to the second backup battery135B. In some instances, the first isolation circuit145A and second isolation circuit145B may be implemented via relays such as solid-state relays that, e.g., omit the first diode185A and the second diode185B, respectively. An example solid-state relay may include a field effect transistor (FET). The first switch190A and the second switch190B may be controlled by the processor160executing instructions stored in the memory155. Thus, the output of the processor160may open or close the first switch190A, the second switch190B, or both. Referring to the first isolation circuit145A, the first diode185A prevents the first non-critical load180A from drawing current from the first backup battery135A. When the first switch190A is open, current flow cannot bypass the first diode185A. As a result, the first non-critical load180A cannot draw current from the first backup battery135A. When the first switch190A is closed, current flow bypasses the first diode185A. As a result, the first non-critical load180A can draw current from the first backup battery135A. In other words, the first diode185A electrically isolates the first backup battery135A from the first non-critical load180A when the first switch190A is open. Referring now to the second isolation circuit145B, the second diode185B prevents the second non-critical load180B from drawing current from the second backup battery135B. When the second switch190B is open, current flow cannot bypass the second diode185B. As a result, the second non-critical load180B cannot draw current from the second backup battery135B. When the second switch190B is closed, current flow bypasses the second diode185B. As a result, the second non-critical load180B can draw current from the second backup battery135B. In other words, the second diode185B electrically isolates the second backup battery135B from the second non-critical load180B when the second switch190B is open.

The battery controller150is implemented via circuits, chips, or other electronic components that control various operations of the high voltage power source125, the first backup battery135A, the second backup battery135B, the first voltage converter130A, the second voltage converter130B, and possibly other components of the power management system115such as the first switch190A of the first isolation circuit145A, the second switch190B of the second isolation circuit145B, etc. The powertrain controller165is implemented via circuits, chips, or other electronic components that control various powertrain components of the host vehicle100. The engine controller170is implemented via circuits, chips, or other electronic components that control the internal combustion engine of the host vehicle100. The AVP interface controller175is implemented via circuits, chips, or other electronic components that control various components of the host vehicle100that carry out autonomous vehicle operations. The AVP interface controller175may be programmed to interface with the virtual driver system105, the components of the autonomous vehicle platform, etc.

The memory155is implemented via circuits, chips or other electronic components and can include one or more of read only memory (ROM), random access memory (RAM), flash memory, electrically programmable memory (EPROM), electrically programmable and erasable memory (EEPROM), embedded MultiMediaCard (eMMC), a hard drive, or any volatile or non-volatile media etc. The memory155may store instructions executable by the processor160and data. The instructions and data stored in the memory155may be accessible to the processor160and possibly other components of the power management system115, the host vehicle100, or both.

The processor160is implemented via circuits, chips, or other electronic component and may include one or more microcontrollers, one or more field programmable gate arrays (FPGAs), one or more application specific integrated circuits (ASICs), one or more digital signal processors (DSPs), one or more customer specific integrated circuits, etc. The processor160may be incorporated into any one or more of the first voltage converter130A, the second voltage converter130B, the battery controller150, the powertrain controller165, the engine controller170, and the AVP interface controller175. The processor160may be programmed to detect a short-circuit, excessive current draw from the non-critical loads, or both, and output control signals to open or close the first switch190A, the second switch190B, or both, as a result of detecting the short-circuit and/or the excessive current draw.

The processor160may be programmed to control the operation of the first switch190A, the second switch190B, or both, by outputting control signals that cause the first switch190A, the second switch190B, or both, to either open or close under various conditions. For example, the first switch190A and the second switch190B may be implemented via, e.g., a transistor or a relay that can be controlled by the signal output of the processor160. In general, the processor160may be programmed to keep the first switch190A, the second switch190B, or both, closed when, e.g., the first voltage converter130A, the second voltage converter130B, or both, respectively, are working properly. The processor160may be programmed to open the first switch190A, the second switch190B, or both, when a failure causing a short-circuit is detected. Detecting the short-circuit may include detecting a failure of the first non-critical load180A. In that instance, the processor160may be programmed to output the control signal to open the first switch190A as a result of detecting the failure of the first non-critical load180A. Likewise, detecting the short-circuit may include detecting a failure of the second non-critical load180B. In that instance, the processor160may be programmed to output the control signal to open the second switch190B as a result of detecting the failure of the second non-critical load180B. The processor160may be further or alternatively programmed to open the first switch190A, the second switch190B, or both, as a result of detecting an excessive current draw by the first non-critical load180A, the second non-critical load180B, or both. Detecting the excessive current draw of the first non-critical load180A or the second non-critical load180B may include monitoring the current provided to the first non-critical load180A and the second non-critical load180B, respectively.

Alternatively or in addition, sometime the state of the first switch190A, the second switch190B, or both, may change in accordance with the voltage output of the high voltage power source125, the first voltage converter130A, the second voltage converter130B, the first backup battery135A, the second backup battery135B, or a combination thereof. For example, in one possible approach, a high output voltage (e.g., a voltage on the order of 12 volts DC) of the first voltage converter130A to the first isolation circuit145A may cause the first switch190A to close. A high output voltage of the second voltage converter130B to the second isolation circuit145B closes may cause the second switch190B to close.

In some instances, a reduction of voltage at a circuit junction (e.g., a change in voltage from the sufficiently high output voltage to a much lower voltage, such as a voltage on the order of 0 volts DC) between the first voltage converter130A and the first isolation circuit145A may cause the first switch190A to open. A voltage drop (i.e., a reduction of voltage at a circuit junction) between the second voltage converter130B and the second isolation circuit145B may cause the second switch190B to open. Such voltage drops may be caused by a short-circuit in one the first non-critical load180A or the second non-critical load180B, respectively. The processor160, as discussed above, may be programmed to detect short-circuits and output control signals to open or close the first switch190A, the second switch190B, or both, as a result of detecting the short-circuit. Alternatively or in addition, the state of the first switch190A, the second switch190B, or both, may be based on the output voltages of the first backup battery135A, the second backup battery135B, or both, relative to the output voltage of the high voltage power source125, as discussed in greater detail below.

As shown inFIG. 2, the first voltage converter130A is electrically connected to the second isolation circuit145B and the second voltage converter130B is electrically connected to the first isolation circuit145A. In that instance, a high output voltage of the second voltage converter130B relative to the first isolation circuit145A may close the first switch190A. Further, a high output voltage of the first voltage converter130A to the second isolation circuit145B may close the second switch190B. A voltage drop between the second voltage converter130B and the first isolation circuit145A may open the first switch190A. A voltage drop between the first voltage converter130A and the second isolation circuit145B may open the second switch190B.

In another possible implementation, the second backup battery135B is electrically connected to the first isolation circuit145A and the first backup battery135A is electrically connected to the second isolation circuit145B. In that implementation, the voltage output of the second backup battery135B may control the state of the first switch190A and the voltage output of the first backup battery135A may control the state of the second switch190B. For example, a high output voltage of the second backup battery135B may cause the first switch190A to close, especially if the output voltage of the second backup battery135B can power the second critical load140B. Closing the first switch190A may allow the first backup battery135A to power the first non-critical load180A. Alternatively, a high output voltage of the first backup battery135A may cause the second switch190B to close, especially if the output voltage of the first backup battery135A can power the first critical load140A. Closing the second switch190B may allow the second backup battery135B to power the second non-critical load180B.

The first backup battery135A may also be able to control the state of the first switch190A. That is, the first switch190A may open as a result of the output voltage of the first backup battery135A exceeding the output voltage of the first voltage converter130A provided to the first isolation circuit145A. The first switch190A may be closed while the output voltage of the first backup battery135A to the first isolation circuit145A is below the output voltage of the first voltage converter130A to the first isolation circuit145A. Likewise, the second backup battery135B may be able to control the state of the second switch190B. That is, the second switch190B may open as a result of the output voltage of the second backup battery135B exceeding the output voltage of the second voltage converter130B provided to the second isolation circuit145B. The second switch190B may be closed while the output voltage of the second backup battery135B to the second isolation circuit145B is below the output voltage of the second voltage converter130B to the second isolation circuit145B.

FIG. 3is a flowchart of an example process300that may be implemented by one or more components of the power management system115to manipulate the state of the first switch190A, the second switch190B, or both under various circumstances. The process300may begin at any time while, e.g., the host vehicle100is operating. The process300may continue to execute until, e.g., the host vehicle100is no longer in use. The process300is just one way to manipulate the states of the first switch190A and the second switch190B. For example, rather than perform the process300, the states of the first switch190A and second switch190B may change in accordance with the output voltage of one component of the power management system115relative to another component of the power management system115. That is, as previously explained, the states of the first switch190A, the second switch190B, or both, may change based on the output voltage of one of the following devices relative to the output voltage of another of the following devices: the high voltage power source125, the first voltage converter130A, the first backup battery135A, the second voltage converter130B, and the second backup battery135B.

At block305, the power management system115determines a circuit state. The circuit state may include data representing whether any short-circuits caused by failures of the first voltage converter130A, the second voltage converter130B, the first non-critical load180A, the second non-critical load180B, etc., have been detected in the circuit200. The circuit state may also or alternatively indicate an excessive current draw by the first non-critical load180A, the second non-critical load180B, or both. The processor160may determine the circuit state by monitoring the output voltages of the any one or more of the high voltage power source125, the first voltage converter130A, the first backup battery135A, the second voltage converter130B, and the second backup battery135B or the current provided to the first non-critical load180A and the second non-critical load180B. The processor160may further or alternatively determine the circuit state by monitoring the voltage across the first non-critical load180A and the second non-critical load180B. Examples of circuit states may include, e.g., normal operation of the circuit200, a short-circuit across the first non-critical load180A, excessive current draw by the first non-critical load180A, a short-circuit across the second non-critical load180B, excessive current draw by the second non-critical load180B, a failure of the first voltage converter130A, a failure of the second voltage converter130B, a state of the first backup battery135A (e.g., whether the first backup battery135A can power the first critical load140A, the first non-critical load180A, both, or neither), a state of the second backup battery135B (e.g., whether the second backup battery135B can power the second critical load140B, the second non-critical load180B, both, or neither), or the like.

At decision block310, the power management system115determines whether to open the first switch190A. Since normal operation of the circuit200shown inFIG. 2would have the first switch190A closed, the processor160determines at block310if the circuit state indicates a reason to open the first switch190A. Examples of reasons to open the first switch190A may include detecting a short-circuit across the first non-critical load180A, excessive current draw by the first non-critical load180A, a short-circuit across the second non-critical load180B, excessive current draw across the second non-critical load180B, a failure of the first voltage converter130A, or a failure of the second voltage converter130B. Opening the first switch190A in those instances will isolate the first backup battery135A from the failed component of the circuit200, thereby prevent the short-circuit or excessive current draw from draining the first backup battery135A. As a result, the output voltage of the first back-up battery will be available to power the first critical load140A. Not all short-circuits or excessive current draws may warrant isolating the first back-up battery by opening the first switch190A, however. Examples of reasons to keep the first switch190A closed despite detecting a short-circuit or excessive current draw may include determining that the first back-up battery can power the first critical load140A and at least one of the first non-critical load180A and the second non-critical load180B. If the processor160determines to open the first switch190A, the process300may proceed to block315. If the processor160decides that the first switch190A should remain closed, the process300may proceed to block325.

At block315, the power management system115generates a control signal for the first switch190A to open. The processor160may be programmed to generate the control signal commanding the first switch190A to open.

At block320, the power management system115outputs the control signal generated at block315to the first switch190A. The processor160may be programmed to output the control signal to the first switch190A, and the first switch190A may open as a result of receiving the control signal.

At decision block325, the power management system115determines whether to open the second switch190B. Since normal operation of the circuit200shown inFIG. 2would have the second switch190B closed, the processor160determines at block325if the circuit state indicates a reason to open the second switch190B. Examples of reasons to open the second switch190B may include detecting a short-circuit across the first non-critical load180A, excessive current draw by the first non-critical load180A, a short-circuit across the second non-critical load180B, excessive current draw across the second non-critical load180B, a failure of the first voltage converter130A, or a failure of the second voltage converter130B. Opening the second switch190B in those instances will isolate the second backup battery135B from the failed component of the circuit200, thereby prevent the short-circuit or excessive current draw from draining the second backup battery135B. As a result, the output voltage of the second back-up battery will be available to power the second critical load140B. Not all short circuits or excessive current draws may warrant isolating the second back-up battery by opening the second switch190B, however. Examples of reasons to keep the second switch190B closed despite detecting a short-circuit or excessive current draw may include determining that the second back-up battery can power the second critical load140B and at least one of the first non-critical load180A and the second non-critical load180B. If the processor160determines to open the second switch190B, the process300may proceed to block330. If the processor160decides that the second switch190B should remain closed, the process300may proceed to block340.

At block330, the power management system115generates a control signal for the second switch190B to open. The processor160may be programmed to generate the control signal commanding the second switch190B to open.

At block335, the power management system115outputs the control signal generated at block330to the second switch190B. The processor160may be programmed to output the control signal to the second switch190B, and the second switch190B may open as a result of receiving the control signal.

At block340, the power management system115reevaluates the circuit state. For instance, the processor160may reevaluate whether the circuit state has changed since block305since the new circuit state could warrant changing the state of the first switch190A, the second switch190B, or both. The process300may proceed to block345after the circuit state has been reevaluated.

At decision block345, the power management system115determines whether to close the first switch190A. Since normal operation of the circuit200shown inFIG. 2would have the first switch190A closed, the processor160determines at block345if the circuit state indicates a reason to close the first switch190A based on the circuit state determined at block340. Examples of reasons to close the first switch190A may include determining that the first switch190A was opened based on the circuit state at block305but that the circuit state has changed in a way that there is no longer a short-circuit across the first non-critical load180A, excessive current draw by the first non-critical load180A, a short-circuit across the second non-critical load180B, excessive current draw across the second non-critical load180B, a failure of the first voltage converter130A, or a failure of the second voltage converter130B. In other words, the processor160may decide to close the first switch190A if the first backup battery135A no longer needs to be isolated from the first non-critical load180A. If the processor160decides to close the first switch190A, the process300may proceed to block350. If the processor160decides that the first switch190A should remain open or that the state of the first switch190A should not change (which may occur if the first switch190A was not opened as a result of block310), the process300may proceed to block360.

At block350, the power management system115generates a control signal for the first switch190A to close. The processor160may be programmed to generate the control signal commanding the first switch190A to close.

At block355, the power management system115outputs the control signal generated at block350to the first switch190A. The processor160may be programmed to output the control signal to the first switch190A, and the first switch190A may close as a result of receiving the control signal.

At decision block360, the power management system115determines whether to close the second switch190B. Since normal operation of the circuit200shown inFIG. 2would have the second switch190B closed, the processor160determines at block360if the circuit state indicates a reason to close the second switch190B based on the circuit state determined at block340. Examples of reasons to close the second switch190B may include determining that the second switch190B was opened based on the circuit state at block305but that the circuit state has changed in a way that there is no longer a short-circuit across the first non-critical load180A, excessive current draw by the first non-critical load180A, a short-circuit across the second non-critical load180B, excessive current draw across the second non-critical load180B, a failure of the first voltage converter130A, or a failure of the second voltage converter130B. In other words, the processor160may decide to close the second switch190B if the second backup battery135B no longer needs to be isolated from the second non-critical load180B. If the processor160decides to close the second switch190B, the process300may proceed to block365. If the processor160decides that the second switch190B should remain open or that the state of the second switch190B should not change (which may occur if the second switch190B was not opened as a result of block310), the process300may return to block305.

At block365, the power management system115generates a control signal for the second switch190B to close. The processor160may be programmed to generate the control signal commanding the second switch190B to close.

At block370, the power management system115outputs the control signal generated at block365to the second switch190B. The processor160may be programmed to output the control signal to the second switch190B, and the second switch190B may close as a result of receiving the control signal.