Control method for preventing DSP (Digital Signal Processor) fault of energy storage converter from influencing reliability of equipment

Abstract

The invention relates to a control method for preventing equipment reliability from being affected by energy storage converter DSP faults, and belongs to the technical field of energy storage converters, a DSP and FPGA combined controller composed of a CPU 1 and a CPU 2 is adopted, and the following steps are executed: heartbeat packets are sent between the CPU 1 and the CPU 2 and verified, heartbeat packets are sent between the CPU 1 and the FPGA and verified, and the heartbeat packets are sent between the CPU 2 and the FPGA and verified. When the CPU 1 is judged to be in fault, at least one of the pulse enable switches 1, 2 and 3 is turned off by the FPGA, when the CPU 2 is judged to be in fault, one of the pulse enable switches 1 and 3 is turned off by the CPU 1 or the FPGA, so that at least one component of the alternating-current relay, the IGBT and the direct-current relay is turned off, and when the FPGA is judged to be in fault, the pulse enable switches 1, 2 and 3 are all turned off. The advantages of a multi-core heterogeneous platform are fully utilized, maloperation and refusal operation caused by the fact that a single intelligent device controls the relay are avoided, and the equipment reliability is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of energy storage converters, and in particular relates to a control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability. Background Art

[0002] Power Conversion System (PCS) is a device in an electrochemical energy storage system that is connected between the battery system and the power grid and / or load to achieve bidirectional conversion of electric energy. It can control the charging and discharging process of the battery and perform AC / DC conversion. When the battery assembly is discharging, the DC power generated by it is inverted into three-phase AC power, and the power is fed back into the power grid, or a stable and appropriate voltage and frequency is provided for the load in the isolated grid; when the battery is charging, the three-phase industrial frequency AC power in the power grid is rectified into DC power and fed into the DC bus.

[0003] Therefore, when the control system chip DSP of the energy storage converter fails, it is necessary to take timely and reliable measures to disconnect several primary electrical devices such as AC relays, DC relays, IGBTs, etc., to protect personnel safety and PCS key components and prevent the scope of the accident from further expanding.

[0004] However, the current control method does not take into account the situation where the DSP or FPAG chip cannot control the AC and DC relays when it malfunctions due to program errors, crystal failures, power supply fluctuations, etc., resulting in a DSP failure in the energy storage inverter that affects the control of the equipment and makes it impossible to shut down the equipment, causing the scope of the accident to expand. Summary of the invention

[0005] The purpose of the present invention is to provide a control method to prevent the DSP failure of the energy storage converter from affecting the reliability of the equipment, and to use the advantages of a multi-core heterogeneous platform to avoid malfunction and refusal to operate caused by a single intelligent device controlling the relay, thereby improving the reliability of the equipment.

[0006] The technical solution is as follows:

[0007] A control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability, using a controller composed of a DSP and an FPGA composed of a CPU1 and a CPU2, wherein both the DSP and the FPGA control the on and off of an AC relay through a pulse enable switch 1 and the on and off of a DC relay through a pulse enable switch 3, and the FPGA controls whether a bus level converter outputs PWM pulses to an IGBT and a drive circuit through a pulse enable switch 2, and performs the following steps:

[0008] Step S1: CPU1 and CPU2 of DSP send heartbeat packets to each other through the inter-core bus and check and judge the status of each other. If it is judged that CPU1 is faulty, it goes to step S3; if it is judged that CPU2 is faulty, it goes to step S4; if there is no fault, it goes to step S2;

[0009] Step S2: CPU1 and FPGA send heartbeat packets to each other through the external memory interface bus and verify each other to determine the status of each other. If it is determined that CPU1 fails, go to step S3; if it is determined that FPGA fails, go to step S5; if there is no failure, go back to step S1;

[0010] Step S3: the FPGA turns off at least one of the pulse enable switch 1, the pulse enable switch 2, and the pulse enable switch 3, so that at least one component of the AC relay, the IGBT, and the DC relay is disconnected, thereby stopping the operation of the energy storage converter;

[0011] Step S4: CPU1 or FPGA turns off one of the pulse enable switch 1 and the pulse enable switch 3, or FPGA turns off the bus level converter through the pulse enable switch 2, so that at least one component of the AC relay, IGBT, and DC relay is disconnected, thereby stopping the operation of the energy storage converter;

[0012] Step S5: Pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 are all turned off due to the loss of the pulse enable signal provided by the FPGA, so that the AC relay, IGBT and DC relay are all disconnected, thereby stopping the operation of the energy storage converter.

[0013] Furthermore, CPU1 is used for abnormal protection logic and external communication, CPU2 is used for grid-connected control algorithm, and FPGA is responsible for suppressing three-phase PWM narrow pulses, interlocking internal and external tube protection, and monitoring DSP operating status.

[0014] Furthermore, in step S1, when CPU1 does not receive the heartbeat sent by CPU2 within 2 Task1 cycles, it is determined that CPU2 is faulty; when CPU2 does not receive the heartbeat sent by CPU1 within 2 Task1 cycles, it is determined that CPU1 is faulty.

[0015] Furthermore, in step S2, when FPGA does not receive the heartbeat sent by CPU1 within 1.5 Task1 cycles, it is determined that CPU1 is faulty; when CPU1 does not receive the heartbeat sent by FPGA within 2 Task1 cycles, it is determined that FPGA is faulty.

[0016] Furthermore, the Task1 period is 35μs.

[0017] Further, in step S3, the FPGA controls the pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 to be turned on by sending pulse enable signals 1, 2, 3, and controls the pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 to be turned off by stopping sending pulse enable signals 1, 2, 3.

[0018] Furthermore, in step S4, the CPU 1 controls the pulse enable switch 1 and the pulse enable switch 3 through the on / off relay signal.

[0019] Beneficial effects:

[0020] 1) The present invention mutually checks the DSP dual-core CPUs, and mutually sends heartbeat packets between the DSP CPU1 and the FPGA for mutual verification, and can monitor their respective states in real time for corresponding processing. The DSP instructions and the FPGA instructions jointly control the relay. Only when the FPGA works normally and the pulse enable switch is enabled, the DSP can close and disconnect the relay. The FPGA can also forcibly close the pulse enable switch to disconnect the relay, thereby avoiding malfunction and refusal to operate caused by controlling the relay by a single intelligent device, and improving the reliability of the equipment.

[0021] 2) DSP is responsible for grid-connected algorithm control, and FPGA is responsible for PWM pulse failure and abnormal protection. It can quickly block PWM pulses, fully utilize the advantages of multi-core heterogeneous platforms, and respond quickly to abnormal situations.

[0022] 3) If any single core of CPU1, CPU2, or FPGA is abnormal or two cores are abnormal at the same time, the remaining cores can trip the AC relays, DC relays, and block the IGBT devices normally. Even if all three cores are abnormal, they can still be tripped through the pulse enable switch and hardware drive circuit to disconnect the primary electrical side devices to protect personnel safety and PCS key components and prevent the scope of the accident from further expanding. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a logic block diagram of the method of the present invention;

[0024] Figure 2 It is a schematic diagram of the overall system structure of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. The directions or positional relationships indicated by the terms "upper", "lower", "front", "back", "left", "right", "bottom", "inside", "outside", etc. are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention:

[0026] like Figure 1 , Figure 2 A control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability is shown. A control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability adopts a controller composed of a DSP and an FPGA composed of CPU1 and CPU2. Both the DSP and the FPGA control the on and off of the AC relay through a pulse enable switch 1 and the on and off of the DC relay through a pulse enable switch 3. The FPGA controls whether the bus level converter outputs PWM pulses to the IGBT and the drive circuit through a pulse enable switch 2, and performs the following steps:

[0027] Step S1: CPU1 and CPU2 of DSP send heartbeat packets to each other through the inter-core bus and check to determine the status of each other. When CPU1 does not receive the heartbeat sent by CPU2 within 2 Task1 cycles, it is determined that CPU2 is faulty; when CPU2 does not receive the heartbeat sent by CPU1 within 2 Task1 cycles, it is determined that CPU1 is faulty. The Task1 cycle is 35μs. When it is determined that CPU1 is faulty, step S3 is entered. When it is determined that CPU2 is faulty, step S4 is entered. If there is no fault, step S2 is entered.

[0028] Step S2: CPU1 and FPGA send heartbeat packets to each other through the external memory interface bus and check and judge the other party's status. When FPGA does not receive the heartbeat sent by CPU1 within 1.5 Task1 cycles, it is judged that CPU1 is faulty. When CPU1 does not receive the heartbeat sent by FPGA within 2 Task1 cycles, it is judged that FPGA is faulty. Task1 cycle is 35μs. When it is judged that CPU1 is faulty, it goes to step S3. When it is judged that FPGA is faulty, it goes to step S5. If there is no fault, it returns to step S1.

[0029] Step S3: FPGA turns off at least one of the pulse enable switch 1, the pulse enable switch 2, and the pulse enable switch 3, so that at least one component of the AC relay, the IGBT, and the DC relay is disconnected, thereby stopping the operation of the energy storage converter. FPGA controls the pulse enable switch 1, the pulse enable switch 2, and the pulse enable switch 3 to be turned on by sending pulse enable signals 1, 2, and 3, and controls the pulse enable switch 1, the pulse enable switch 2, and the pulse enable switch 3 to be turned off by stopping sending pulse enable signals 1, 2, and 3.

[0030] Step S4: CPU1 or FPGA turns off one of the pulse enable switch 1 and the pulse enable switch 3, or FPGA turns off the bus level converter through the pulse enable switch 2, so that at least one component of the AC relay, IGBT, and DC relay is disconnected, thereby stopping the operation of the energy storage converter;

[0031] Step S5: Pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 are all turned off due to the loss of the pulse enable signal provided by the FPGA, so that the AC relay, IGBT and DC relay are all disconnected, thereby stopping the operation of the energy storage converter.

[0032] CPU1 is used for abnormal protection logic and external communication, CPU2 is used for grid-connected control algorithm, and FPGA is responsible for suppressing three-phase PWM narrow pulses, interlocking internal and external tube protection, and monitoring DSP operating status.

[0033] Embodiment 1: The energy storage converter control system adopts a dual-core DSP+FPGA architecture. The DSP chip includes CPU1 and CPU2. CPU1 is used for abnormal protection logic and external communication, CPU2 is used for grid-connected control algorithm, and FPGA is mainly responsible for suppressing three-phase PWM narrow pulses, internal and external tube protection interlocking, and monitoring DSP operating status.

[0034] When the energy storage converter is started and operated normally, the DC relay, AC relay, and IGBT will be closed and operate normally according to the grid-connected algorithm. The dual cores inside the DSP check each other through the inter-core bus. CPU1 and CPU2 send heartbeat packets to each other to determine the status of each other. When CPU1 does not receive the heartbeat sent by CPU2 within 2 Task1 cycles, it is judged that CPU2 is faulty. When CPU2 does not receive the heartbeat sent by CPU1 within 2 Task1 cycles, it is judged that CPU1 is faulty. CPU1 and FPGA check each other through the external memory interface (EMIF) bus. CPU1 and FPGA send heartbeats to each other to determine the status of each other. When FPGA does not receive the heartbeat sent by CPU1 within 1.5 Task1 cycles, it is judged that CPU1 is faulty. When CPU1 does not receive the heartbeat sent by FPGA within 2 Task1 cycles, it is judged that FPGA is faulty. The Task1 scheduling cycle is 35μs.

[0035] When CPU1 fails, CPU1 cannot send a trip signal and cannot control the AC and DC relays. At this time, FPGA and CPU2 are normal and can identify CPU1 failure through the heartbeat packet. FPGA can control the forced trip signal 1 to be low level, so that the pulse enable switch 1 is turned off, the AC relay drive is disabled, the coil is de-energized, and the AC relay can be disconnected. FPGA can also turn off the PWM pulse in sequence or force the pulse enable switch to output a high level through the forced pulse seal signal 2, turn off the bus level converter, and prohibit the PWM pulse output IGBT. At the same time, FPGA controls the forced trip signal 3 to be low level, turns off the pulse enable switch 3, and the DC relay drive controls the relay coil to lose power, and the DC relay is turned off.

[0036] When CPU2 fails, the PWM wave sent by CPU2 is abnormal or disordered. If not handled properly, the IGBT may explode. CPU1 and FPGA are normal. When CPU1 detects that CPU2 is abnormal, CPU normally sends relay disconnection / closing signals 1 and 3 to turn off the DC relay and AC relay. At the same time, it can notify FPGA through the EMIF bus to turn off the PWM pulse, first turn off the external tube and then turn off the internal tube signal.

[0037] When the FPGA fails, since the enable signal of pulse enable switches 1, 2, and 3 comes from the FPGA pulse, the internal trigger pin of the switch inputs a fixed pulse that meets the trigger time requirement. The pulse trigger time must be less than 0.45*10*3300 / 1000=14.85μs, that is, the trigger frequency is required to be greater than 1 / 14.85=67.34kHz. The actual frequency set by the FPGA is 200kHz. The trigger enable buffer is turned on and the relay drive is controlled by CPU1. When the FPGA fails, it will not be able to output a fixed pulse, that is, a pulse enable signal. The pulse enable switches 1, 2, and 3 will be closed, that is, the buffer is in the closed state, so that the entire pulse enable switch is in the off state. The pulse enable switch 1 is turned off, the AC relay drive is disabled, the coil loses power, and the AC relay can be disconnected; the pulse enable switch 2 is turned off, so that the bus level converter is turned off and the PWM pulse is blocked; the pulse enable switch 3 is turned off, the DC relay drive is disabled, the coil loses power, and the DC relay can be disconnected.

[0038] Therefore, if any single core of CPU1, CPU2, or FPGA is abnormal or abnormal at the same time, the other cores can trip the AC relays, DC relays, and block the IGBT devices normally. Even if all three cores are abnormal, they can still be tripped through the pulse enable switch and hardware drive circuit to disconnect the primary electrical side devices to protect personnel safety and PCS key components and prevent the scope of the accident from further expanding.

[0039] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the principles and spirit of the present invention should be included in the protection scope of the present invention.

Claims

1. A control method to prevent the DSP failure of an energy storage converter from affecting the reliability of the device, characterized in that: A controller composed of a DSP and FPGA composed of CPU1 and CPU2 is used. Both DSP and FPGA control the on and off of the AC relay through pulse enable switch 1 and the on and off of the DC relay through pulse enable switch 3. FPGA controls whether the bus level converter outputs PWM pulses to the IGBT and the drive circuit through pulse enable switch 2, and performs the following steps: Step S1: CPU1 and CPU2 of DSP send heartbeat packets to each other through the inter-core bus and check and judge the status of each other. If it is judged that CPU1 is faulty, it goes to step S3; if it is judged that CPU2 is faulty, it goes to step S4; if there is no fault, it goes to step S2; Step S2: CPU1 and FPGA send heartbeat packets to each other through the external memory interface bus and verify each other to determine the status of each other. If it is determined that CPU1 fails, go to step S3; if it is determined that FPGA fails, go to step S5; if there is no failure, go back to step S1; Step S3: the FPGA turns off at least one of the pulse enable switch 1, the pulse enable switch 2, and the pulse enable switch 3, so that at least one component of the AC relay, the IGBT, and the DC relay is disconnected, thereby stopping the operation of the energy storage converter; Step S4: CPU1 or FPGA turns off one of the pulse enable switch 1 and the pulse enable switch 3, or FPGA turns off the bus level converter through the pulse enable switch 2, so that at least one component of the AC relay, IGBT, and DC relay is disconnected, thereby stopping the operation of the energy storage converter; Step S5: Pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 are all turned off due to the loss of the pulse enable signal provided by the FPGA, so that the AC relay, IGBT and DC relay are all disconnected, thereby stopping the operation of the energy storage converter.

2. The control method and detection method for preventing the energy storage converter DSP failure from affecting the equipment reliability as claimed in claim 1, characterized in that: The CPU1 is used for abnormal protection logic and external communication, the CPU2 is used for grid-connected control algorithm, and the FPGA is responsible for suppressing three-phase PWM narrow pulses, interlocking internal and external tube protection, and monitoring DSP operating status.

3. The control method for preventing the energy storage converter DSP failure from affecting the equipment reliability as claimed in claim 1, characterized in that: In the step S1, when CPU1 does not receive the heartbeat sent by CPU2 within 2 Task1 cycles, it is determined that CPU2 is faulty; when CPU2 does not receive the heartbeat sent by CPU1 within 2 Task1 cycles, it is determined that CPU1 is faulty.

4. The control method for preventing the energy storage converter DSP failure from affecting the equipment reliability as claimed in claim 1, characterized in that: In the step S2, when the FPGA does not receive the heartbeat sent by the CPU1 within 1.5 Task1 cycles, it is determined that the CPU1 is faulty; when the CPU1 does not receive the heartbeat sent by the FPGA within 2 Task1 cycles, it is determined that the FPGA is faulty.

5. The control method for preventing the energy storage converter DSP failure from affecting the equipment reliability as claimed in claim 3 or 4, characterized in that: The Task1 cycle is 35 μs.

6. The control method for preventing the energy storage converter DSP failure from affecting the equipment reliability as claimed in claim 1, characterized in that: In the step S3, the FPGA controls the pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 to be turned on by sending pulse enable signals 1, 2, and 3, and controls the pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 to be turned off by stopping sending pulse enable signals 1, 2, and 3.

7. The control method for preventing the energy storage converter DSP failure from affecting the equipment reliability as claimed in claim 1, characterized in that: In step S4, the CPU 1 controls the pulse enable switch 1 and the pulse enable switch 3 through the on / off relay signal.

Images