Active failsafe module for controlling a safety state of an electric motor

Abstract

The present disclosure relates to an active failsafe module for controlling a safe state of an electric motor. An apparatus is disclosed that, in one embodiment, includes a circuit configured to selectively activate a transistor. The circuit is additionally configured to assert a signal when the circuit detects an electrical short between terminals of the transistor, or when the circuit detects that the transistor does not conduct current when activated by the circuit. The circuit is additionally configured to output another signal that is set to a first state or a second state. The other signal is set to the first state when the circuit detects the electrical short. The other signal is set to the second state when the circuit detects that the transistor does not conduct current when activated.

Description

Technical Field

[0001] This invention relates to an active fail-safe module for controlling the safe state of an electric motor. Background Technology

[0002] An electric motor is a machine that converts electrical energy into mechanical energy. Electric motors are used in electric vehicles (EVs), and they generate force by driving the rotation of a shaft through the interaction between the motor's magnetic field and the current in the conductor windings. Electric motors are prone to electrical faults. For example, harsh environmental factors can cause short circuits or open circuits in the motor. Some faults can cause considerable mechanical damage or personal injury. Systems have been developed to monitor electrical faults in electric motors. Upon detecting a fault, the monitoring system can activate a safe state for the motor, thereby preventing damage or personal injury. Summary of the Invention

[0003] In a first aspect, an apparatus is provided, the apparatus comprising: circuitry configured to selectively activate a transistor; wherein the circuitry is further configured to assert a signal when the circuitry detects an electrical short circuit between terminals of the transistor, or when the circuitry detects that the transistor does not conduct current when the transistor is activated by the circuitry; wherein the circuitry is further configured to output another signal, the other signal being set to a first state or a second state; wherein the other signal is set to the first state when the circuitry detects an electrical short circuit; wherein the other signal is set to the second state when the circuitry detects that the transistor does not conduct current when activated.

[0004] In one or more embodiments, the device may further include: a plurality of first circuits configured to selectively activate a plurality of first transistors, respectively; wherein each of the first circuits is configured to assert a first signal when the circuit detects an electrical short circuit between the terminals of its respective first transistor, or when the circuit detects that its respective first transistor does not conduct current when activated; wherein each of the first circuits is further configured to output a second signal, the second signal being set to a first state or a second state; wherein when each of the first circuits detects an electrical short circuit between the terminals of its respective first transistor, the circuit sets its second signal to the first state; wherein when each of the first circuits detects that its respective first transistor does not conduct current when activated, the circuit sets its second signal to the second state.

[0005] In one or more embodiments, the device may further include: a plurality of second circuits configured to selectively activate a plurality of second transistors, respectively; wherein each of the second circuits is configured to assert a first signal when the circuit detects an electrical short circuit between the terminals of its respective second transistor, or when the circuit detects that its respective second transistor does not conduct current when activated; wherein each of the second circuits is further configured to output a second signal, the second signal being set to a first state or a second state; wherein when each of the second circuits detects an electrical short circuit between the terminals of its respective second transistor, the circuit sets its second signal to the first state; wherein when each of the second circuits detects that its respective second transistor does not conduct current when activated, the circuit sets its second signal to the second state.

[0006] In one or more embodiments, the device may further include: a microcontroller coupled to and configured to control a plurality of first circuits and a plurality of second circuits; and control circuitry coupled to the microcontroller and the plurality of first circuits and the plurality of second circuits, wherein the control circuitry controls the plurality of first circuits and the plurality of second circuits in response to detecting a malfunction in the microcontroller.

[0007] In one or more embodiments, in response to a circuit assertion signal or in response to any circuit in the first circuit asserting its first signal, the control circuit may be configured to assert a first control signal; wherein the control circuit may be configured to generate a second control signal, the second control signal being set to a first voltage or a second voltage; wherein in response to a circuit setting another signal to a first state, or in response to any circuit in the first circuit setting its second signal to a first state, the second control signal may be set to a first voltage; wherein in response to a circuit setting another signal to a second state, or in response to any circuit in the first circuit setting its second signal to a second state, the second control signal may be set to... The second voltage; wherein, in response to the control circuit asserting the first control signal and in response to the control circuit setting the second signal to the first voltage, the circuit can activate the transistor; wherein, in response to the control circuit asserting the first control signal and in response to the control circuit setting the second signal to the first voltage, each circuit in the first circuit can activate its corresponding first transistor; wherein, in response to the control circuit asserting the first control signal and in response to the control circuit setting the second signal to the second voltage, the circuit can deactivate the transistor; wherein, in response to the control circuit asserting the first control signal and in response to the control circuit setting the second signal to the second voltage, each circuit in the first circuit can deactivate its corresponding first transistor.

[0008] In one or more embodiments, the control circuit may be configured to generate a third control signal; wherein, in response to the circuit setting another signal to a second state, or in response to any circuit in the first circuit setting its second signal to a second state, the third control signal may be set to a first voltage; wherein, in response to the circuit setting another signal to a first state, or in response to any circuit in the first circuit setting its second signal to a first state, the third control signal may be set to a second voltage; wherein, in response to the control circuit asserting the control signal and in response to the control circuit setting the third signal to a second voltage, each circuit in the second circuit may deactivate its corresponding second transistor; wherein, in response to the control circuit asserting the first control signal and in response to the control circuit setting the third signal to a first voltage, each circuit in the second circuit may activate its corresponding second transistor.

[0009] In a second aspect, an apparatus is provided comprising: a plurality of first circuits configured to selectively activate a plurality of first transistors, respectively; wherein each of the first circuits is configured to assert a first signal when the circuit detects an electrical short circuit between the terminals of its respective first transistor, or when the circuit detects that its respective first transistor does not conduct current when activated; wherein each of the first circuits is further configured to output a second signal, the second signal being set to a first state or a second state; wherein when each of the first circuits detects an electrical short circuit between the terminals of its respective first transistor, the circuit sets its second signal to the first state; wherein when each of the first circuits detects that its respective first transistor does not conduct current when activated, the circuit sets its second signal to the second state.

[0010] In one or more embodiments, the device may further include: a plurality of second circuits configured to selectively activate a plurality of second transistors, respectively; wherein each of the second circuits is configured to assert a first signal when the circuit detects an electrical short circuit between the terminals of its respective second transistor, or when the circuit detects that its respective second transistor does not conduct current when activated; wherein each of the second circuits is further configured to output a second signal, the second signal being set to a first state or a second state; wherein when each of the second circuits detects an electrical short circuit between the terminals of its respective second transistor, the circuit sets its second signal to the first state; wherein when each of the second circuits detects that its respective second transistor does not conduct current when activated, the circuit sets its second signal to the second state.

[0011] In one or more embodiments, the device may further include: a plurality of first transistors; a plurality of second transistors; wherein the plurality of first transistors are respectively coupled in series with the plurality of second transistors.

[0012] In one or more embodiments, in response to any circuit in the first circuit asserting its first signal, the circuit can be configured to assert a first control signal; wherein the circuit can be configured to generate a second control signal, the second control signal being set to a first voltage or a second voltage; wherein in response to any circuit in the first circuit setting its second signal to a first state, the second control signal can be set to the first voltage; wherein in response to any circuit in the first circuit setting its second signal to a second state, the second control signal can be set to the second voltage; wherein in response to the circuit asserting the first control signal and in response to the circuit setting the second signal to the first voltage, each circuit in the first circuit can activate its corresponding first transistor; wherein in response to the circuit asserting the first control signal and in response to the circuit setting the second signal to the second voltage, each circuit in the first circuit can deactivate its corresponding first transistor.

[0013] In one or more embodiments, the circuit may be configured to generate a third control signal, the third control signal being set to a first voltage or a second voltage; wherein, in response to any circuit in the first circuit setting its second signal to a second state, the third control signal may be set to the first voltage; wherein, in response to any circuit in the first circuit setting its second signal to the first state, the third control signal may be set to the second voltage; wherein, in response to the circuit asserting the first control signal and in response to the circuit setting the third signal to the second voltage, each circuit in the second circuit may deactivate its corresponding second transistor; wherein, in response to the circuit asserting the first control signal and in response to the circuit setting the third signal to the first voltage, each circuit in the second circuit may activate its corresponding second transistor.

[0014] In one or more embodiments, the device may further include: a logic gate coupled between the circuit and the first and second circuits, wherein the logic gate is configured to receive a first signal from the first and second circuits, and wherein the logic gate is configured to generate a logic gate output signal, the logic gate output signal being set to a first state or a second state, wherein the logic gate output signal is set to the first state only when one or more of the first signals from the first and second circuits are set to the first state; a first logic gate coupled between the circuit and the first circuit, wherein the first logic gate is configured to receive a second signal from the first circuit, and wherein the first logic gate is configured to generate a first logic gate output signal, the first logic gate output signal being set to a first state or a second state, wherein the first logic gate output signal is set to the first state only when one or more of the second signals from the first circuit are set to the first state; and a second logic gate coupled between the circuit and the second circuit, wherein the second logic gate is configured to receive a first signal from the second circuit. The circuit comprises two signals, wherein a second logic gate is configured to generate a second logic gate output signal, the second logic gate output signal being set to a first state or a second state, wherein the second logic gate output signal is set to the first state only when one or more of the second signals from the second circuit are set to the first state; wherein a circuit is configured to receive the logic gate output signal; wherein, in response to the logic gate switching the logic gate output signal to the first state, the circuit is configured to assert a first control signal; wherein a circuit is configured to receive the first logic gate output signal; wherein, in response to the logic gate setting the logic gate output signal to the first state and in response to the first logic gate setting the first logic gate output signal to the first state, the circuit is configured to set a second control signal to the first state; wherein a circuit is configured to receive the second logic gate output signal; wherein, in response to the logic gate setting the logic gate output signal to the first state and in response to the second logic gate setting the first logic gate output signal to the first state, the circuit is configured to set a third control signal to the second state.

[0015] In a third aspect, an apparatus is provided, comprising: a microcontroller configured to control an inverter system; and circuitry configured to activate any one of a plurality of states in the inverter system in response to detection of an electrical fault in the inverter system and in response to a malfunction in the microcontroller.

[0016] In one or more embodiments, the device may further include an inverter system, wherein the inverter system includes: a plurality of first transistors; a plurality of second transistors respectively coupled to the plurality of first transistors; wherein multiple safety states include a first state and a second state; wherein the plurality of first transistors are activated in the first state; wherein the plurality of second transistors are deactivated in the first state; wherein the plurality of first transistors are deactivated in the second state; wherein the plurality of second transistors are activated in the second state.

[0017] In one or more embodiments, the device may further include: a plurality of first circuits configured to selectively activate a plurality of first transistors, respectively; wherein each of the first circuits is configured to assert a first signal when the circuit detects an electrical short circuit between the terminals of its respective first transistor, or when the circuit detects that its respective first transistor does not conduct current when activated; wherein each of the first circuits is further configured to output a second signal, the second signal being set to a first state or a second state; wherein when each of the first circuits detects an electrical short circuit between the terminals of its respective first transistor, the circuit sets its second signal to the first state; wherein when each of the first circuits detects that its respective first transistor does not conduct current when activated, the circuit sets its second signal to the second state.

[0018] In one or more embodiments, the device may further include: a plurality of second circuits configured to selectively activate a plurality of second transistors, respectively; wherein each of the second circuits is configured to assert a first signal when the circuit detects an electrical short circuit between the terminals of its respective second transistor, or when the circuit detects that its respective second transistor does not conduct current when activated; wherein each of the second circuits is further configured to output a second signal, the second signal being set to a first state or a second state; wherein when each of the second circuits detects an electrical short circuit between the terminals of its respective second transistor, the circuit sets its second signal to the first state; wherein when each of the second circuits detects that its respective second transistor does not conduct current when activated, the circuit sets its second signal to the second state.

[0019] In one or more embodiments, in response to any circuit in the first circuit asserting its first signal and in response to a malfunction of the microcontroller, the circuit can be configured to assert a first control signal; wherein the circuit can be configured to generate a second control signal, the second control signal being set to a first voltage or a second voltage; wherein in response to any circuit in the first circuit setting its second signal to a first state, the second control signal can be set to the first voltage; wherein in response to any circuit in the first circuit setting its second signal to a second state, the second control signal can be set to the second voltage; wherein in response to the circuit asserting the first control signal and in response to the circuit setting the second signal to the first voltage, each circuit in the first circuit can activate its corresponding first transistor; wherein in response to the circuit asserting the first control signal and in response to the circuit setting the second signal to the second voltage, each circuit in the first circuit can deactivate its corresponding first transistor.

[0020] In one or more embodiments, the circuit may be configured to generate a third control signal, the third control signal being set to a first voltage or a second voltage; wherein, in response to any circuit in the first circuit setting its second signal to a second state, the third control signal may be set to the first voltage; wherein, in response to any circuit in the first circuit setting its second signal to the first state, the third control signal may be set to the second voltage; wherein, in response to the circuit asserting the first control signal and in response to the circuit setting the third signal to the second voltage, each circuit in the second circuit may deactivate its corresponding second transistor; wherein, in response to the circuit asserting the first control signal and in response to the circuit setting the third signal to the first voltage, each circuit in the second circuit may activate its corresponding second transistor.

[0021] In one or more embodiments, a logic gate may be coupled between a circuit and a first circuit and a second circuit, wherein the logic gate is configured to receive a first signal from the first circuit and the second circuit, and wherein the logic gate is configured to generate a logic gate output signal, the logic gate output signal being set to a first state or a second state, wherein the logic gate output signal is set to the first state only when one or more of the first signals from the first circuit and the second circuit are set to the first state; a first logic gate may be coupled between the circuit and the first circuit, wherein the first logic gate is configured to receive a second signal from the first circuit, and wherein the first logic gate is configured to generate a first logic gate output signal, the first logic gate output signal being set to a first state or a second state, wherein the first logic gate output signal is set to the first state only when one or more of the second signals from the first circuit are set to the first state; a second logic gate may be coupled between the circuit and the second circuit, wherein the second logic gate is configured to receive a second signal from the second circuit, and wherein... The second logic gate is configured to generate a second logic gate output signal, which is set to a first state or a second state, wherein the second logic gate output signal is set to the first state only when one or more of the second signals from the second circuit are set to the first state; wherein the circuit is configured to receive the logic gate output signal; wherein, in response to the logic gate switching the logic gate output signal to the first state, the circuit is configured to assert a first control signal; wherein the circuit is configured to receive the first logic gate output signal; wherein, in response to the logic gate setting the logic gate output signal to the first state and in response to the first logic gate setting the first logic gate output signal to the first state, the circuit is configured to set a second control signal to the first state; wherein the circuit is configured to receive the second logic gate output signal; wherein, in response to the logic gate setting the logic gate output signal to the first state and in response to the second logic gate setting the first logic gate output signal to the first state, the circuit is configured to set a third control signal to the second state.

[0022] In one or more embodiments, the device may further include an inverter system, wherein the inverter system includes: a gate driver circuit configured to selectively activate transistors; wherein the gate circuit is further configured to assert a signal when the gate driver circuit detects an electrical short circuit between the terminals of the transistor, or when the gate driver circuit detects that the transistor does not conduct current when the transistor is activated by the circuit; wherein the gate driver circuit is further configured to output another signal, the other signal being set to a first state or a second state; wherein the other signal is set to the first state when the gate driver circuit detects an electrical short circuit; wherein the other signal is set to the second state when the gate driver circuit detects that the transistor does not conduct current when activated. Attached Figure Description

[0023] It will be understood that, for the sake of simplicity and clarity, the elements shown in the drawings are not necessarily drawn to scale. For example, the dimensions of some elements may be enlarged relative to other elements. This document illustrates and describes embodiments incorporating the teachings of this disclosure with reference to the accompanying drawings, wherein:

[0024] Figure 1 The relevant components of an example three-phase pulse width modulation (PWM) inverter system are shown.

[0025] Figure 2 It shows the application to Figure 1 A timing diagram of example control signals for a transistor.

[0026] Figures 3-5 It shows Figure 1 Example faults in an inverter.

[0027] Figure 6 The relevant components of an example three-phase PWM inverter system employing an embodiment of this disclosure are shown.

[0028] Figure 7 and Figure 8 It shows Figure 6 Example faults in an inverter.

[0029] The same reference numerals are used in different figures to indicate similar or identical items. Detailed Implementation

[0030] The electric motor is powered by a direct current (DC) power source (e.g., a battery) or an alternating current (AC) power source (e.g., the power grid). In addition to AC and DC types, the motor can be brushed or brushless and can have various phases (e.g., single-phase, two-phase, three-phase, etc.). This disclosure will be described with reference to a three-phase DC motor powered by a battery, and it should be understood that this disclosure is not limited thereto. Furthermore, this disclosure will be described with reference to electric motors used in electric vehicles (EVs), and it should be understood that this disclosure is not limited thereto.

[0031] Microcontrollers are used to control and monitor electric motors. If an electrical fault is detected, the microcontroller can activate a safe state in the motor. However, a disadvantage is that the microcontroller may malfunction. If a fault is detected, a malfunctioning microcontroller may fail to activate the motor's safe state. A fail-safe module is provided along with the microcontroller and serves as a safety backup for the microcontroller. If the microcontroller fails to activate the motor's safe state in the event of a fault, the fail-safe module should intervene and activate the safe state.

[0032] Figure 1The relevant components of an example three-phase pulse-width modulation (PWM) inverter system 100 for an electric motor are shown. Simply put, an inverter is an electronic device or circuit that converts DC power from a battery into AC power for use by an electric motor. Inverter system 100 includes high-side power transistors TH1-TH3, which are respectively coupled in series with low-side power transistors TL1-TL3 via terminal nodes N1-N3. Terminal nodes N1-N3 are in turn coupled to the motor windings L1-L3. For illustrative purposes only, power transistors TH1-TH3 and TL1-TL3 are insulated-gate bipolar transistors (IGBTs), and it should be understood that the term power transistor is not limited to this. The collectors of high-side transistors TH1-TH3 are connected to a battery (not shown) providing DC voltage HVBat (e.g., 12 V, 48 V, 1 kV, etc.), while the emitters of low-side transistors TL1-TL3 are coupled to ground or GND.

[0033] The operation of inverter system 100 is relatively simple. High-side transistors TH1-TH3 are selectively activated by high-side gate drivers H101-H103 via gate control voltages VGH1-VGH3, and low-side transistors TL1-TL3 are selectively activated by low-side gate drivers L101-L103 via gate control voltages VGL1-VGL3. If functioning correctly, each power transistor should conduct current to or from the winding when activated by its corresponding gate driver. Through the cooperative activation of the high-side and low-side transistors, the current direction continuously and regularly reverses (current enters the winding, then suddenly reverses and flows back). Figure 2 Timing diagrams are shown, for example, of control voltages VGH1-VGH3 and VGL1-VGL3 and their cooperative relationships.

[0034] Each of gate drivers H101-H103 and L101-L103 can detect internal or external electrical failures or faults. If a gate driver detects a fault or failure, it will assert a general error signal. For example, gate driver H101 can monitor the voltage at terminal node N1, which should only be HVBat when TH1 is activated by gate driver H101. If gate driver H101 detects a voltage (i.e., HVBat) at N1 when transistor TH1 is deactivated, it presumes a short circuit between the collector and emitter of TH1, and gate driver H101 will assert a general error signal. Alternatively, gate driver H101 may detect an internal failure that could cause TH1 to fail to activate. For illustrative purposes, a signal (e.g., Error-H1 at Error_Out) is asserted when it transitions from a first voltage (e.g., a positive voltage) to a second voltage (e.g., 0 V) ​​and vice versa. For illustrative purposes only, unless otherwise stated, every general error signal is asserted to 0 V (e.g., Error-H1=0V).

[0035] Gate driver H101 also monitors the voltage across a sensing resistor (not shown), strategically positioned in the conductive path between the collectors of HVBat and TH1. When TH1 is activated, current should flow through the sensing resistor and TH1. If gate driver H101 does not detect a voltage across the sensing resistor when transistor TH1 is activated, an open circuit is presumed. If this is detected, gate driver H101 asserts a general error signal Error-H1 = 0V. If no fault is detected, gate driver H101 maintains the general error signal Error-H1 = Vdd, where Vdd is a positive voltage (e.g., 5 V). Other side gate drivers operate in a similar manner. Disadvantageously, each general error signal (e.g., Error-H1) generated by the gate driver is a single bit and does not identify the type of fault (e.g., short circuit, open circuit, etc.). In effect, each general error signal only indicates an error at some point.

[0036] Figure 1Also shown are MCU 110 and Fault-Safe Controller (FC) 112, each of which monitors the common error signal output of the gate drivers. If one of the common error signals is asserted (e.g., Error-H1=0V), either MCU 110 or FC 112 can activate a safe state of inverter system 100. In addition to monitoring the common error signals, FC 112 also monitors MCU 110. If, in response to a reported fault, FC 112 detects that MCU 110 has malfunctioned and is unable to activate a safe state, FC 112 will activate the safe state. MCU 110 may be able to activate any of a variety of different safe states for inverter system 100 depending on, for example, the location of the fault in inverter 100, while FC 112 activates only one safe state (hereinafter referred to as the "FC safe state"). The FC safe state is implemented by deactivating TH1-TH3 via gate drivers H101-H103 and FD 114, and simultaneously activating TL1-TL3 via gate drivers L101-L103 and FD 114. In the FC safe state, winding terminals N1-N3 should be connected to ground (GND) and isolated from HVBat. MCU 110 and FC112 are described more fully below.

[0037] The MCU 110 is a compact integrated circuit designed to perform specific operations. Although not shown, the MCU 110 includes a central processing unit (CPU), memory, and peripheral configurations such as timers and input / output (I / O) ports on a single chip. The CPU can program the timers according to software executed on the CPU. Once programmed and started, these timers can autonomously generate PWM signals PWM-H1–PWM-H3 for output to gate drivers H101–H10, and PWM signals PWM-L1–PWM-L3 for output to gate drivers L101–L10, respectively. Gate drivers H101–H103 generate gate control voltages VGH1–VGH3 based on PWM signals PWM-H1–PWM-H3, and gate drivers L101–L103 generate gate control voltages VGL1–VLH3 based on PWM signals PWM-L1–PWM-L3. The CPU can reprogram the timers to adjust the duty cycle and period of the PWM signals, thereby adjusting the speed of the EV drive shaft. The CPU can also execute software that detects inverter system faults and responds to them.

[0038] If a malfunction causes MCU 110 to fail to activate the safe state, FC 112 acts as a backup for MCU 110. FC 112 monitors the watchdog (WD) signal and the HE signal from the MCU. The WD signal, when asserted, indicates a software failure in MCU 110. The HE signal, when asserted, indicates a hardware failure in MCU 110. If either of these signals is asserted, it is assumed that MCU 110 cannot activate the inverter system safe state in response to an assertion of a general error signal. For illustration, if Error-L1 is asserted, and if either the WD or HE signal is asserted, FC 112 will activate the FC safe state. More specifically, FC 112 will assert the failsafe enable signal FE at FC_FE_Out. FE is received at FS_Enable_In by FD 114 and each of the gate drivers. When the FE signal is asserted, each gate driver in the gate drivers will respond to the signal received at its FS_State_In input and ignore the signal received from MCU 110. More specifically, each gate driver in the gate drivers will activate or deactivate its corresponding power transistor based on the state of the signal received at FS_State_In. FD 114 also responds to the FE assertion. When FE is asserted, FD 114 generates FSH=Vdd and FSL=0V. FSH and FSL are received at the FS_State_In inputs of high-side gate drivers H101-H103 and low-side gate drivers L101-L103, respectively. When FSH=Vdd, gate drivers H101-H103 deactivate high-side power transistors TH1-TH3, and when FSL=0V, gate drivers L101-L103 activate low-side power transistors TL1-TL3, thereby activating the FC safe state.

[0039] refer to Figure 3-5 The diagram illustrates an example fault, providing a better explanation of the operation of the FC 112. Figure 3In this example, the fault manifests as an open circuit 302 between the collector of power transistor TH1 and HVBat. Fault 302 may be caused by a weak solder bump that fails after experiencing severe EV road vibrations. Open circuit fault 302 is detected by gate driver H101, which asserts Error-H1 = 0V in response. AND gate 116 receives all general error signals, including Error-H1, from the gate driver and performs a logical AND operation on all general error signals. AND gate 116 asserts its output as 0V. Furthermore, in this example, MCU 110 experiences a software fault, resulting in the WD signal being asserted. The asserted output of AND gate 116 and the asserted WD signal are both detected by FC 112. In response, FC 112 asserts the FE signal, thereby activating the aforementioned FC safety state. With the power transistor in the FC safety state, open circuit 302 will not damage the motor.

[0040] exist Figure 4 In the example, the fault takes the form of a short circuit 402 between node N1 and GND. Short circuit 402 can take the form of conductive road debris. The short circuit failure is detected by driver L101, and in response, the driver asserts Error-L1=0V. This causes AND gate 116 to assert its output as 0V, which is detected by FC 112. MCU 110 also experiences a hardware failure, and as a result, the HE signal is asserted. The asserted output of AND gate 116 and the asserted HE signal are both detected by FC 112. In response, FC 112 asserts the FE signal, thereby activating the FC safe state as described above. With the power transistor in the FC safe state, short circuit 402 will not damage the motor.

[0041] FC 112 can only activate one safety state (i.e., the FC safety state mentioned above), in which high-side transistors TH1-TH3 are deactivated to isolate nodes N1-N3 from HVBat, and low-side transistors TL1-TL3 are activated to connect N1-N3 to ground GND. Disadvantageously, this safety state may have issues with certain types of faults or failures. For illustration, Figure 5Inverter system 100 is illustrated with a short circuit 502 between winding node N3 and HVBat. This short circuit failure is detected by driver H103, which asserts Error-H3=0V in response. Assuming the WD signal is also asserted due to a software fault in MCU 110, FC 112 asserts FE. The output of the assertion by AND gate 116 and the asserted WD signal are both detected by FC 112. In response, FC 112 asserts the FE signal, thereby activating the FC safety state, in which low-side gate drivers L101-L103 activate low-side power transistors TL1-TL3. The activated low-side power transistors TL1-TL3 connect N1-N3 to ground GND, respectively. Disadvantageously, the activated TL3 completes the conductive path between HVBat and ground GND via short circuit 502, which can cause damage. Therefore, the FC safety state is not suitable for use with... Figure 5 The situation shown.

[0042] This disclosure provides a fail-safe module for addressing the aforementioned and other problems. Figure 6 A three-phase pulse width modulation (PWM) inverter system 600 monitored by a fail-safe module (FM) 602 is shown according to one embodiment of the present disclosure. Inverter system 600 includes many components of inverter system 100. However, at least one significant difference exists between the inverter systems; Figure 1The high-side gate drivers H101-H103 are replaced by high-side gate drivers DH1-DH3, and the low-side gate drivers L101-L103 are replaced by low-side gate drivers DL1-DL3. Similar to gate drivers H101-H103 and L101-H103, gate drivers DH1-DH3 and DL1-DL3 can detect internal and external failures and faults, such as short circuits or open circuits between the collector and emitter, or failure to activate a transistor when directed through the MCU 610. Similar to gate drivers H101-H103 and L101-H103, each of gate drivers DH1-DH3 and DL1-DL3 can assert a general error signal (e.g., Error-H1) when it detects a fault. Additionally, each of gate drivers DH1-DH3 and DL1-DL3 can assert a specific error signal ErrorS, which indicates the type of fault detected. For illustrative purposes only, ErrorS = 0V indicates a short-circuit fault, and ErrorS = Vdd indicates an electrical open-circuit fault or that the driver failed to activate the transistor. Therefore, if gate driver DH1 detects a short circuit across the collector and emitter terminals of transistor TH1, gate driver DH1 will assert a general error signal Error-H1 = 0V and a specific error signal ErrorS-H1 = 0V. And, if gate driver DH1 detects an open circuit across the collector and emitter terminals of transistor TH1, gate driver DH1 will assert a general error signal Error-H1 = 0V and a specific error signal ErrorS_H1 = Vdd.

[0043] The FM 602, illustrated in the block diagram, can be in the form of an integrated circuit including one or more electronic control functions on a single die. The FM 602 may include a mix of digital standard functionality and analog functionality. The FM 602 can be a simple hardwired device or, for example, a device controlled by a state machine configurable via a serial peripheral interface.

[0044] FM 602 receives the outputs of AND gates 604-608. AND gate 604 receives specific error signals ErrorS-L1–ErrorS-L3. AND gate 606 receives all six general error signals Error-L1–Error-L3 and Error-H1–Error-H3. AND gate 608 receives specific error signals ErrorS-H1–ErrorS-H3. FM 602 receives the outputs of AND gates 604-608. If one or more low-side gate drivers detect a short-circuit fault, AND gate 604 outputs 0 V. If one or more gate drivers detect a short-circuit fault or an open-circuit fault, AND gate 606 outputs 0 V. If one or more high-side gate drivers detect a short-circuit fault, AND gate 608 outputs 0 V. Based on the output of AND gate 606, FM 602 can determine whether a fault or failure exists within inverter 600. Based on the output of AND gate 604, FM 602 can determine whether a short-circuit fault exists at the collector-emitter terminal of one of the high-side power transistors. Based on the output of AND gate 608, FM 602 can determine whether a short-circuit fault exists at the collector-emitter terminal of one of the low-side power transistors. FM 602 may include lumped logic (not shown) that generates output signals FSL, FE, and FSH directly or indirectly based on the input signals from AND gates 604-608 and the input signals WD and HE from MCU 610. FSL and FSH should be set to the correct state before FE is asserted. It should be noted that one or more AND gates in AND gate 604 may be replaced by OR gates to accommodate a gate driver that reports an error when the corresponding error signal is asserted as Vdd and FM 602 recognizes Vdd as the asserted signal.

[0045] Figure 6 The MCU 610 is largely the same as Figure 1Similar to the MCU 110, the MCU 610 includes a CPU, memory, and peripherals such as timers and input / output (I / O) ports on a single chip. The CPU can program the timers according to software executed on the CPU. Once programmed and started, these timers autonomously generate the same PWM signals as described above. PWM-H1–PWM-H3 are provided to gate drivers DH1–DH3, and PWM-L1–PWM-L3 are provided to gate drivers DL1–DL3, respectively. Gate drivers DH1–DH3 use PWM-H1–PWM-H3 to generate gate control voltages VGH1–VGH3, and gate drivers DL1–DL3 use PWM-L1–PWM-L3 to generate gate control voltages VGL1–VLH3. The CPU can reprogram the timers to adjust the duty cycle and period of the PWM signals. The CPU can also execute software to monitor and respond to faults in the inverter system 600.

[0046] Both MCU 610 and FM 602 can activate the safety states of inverter system 600. Similar to MCU 110, the CPU of MCU 610 executes software to activate any of a variety of safety states of inverter system 600 based on a fault identified in inverter system 600. If MCU 610 fails to activate a safety state in response to an inverter system fault, FM 602 acts as a backup for MCU 610. Compared to FC 102, FM 602 can activate any of a variety of safety states. For example, FM 602 can activate at least two safety states (hereinafter referred to as "FM safety state 1" and "FM safety state 2"), which will be described more fully below. For illustrative purposes only, FM 602 will activate either FM safety state 1 or FM safety state 2, and it should be understood that this disclosure is not limited to only two FM safety states.

[0047] FM 602 will activate either FM Safety State 1 or FM Safety State 2 of inverter 600 depending on the type and location of the fault. In FM Safety State 1, FM 602 deactivates or disconnects TH1-TH3 and activates or closes TL1-TL3. In FM Safety State 2, FM 602 activates or closes TH1-TH3 and deactivates or disconnects TL1-TL3. In one embodiment, FM 602 activates FM Safety State 2 when one of the high-side gate drivers DH1-DH3 asserts ErrorS=0V, thus indicating a short circuit across the collector-emitter junction of the corresponding high-side power transistor. Otherwise, FM 602 activates FM Safety State 1.

[0048] As described above, FM 602 acts as a fail-safe backup for MCU 610. FM 602 monitors the WD and HE signals from MCU 610 to determine the state of MCU 610. The WD signal, when asserted, indicates a software fault in MCU 610. The HE signal, when asserted, indicates a hardware fault in MCU 610. If either of these signals is asserted, MCU 610 malfunctions and cannot activate the safe state of inverter system 600. Similarly, if MCU 110 fails and cannot activate the safe state of inverter 600, FM 602 will activate one of the two safe states.

[0049] To illustrate the operation of FM 602, if a short circuit is detected across the collector and emitter terminals of TH1, the high-side gate driver DH1 generates a general error signal Error-H1=0V and a specific error signal ErrorS-H1=0V. AND gates 606 and 608 receive these two signals. As a result, AND gates 606 and 608 assert their outputs as 0V, which are received at the FM 602 inputs Error_In and ErrorH_In, respectively. AND gate 604 outputs Vdd to ErrorL_In. Due to the assertion of the WD or HE signal, FM 602 determines that the MCU 610 is not operating correctly. Taking these conditions into account, FM 602 activates FM safety state 1. More specifically, FM 602 generates a fail-safe enable signal FE=Vdd, which is normally 0V. Additionally, FM 602 asserts FSL=Vdd and FSH=0V. Each of the gate drivers receives the FE signal at its corresponding FS_Enable_In input. When FE=Vdd, the gate driver will respond to its FS_State_In input and ignore the signal from the MCU 610. When FE=Vdd and FSH=0V, DH1-DH3 will deactivate TH1-TH3 respectively, and when FE=Vdd and FSH=0V, DH1-DH3 will activate TH1-TH3 respectively. When FE=Vdd and FSL=0V, DL1-DL3 will deactivate DL1-DL3 respectively, and when FE=Vdd and FSL=0V, DL1-DL3 will activate TL1-TL3 respectively.

[0050] FM 602 can activate FM Safety State 1 or FM Safety State 2 based on an inverter system fault. (See reference) Figure 7 and 8 The diagram illustrates an example fault in inverter system 600, providing a better explanation of the operation of FM 602. Figure 7In this example, the fault manifests as a short circuit 702 between the emitter of power transistor TL3 and GND. The short circuit fault 702 is detected by gate driver DL3, and in response, DL3 asserts a general error signal Error-L3=0V and a specific error signal ErrorS-L3=0V, respectively. AND gates 604 and 606 receive ErrorS-L3=0V and Error-L3=0V, respectively. Other general and specific error signals generated by DL1, DL2, and DH1-DH3 are held at Vdd. AND gates 604 and 606 assert their outputs as 0V, indicating a short circuit fault across one of the low-side power transistors TL1-TL3 for FM 602. Furthermore, in this example, MCU 110 experiences a software error, resulting in the assertion of the WD signal. In response to these input signals, FM 602 activates FM safety state 2 by asserting FE=Vdd, FSL=Vdd, and FSH=0V. Each gate driver in the gate driver group receives the FE signal, and when FE=Vdd, the gate driver will respond to its FS_State_In input and ignore the signal from the MCU 610. When FSH=0V, DH1-DH3 will disconnect TH1-TH3 respectively, and when FSL=Vdd, DL1-DL3 will close DL1-DL3 respectively.

[0051] exist Figure 8In this example, the fault manifests as a short circuit 802 between the emitter of power transistor TH3 and HVBat. The short circuit fault 802 is detected by gate driver DH3, and in response, DH3 asserts the general error signal Error-H3=0V and the specific error signal ErrorS-HL3=0V, respectively. AND gates 604 and 606 receive ErrorS-H3=0V and Error-H3=0V, respectively. Other general and specific error signals generated by DH1, DH2, and DL1-DL3 are set to Vdd. AND gates 606 and 608 assert their outputs as 0V, indicating a short circuit fault across one of the high-side power transistors TH1-THL3 for FM 602. Furthermore, in this example, MCU 110 experiences a software or hardware error, resulting in the assertion of the WD or HE signal. In response to these input signals, FM 602 activates FM safety state 1 by asserting FE=Vdd, FSL=0V, and FSH=Vdd. Each gate driver in the gate driver group receives the FE signal, and when FE=Vdd, the gate driver will respond to its FS_State_In input and ignore the signal from the MCU 610. When FSH=Vdd, DH1-DH3 will close TH1-TH3 respectively, and when FSL=0V, DL1-DL3 will open DL1-DL3 respectively.

[0052] An apparatus is disclosed, in one embodiment of which includes circuitry configured to selectively activate a transistor. The circuitry is further configured to assert a signal when the circuitry detects an electrical short circuit between terminals of the transistor, or when the circuitry detects that the transistor does not conduct current when activated by the circuitry. The circuitry is further configured to output another signal, which is set to a first state or a second state. When the circuitry detects the electrical short circuit, the other signal is set to the first state. When the circuitry detects that the transistor does not conduct current when activated, the other signal is set to the second state.

[0053] While the invention has been described in conjunction with several embodiments, it is not intended to be limited to the specific forms given herein. Rather, it is intended to cover such alternatives, modifications, and equivalents that may be reasonably included within the scope of the invention as defined by the appended disclosure.

Claims

1. A fault protection device, characterized in that, include: A fault protection circuit, configured to selectively activate high-side transistors and low-side transistors; The fault protection circuit is further configured to generate a fault-safe enable signal (FE) when it detects an electrical short circuit between the terminals of the high-side transistor or the low-side transistor, or when it does not conduct current during activation. The fault protection circuit is further configured to output a fault protection status signal, which is set to a first state or a second state. When the fault protection circuit detects the electrical short circuit, the fault protection status signal is set to the first state. When the fault protection circuit detects that the current is not conducting when activated, the fault protection status signal is set to the second state. High-side gate drivers are configured to selectively activate the high-side transistors, respectively; Each of the high-side gate drivers is configured to assert a general error signal when it detects an electrical short between the terminals of its corresponding high-side transistor, or when it detects that its corresponding high-side transistor is not conducting current when activated. Each of the high-side door drivers is further configured to output a specific error signal that is set to the first state or the second state; Specifically, when each high-side gate driver detects an electrical short circuit between the terminals of its corresponding high-side transistor, it sets its specific error signal to a first state; Specifically, when each high-side gate driver detects that its corresponding high-side transistor is not conducting current when activated, it sets its specific error signal to the second state. The low-side gate driver is configured to selectively activate the low-side transistors, respectively; Each of the low-side gate drivers is configured to assert the general error signal when it detects an electrical short between the terminals of its corresponding low-side transistor, or when it detects that its corresponding low-side transistor is not conducting current when activated. Each low-side door driver is also configured to output a specific error signal that is set to a first state or a second state; Specifically, when each low-side gate driver detects an electrical short circuit between the terminals of its corresponding low-side transistor, it sets its specific error signal to a first state; Specifically, when each low-side gate driver detects that its corresponding low-side transistor is not conducting current when activated, it sets its specific error signal to the second state. A first logic gate is coupled between a fault protection circuit and a high-side gate driver, wherein the first logic gate is configured to receive a specific error signal from the high-side gate driver circuit. The first logic gate is configured to generate a first logic gate output signal set to the first state or the second state; The first logic gate output signal is set to the first state only when one or more specific error signals from the high-side gate driver are set to the first state. The second logic gate is coupled between the fault protection circuit and the low-side gate driver; The second logic gate is configured to receive the specific error signal from the low-side gate driver; The second logic gate output signal is set to the first state only when one or more specific error signals from the low-side gate driver are set to the first state; The fault protection circuit is configured to receive the output signal of the first logic gate; The fault protection circuit is configured to set the output information of the first logic gate to a first state in response to the first logic gate, and to set the fault protection state signal to a first state. The fault protection circuit is configured to receive the output signal of the second logic gate; and The fault protection circuit is configured to set the input signal of the first logic gate to a first state and set another fault protection state signal to the second state in response to the second logic gate.

2. The device according to claim 1, characterized in that, In addition, including: A microcontroller coupled to and configured to control a plurality of first circuits and a plurality of second circuits; A control circuit coupled to the microcontroller and the plurality of first circuits and the plurality of second circuits, wherein the control circuit controls the plurality of first circuits and the plurality of second circuits in response to detecting a malfunction in the microcontroller.

3. The device according to claim 2, characterized in that, In response to a general error signal asserted by any circuit in the first circuit, the control circuit is configured to assert a first control signal; wherein the control circuit is configured to generate a second control signal, the second control signal being set to a first voltage or a second voltage; In this circuit, in response to any one of the circuits in the first circuit setting a specific error signal to the first state, the second control signal is set to the first voltage; In this circuit, in response to any one of the circuits in the first circuit setting a specific error signal to the second state, the second control signal is set to the second voltage; In response to the control circuit asserting the first control signal and in response to the control circuit setting the second control signal to the first voltage, each circuit in the first circuit activates a corresponding high-side transistor. In response to the control circuit asserting the first control signal and in response to the control circuit setting the second control signal to the second voltage, each circuit in the first circuit deactivates the corresponding high-side transistor.

4. The device according to claim 3: Its features are, The control circuit is configured to generate a third control signal; In response to any circuit in the first circuit setting a specific error signal to the second state, the third control signal is set to the first voltage; In response to any of the first circuits setting a specific error signal to the first state, the third control signal is set to the second voltage; In this context, in response to the control circuit asserting the first control signal and in response to the control circuit setting the third control signal to the second voltage, each of the second circuits deactivates its corresponding low-side transistor. In response to the control circuit asserting the first control signal and in response to the control circuit setting the third control signal to the first voltage, each circuit in the second circuit activates its corresponding low-side transistor.

5. A fault protection device, characterized in that, include: The high-side gate driver is configured to selectively activate the high-side transistors, respectively; Each of the high-side gate drivers is configured to assert a general error signal when it detects an electrical short between the terminals of its corresponding high-side transistor, or when it detects that its corresponding high-side transistor is not conducting current when activated. Each of the high-side door drivers is further configured to output a specific error signal that is set to a first state or a second state; Specifically, when each high-side gate driver detects an electrical short circuit between the terminals of its corresponding high-side transistor, it sets its specific error signal to a first state; Specifically, when each high-side gate driver detects that its corresponding high-side transistor is not conducting current when activated, it sets its specific error signal to the second state. The low-side gate driver is configured to selectively activate the low-side transistors, respectively. Each of the low-side gate drivers is configured to assert the general error signal when it detects an electrical short between the terminals of its corresponding low-side transistor, or when it detects that its corresponding low-side transistor is not conducting current when activated. Each low-side door driver is also configured to output a specific error signal that is set to a first state or a second state; Specifically, when each low-side gate driver detects an electrical short circuit between the terminals of its corresponding low-side transistor, it sets its specific error signal to a first state; Specifically, when each low-side gate driver detects that its corresponding low-side transistor is not conducting current when activated, it sets its specific error signal to the second state. A first logic gate is coupled between a fault protection circuit and a high-side gate driver, wherein the first logic gate is configured to receive a specific error signal from the high-side gate driver circuit. The first logic gate is configured to generate a first logic gate output signal set to the first state or the second state; The first logic gate output signal is set to the first state only when one or more specific error signals from the high-side gate driver are set to the first state. The second logic gate is coupled between the fault protection circuit and the low-side gate driver; The second logic gate is configured to receive the specific error signal from the low-side gate driver; The second logic gate output signal is set to the first state only when one or more specific error signals from the low-side gate driver are set to the first state; The fault protection circuit is configured to receive the output signal of the first logic gate; The fault protection circuit is configured to set the output information of the first logic gate to a first state in response to the first logic gate, and to set the fault protection state signal to a first state. The fault protection circuit is configured to receive the output signal of the second logic gate; and The fault protection circuit is configured to set the input signal of the first logic gate to a first state and set another fault protection state signal to the second state in response to the second logic gate.

6. The device according to claim 5, characterized in that, In addition, including: The plurality of high-side transistors; The plurality of low-side transistors; The plurality of high-side transistors are respectively coupled in series with the plurality of low-side transistors.

Images