System for controlling a voltage converter

Abstract

The present invention relates to a system (1) for controlling a voltage converter, the voltage converter comprising a plurality of high-side switches forming a high group and a plurality of low-side switches forming a low group, the control system (1) comprising: a measuring module (10) for measuring a voltage (V) of the DC voltage source (B); a comparing module (11) for comparing the measured voltage (V) with a first safety threshold (OV1); and a control module (12) for controlling a first group of switches selected from the high group or the low group to be closed if the comparing module (11) indicates that the measured voltage (V) is higher than the first safety threshold (OV1).

Description

Technical Field

[0001] The invention relates to an electrical system comprising a rotating electrical machine for a motor vehicle, the electrical machine being driven by a voltage converter. More particularly, the invention relates to a system for controlling a voltage converter and an electrical system comprising a rotating electrical machine and such a control system. Background Art

[0002] Voltage converters are known, comprising a control system and a plurality of switch arms connected in parallel, each arm comprising a high-side switch and a low-side switch connected to each other at a midpoint, each midpoint being intended to be connected to at least one phase of a rotating electrical machine. The control system controls the opening or closing of each switch to control the power supply of the motor. The low-side switch or high-side switch is an electronic power switch, such as a metal oxide semiconductor field effect transistor (MOSFET) type. The switch allows each phase of the stator to be powered, either by a battery to supply power to the vehicle's onboard network in motor mode, or to supply power to the onboard network and charge the vehicle's battery in alternator mode. In the case where the motor includes three phases on the stator, the voltage converter includes three low-side switches and three high-side switches, each low-side switch is connected to one of the three phases and grounded, and each high-side switch is connected to one of the three phases and connected to the positive terminal corresponding to the onboard network of the motor vehicle.

[0003] When a motor vehicle electrical device connected to the on-board network fails, an overvoltage may appear on the on-board network, that is, the voltage appearing on the on-board network is much higher than the nominal voltage of the network.

[0004] For example, such an overvoltage may occur in the case of a switch failure of the voltage converter, in which the switch of the voltage converter remains in an open state or a closed state when the control system controls the switch of the voltage converter to be in a closed state or an open state, respectively.

[0005] Such overvoltage may damage or reduce the reliability of not only the rotating electrical machine or the voltage converter and its control system, but also any electrical equipment connected to the vehicle network.

[0006] In order to limit or stop the overvoltage, it is known that the system for controlling the electric machine comprises a detection device associated with each switch. Such a detection device makes it possible to detect and identify a fault in the switch associated with it and to control the closing and opening of other switches according to the identified fault in order to limit or stop the overvoltage.

[0007] For example, in the event that the high-side switch remains in a closed state, the fault detector of the switch will detect a fault in which the switch remains in a closed state, and transmit information about the fault detection to a control module of the control system, which will control the closing of the other two high-side switches, thereby making the rotating electrical machine safe by placing all phases of the stator at the same potential (i.e., phase short-circuiting).

[0008] However, such a control system must include as many fault detectors as there are switches, which creates considerable cost and difficulty in accommodating these fault detectors in the control system. Summary of the invention

[0009] The object of the present invention is to at least partially overcome these disadvantages.

[0010] To this end, the invention relates to a system for controlling a voltage converter intended to connect a rotating electrical machine to a DC voltage source, in particular to an on-board network, the voltage converter comprising a plurality of switching arms connected in parallel, each switching arm comprising a high-side switch and a low-side switch connected to one another at a midpoint intended to be connected to said rotating electrical machine, the high-side switches forming a high group and the low-side switches forming a low group, the control system comprising:

[0011] 1. A module for measuring the voltage of a DC voltage source,

[0012] 2. A means for comparing the measured voltage with a first safety threshold,

[0013] 3. A control module for generating a command to close a first set of switches selected from the high group or the low group if the comparison module indicates that the measured voltage is above the first safety threshold.

[0014] A high-side or low-side switch refers to an electronic power switch, for example of the IGBT (Insulated Gate Bipolar Transistor) type or the Metal Oxide Semiconductor Field Effect Transistor (MOSFET) type.

[0015] Therefore, when an overvoltage is detected, the control system protects the voltage converter and the rotating electrical machine by systematically closing all switches on the same side.

[0016] Due to its systematic nature, this system does not require the installation of fault detection and identification devices at each switch. Therefore, compared with existing control systems, it is smaller and has a lower implementation cost.

[0017] In the case where the control system controls all switches of the low group so as to close when the measured voltage is above a first safety threshold, the voltage converter is thus protected when one of the high-side switches generates an open-circuit fault (the switch remains open regardless of any command it receives) or when one of the low-side switches generates a short-circuit fault (the switch remains closed regardless of any command it receives).

[0018] In case the control system controls all high group switches to close when the measured voltage is above the first safety threshold, the voltage converter is thus protected when one of the high side switches fails short circuit or when one of the low side switches fails open circuit.

[0019] In both cases, the voltage converter also protects the vehicle network against overvoltages caused by devices other than the voltage converter and / or the rotating electrical machine.

[0020] The invention may also include one or more of the following features considered individually or in all technically possible combinations:

[0021] According to a particular embodiment of the invention, when the measured voltage is higher than or equal to a first safety threshold, the control module is further designed to generate a command to open switches other than the first group of switches.

[0022] This is to prevent a short circuit from occurring and damaging the switches of the voltage converter if one of the switches in the first group fails.

[0023] According to one embodiment, the measured voltage is the voltage of a DC voltage source.For example, the measuring module measures the voltage between two terminals of a voltage converter intended to be connected to the DC voltage source.

[0024] According to one embodiment, the first safety threshold is between 1.10 and 1.25 times the nominal voltage of the DC voltage source powering the converter, for example 1.2 times the nominal voltage of the DC voltage source. For example, the nominal supply voltage is equal to forty-eight volts, and the first safety threshold is fifty-three to sixty volts.

[0025] According to one embodiment, the comparison module compares the measured power supply voltage with a second safety threshold that is higher than the first safety threshold, and the control module is further designed to generate a command to close a second group of switches selected from the high-side switch group or the low-side switch group when the measured voltage is higher than or equal to the second safety threshold, the second group of switches being different from the first group of switches.

[0026] This control system can make the voltage converter safe when one of its switches is short-circuited or open-circuited.

[0027] In a variation on this embodiment, the control system is configured not to control the second set of switches to close before the first set of switches have closed.

[0028] In a particular embodiment of the invention, the second safety threshold is between 1.2 and 1.4 times the nominal voltage of the DC voltage source of the voltage converter, for example 1.33 times the nominal voltage of the DC voltage source.

[0029] Therefore, it is maintained within a voltage value range that does not cause damage to the voltage converter components.

[0030] In an exemplary implementation of this embodiment, the nominal voltage of the DC voltage source is equal to 48 volts, and the second safety threshold is in the range of 58 volts to 67 volts, for example 64 volts.

[0031] In another embodiment of the present invention, the second safety threshold is equal to the sum of the first safety threshold and at least one voltage between 4 volts and 12 volts.

[0032] In another embodiment of the present invention, the control module is further designed to generate a command to open the first set of switches when the measured voltage is higher than or equal to a second safety threshold.

[0033] This is to prevent short circuits and damage to the switches of the voltage converter.

[0034] In another embodiment of the invention, when the measured voltage is higher than or equal to the second safety threshold, the first set of switches remains closed. This makes it possible to cause a short circuit and use the vehicle's short circuit protection devices, such as fast-acting fuses, or a switch on each arm, to damage them until they are all open.

[0035] According to one embodiment, the first set of switches is a set of low-side switches.

[0036] According to one embodiment, the first set of switches is a set of high-side switches.

[0037] The present invention also relates to a control unit for controlling high-side and low-side switches, the control unit comprising the above control system, which may include features of one or more of the above embodiments.

[0038] The present invention also relates to an electrical system, comprising:

[0039] a first and a second power supply terminal for connecting to a DC voltage source, in particular to a battery of a motor vehicle,

[0040] b. A rotating electrical machine comprising a stator having at least three phases,

[0041] c. a voltage converter for supplying power from the DC voltage source to the rotating electrical machine, the voltage converter comprising:

[0042] i. a plurality of switch arms connected in parallel, each arm comprising a high-side switch and a low-side switch connected to each other at a midpoint, each midpoint being connected to at least one phase of the rotating electrical machine, and

[0043] ii. A control unit for controlling the high-side and low-side switches, said control unit comprising a control system according to the invention.

[0044] The electrical system benefits from the same advantages as the control system, as described above.

[0045] In a particular embodiment of the electrical system, the control unit further comprises at least one fault detection module, such as a phase current direction fault module, and wherein the control unit controls the first set of switches to close when the fault module detects a fault.

[0046] In a particular embodiment of the electrical system, the control unit further comprises:

[0047] Controllers designed to control both high-side and low-side switches.

[0048] a machine control module for receiving from an electronic control unit of the vehicle an instruction to switch the rotary electric machine to motor mode or to switch the rotary electric machine to alternator mode and arranged for converting the instruction into commands for controlling the high-side and low-side switches of the voltage converter,

[0049] A logic module is used to prioritize commands sent by the control system over commands sent by the machine control module. The logic module sends commands for switching received by the machine control module or the control system to the controller.

[0050] The use of a logic module ensures that the controller receives only one command, thus preventing electrical system failure.

[0051] The invention also relates to a method for controlling a system according to the invention for controlling a voltage converter connected to a rotating electrical machine and to a DC voltage source, in particular to an on-board network of a motor vehicle, said method comprising:

[0052] 1. Steps for measuring the voltage of a DC voltage source by means of a measuring module,

[0053] 2. A step of comparing the measured voltage with a first safety threshold by a comparison module, and

[0054] 3. If the measured voltage is above a first safety threshold, a step of generating a command by the control module to close a first set of switches selected from the high set or the low set.

[0055] The invention also relates to a method of making an electrical system safe, the electrical system comprising: an electrical machine comprising a stator having at least three phases; a voltage converter for providing power from a DC voltage source to the rotating electrical machine, the voltage converter comprising:

[0056] 1. A plurality of switch arms connected in parallel, each arm comprising a high-side switch connected to a positive terminal of a DC voltage source and a low-side switch connected to vehicle ground or a negative terminal of the DC voltage source, the low-side switch and the high-side switch of each arm being connected to each other at a midpoint, each midpoint being connected to at least one phase of the rotating electrical machine, and

[0057] 2. A control unit comprising a control system according to the invention, with or without the features of the various embodiments,

[0058] The method of making an electrical system safe includes the following steps:

[0059] 1. Measure the voltage of the DC voltage source,

[0060] 2. Compare the measured voltage with a first safety threshold,

[0061] 3. When the measured power supply voltage is higher than a first safety threshold, closing a first set of switches selected from the high-side switch set or the low-side switch set. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Other features and advantages of the invention will become apparent from the following description, which is provided by way of non-limiting example and with reference to the accompanying drawings, in which:

[0063] Figure 1 A block diagram of an electrical system including a control unit comprising a control system according to one example of a first embodiment is shown.

[0064] Figure 2 A block diagram of a control unit including a control system according to one example of the first embodiment is shown.

[0065] Figure 3 and Figure 4 A histogram of the voltage measured between the terminals of a DC voltage source is shown.

[0066] For increased clarity, the same reference numerals are used throughout the drawings to identify the same or similar elements. DETAILED DESCRIPTION

[0067] Figure 1 A block diagram of an electrical system SE is shown, the electrical system SE comprising a first power supply terminal B+ and a second power supply terminal B- connected to a DC power supply B, which in this case, in this example, is a 48V DC power supply, such as a battery of a motor vehicle, allowing other electrical devices of the vehicle (not shown) to be powered via the on-board network. The DC voltage source may comprise a battery of the motor vehicle and a capacitor bank connected in parallel with the vehicle battery. In this example, the second terminal B- is the ground of the electrical system SE.

[0068] The electrical system SE comprises a rotating electrical machine M comprising a stator having at least three phases U, V, W and three coils U, V, W wound on the stator. In this example, the coils U, V, W are connected in a star configuration and each coil comprises a corresponding phase U, V, W at its output end.

[0069] The electrical system SE also comprises a voltage converter O for supplying electrical power from said DC voltage source B to the rotating electrical machine M.

[0070] The voltage converter O includes a plurality of switch arms connected in parallel between the terminals B+ and B-. The voltage converter O includes as many arms as the number of phases of the rotating electrical machine M. In this case, in the example described here, the voltage converter O includes three arms. Therefore, the voltage converter O includes a first arm X, a second arm Y, and a third arm Z.

[0071] Each arm X, Y, Z comprises a high-side switch HS_X, HS_Y, HS_Z and a low-side switch LS_X, LS_Y, LS_Z. Each high-side and low-side switch of the arm X, Y, Z is connected to each other at a midpoint PX, PY, PZ. The high-side switches form a switch group, called high group HS. Similarly, the low-side switches form a switch group, called low group BS.

[0072] In the examples described herein, each high-side or low-side switch is a metal oxide semiconductor field effect transistor, and each transistor includes a flyback diode.

[0073] In this case, in this example, on the first arm X, the first high-side switch HS_X is therefore connected to the first low-side switch LS_X via the first midpoint PX, on the second arm Y, the second high-side switch HS_Y is connected to the second low-side switch LS_Y via the second midpoint PY, and the third high-side switch HS_Z is correspondingly connected to the third low-side switch LS_Z via the third midpoint PZ.

[0074] Each midpoint PX, PY, PZ is connected to at least one phase U, V, W of the rotating electrical machine M, so in this case, in this example, the first midpoint PX is connected to phase U, the second midpoint PY is connected to phase V and the third midpoint Z is connected to phase W.

[0075] The voltage converter O further comprises a control unit U for controlling the high-side switches HS_X, HS_Y, HS_Z and the low-side switches LS_X, LS_Y, LS_Z. Thus, for each switch, the control unit U comprises an output connected to the control section for the corresponding switch. Figure 1 In the overload diagram, only the connection between the output of the control unit U and the control section for the third low-side switch LS_Z and the connection between the other output of the control unit U and the control section for the second high-side switch HS_Y are shown.

[0076] The control unit U controls the switching of each arm X, Y, Z by pulse width modulation (PWM).

[0077] Figure 2 A block diagram showing the control unit

[0078] The control unit U comprises a control system 1 comprising a module 10 for measuring the voltage of a DC voltage source B. In the example described here, the measuring module 10 measures the voltage V between the terminals B+ and B-. In other words, in the example described here, the voltage module 10 measures the voltage of a DC voltage source B having a nominal voltage of 48 Volts.

[0079] The control system 1 further comprises a comparison module 11 arranged to receive the measured voltage V from the measurement module 10 . The comparison module 11 compares the measured voltage V with a first safety threshold OV1 . The first safety threshold OV1 is stored in a non-volatile memory of the comparison module 11 , for example.

[0080] In the example described here, the first safety threshold OV1 is between 1.10 and 1.25 times the nominal voltage, for example corresponding to 1.2 times the nominal voltage of a DC voltage source, for example a DC voltage source of an on-board network of a vehicle. In this case, in this example, the safety threshold OV1 is 56 volts, or approximately 1.17 times the nominal voltage of a 48 volt DC voltage source.

[0081] The comparison module 11 is further designed to compare the measured voltage V with a second safety threshold OV2 which is higher than the first safety threshold OV1 . The second safety threshold OV2 is stored in a non-volatile memory of the comparison module 11 , for example.

[0082] The control system 1 also comprises a control module 12. In the example described here, the control module 12 is based on logic gates. As a variant, the control module 12 may be a microcontroller.

[0083] The comparison module 11 is configured to transmit information ov1 to the control module 12 when the measured voltage V is higher than the first safety threshold OV1. For example, when the measured voltage V is higher than the first safety threshold OV1, the information ov1 is transmitted in the form of a high logic level, otherwise it is transmitted in the form of a low logic level.

[0084] The comparison module 11 is also configured to send information ov2 to the control module 12 when the measured voltage V is higher than the second safety threshold OV2. For example, when the measured voltage V is higher than the second safety threshold OV2, the information ov2 is transmitted in the form of a high logic level, otherwise it is transmitted in the form of a low logic level. In the example described here, the second safety threshold is equal to 64 volts, i.e. 33% higher than the nominal voltage of 48 volts.

[0085] On receipt of the information ov1 , the control module 12 sends a command to close a first set of switches LS, HS selected from a set HS of high-side switches (ie the high set) or a set LS of low-side switches (ie the low set).

[0086] In the example described here, the first group of switches is the low group LS and the command is the command ASC_LS to close all switches of the low group LS.

[0087] Optionally, upon receipt of the information ov1, the control module 12 can also send a command to open a second set of switches LS, HS, the second set of switches being selected from a set HS of high-side switches (i.e., high set), or a set LS of low-side switches (i.e., low set), the second set of switches being different from the first set. In this case, the switching of each of the arms X, Y and Z is subject to a dead time during which both the high and low switches of the arm are open. In particular, the objective is to control the opening of a switch which is actually open before controlling the closing of another switch, so as to ensure that there is no "cross conduction" according to the expression known to those skilled in the art, which means that the high and low switches are closed at the same time.

[0088] In the example described here, the second group of switches is the high group HS, and the control module 12 may also send a command to open all switches of the high group HS.

[0089] On receipt of the information ov2, the control module 12 sends a command to close the second set of switches. In this case, in the example described here, the second set of switches is therefore the switches of the high group HS, and the command is a command ASC_HS to close all the switches of the high group HS.

[0090] Optionally, upon receipt of the information ov2, the control module 12 can also send a command to open the first group of switches. In this case, in the example described here, the switches of the first group are therefore the switches of the low group LS, and the command is a command to open all the switches of the low group LS. In this optional case, the switching of each of the arms X, Y and Z is subject to a dead time.

[0091] Thus, in the example described here, in the event of an overvoltage, the control module 12 first sends a command to close all low-side switches (low group LS) and potentially to open all high-side switches (high group HS).

[0092] exist Figure 1 In the process, the switch of the low group LS is closed, and the switch of the high group HS is open. Figure 1It can be seen in FIG. 1 that all phases U, V, W are at the same potential, in this case at the ground potential of the vehicle B-. Therefore, the electrical system SE is protected if the fault originates from a faulty high-side switch that remains open "held open state fault", or if the fault originates from a faulty low-side switch that remains closed "held closed state fault", or if the fault originates from another item on the on-board network, such as an untimely disconnection of the first DC power source B when the rotating electrical machine is in generator mode.

[0093] If the measured voltage is stable and does not exceed the second threshold OV2, the converter is in a satisfactory state, i.e., in a state where the overvoltage has been controlled and the converter is protected from the consequences of the overvoltage. In other words, the control system 1 has applied the correct strategy for the switching arm of the short-circuit voltage converter 0 for the fault type causing the overvoltage.

[0094] It should be noted that the second threshold must be configured far enough from the first threshold to allow time for the overvoltage to stabilize below the second threshold if shorting the first set of switches is the correct strategy to implement for the type of fault causing the overvoltage.

[0095] Otherwise, if the control system 1 does not apply the correct strategy for short-circuiting the switching arms of the voltage converter 0, the measured voltage V continues to increase until it exceeds the second threshold OV2. When the second threshold OV2 is exceeded, the control module 12 then sends a second command to close all high-side switches (high group HS) and potentially to open all low-side switches (low group LS).

[0096] At this stage, the control system 1 has to apply the correct strategy of short-circuiting the switching arms of the voltage converter 0. Thus, the overvoltage has been controlled and the converter is protected from the consequences of this overvoltage.

[0097] Optionally, the control module 12 may also include one or more inputs AE, which are configured to receive error information, such as error information related to too low a voltage (undervoltage or UV) on the vehicle network. Upon receiving the error information via the one or more inputs AE, the control module 12 also sends a command to close the first set of switches, and potentially sends a command to open the second set of switches.

[0098] In the embodiment described here, the control unit U also comprises a machine control module 2, a logic module 3 and a controller 4, also referred to as a “driver”.

[0099] The machine control module 2 comprises an input (not shown) for receiving a command from the electronic control unit of the vehicle, either to switch the rotary electric machine to motor mode according to the torque value provided, or to switch the rotary electric machine to alternator mode according to the resistive torque, in order to charge the DC voltage source of the vehicle. The machine control module 2 converts this command into a command for the high-side HS switch and the low-side LS switch, which is transmitted through the logic module 3 and the controller 4. In other words, the high-side switch HS and the low-side switch LS each receive a command, for example through pulse width modulation PWM_HS, PWM_LS, to be opened or closed, by means of the machine control module 2, the logic module 3 and the controller 4.

[0100] The logic module 3 is designed to prioritize the commands sent by the control system 1 over the commands sent by the machine control module 2. In other words, the control system 1 has priority over the machine control module 2.

[0101] Thus, the logic module 3 receives commands from the machine control module 2 or from the control system 1 in order to transmit them to the controller 4 .

[0102] Therefore, the logic module 3 preferentially sends the command received from the control module 12 rather than the command received from the machine control module 2. In other words, when the logic module 3 receives a command from the control module 12, it transmits the command to the controller 4, while not transmitting the command received from the machine control module 2 to the controller 4.

[0103] When the machine control module 2 is a microprocessor and when the control module 12 and the logic module 3 are based on logic gates, the reaction time of the machine control module 2 (typically in the order of tens of microseconds) is longer than the reaction time of the control module 12 (typically in the order of microseconds). Therefore, the prioritization performed by the logic module 3 ensures that the voltage converter O and the rotating electrical machine M become safe more quickly.

[0104] The logic module 3 may also send information ASC_LS_ON, ASC_HS_ON to the machine control module 2, for example in the form of logic levels, so as to inform the machine control module 2 that the control module 12 has controlled the closing of the first or second group of switches.

[0105] In this embodiment of the invention, the machine control module 2 may be further connected to the measurement module 11. Thus, in this case, the measurement module 11 may transmit the information ov1 or ov2 to the machine control module 2, which may thus:

[0106] 1. Check that the control module 12 is not erroneous in closing the first or second set of switches, and / or

[0107] 2. Send a command to the logic module 3 to close the first set of switches and then, if necessary, to close the second set of switches.

[0108] The double transmission of the command to close the first set of switches and, if necessary, the second set of switches thus makes it possible to have redundancy in the control and ensure a higher level of safety for the voltage converter 1 , in particular in the event of a fault in the control module 12 .

[0109] The machine control module 2 may further optionally include an input EV for measuring the voltage of a voltage source, in this example the voltage V measured by the measuring module 10. The machine control module 2 is thus able to check the operation of the measuring module 10. Furthermore, this allows the machine control module 2 to be able to return to normal mode when the measured voltage V decreases, for example when the engine control module 2 additionally receives information from the electronic control unit of the vehicle that an overvoltage is coming from a device other than the voltage converter 0.

[0110] The machine control module 2 may also optionally comprise an output VS connected to the comparison module 11 in order to force the comparison module 11 to indicate to the control module 12 that the measured voltage is above the first threshold or above the second safety threshold in order to check whether the control system 1 is operational.

[0111] The machine control module 2 may optionally further include other safety or fault detection modules for detecting or predicting overvoltage. For example, the machine control module 2 may include a phase current direction fault module 9. The fault module 9 is connected to a sensor 90 that measures the direction of the phase current. If the phase current direction is wrong, overvoltage may result. Therefore, when the machine control module 2 receives information from the safety module 9, the machine control module 2 directly controls the first set of switches to close, and optionally, controls the second set of switches to open.

[0112] Now refer to Figure 3 Describes the change in voltage V measured between terminals B+ and B- in the case where the first DC power source B is not disconnected in time.

[0113] In the bar graph, during the "Normal" time period A, the voltage converter O normally controls the high-side and low-side switches according to the instructions from the vehicle electronic control unit. During this time period, the measured voltage V is lower than the first safety threshold OV1, specifically, it is equal to the nominal voltage of the DC voltage source, in this case 48 volts, for a first duration. During this time period, at time T1, when the rotating electrical machine is in generator mode, the first DC power source B is disconnected from the vehicle network. This disconnection produces a load dump effect, resulting in an overvoltage of the vehicle network.

[0114] After disconnection, at time T2, the measured voltage exceeds the first safety threshold OV1, in this case 56 Volts.

[0115] The comparison module 11 of the control system 1 then sends to the control module 12 information ov1 according to which the measured voltage V is above the first safety threshold OV1. On receipt of this command, the control module 12 controls the closing of the switches of the first group and the opening of the switches of the second group. In this case, in this example, the control module 12 sends to the logic module 3 a command ASC_LS to close the low-side switches, thereby grounding the phases, and a command to open the high-side switches. Whatever commands the machine control module 2 also sends, the logic module 3 resends these commands to the controller 4 in order to control the closing of the switches of the low group LS and the opening of the switches of the high group HS.

[0116] from Figure 3 It can be seen from the histogram that the measured voltage V continues to rise until time T3 and then stabilizes at a voltage value between the first safety threshold OV1 and the second safety threshold OV2.

[0117] This stability indicates that the control system 1 has applied the correct strategy for short-circuiting the switching arms of the voltage converter 0 for the type of fault causing the overvoltage.

[0118] Now refer to Figure 4 Describes the voltage variation measured between terminals B+ and B- while the low-side switch of voltage converter 0 remains open.

[0119] In the bar graph, during the "normal" time period A, the voltage converter O normally controls the high-side and low-side switches according to the instructions from the vehicle electronic control unit. During this time period, the measured voltage V is lower than the first safety threshold OV1, specifically, it is equal to the nominal voltage of the DC voltage source, in this case 48 volts, for a first duration. During this time period A, at time T1, one low-side switch of the voltage converter O is stuck in the off state.

[0120] After the fault occurs on the low-side switch, at time T2 the measured voltage V exceeds a first safety threshold OV1 , in this case 56 Volts.

[0121] The comparison module 11 of the control system 1 then sends to the control module 12 information ov1 according to which the measured voltage V is above the first safety threshold OV1. On receipt of this command, the control module 12 controls the closing of the switches of the first group and the opening of the switches of the second group. In this case, in this example, the control module 12 sends to the logic module 3 a command ASC_LS to close the low-side switches, thereby grounding the phases, and a command to open the high-side switches. Whatever commands the machine control module 2 also sends, the logic module 3 resends these commands to the controller 4 in order to control the closing of the switches of the low group LS and the opening of the switches of the high group HS.

[0122] from Figure 4 As can be seen in the histogram, the measured voltage V is unstable and continues to increase until it reaches and exceeds a voltage value higher than the second safety threshold OV2.

[0123] This continuous rise of the measured voltage V indicates that the control system 1 does not apply the correct strategy of short-circuiting the switching arms of the voltage converter 0 for the type of fault causing the overvoltage.

[0124] This is because the faulty low-side transistor remains off and at least one phase of the rotating electrical machine is not short-circuited to ground.

[0125] Since the measured voltage V exceeds the second safety threshold ov2, in this case 64 volts, the comparison module 11 of the control system 1 then sends information ov2 to the control module 12, according to which the measured voltage V is above the second safety threshold OV2. On receiving this command, the control module 12 controls the second set of switches to close and the first set of switches to open. In this case, in this example, the control module 12 sends the command ASC_HS to the logic module 3 to close the high-side switches and sends a command to open the low-side switches. Regardless of what commands the machine control module 2 also sends, the logic module 3 resends these commands to the controller 4 in order to control the opening of the switches of the low group LS and the closing of the switches of the high group HS.

[0126] exist Figure 4 It can be seen from the histogram that the measured voltage V continues to rise until time T3 and stabilizes at a voltage value higher than the second safety threshold OV2.

[0127] This stability indicates that the control system 1 has applied the correct strategy for short-circuiting the switching arms of the voltage converter 0 for the type of fault causing the overvoltage.

[0128] The above embodiments may not include one or more of the above optional functions.

[0129] Of course, the invention is not limited to the embodiments described with reference to the drawings and alternative embodiments may be envisaged without departing from the scope of the invention.

[0130] Therefore, in the above embodiment, the switches of the first group are low-side switches and the switches of the second group are high-side switches, but as a variation, the switches of the first group may be high-side switches and the switches of the second group may be low-side switches.

[0131] Likewise, the rotating electrical machine described above is a three-phase electrical machine. As a variant, the rotating electrical machine may more generally have n phases, for example n=6 for a six-phase electrical machine. In this case, the voltage converter O also comprises n switching arms.

[0132] Likewise, in the above-described embodiment, the coils u, v, w are connected in a star configuration. As a variation, the coils u, v, w may be connected in a delta configuration.

[0133] Likewise, in the above-described embodiment, the logic module 3, the control module 12 and the machine control module 2 are implemented as different entities. As a variant, the logic module 3, the control module 12 and the machine control module 2 may be implemented as a single entity, such as a microcontroller including a programmable logic circuit, such as an FPGA (“Field Programmable Gate Array”) type.

[0134] Furthermore, in the above-described embodiments, the high-side and low-side transistors are MOSFETs. As a variant, these transistors may be IGBTs.

Claims

1. A system for controlling a voltage converter (O), the voltage converter (O) being used to connect a rotating electric machine (M) to a DC voltage source (B), the voltage converter (O) comprising a plurality of switch arms (X, Y, Z) connected in parallel, each switch arm (X, Y, Z) comprising a high-side switch (HS_X, HS_Y, HS_Z) and a low-side switch (LS_X, LS_Y, LS_Z), the high-side switch and the low-side switch being connected to each other at a midpoint (PX, PY, PZ) for connection to the rotating electric machine, the high-side switches forming a high group (HS) and the low-side switches forming a low group (LS), the system (1) comprising: a. a measuring module (10) for measuring the voltage (V) of the DC voltage source (B), b. a comparison module (11) for comparing the measured voltage (V) with a first safety threshold (OV1), c. a control module (12) for generating a command to close a first set of switches (LS) selected from a high set (HS) or a low set (LS) if the comparison module (11) indicates that the measured voltage (V) is higher than the first safety threshold (OV1); The comparison module (11) compares the measured voltage (V) with a second safety threshold (OV2) higher than the first safety threshold (OV1), and the control module (12) is also designed to generate a command to close a second group of switches selected from a high group (HS) or a low group (LS) when the measured voltage (V) is higher than or equal to the second safety threshold (OV2), wherein the second group of switches is different from the first group of switches.

2. The system (1) according to claim 1, wherein: The measurement voltage (V) is a voltage between two terminals (B+, B-) of the voltage converter (O) for connection to the DC voltage source (B).

3. The system (1) according to claim 1 or 2, wherein: When the measured voltage (V) is higher than or equal to the first safety threshold (OV1), the control module (12) is also designed to generate a command to open switches other than the first group of switches.

4. The system (1) according to claim 1, wherein: The control module (12) is also designed to generate a command to open the first set of switches when the measured voltage (V) is higher than or equal to the second safety threshold (OV2).

5. The system (1) according to claim 1 or 2, wherein: The first set of switches (LS) is a low set (LS).

6. An electrical system (SE), comprising: a. a first power terminal (B+) and a second power terminal (B-) for connecting to a DC voltage source (B), b. a rotating electrical machine (M) comprising a stator having at least three phases, c. a voltage converter (O) for supplying power from the DC voltage source (B) to the rotating electrical machine (M), the voltage converter (O) comprising: i. a plurality of switch arms (X, Y, Z) connected in parallel, each arm (X, Y, Z) comprising a high-side switch (HS_X, HS_Y, HS_Z) and a low-side switch (LS_X, LS_Y, LS_Z) connected to each other at a midpoint (PX, PY, PZ), each midpoint (PX, PY, PZ) being connected to at least one phase of the rotating electrical machine (M), and ii. A control unit for controlling a high-side switch and a low-side switch, the control unit comprising a system (1) according to any of the preceding claims.

7. Electrical system (SE) according to claim 6, wherein: The control unit further comprises at least one fault detection module (9), and wherein, when the fault detection module (9) detects a fault, the control unit controls the first set of switches to close.

8. Electrical system (SE) according to claim 6 or 7, wherein: The control unit also includes: a. A controller (4) designed to control a high-side switch and a low-side switch, b. a machine control module (2) for receiving an instruction from an electronic control unit of the vehicle to switch the rotating electrical machine (M) to motor mode or to switch the rotating electrical machine (M) to alternator mode, and arranged to convert the instruction into commands for controlling the high-side (HS) and low-side (LS) switches of the voltage converter (O), c. A logic module (3) for giving priority to commands sent by the system (1) over commands sent by the machine control module (2), wherein the logic module (3) sends commands for switching received by the machine control module (2) or the system (1) to the controller (4).

9. A method for controlling a system for controlling a voltage converter according to any one of claims 1 to 5, the voltage converter (O) being connected to a rotating electrical machine (M) and a DC voltage source (B), the method comprising: a. a step of measuring the voltage (V) of the DC voltage source (B) by the measuring module (10), b. a step of comparing the measured voltage (V) with a first safety threshold (OV1) by means of the comparison module (11), and c. If the measured voltage (V) is higher than the first safety threshold (OV1), a step of generating a command by a control module (12) to close a first set of switches (LS) selected from a high set (HS) or a low set (LS).

Images