A system and method for safely monitoring output torque of an electric drive system

Abstract

The present invention is applicable to the field of safety technology of electric drive system of electric vehicles, and provides an electric drive system output torque safety monitoring system and method, including signal acquisition, signal verification, resolver decoding module, torque estimation, torque monitoring and feedback, safety state control and fault reporting, CAN message verification and E2E processing and CAN communication receiving and sending module. According to the comparison between the calculated actual output torque of the motor and the torque request instruction from the CAN bus, when the deviation between the actual output torque and the torque request instruction exceeds the unexpected torque threshold, the electric drive system is controlled to enter an active short circuit or shutdown state. Avoid the occurrence of unexpected acceleration and deceleration, unexpected driving or unexpected reverse driving of the vehicle due to the inconsistency between the actual output torque of the motor and the torque request instruction, and achieve the development of safety goals of ASIL C level and higher level, with good engineering application value.

Description

Technical Field

[0001] The present invention belongs to the technical field of electric vehicle electric drive system safety, and in particular relates to an electric drive system output torque safety monitoring system and method. Background Art

[0002] Electric vehicles use the electric energy stored in the battery as the only energy supply. They have the characteristics of high efficiency, energy saving, low noise and zero emission. They have incomparable advantages in energy saving and environmental protection. Therefore, they have gradually become one of the important development trends in the automotive industry. As an important part of electric vehicles, the electric drive system includes motor controllers, motors and reducers. It is the key to realize the mutual conversion of electric energy and mechanical energy. The reliability and safety of its work are particularly important. With the release and implementation of the international functional safety standard ISO26262 and the national standard GB / T 34590, preventing the vehicle from unexpected acceleration and deceleration, unexpected driving or unexpected reverse driving due to the output of unexpected torque by the electric drive system is a vital safety goal of the electric drive system. The functional safety standard divides the ASIL level (Automotive Safety Integration Level) into four levels, namely ASILA, ASILB, ASIL C and ASIL D, among which ASILA is the lowest level and ASILD is the highest level. The ASIL level determines the safety requirements of the entire system. The higher the ASIL level, the stricter the development process, the corresponding increase in development costs and the extension of the development cycle.

[0003] At present, the electric drive industry usually conducts HARA (Hazard analysis and risk assessment) analysis based on the power system at the vehicle level, and according to the existing electric vehicle control strategy, the torque safety target of the motor controller is ASIL C or ASIL D. Therefore, how electric drive manufacturers can design an electric drive system output torque safety monitoring system and method under the premise of controlling development costs, and develop products that meet functional safety requirements according to the monitoring system will be the key to improving the core competitiveness of enterprises.

[0004] In the existing Chinese patent application (publication number: CN109130885A), a system and method for reducing the ASIL level of an electric vehicle motor controller is disclosed. The patent can reduce the ASIL level of the motor controller under the premise of ensuring that the torque functional safety of the same ASIL level is met at the vehicle level, so that the complexity and technical difficulties of the motor controller are reduced, and the cost of the vehicle and the project risk are effectively reduced. However, it is necessary to add a set of current sensors and rotary transformers and add corresponding software and hardware designs to the VCU, which is very difficult to achieve under the current industry situation with extremely stringent cost requirements. In the Chinese patent application (authorization announcement number: CN104590243B), a whole vehicle functional safety monitoring system is disclosed. The patent proposes a centralized whole vehicle functional safety monitoring system with torque monitoring and acceleration monitoring. The motor controller is used as a terminal power source controller, and its ASIL level is degraded, thereby reducing the complexity and cost of the monitoring system. However, the prior art does not describe how to design the monitoring system after the ASIL level of the motor controller is degraded. Summary of the invention

[0005] In view of the above problems, on the one hand, the present invention discloses a safety monitoring system for output torque of an electric drive system, the system comprising:

[0006] A signal acquisition module, used to collect operating parameters of the electric drive system;

[0007] The torque estimation module is used to obtain the actual output torque of the motor according to the operating parameters of the electric drive system collected by the signal acquisition module;

[0008] The torque monitoring and feedback module is used to compare the torque request command with the actual output torque of the motor to determine whether the electric drive system outputs unexpected torque. If unexpected torque is generated, an unexpected torque fault is sent to the safety state control and fault reporting module;

[0009] The safety state control and fault reporting module is used to control the electric drive system to enter a safe state according to the unexpected torque fault output by the torque monitoring and feedback module.

[0010] Furthermore, the operating parameters include resolver Sin / Cos signal, three-phase current signal, bus voltage signal, three-phase PWM wave feedback signal, resolver zero angle and motor parameters;

[0011] The motor parameters include the number of motor pole pairs, the difference between the motor dq axis inductance and the rotor flux.

[0012] Furthermore, the system further comprises:

[0013] A signal verification module is used to verify the operating parameters output by the signal acquisition module respectively, output a signal verification fault when the operating parameters are abnormal, and send the signal verification fault to the torque estimation module and the safety state control and fault reporting module;

[0014] The resolver decoding module calculates the rotor position signal and the motor speed signal based on the resolver Sin / Cos signal and the resolver zero angle.

[0015] Furthermore, the system further comprises:

[0016] The CAN message verification and E2E processing module is used to perform E2E verification on the received CAN message, generate CAN communication verification fault, and transmit the CAN communication verification fault to the safety state control and fault reporting module, and perform E2E processing on the actual output torque of the motor output by the torque monitoring and feedback module and the functional safety fault signal output by the safety state control and fault reporting module;

[0017] A CAN communication receiving and sending module, used for receiving and sending CAN communication messages, wherein the CAN communication messages include torque request instructions and control mode instructions;

[0018] The safety state control and fault reporting module is also used to control the electric drive system to enter a safe state according to the signal verification fault output by the signal verification module, the unexpected torque fault output by the torque monitoring and feedback module, or the CAN communication verification fault output by the CAN message verification and E2E processing module, and merge various faults into functional safety fault signals and send them to the CAN message verification and E2E processing module.

[0019] Furthermore, the E2E processing includes calculating signal redundancy information of the actual output torque of the motor and the functional safety fault signal and increasing a cycle counter.

[0020] Furthermore, the signal acquisition module performs dual-channel redundant sampling on the bus voltage, and outputs a bus voltage Vbus1 signal and a bus voltage Vbus2 signal.

[0021] Furthermore, the CAN message verification and E2E processing module performs E2E verification on the received CAN message, specifically including: signal redundancy information verification, cycle counter verification and Alive verification; the verification operation cycle is set to be equal to the CAN message cycle.

[0022] Further, a fault counter is set for the signal redundant information check, the cycle counter check and the Alive check respectively; each time a fault occurs during the check, the fault counter increases by Count1; each time a normal result is obtained during the check, the fault counter decreases by Count2; Count1>Count2 and the minimum value of the fault counter is 0;

[0023] When the value in any of the three fault counters is greater than or equal to the fault threshold, the CAN message verification and E2E processing module confirms that an E2E fault has occurred and outputs the CAN communication verification fault to the safety state control and fault reporting module.

[0024] Furthermore, the signal verification module performs amplitude range verification and rationality verification on the resolver transformer Sin / Cos signal; the Sin / Cos signal is a differential signal, including a Sin positive signal, a Sin negative signal, a Cos positive signal and a Cos negative signal, the Sin signal = Sin positive signal - Sin negative signal, the Cos signal = Cos positive signal - Cos negative signal;

[0025] The amplitude range check includes determining whether the Sin positive signal, the Sin negative signal, the Cos positive signal or the Cos negative signal is greater than the upper limit threshold of the resolver amplitude or less than the lower limit threshold of the resolver amplitude. If the determination result is yes, it is determined that a Sin / Cos amplitude range fault occurs.

[0026] The rationality check includes determining whether the square sum of the Sin signal and the Cos signal after standardization is within the rationality threshold of the resolver transformer. If the determination result is no, it is determined that a Sin / Cos rationality fault occurs.

[0027] Furthermore, the signal verification module performs amplitude range verification and rationality verification on the three-phase current signal;

[0028] The amplitude range check includes judging whether any phase current in the three-phase circuit is greater than the phase current upper limit or less than the phase current lower limit. If the judgment result is yes, it is judged that a three-phase current signal amplitude range fault occurs;

[0029] The rationality check includes determining whether the absolute value of the sum of the three-phase currents is less than a current rationality threshold. If the determination result is yes, it is determined that a three-phase current rationality fault occurs.

[0030] Furthermore, the signal verification module performs comparative verification on the bus voltage signal;

[0031] The comparison check includes: if the bus voltage Vbus1 is less than the voltage threshold, determine whether the absolute value of the bus voltage Vbus1 minus the bus voltage Vbus2 exceeds the voltage fault threshold 1; if the bus voltage Vbus1 is greater than or equal to the voltage threshold, determine whether the absolute value of the bus voltage Vbus1 minus the bus voltage Vbus2 divided by Vbus1 exceeds the voltage fault threshold 2; if any judgment result is yes, it is determined that a bus voltage comparison check fault occurs.

[0032] Furthermore, the signal verification module performs a range verification on the zero angle of the rotary transformer;

[0033] The range check includes determining whether the resolver zero angle is greater than an upper limit of the zero angle or less than a lower limit of the zero angle. If the determination result is yes, it is determined that a resolver zero angle range check fault occurs.

[0034] Furthermore, the resolver decoding module performs an inverse tangent operation on the resolver Sin / Cos signal to obtain a resolver position angle, and the resolver position angle plus the resolver zero angle obtain a rotor position signal; and obtains a motor speed signal based on a differential calculation of the resolver position angle.

[0035] Further, the torque estimation module includes a power model estimation unit, a current model estimation unit and a torque merging unit;

[0036] The current model estimation unit obtains an estimated torque 1 according to the three-phase current signal, the rotor position signal, the number of motor pole pairs, the difference in the motor dq axis inductance and the rotor flux;

[0037] The power model estimation unit obtains an estimated torque 2 according to the bus voltage Vbus1, the three-phase PWM wave feedback signal, the three-phase current signal, and the motor speed signal;

[0038] The torque merging unit determines to output estimated torque 1 or estimated torque 2 according to the motor speed; if the motor speed is lower than speed threshold 1, estimated torque 1 is output; if the motor speed is higher than speed threshold 2, estimated torque 2 is output, and hysteresis loop processing is performed between speed threshold 1 and speed threshold 2;

[0039] When the signal verification module outputs a signal verification fault, the torque merging unit outputs an invalid torque value.

[0040] Furthermore, the torque monitoring and feedback module determines whether to perform a comparison check between the torque request instruction and the actual output torque of the motor; if the control mode instruction received from the CAN message verification and E2E processing module is a torque mode, a comparison check is performed, and no comparison check is performed for other modes.

[0041] Furthermore, the comparison and verification of the torque request instruction and the actual output torque of the motor specifically includes:

[0042] When the direction of the torque request command and the direction of the actual motor output torque are both positive, if the difference between the actual motor output torque and the torque request command is greater than or equal to the unexpected torque threshold 1, an unexpected torque fault is determined;

[0043] When the direction of the torque request command and the direction of the actual motor output torque are both negative, if the difference between the actual motor output torque and the torque request command is less than or equal to the negative unexpected torque threshold 1, an unexpected torque fault is determined;

[0044] When the direction of the torque request instruction is inconsistent with the direction of the actual output torque of the motor, if the absolute value of the actual output torque of the motor is greater than or equal to the unexpected torque threshold 2, an unexpected torque fault is determined.

[0045] Furthermore, when the safety state control and fault reporting module receives a CAN communication verification fault, a signal verification fault or an unexpected torque fault, it controls the electric drive system to enter an active short circuit or shutdown state.

[0046] On the other hand, the present invention also discloses a method for safely monitoring the output torque of an electric drive system, the method comprising:

[0047] Collecting the operating parameters of the electric drive system;

[0048] According to the operating parameters of the electric drive system collected by the signal acquisition module, the actual output torque of the motor is obtained;

[0049] Compare the torque request command with the actual output torque of the motor to determine whether the electric drive system outputs unexpected torque. If unexpected torque is generated, an unexpected torque fault is generated.

[0050] Control the electric drive system to enter a safe state according to unexpected torque failure;

[0051] The operating parameters include resolver Sin / Cos signal, three-phase current signal, bus voltage signal, three-phase PWM wave feedback signal, resolver zero angle and motor parameters;

[0052] The motor parameters include the number of motor pole pairs, the difference between the motor dq axis inductance and the rotor flux.

[0053] Furthermore, after collecting the operating parameters of the electric drive system, the method further includes:

[0054] The bus voltage is subjected to dual-channel redundant sampling to obtain a bus voltage Vbus1 signal and a bus voltage Vbus2 signal.

[0055] Furthermore, the method further comprises:

[0056] Verify the operating parameters separately and generate signal verification fault when the operating parameters are abnormal;

[0057] The rotor position and motor speed are calculated based on the resolver Sin / Cos signal and the resolver zero angle;

[0058] Perform E2E verification on the received CAN message, generate CAN communication verification fault, and perform E2E processing on the actual output torque of the motor and the functional safety fault signal; the CAN communication message includes a torque request instruction and a control mode instruction;

[0059] The electric drive system is controlled to enter a safe state according to signal verification failure, unexpected torque failure and CAN communication verification failure, and various faults are combined into functional safety fault signals.

[0060] Furthermore, obtaining the actual output torque of the motor according to the operating parameters of the electric drive system collected by the signal acquisition module specifically includes:

[0061] The estimated torque 1 is obtained according to the three-phase current signal, the rotor position signal, the number of motor pole pairs, the difference between the motor dq axis inductance and the rotor flux;

[0062] According to the bus voltage Vbus1, the three-phase PWM wave feedback signal, the three-phase current signal, and the motor speed signal, the estimated torque 2 is obtained;

[0063] Output estimated torque 1 or estimated torque 2 according to the motor speed; if the motor speed is lower than speed threshold 1, estimated torque 1 is output; if the motor speed is higher than speed threshold 2, estimated torque 2 is output; hysteresis loop processing is performed between speed threshold 1 and speed threshold 2;

[0064] When the operating parameters are abnormal and a signal verification fault is generated, an invalid torque value is output.

[0065] Compared with the prior art, the present invention has the following beneficial effects:

[0066] The present invention provides an electric drive system output torque safety monitoring system and method, including signal acquisition, signal verification, resolver decoding module, torque estimation, torque monitoring and feedback, safety state control and fault reporting, CAN message verification and E2E processing and CAN communication receiving and sending module. By monitoring the electric drive system operating parameters and CAN communication signals related to functional safety, torque estimation and unexpected torque output monitoring, and detecting a fault, the control system enters a safe state and reports the fault, achieving ASIL C level and higher level safety target development, with controllable cost and good engineering application value.

[0067] Other features and advantages of the present invention will be described in the following description, and partly become obvious from the description, or be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0069] Figure 1 A schematic diagram of the structure of a safety monitoring system for output torque of an electric drive system according to an embodiment of the present invention is shown;

[0070] Figure 2 A schematic diagram showing the types of checks in a signal check module according to an embodiment of the present invention is shown;

[0071] Figure 3 A schematic diagram of output torque timing control of a torque merging module according to an embodiment of the present invention is shown;

[0072] Figure 4 A schematic diagram illustrating the torque direction of an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] To solve the above problems, Figure 1 The schematic diagram of the structure of the electric drive system output torque safety monitoring system according to an embodiment of the present invention is shown, wherein the safety monitoring system comprises:

[0075] The signal acquisition module collects the operating parameters of the electric drive system for functional safety monitoring, and outputs the resolver Sin / Cos signal, three-phase current signal, bus voltage signal, three-phase PWM wave feedback signal, resolver zero angle and motor parameters; and the signal acquisition module also performs dual-channel redundant sampling of the bus voltage, and outputs the bus voltage Vbus1 signal and the bus voltage Vbus2 signal.

[0076] The signal verification module is used to verify the signals output by the signal acquisition module respectively, output the signal verification fault when the operating parameters are abnormal, and send the signal verification fault to the torque estimation module and the safety state control and fault reporting module.

[0077] The resolver decoding module calculates the rotor position signal and the motor speed signal based on the resolver Sin / Cos signal and the resolver zero angle.

[0078] The torque estimation module is used to estimate the actual output torque of the motor according to the operating parameters of the electric drive system output after being collected by the signal acquisition module.

[0079] The torque monitoring and feedback module is used to compare the torque request command from the CAN (Controller Area Network) communication receiving and sending module and the actual output torque of the motor, and determine whether the electric drive system generates unexpected torque output. If unexpected torque is generated, an unexpected torque fault is sent to the safety status control and fault reporting module, and the actual output torque of the motor is output to the CAN message verification and E2E processing module.

[0080] The CAN message verification and E2E processing module is used to perform E2E (End to End) verification on the received CAN messages, perform E2E processing on the actual output torque of the motor output by the torque monitoring and feedback module and the functional safety fault signal output by the safety state control and fault reporting module, and transmit the CAN communication verification fault to the safety state control and fault reporting module.

[0081] The CAN communication receiving and sending module is used for receiving and sending CAN communication messages. The CAN messages received by the CAN communication receiving and sending module from the CAN bus include torque request instructions and control mode instructions.

[0082] The safety state control and fault reporting module is used to control the electric drive system to enter a safe state according to the signal verification fault output by the signal verification module, the unexpected torque fault output by the torque monitoring and feedback module, and the CAN communication verification fault output by the CAN message verification and E2E processing module, and merge various faults into functional safety fault signals and send them to the CAN message verification and E2E processing module.

[0083] It should be noted that the signal acquisition module collects the actual output switch PWM signal of the drive module in the motor controller as a three-phase PWM wave feedback signal, rather than the PWM input signal output to the drive module by the motor control algorithm.

[0084] The signal acquisition module reads the resolver zero angle from the NvM (Non-Volatile Memory) of the control chip in the motor controller.

[0085] The signal acquisition module reads the motor parameters from the NvM (Non-Volatile Memory) of the control chip in the electric drive system. The motor parameters include the number of motor pole pairs, the difference between the motor dq axis inductance and the rotor flux.

[0086] The torque request command and the control mode command can be in the same CAN message or distributed in two CAN messages.

[0087] In one embodiment of the present invention, the CAN message verification and E2E processing module shall perform E2E verification on the received CAN message containing the torque request instruction and the control mode instruction to determine whether the CAN message is complete;

[0088] The E2E check includes signal redundancy information check, cycle counter check and Alive check, and the check operation cycle is set to be equal to the CAN message cycle. The signal redundancy information check is preferably Checksum check, and the cycle counter check is preferably Rollingcount check.

[0089] For example, if the communication cycle of the same CAN message containing the torque request instruction and the control mode instruction is 10ms, then the E2E check is performed every 10ms, that is, the Checksum, Rollingcount and Alive checks are performed once each; if the torque request instruction and the control mode instruction are in different CAN messages, and the communication cycles of the two CAN messages are different, then the E2E check cycle is set according to their message cycle.

[0090] The Checksum check includes determining whether the Checksum bit in the CAN message of the torque request command and the control mode command is consistent with the expected value. If not, it is considered that a Checksum fault has occurred. The Rolling count check includes determining whether the Rolling count bit in the CAN message of the torque request command and the control mode command is consistent with the expected value. If not, it is considered that a Rollingcount fault has occurred. The Alive check includes determining whether the CAN message containing the torque request command and the control mode command is not received for more than the time threshold Time_threshold, and it is considered that an Alive fault has occurred.

[0091] Set Checksum, Rollingcount and Alive fault counters respectively. Every time a fault occurs during verification, the fault counter increases by Count1. Every time a normal result is obtained during verification, the fault counter decreases by Count2. Count1>Count2 and the minimum value of the fault counter is 0. When any of the three fault counters is greater than or equal to the threshold Count3, the CAN message verification and E2E processing module confirms that an E2E fault occurs and outputs the CAN communication verification fault to the safety state control and fault reporting module.

[0092] The CAN message verification and E2E processing module shall perform E2E processing on the actual output torque of the motor output by the torque monitoring and feedback module and the functional safety fault signal output by the safety status control and fault reporting module. The E2E processing includes calculating signal redundancy information and increasing a Rollingcount counter or a cycle counter. The signal redundancy information calculation is preferably a Checksum operation or a CRC8 (cyclic redundancy check calculation). CRC8 is 8-bit data and Rollingcount is 4-bit data.

[0093] For example: the actual output torque of the motor is Act_Torque, and the functional safety fault signal is FuSa_Fault. Then, CRC8 operation is performed according to Act_Torque and FuSa_Fault to obtain CRC_Value. At the same time, the Rollingcount counter Rcount is defined, and its starting value is 0, which is increased by 1 every 10ms, and the count is 0-15 cycles. Then, the complete data format sent by the CAN message check and E2E processing module to the CAN communication receiving and sending module is Act_Torque, FuSa_Fault, CRC_Value, Rcount.

[0094] Therefore, the CAN communication receiving and sending module should send the CAN message check and the complete data format sent to this module by the E2E processing module to the CAN bus.

[0095] Figure 2 A schematic diagram of the types of checks in the signal check module of an embodiment of the present invention is shown. The signal check module should perform amplitude range check and rationality check on the Sin / Cos signal of the resolver transformer; since the Sin / Cos signal output by the resolver is a differential signal, that is, the signal input to the signal check module is the Sin positive signal, the Sin negative signal, the Cos positive signal and the Cos negative signal, the Sin signal = Sin positive signal - Sin negative signal, and the Cos signal = Cos positive signal - Cos negative signal.

[0096] The amplitude range check method is to determine whether the Sin positive signal, Sin negative signal, Cos positive signal or Cos negative signal is greater than the resolver amplitude upper limit threshold or less than the resolver amplitude lower limit threshold, that is, two judgments are made for each of the four signals. If the result of any one of the eight judgments is yes, it is determined that a Sin / Cos amplitude range fault occurs.

[0097] The rationality check is to determine whether the square sum of the Sin signal and the Cos signal after per-unit calibration is within the rationality threshold of the resolver transformer. If it is not within the range, it is determined that a Sin / Cos rationality fault occurs. The preferred rationality threshold of the resolver transformer is 1±10%. The per-unit calibration is the Sin signal and the Cos signal divided by a reference value at the same time, so that the Sin signal and the Cos signal are both between 0 and 1.

[0098] Secondly, the signal verification module shall perform amplitude range verification and rationality verification on the three-phase current signal;

[0099] The amplitude range verification method is to check whether any phase current in the three-phase circuit is greater than the phase current upper limit or less than the phase current lower limit. If the judgment result is yes, it is judged that a three-phase current signal amplitude range fault occurs;

[0100] The rationality check is to determine whether the absolute value of the sum of the three-phase currents is less than the current rationality threshold. The preferred current rationality threshold is 30A, which can be calibrated according to the actual electric drive system. If the judgment result is yes, it is determined that a three-phase current rationality fault occurs.

[0101] Then, the signal verification module should also compare and verify the bus voltage signal, and the comparison verification method is: if the bus voltage Vbus1 is less than the voltage threshold, determine whether the absolute value of the bus voltage Vbus1 minus the bus voltage Vbus2 exceeds the voltage fault threshold 1; if the bus voltage Vbus1 is greater than or equal to the voltage threshold, determine whether the absolute value of the bus voltage Vbus1 minus the bus voltage Vbus2 divided by Vbus1 exceeds the voltage fault threshold 2; if any judgment result is yes, it is determined that the bus voltage comparison verification fault occurs. The preferred voltage threshold is 100V, the voltage fault threshold 1 is 10V, and the voltage fault threshold 2 is 10%.

[0102] Finally, the signal verification module should perform a range check on the resolver zero angle to detect whether the resolver zero angle is greater than the upper limit of the zero angle or less than the lower limit of the zero angle. If the judgment result is yes, it is determined that a resolver zero angle range verification fault occurs.

[0103] In one embodiment of the present invention, the resolver decoding module obtains the resolver position angle through the inverse tangent operation arctan (Sin signal / Cos signal) according to the resolver Sin / Cos signal, and obtains the rotor position signal by adding the resolver position angle to the resolver zero angle; and obtains the motor speed signal according to the differential calculation of the resolver position angle.

[0104] Figure 1 A schematic diagram of the structure of the electric drive system output torque safety monitoring system according to an embodiment of the present invention is shown, wherein the torque estimation module includes three units, namely a power model estimation unit, a current model estimation unit and a torque merging unit.

[0105] The current model estimation unit calculates the estimated torque 1 using the three-phase current signal, the rotor position signal, the number of motor pole pairs, the difference between the motor dq axis inductance and the rotor flux;

[0106] The power model estimation unit calculates the estimated torque 2 using the bus voltage Vbus1, the three-phase PWM wave feedback signal, the three-phase current signal, and the motor speed signal;

[0107] The torque merging unit determines the output of estimated torque 1 or estimated torque 2 according to the motor speed. If the motor speed is lower than the speed threshold 1, the estimated torque 1 is output. If the motor speed is higher than the speed threshold 2, the estimated torque 2 is output. A hysteresis loop is performed between the speed threshold 1 and the speed threshold 2. Figure 3 shown.

[0108] If the signal verification module detects any fault, the torque merging unit outputs an invalid torque value, such as 32767.

[0109] In addition, it should be noted that the torque monitoring and feedback module must first determine whether it is necessary to start the comparison check between the torque request instruction and the actual output torque of the motor. If the control mode instruction from the CAN message check and E2E processing module is the torque mode, the comparison is turned on, and other modes are not turned on. The torque request instruction comes from the vehicle CAN bus, and is input into the torque monitoring and feedback module after passing through the CAN communication receiving and sending module and the CAN message check and E2E processing module. The torque request instruction represents the torque that the vehicle expects the motor to output; the comparison check between the torque request instruction and the actual output torque of the motor can detect whether the actual output torque of the motor is consistent with the torque expected by the vehicle. If the error exceeds a certain range, it is considered that unexpected torque output occurs, and the electric drive system is controlled to enter the active short circuit or shutdown state through the safety state control and fault reporting module. According to industry experience, the active short circuit or shutdown state is considered safe for the vehicle because the motor output torque is very small at this time.

[0110] The comparison and verification of the torque request command and the actual output torque of the motor specifically includes:

[0111] (1) When the direction of the torque request command and the direction of the actual motor output torque are both positive (see Figure 4 ), if the difference between the actual motor output torque and the torque request command is greater than or equal to the unexpected torque threshold 1, an unexpected torque fault is determined;

[0112] (2) When the direction of the torque request command and the direction of the actual motor output torque are both negative (see Figure 4 ), if the difference between the actual motor output torque and the torque request command is less than or equal to the negative unexpected torque threshold 1, an unexpected torque fault is determined;

[0113] (3) When the direction of the torque request instruction is inconsistent with the direction of the actual output torque of the motor, if the absolute value of the actual output torque of the motor is greater than or equal to the unexpected torque threshold 2, an unexpected torque fault is determined.

[0114] In summary, when the safety status control and fault reporting module receives a CAN communication verification fault, a Sin / Cos amplitude range fault, a Sin / Cos rationality fault, a three-phase current signal amplitude range fault, a three-phase current rationality fault, a bus voltage comparison verification fault, a resolver zero angle range verification fault or an unexpected torque fault, the electric drive system is controlled to enter an active short circuit or shutdown state.

[0115] The safety status control and fault reporting module should summarize the CAN communication E2E verification fault, Sin / Cos amplitude range fault, Sin / Cos rationality fault, three-phase current signal amplitude range fault, three-phase current rationality fault, bus voltage comparison verification fault, resolver zero angle range verification fault, unexpected torque fault, and the output functional safety fault signal is FuSa_Fault to the CAN message verification and E2E processing module.

[0116] The signal output by the signal acquisition module is verified by the signal verification module to ensure that the signal input used by the torque monitoring and feedback module to calculate the actual output torque of the motor meets the functional safety requirements; the received CAN message containing the torque request instruction and the control mode instruction is verified by E2E through CAN message verification and E2E processing to ensure that the calculated torque request instruction and control mode instruction of the input torque monitoring and feedback module meet the functional safety requirements; according to the comparison between the calculated actual output torque of the motor and the torque request instruction from the CAN bus, when the deviation between the actual output torque and the torque request instruction exceeds the unexpected torque threshold, the electric drive system is controlled to enter an active short circuit or shutdown state. Avoid hazardous events such as unexpected acceleration and deceleration, unexpected driving or unexpected reverse driving of the vehicle due to the inconsistency between the actual output torque of the motor and the torque request instruction, and achieve the development of safety goals of ASIL C level and higher.

[0117] The present invention provides an electric drive system output torque safety monitoring system and method, including signal acquisition, signal verification, resolver decoding module, torque estimation, torque monitoring and feedback, safety state control and fault reporting, CAN message verification and E2E processing and CAN communication receiving and sending module. By monitoring the electric drive system operating parameters and CAN communication signals related to functional safety, torque estimation and unexpected torque output monitoring, and detecting a fault, the control system enters a safe state and reports the fault, achieving the development of safety targets of ASIL C level and higher level, and having good engineering application value.

[0118] Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An electric drive system output torque safety monitoring system, characterized in that: The system comprises: A signal acquisition module, used to collect operating parameters of the electric drive system; The torque estimation module is used to obtain the actual output torque of the motor according to the operating parameters of the electric drive system collected by the signal acquisition module; The torque estimation module includes a power model estimation unit, a current model estimation unit and a torque merging unit; the current model estimation unit obtains an estimated torque 1 according to the three-phase current signal, the rotor position signal, the motor pole pair, the difference between the motor dq axis inductance and the rotor flux; the power model estimation unit obtains an estimated torque 2 according to the bus voltage Vbus1, the three-phase PWM wave feedback signal, the three-phase current signal and the motor speed signal; the torque merging unit outputs the estimated torque 1 or the estimated torque 2 according to the motor speed judgment; if the motor speed is lower than the speed threshold 1, the estimated torque 1 is output; if the motor speed is higher than the speed threshold 2, the estimated torque 2 is output, and a hysteresis loop is performed between the speed threshold 1 and the speed threshold 2; when the signal verification module outputs a signal verification fault, the torque merging unit outputs an invalid torque value; The torque monitoring and feedback module is used to compare the torque request command with the actual output torque of the motor to determine whether the electric drive system outputs unexpected torque. If unexpected torque is generated, an unexpected torque fault is sent to the safety state control and fault reporting module; A safety state control and fault reporting module is used to control the electric drive system to enter a safe state according to the unexpected torque fault output by the torque monitoring and feedback module; A signal verification module is used to verify the operating parameters output by the signal acquisition module respectively, output a signal verification fault when the operating parameters are abnormal, and send the signal verification fault to the torque estimation module and the safety state control and fault reporting module; The signal verification module performs amplitude range verification on the three-phase current signal; the amplitude range verification includes determining whether any phase current in the three-phase circuit is greater than the phase current upper limit or less than the phase current lower limit. If the determination result is yes, it is determined that a three-phase current signal amplitude range fault occurs; The signal verification module compares and verifies the bus voltage signal; the comparison verification includes: if the bus voltage Vbus1 is less than the voltage threshold, determining whether the absolute value of the bus voltage Vbus1 minus the bus voltage Vbus2 exceeds the voltage fault threshold 1; if the bus voltage Vbus1 is greater than or equal to the voltage threshold, determining whether the absolute value of the bus voltage Vbus1 minus the bus voltage Vbus2 divided by Vbus1 exceeds the voltage fault threshold 2; if any judgment result is yes, it is determined that a bus voltage comparison verification fault occurs.

2. The electric drive system output torque safety monitoring system according to claim 1, characterized in that: The operating parameters include resolver Sin / Cos signal, three-phase current signal, bus voltage signal, three-phase PWM wave feedback signal, resolver zero angle and motor parameters; The motor parameters include the number of motor pole pairs, the difference between the motor dq axis inductance and the rotor flux.

3. The electric drive system output torque safety monitoring system according to claim 2, characterized in that: The system further comprises: The resolver decoding module calculates the rotor position signal and the motor speed signal based on the resolver Sin / Cos signal and the resolver zero angle.

4. The electric drive system output torque safety monitoring system according to claim 3, characterized in that: The system further comprises: The CAN message verification and E2E processing module is used to perform E2E verification on the received CAN message, generate CAN communication verification fault, and transmit the CAN communication verification fault to the safety state control and fault reporting module, and perform E2E processing on the actual output torque of the motor output by the torque monitoring and feedback module and the functional safety fault signal output by the safety state control and fault reporting module; A CAN communication receiving and sending module, used for receiving and sending CAN communication messages, wherein the CAN communication messages include torque request instructions and control mode instructions; The safety state control and fault reporting module is also used to control the electric drive system to enter a safe state according to the signal verification fault output by the signal verification module, the unexpected torque fault output by the torque monitoring and feedback module, or the CAN communication verification fault output by the CAN message verification and E2E processing module, and merge various faults into functional safety fault signals and send them to the CAN message verification and E2E processing module.

5. The electric drive system output torque safety monitoring system according to claim 4, characterized in that: The E2E processing includes calculating signal redundancy information of the actual output torque of the motor and the functional safety fault signal and increasing a cycle counter.

6. The electric drive system output torque safety monitoring system according to claim 3, characterized in that: The signal acquisition module performs dual-channel redundant sampling on the bus voltage, and outputs a bus voltage Vbus1 signal and a bus voltage Vbus2 signal.

7. The electric drive system output torque safety monitoring system according to claim 4, characterized in that: The CAN message verification and E2E processing module performs E2E verification on the received CAN message, specifically including: signal redundancy information verification, cycle counter verification and Alive verification; the verification operation cycle is set to be equal to the CAN message cycle.

8. The electric drive system output torque safety monitoring system according to claim 7, characterized in that: Setting a fault counter for the signal redundancy information check, the cycle counter check and the Alive check respectively; Each time a fault occurs during the check, the fault counter increases by Count1; Each time a normal result is detected, the fault counter decreases Count2; Count1>Count2 and the minimum value of the fault counter is 0; When the value in any of the three fault counters is greater than or equal to the fault threshold, the CAN message verification and E2E processing module confirms that an E2E fault has occurred and outputs the CAN communication verification fault to the safety state control and fault reporting module.

9. The electric drive system output torque safety monitoring system according to claim 2, characterized in that: The signal verification module performs amplitude range verification and rationality verification on the resolver transformer Sin / Cos signal; the Sin / Cos signal is a differential signal, including a Sin positive signal, a Sin negative signal, a Cos positive signal and a Cos negative signal, the Sin signal = Sin positive signal - Sin negative signal, the Cos signal = Cos positive signal - Cos negative signal; The amplitude range check includes determining whether the Sin positive signal, the Sin negative signal, the Cos positive signal or the Cos negative signal is greater than the upper limit threshold of the resolver amplitude or less than the lower limit threshold of the resolver amplitude. If the determination result is yes, it is determined that a Sin / Cos amplitude range fault occurs. The rationality check includes determining whether the square sum of the Sin signal and the Cos signal after standardization is within the rationality threshold of the resolver transformer. If the determination result is no, it is determined that a Sin / Cos rationality fault occurs.

10. The electric drive system output torque safety monitoring system according to claim 2, characterized in that: The signal verification module performs rationality verification on the three-phase current signal; The rationality check includes determining whether the absolute value of the sum of the three-phase currents is less than a current rationality threshold. If the determination result is yes, it is determined that a three-phase current rationality fault occurs.

11. The electric drive system output torque safety monitoring system according to claim 2, characterized in that: The signal verification module performs range verification on the zero angle of the rotary transformer; The range check includes determining whether the resolver zero angle is greater than an upper limit of the zero angle or less than a lower limit of the zero angle. If the determination result is yes, it is determined that a resolver zero angle range check fault occurs.

12. The electric drive system output torque safety monitoring system according to claim 6, characterized in that: The resolver decoding module performs an inverse tangent operation according to the resolver Sin / Cos signal to obtain a resolver position angle, and the resolver position angle plus the resolver zero angle obtain a rotor position signal; and obtains a motor speed signal according to the differential calculation of the resolver position angle.

13. The electric drive system output torque safety monitoring system according to claim 1, characterized in that: The torque monitoring and feedback module determines whether to perform a comparison check between the torque request instruction and the actual output torque of the motor; If the control mode command received from the CAN message verification and E2E processing module is the torque mode, a comparison check is performed, and no comparison check is performed for other modes.

14. The electric drive system output torque safety monitoring system according to claim 13, characterized in that: The comparison and verification of the torque request command and the actual output torque of the motor specifically includes: When the direction of the torque request command and the direction of the actual motor output torque are both positive, if the difference between the actual motor output torque and the torque request command is greater than or equal to the unexpected torque threshold 1, an unexpected torque fault is determined; When the direction of the torque request command and the direction of the actual motor output torque are both negative, if the difference between the actual motor output torque and the torque request command is less than or equal to the negative unexpected torque threshold 1, an unexpected torque fault is determined; When the direction of the torque request instruction is inconsistent with the direction of the actual output torque of the motor, if the absolute value of the actual output torque of the motor is greater than or equal to the unexpected torque threshold 2, an unexpected torque fault is determined.

15. The electric drive system output torque safety monitoring system according to any one of claims 1 to 14, characterized in that: When the safety state control and fault reporting module receives a CAN communication verification fault, a signal verification fault or an unexpected torque fault, it controls the electric drive system to enter an active short circuit or shutdown state.

16. A method for safely monitoring output torque of an electric drive system, characterized in that: The method comprises: Collecting the operating parameters of the electric drive system; According to the operating parameters of the electric drive system collected by the signal acquisition module, the actual output torque of the motor is obtained, specifically including: obtaining estimated torque 1 according to the three-phase current signal, the rotor position signal, the number of motor poles, the difference in the motor dq axis inductance and the rotor flux; obtaining estimated torque 2 according to the bus voltage Vbus1, the three-phase PWM wave feedback signal, the three-phase current signal and the motor speed signal; outputting estimated torque 1 or estimated torque 2 according to the motor speed; if the motor speed is lower than the speed threshold 1, the estimated torque 1 is output; if the motor speed is higher than the speed threshold 2, the estimated torque 2 is output, and a hysteresis loop is performed between the speed threshold 1 and the speed threshold 2; when the operating parameter abnormality generates a signal verification fault, an invalid torque value is output; Compare the torque request command with the actual output torque of the motor to determine whether the electric drive system outputs unexpected torque. If unexpected torque is generated, an unexpected torque fault is generated. Control the electric drive system to enter a safe state according to unexpected torque failure; The operating parameters include resolver Sin / Cos signal, three-phase current signal, bus voltage signal, three-phase PWM wave feedback signal, resolver zero angle and motor parameters; The motor parameters include the number of motor pole pairs, the difference between the motor dq axis inductance and the rotor flux; The method further comprises: respectively verifying the operating parameters, and generating a signal verification fault when the operating parameters are abnormal.

17. The method for safely monitoring the output torque of an electric drive system according to claim 16, characterized in that: After collecting the operating parameters of the electric drive system, the method further includes: The bus voltage is subjected to dual-channel redundant sampling to obtain a bus voltage Vbus1 signal and a bus voltage Vbus2 signal.

18. The method for safely monitoring the output torque of an electric drive system according to claim 16, characterized in that: The method further comprises: The rotor position and motor speed are calculated based on the resolver Sin / Cos signal and the resolver zero angle; Perform E2E verification on the received CAN message, generate CAN communication verification fault, and perform E2E processing on the actual output torque of the motor and the functional safety fault signal; CAN communication message includes torque request command and control mode command; The electric drive system is controlled to enter a safe state according to signal verification failure, unexpected torque failure and CAN communication verification failure, and various faults are combined into functional safety fault signals.

Images