Electronic control devices for power conversion, power supply ICs

Abstract

This invention integrates safety functions into a power supply IC, thereby improving reliability. The electronic control device for power conversion includes: a power module that converts DC power into AC power and supplies it to a motor; a gate driver that controls the power module; a microcontroller that controls the gate driver; a power supply IC that supplies power to at least one of the gate driver and the microcontroller; a discharge circuit that releases the high voltage supplied to the power module; and a sensor. The power supply IC includes: a microcontroller anomaly detection circuit that detects anomalies in the microcontroller; and a safety processing circuit that determines the necessity of safety processing based on the output of at least one of the microcontroller anomaly detection circuit and the sensor, and performs safety processing, wherein the safety processing circuit stops the motor or releases the high voltage using the discharge circuit.

Description

Technical Field

[0001] This invention relates to an electronic control device for power conversion and a power supply IC. Background Technology

[0002] Electric vehicles, in addition to low-voltage batteries that power the onboard electronic control devices, also possess high-voltage batteries to drive the motor. Compared to traditional vehicles powered solely by internal combustion engines, electric vehicles have an increased number of components for voltage, current, and temperature monitoring. Furthermore, electric vehicles require control functions for safely handling high voltages and various control functions to safely stop the motor and other components in case of malfunctions. The power conversion electronic control devices used in electric vehicles incorporate these diverse monitoring and control functions, but the large number of IC components required increases the device cost, and ensuring the reliability of each IC component becomes a challenge.

[0003] Patent Document 1 discloses an apparatus comprising: a plurality of programmable hardware resources disposed on an integrated circuit (IC) die; an analog-to-digital converter (ADC) disposed on the IC die and configured to quantize the values ​​of one or more analog parameters of the IC die; a configuration control circuit disposed on the IC die and configured to, in response to a set of configuration data, program the programmable hardware resources to install a set of circuits specified by the set of configuration data, and connect the ADC to various nodes of the IC die to sample the one or more analog parameters; and an interface circuit coupled to the ADC and configured to generate a control signal based on the quantized values ​​of the one or more analog parameters from the ADC, and output the control signal to a power supply coupled to a power supply terminal of the IC die.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Publication No. 2017-536041. Summary of the Invention

[0007] The problem the invention aims to solve

[0008] In the invention described in Patent Document 1, there is room for improvement in reliability.

[0009] Technical means to solve the problem

[0010] The first aspect of the present invention provides an electronic control device for power conversion, comprising: a power module that converts direct current power into alternating current power and supplies it to a motor; a gate driver that controls the power module; a microcontroller that controls the gate driver; a power supply IC that supplies power to at least one of the gate driver and the microcontroller; a discharge circuit that releases the high voltage supplied to the power module; and a sensor, wherein the power supply IC comprises: a microprocessor anomaly detection circuit that detects anomalies in the microcontroller; and a safety processing circuit that determines the necessity of safety processing based on the output of at least one of the microprocessor anomaly detection circuit and the sensor and performs safety processing, wherein the safety processing circuit stops the motor or releases the high voltage using the discharge circuit.

[0011] The power supply IC of the second aspect of the present invention is provided in the above-mentioned electronic control device for power conversion.

[0012] The effects of the invention

[0013] According to the present invention, safety functions are integrated into the power IC, thereby improving reliability. Attached Figure Description

[0014] Figure 1 This is a diagram showing the basic structure of an electric vehicle.

[0015] Figure 2 This is a schematic diagram showing the connection between the inverter and the motor.

[0016] Figure 3 This diagram illustrates the configuration of an inverter focused on power supply.

[0017] Figure 4 This is a block diagram showing the configuration of the inverter in the first embodiment.

[0018] Figure 5 This is a block diagram showing the configuration of the inverter in the second embodiment.

[0019] Figure 6 This is a block diagram showing the configuration of the inverter in the third embodiment.

[0020] Figure 7 This is a block diagram showing the configuration of the inverter in the fourth embodiment.

[0021] Figure 8 This is a block diagram showing the configuration of the inverter in the fifth embodiment.

[0022] Figure 9 This is a block diagram showing the configuration of the inverter in the sixth embodiment.

[0023] Figure 10 This is a block diagram showing the configuration of the inverter in the seventh embodiment.

[0024] Figure 11 This is a block diagram showing the configuration of the inverter in the eighth embodiment.

[0025] Figure 12 This is a block diagram showing the configuration of the inverter in the 9th embodiment.

[0026] Figure 13 This is a block diagram showing the configuration of the inverter in the 10th embodiment.

[0027] Figure 14 This is a block diagram showing the configuration of the inverter in the 11th embodiment. Detailed Implementation

[0028] Before describing individual implementation methods, we will describe the representative components of an electric vehicle. Figure 1 This is a schematic diagram of the electric vehicle. The electric vehicle 1 has a high-voltage battery 13, an inverter 3, a motor 4, an internal combustion engine 5, a generator 6, a low-voltage battery 12, and wheels 7. The high-voltage battery 13 is charged by the generator 6 driven by the power of the internal combustion engine 5 or the motor 4, such as a gasoline engine, or by an external power source 2.

[0029] Furthermore, the inverter 3 is a particularly important component for the proper control of electricity to drive the electric vehicle 1. The electricity extracted from the high-voltage battery 13 is direct current (DC) power 10, while the motor 4 mounted on the electric vehicle 1 generally requires alternating current (AC) power 11 for driving. The inverter 3, driven by the low-voltage battery 12, converts the DC power 10 supplied from the high-voltage battery 13 into AC power 11 to drive and control the motor 4. Therefore, the inverter 3 is also referred to as an electronic control device for power conversion. The motor 4, controlled by the inverter 3, drives the electric vehicle 1 by transmitting the generated power to the wheels 7.

[0030] Figure 2 This is a schematic diagram showing the connection between inverter 3 and motor 4. The motor 4 used in electric vehicle 1 is a three-phase AC motor, which operates by taking three different phases of AC power as input.

[0031] Therefore, the inverter 3 is equipped with three power modules that supply AC power to the motor 4, namely the first power module 201, the second power module 202, and the third power module 203.

[0032] These power modules in inverter 3 perform the primary function of converting DC power to AC power. Each power module incorporates power devices such as two sets of Insulated Gate Bipolar Transistors (IGBTs) and Metal Oxide Semiconductor Field Effect Transistors (MOSFETs). Specifically, the first power module 201 includes power device 1A (symbol 204) and power device 1B (symbol 205). The second power module 202 includes power device 2A (symbol 206) and power device 2B (symbol 207). The third power module 203 includes power device 3A (symbol 208) and power device 3B (symbol 209).

[0033] The power devices shown in symbols 204-209 are used for switching, and the alternating current flowing to the motor 4 is output controlled to convert the direct current to alternating current. The power devices shown in symbols 204-209 are controlled by gate drivers 101-106, respectively. Each of gate drivers 101-106 is controlled by a microcontroller 20. The microcontroller 20 controls the rotational speed of the motor 4 by changing the frequency of the alternating current generated by each power module through the control of each of the gate drivers 101-106.

[0034] Figure 3 This diagram illustrates the configuration of inverter 3, which focuses on power supply. However, Figure 3 This mainly illustrates the control flow of power and the safety processing circuit. Inverter 3 includes a power supply IC 30, a microcontroller 20, a voltage sensor 301, a current sensor 302, a temperature sensor 303, a safety processing circuit 51, and first gate drivers 101 to sixth gate drivers 106. The power supply IC 30 has the function of supplying stable power in conjunction with the components and circuits built into inverter 3.

[0035] The power supply IC 30 includes a power generation unit 80 and a microcomputer fault detection circuit 70. The power generation unit 80 includes a boost / buck circuit 31, an internal power supply circuit 34, a first power supply circuit 40, a second power supply circuit 41, a third power supply circuit 42, a fourth power supply circuit 43, a fifth power supply circuit 44, and a sixth power supply circuit 45. The power supply IC 30 receives power from the low-voltage battery 12, raises or lowers the voltage level via the boost / buck circuit 31, adjusts the characteristics using the first to sixth power supply circuits 40, and supplies power to the external circuit. Additionally, the power supply IC 30 receives power from the low-voltage battery 12, adjusts the voltage level via the internal power supply circuit 34, and supplies power to its internal components. For example, for illustration purposes, the microcomputer fault detection circuit 70 is not connected to the internal power supply circuit 34, but in reality, the microcomputer fault detection circuit 70 is powered by the internal power supply circuit 34.

[0036] The first power supply circuit 40 and the second power supply circuit 41 provide power with different characteristics to the microcontroller 20. The third power supply circuit 42 supplies power to the voltage sensor 301. The fourth power supply circuit 43 supplies power to the current sensor 302. The fifth power supply circuit 44 supplies power to the temperature sensor 303. The sixth power supply circuit 45 supplies power to the first gate driver 101 to the sixth gate driver 106. Alternatively, the power output from the buck-boost circuit 31 can be directly supplied to the outside without passing through any power supply circuit. Alternatively, the power output to the outside of the power supply IC 30 without passing through any power supply circuit can be further supplied to the components and circuits built into the inverter 3 after passing through the seventh power supply circuit 46.

[0037] The number of power circuits mounted on the power IC 30 needs to be supplied from the power IC 30, and needs to correspond to the amount of power with different characteristics required outside the power IC 30. For example, if the characteristics of the power supplied to the voltage sensor 301, current sensor 302 and temperature sensor 303 can be the same, the fourth power circuit 43 and the fifth power circuit 44 can be omitted.

[0038] The safety processing circuit 51 is composed of programmable circuits such as FPGA (Field-Programmable Gate Array) and CPLD (Complex Programmable Logic Device). The safety processing circuit 51 is connected to the microcontroller 20, voltage sensor 301, current sensor 302, temperature sensor 303, and microcomputer anomaly detection circuit 70, and detects anomalies generated in the microcontroller 20, etc., using known methods. When an anomaly is detected in any of the microcontrollers, etc., the safety processing circuit 51 performs safety processing. Safety processing refers to at least one of the following: activating the discharge circuit 400 to release the high voltage, and stopping the operation of the first gate driver 101 to the sixth gate driver 106 to stop the motor 4.

[0039] The microprocessor anomaly detection circuit 70 is implemented, for example, using a watchdog timer provided by the power supply IC 30. The microprocessor anomaly detection circuit 70 detects anomalies in the microcontroller 20 through communication such as SPI (Serial Peripheral Interface) between the microcontroller 20 and the power supply IC 30. For example, when an anomaly is detected, the microprocessor anomaly detection circuit 70 resets the microcontroller 20. Specifically, the anomaly detection process involves the power supply IC 30 sending questions to the microcontroller 20 according to its requests, continuously diagnosing whether the responses from the microcontroller 20 are correct or whether they were given at the appropriate time, etc. When the count value incremented or decremented due to anomaly detection exceeds a certain value, a reset signal is output, causing the microcontroller 20 to stop.

[0040] The above describes a representative configuration of an electric vehicle. In the various embodiments described below, the differences from the previously described representative configuration will be primarily explained.

[0041] —First Embodiment—

[0042] Figure 4 This is a configuration diagram of the inverter 3A according to the first embodiment. The inverter 3A includes: a power supply IC 30A that supplies power to an external source; a power module group 200 that supplies power to a motor 4; a gate driver group 100 that controls the power module group 200; a microcontroller 20 that controls the gate driver group 100; a voltage sensor 301 that observes the voltage supplied to the power module group 200; a discharge circuit 400 that releases the high voltage supplied to the power module group 200 from a capacitor 403; and a current sensor 302 that observes the current supplied to the motor 4. Additionally, in Figure 4 Detailed information about the power generation unit 80 is omitted, but... Figure 3As explained, power is supplied to each component of the power IC 30 from the buck-boost circuit 31 of the power generation unit 80 and the internal power circuit 34.

[0043] Figure 4 The power module group 200 in the middle is equivalent to summing up Figure 2 The first power module 201 to the third power module 203 in the middle. Figure 4 The gate driver group 100 in the middle is equivalent to summing up Figure 2 The first gate driver 101 to the sixth gate driver 106 in the series. Figure 4 The power IC30A in the middle corresponds to Figure 2 and Figure 3 The power supply IC 30A in this embodiment, in addition to having Figure 2 as well as Figure 3 In addition to the power supply IC 30, it also includes a first safety processing circuit 52. The first safety processing circuit 52 corresponds to... Figure 3 The safety processing circuit 51 in the middle.

[0044] The power module assembly 200 has a temperature sensor 303 for measuring the temperature of the power modules. As is typical for inverter control, the microcontroller 20... Figure 4 The signals from the current sensor 302, voltage sensor 301, and temperature sensor 303 shown control the gate driver assembly 100 to achieve the desired motor drive, but... Figure 4 Sensor signals are omitted in subsequent diagrams. The first safety processing circuit 52 of the power supply IC 30A controls the gate driver group 100 to perform safety processing based on at least one of the outputs of the temperature sensor 303, voltage sensor 301, current sensor 302, microprocessor anomaly detection circuit 70, and microcontroller 20. However, in this embodiment, safety processing refers to safely stopping the motor 4. This will be described in detail below.

[0045] The power IC 30A has a communication interface for communicating with the microcontroller 20. This communication interface corresponds to communication standards such as SPI and I2C.

[0046] During operation, the microcontroller 20 communicates periodically with the power supply IC 30A. The microprocessor-based fault detection circuit 70 of the power supply IC 30A also functions as a watchdog timer with a counter. This watchdog timer increments its counter value at regular intervals and decrements it when the power supply IC 30A and microcontroller 20 perform a predetermined exchange. When the counter value exceeds a user-defined threshold, the microprocessor-based fault detection circuit 70 determines that a fault has occurred in the microcontroller 20 and notifies the first safety processing circuit 52 of the fault occurrence. The first safety processing circuit 52, having been notified of the fault, stops the motor 4.

[0047] Temperature sensor 303 is located within power module assembly 200. Temperature sensor 303 is, for example, a diode sensor. The first safety processing circuit 52 determines that the temperature measured by temperature sensor 303 exceeds the temperature preset in power supply IC 30A, i.e., the maximum rated temperature of power module assembly 200, and stops the motor 4. However, the temperature at which the first safety processing circuit 52 determines the temperature to be abnormal can be set based on the maximum rated temperature, or it can be a temperature a few degrees lower than the maximum rated temperature.

[0048] Voltage sensor 301, for example, uses an amplifier to detect a lower-level signal proportional to the voltage of high-voltage battery 13, thereby observing the voltage value of high-voltage battery 13. If the voltage observed by voltage sensor 301 is lower than the operating voltage of inverter 3A, the first safety processing circuit 52 determines that the voltage is abnormal and stops motor 4. Current sensor 302, for example, uses a Hall element to observe the current supplied to motor 4. If the current observed by current sensor 302 exceeds the maximum rated current of motor 4, the first safety processing circuit 52 determines that the current is abnormal and stops motor 4.

[0049] According to the first embodiment described above, the following effects can be obtained.

[0050] (1) The inverter 3A, as an electronic control device for power conversion, includes: a power module group 200 that converts DC power into AC power and supplies it to a motor 4; a gate driver group 100 that controls the power module group 200; a power supply IC 30A that supplies power to the gate driver group 100 and the microcontroller 20; the microcontroller 20 that controls the gate driver group 100; a discharge circuit 400 that releases the high voltage supplied to the power module group 200; a voltage sensor 301; a current sensor 302; and a temperature sensor 303. The power supply IC 30A includes: a microprocessor fault detection circuit 70 that detects a reset signal based on a command from the microcontroller 20 and a fault in the microcontroller 20; and a first safety processing circuit 52 that determines the necessity of safety processing based on the output of at least one of a plurality of sensors and performs safety processing.

[0051] Therefore, since the inverter 3A integrates the safety function into the power supply IC 30A, compared to placing the safety function externally in the power supply IC 30A, reliability is improved because there are no interruptions in the signal path. For example, when implementing the safety function using a separate safety function IC, signal lines and power supply lines are required between the power supply IC and the safety function IC. If either the signal line or the power supply line is interrupted, the safety function cannot be used, resulting in lower reliability compared to this embodiment. Furthermore, compared to using a safety function IC, this embodiment reduces the number of components and wiring patterns, thus lowering manufacturing costs.

[0052] (2) The sensors installed on the inverter 3A are a temperature sensor 303 for measuring the temperature of the power module group 200, a current sensor 302 for measuring the current supplied to the motor 4, and a voltage sensor 301 for measuring the high voltage. As a safety measure, the first safety processing circuit 52 directly controls the gate driver group 100 without relying on the microcontroller 20, controlling the operation of the power module group 200 to safely stop the motor 4. For example, it disconnects all power devices in the power module group 200 or connects some power devices, thereby stopping the AC current output to the motor 4 and stopping the drive of the motor 4.

[0053] (Variation Example 1)

[0054] The first safety processing circuit 52 can also cut off the output of the first power supply circuit 40 to the sixth power supply circuit 45 of the power generation unit 80 when an abnormality is detected. In particular, by cutting off the power supply to the sixth power supply circuit 45 that supplies power to the gate driver group 100, the power module group 200 stops generating AC power, so the motor 4 stops.

[0055] According to this modified example 1, the following effects can be achieved.

[0056] (3) As a safety measure, the first safety processing circuit 52 cuts off the power supply to the gate driver group 100. Therefore, the motor 4 can be stopped without relying on the microcontroller 20, achieving the same effect as the first safety processing circuit 52 directly controlling the gate driver group 100 and stopping the operation of the power module group 200.

[0057] —Second Implementation—

[0058] Reference Figure 5A second embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the first embodiment; the main differences will be explained. Points not specifically described are the same as in the first embodiment. The main difference in this embodiment compared to the first embodiment lies in ensuring safety through discharge.

[0059] Figure 5 This is a configuration diagram of the inverter 3B according to the second embodiment. It is different from the one in the first embodiment. Figure 4 The main differences are that the power supply IC 30B has a second safety processing circuit 53 instead of the first safety processing circuit 52, and the sensors used are different. The second safety processing circuit 53 receives the outputs of the voltage sensor 301, the microcontroller 20, and the microcomputer anomaly detection circuit 70. That is, in this embodiment, the outputs of the current sensor 302 and the temperature sensor 303 may not be input to the power supply IC 30B. Therefore, in this embodiment, the inverter 3B may also not have the current sensor 302 and the temperature sensor 303.

[0060] When a reset signal is received from microcontroller 20 and an anomaly is detected from microcontroller anomaly detection circuit 70, the second safety processing circuit 53 performs safety processing based on the output of voltage sensor 301. The safety processing performed by the second safety processing circuit 53 involves discharging the discharge circuit 400. However, the second safety processing circuit 53 can also operate based on outputs received from only one of the microcontroller 20 and microcontroller anomaly detection circuit 70.

[0061] According to the second embodiment described above, the following effects can be obtained.

[0062] (4) The inverter 3B is equipped with a voltage sensor 301 that measures the voltage of the high voltage. The second safety processing circuit 53 discharges the discharge circuit 400 as a safety processing step. Therefore, the reliability of important functions related to functional safety, such as the control function for safely handling high voltage, can be improved.

[0063] —Third Implementation—

[0064] Reference Figure 6 A third embodiment of the inverter will be described. In the following description, the same reference numerals are used for components identical to those in the first embodiment; the main differences will be explained. Points not specifically described are the same as in the first embodiment. The main difference in this embodiment compared to the first embodiment is the inclusion of a first safety processing circuit 52 and a second safety processing circuit 53.

[0065] Figure 6This is a configuration diagram of the inverter 3C according to the third embodiment. The power supply IC 30C of the inverter 3C in this embodiment includes a first safety processing circuit 52 and a second safety processing circuit 53. The operation of the first safety processing circuit 52 is the same as described in the first embodiment. The operation of the second safety processing circuit 53 is the same as described in the second embodiment. Therefore, the safety processing in this embodiment refers to safely stopping the motor 4 and releasing the high voltage.

[0066] According to the third embodiment described above, the following effects can be obtained.

[0067] (5) The inverter 3C has a first safety processing circuit 52 and a second safety processing circuit 53.

[0068] Therefore, as a safety measure, inverter 3C is able to stop motor 4 and discharge high voltage.

[0069] —Fourth Implementation—

[0070] Reference Figure 7 The fourth embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the third embodiment; the main differences will be explained. Points not specifically described are the same as in the third embodiment. In this embodiment, the main difference lies in supplying power to the first safety processing circuit 52 and the second safety processing circuit 53 for both systems.

[0071] Figure 7 This is a configuration diagram of the inverter 3D according to the fourth embodiment. In addition to the configuration of the inverter 3D in the third embodiment, the inverter 3D in this embodiment also includes a first power supply 14 and a second power supply 15, which is different from the first power supply 14. The first power supply 14 supplies first input power to the first safety processing circuit 52 and the second safety processing circuit 53. The second power supply 15 supplies second input power to the first safety processing circuit 52 and the second safety processing circuit 53. The first safety processing circuit 52 and the second safety processing circuit 53 can operate by supplying at least one of the first input power and the second input power. In other words, even if the power supply from either the first power supply 14 or the second power supply 15 is interrupted, the first safety processing circuit 52 and the second safety processing circuit 53 can continue to operate.

[0072] In addition, Figure 7In the diagram, the connections between voltage sensor 301 and the first safety processing circuit 52 and the second safety processing circuit 53, the connections between current sensor 302 and the first safety processing circuit 52, the connections between temperature sensor 303 and the first safety processing circuit 52, the connections between the second safety processing circuit 53 and the discharge circuit 400, and the connections between the first safety processing circuit 52 and the gate driver group 100 are omitted for ease of illustration. Instead, dashed arrows are used to indicate the transmission and reception of the omitted information in voltage sensor 301, current sensor 302, temperature sensor 303, discharge circuit 400, and gate driver group 100.

[0073] According to the fourth embodiment described above, the following effects can be obtained.

[0074] (6) Supply the first input power of the first power source 14 and the second input power of the second power source 15, which is different from the first power source 14, to the first safety processing circuit 5 and the second safety processing circuit 53. Even if one of the two power sources cannot supply power due to a broken wire, the operation of the first safety processing circuit 52 and the second safety processing circuit 53 can be maintained using the power source of the one that is not broken. Therefore, the reliability of important functions related to functional safety, such as the control function for safely handling high voltage and the control function for controlling the vehicle to a safe state when an abnormality occurs, can be improved.

[0075] Furthermore, in this embodiment, the power supply IC 30D includes a first safety processing circuit 52 and a second safety processing circuit 53, but it is sufficient to include at least one of the first safety processing circuit 52 and the second safety processing circuit 53. Additionally, when the power supply IC 30D includes both the first safety processing circuit 52 and the second safety processing circuit 53, at least one of the first safety processing circuit 52 and the second safety processing circuit 53 may receive power from both the first power supply 14 and the second power supply 15.

[0076] —Fifth Implementation—

[0077] Reference Figure 8 A fifth embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the fourth embodiment; the main differences will be explained. Points not specifically described are the same as in the fourth embodiment. The main difference between this embodiment and the fourth embodiment is that no additional power source is provided.

[0078] Figure 8 This is a configuration diagram of the inverter 3E according to the fifth embodiment. However, in Figure 8 In, with Figure 7Similarly, for ease of diagramming, some wiring is omitted, and dashed arrows are used to indicate the transmission and reception of information. In this embodiment, a low-voltage battery 12 replaces the first power supply 14 in the fourth embodiment. Furthermore, a high-voltage battery 13 replaces the second power supply 15 in the fourth embodiment. That is, in this embodiment, existing batteries can be used to construct a redundant power supply. Additionally, as referred to... Figure 3 As explained, strictly speaking, the power supply from the low-voltage battery 12 is supplied to the power generation unit 80. However, in Figure 8 In order to clearly indicate that there are two systems, it is recorded that the power supply is not provided through the power generation unit 80.

[0079] According to the fifth embodiment described above, the following effects can be obtained.

[0080] (7) The first power source 14 is a low-voltage battery 12. The second power source 15 is a high-voltage battery 13 that supplies power to the power module group 200 and has a higher voltage than the low-voltage battery 12.

[0081] The first safety processing circuit 52 and the second safety processing circuit 53 continue to operate by being powered from either the low-voltage battery 12 or the high-voltage battery 13. Therefore, the first safety processing circuit 52 and the second safety processing circuit 53 can be operated by using the batteries already installed in the vehicle without the need for a new power source.

[0082] Furthermore, in this embodiment, the power supply IC 30E includes a first safety processing circuit 52 and a second safety processing circuit 53, but it is sufficient to include at least one of the first safety processing circuit 52 and the second safety processing circuit 53. Additionally, when the power supply IC 30E includes both the first safety processing circuit 52 and the second safety processing circuit 53, at least one of the first safety processing circuit 52 and the second safety processing circuit 53 may receive power from both the low-voltage battery 12 and the high-voltage battery 13.

[0083] —Sixth Implementation—

[0084] Reference Figure 9 The sixth embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the fifth embodiment; the main differences will be explained. Points not specifically described are the same as in the fifth embodiment. In this embodiment, an example is shown where the safety processing circuit in the fifth embodiment is primarily composed of logic gates that cannot be changed.

[0085] Figure 9 This is a configuration diagram of the inverter 3F according to the sixth embodiment. However, in Figure 9 In, with Figure 7Similarly, for ease of drawing, some wiring is omitted, and dashed arrows are used to indicate the transmission and reception of information. In the inverter 3E of the fifth embodiment, the first safety processing circuit 52 has a first logic gate 54, and the second safety processing circuit 53 has a second logic gate 55. The first logic gate 54 and the second logic gate 55 are logic gates that cannot be changed.

[0086] According to the sixth embodiment described above, the following effects can be obtained.

[0087] (8) The logic of the first safety processing circuit 52 and the second safety processing circuit 53 is set to an unwritable state. Therefore, since the operation of the first safety processing circuit 52 and the second safety processing circuit 53 cannot be rewritten, it is possible to prevent the loss of safety functions, loss of vehicle control, etc. caused by erroneous writing.

[0088] Furthermore, in this embodiment, the power supply IC 30F includes a first security processing circuit 52 and a second security processing circuit 53, but it is sufficient to include at least one of the first security processing circuit 52 and the second security processing circuit 53. Alternatively, if the power supply IC 30F includes both the first security processing circuit 52 and the second security processing circuit 53, it is also possible that only one of the first security processing circuit 52 and the second security processing circuit 53 is configured to include a logic gate.

[0089] —Seventh Implementation—

[0090] Reference Figure 10 The seventh embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the sixth embodiment; the main differences will be explained. Points not specifically described are the same as in the sixth embodiment. The main difference in this embodiment compared to the sixth embodiment is that the power supply IC has a non-volatile memory that can only be written to once.

[0091] Figure 10 This is a configuration diagram of the inverter 3G according to the seventh embodiment. However, in Figure 10 In, with Figure 7 Similarly, for ease of diagramming, some wiring is omitted, and dashed arrows are used to indicate the transmission and reception of information. In addition to the configuration of the power IC 30F in the sixth embodiment, the power IC 30G also includes: a register 63 that stores data for communication with the microcontroller 20; and a non-volatile memory 61 that can be written to only once. Data can be written from the microcontroller 20 to the non-volatile memory 61 via the register 63.

[0092] The operation of the first logic gate 54 and the second logic gate 55 is determined based on information stored in at least one of the non-volatile memory 61 and the register 63. For example, information stored in the register 63 may be read into the first logic gate 54 and the second logic gate 55 before information stored in the non-volatile memory 61, or information stored in the non-volatile memory 61 may be read into the first logic gate 54 and the second logic gate 55 before information stored in the register 63.

[0093] Furthermore, the information stored in the non-volatile memory 61 can also be used only to set safety processing actions that must be performed with minimal effort when either the first power input or the second power input is cut off. In this case, by setting other safety processing actions through register 63, the capacity of the non-volatile memory 61 mounted on the power IC 30G can be minimized.

[0094] According to the seventh embodiment described above, the following effects can be obtained.

[0095] (9) The logic of the first safety processing circuit 52 and the second safety processing circuit 53 is configured to be rewritten using an interface mounted on the microcontroller 20, which is external to the power supply IC 30G. Therefore, the same semiconductor chip can be used to configure different functions for each vehicle. Specifically, the processing content of the first safety processing circuit 52 and the second safety processing circuit 53 can be easily programmed from the microcontroller 20 via the interface between the power supply IC 30G and the microcontroller 20.

[0096] (10) A non-volatile memory 61 that can only be written once is mounted on the power IC 30G. The first security processing circuit 52 and the second security processing circuit 53 are configured with logic gates that set logic based on the information stored in the non-volatile memory. Therefore, since writing is limited to once, after setting once, it is possible to prevent the loss of safety functions, loss of vehicle control, etc. caused by accidental writing.

[0097] Furthermore, in this embodiment, the power supply IC 30G includes a first security processing circuit 52 and a second security processing circuit 53, but it is sufficient to include at least one of the first security processing circuit 52 and the second security processing circuit 53. Alternatively, if the power supply IC 30G includes both the first security processing circuit 52 and the second security processing circuit 53, it is also possible that only one of the first security processing circuit 52 and the second security processing circuit 53 is configured to include a logic gate.

[0098] —Eighth Implementation—

[0099] Reference Figure 11The eighth embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the seventh embodiment; the main differences will be explained. Points not specifically described are the same as in the seventh embodiment. The main difference between this embodiment and the seventh embodiment is that the non-volatile memory can be written to multiple times.

[0100] Figure 11 This is a configuration diagram of the inverter 3H according to the eighth embodiment. However, in Figure 11 In, with Figure 7 Similarly, for ease of drawing, some wiring is omitted, and dashed arrows are used to indicate the transmission and reception of information. The inverter 3H in this embodiment differs from the 7th embodiment in that the non-volatile memory 62 of the power supply IC 30H can be written to multiple times.

[0101] In other respects, it is the same as the seventh embodiment, so the description is omitted.

[0102] According to the eighth embodiment described above, the following effects can be obtained.

[0103] (11) A non-volatile memory 62 capable of multiple writes is mounted on the power supply IC 30H. The first security processing circuit 52 and the second security processing circuit 53 are configured with logic gates that set logic based on information stored in the non-volatile memory. Therefore, it is possible to respond to changes in security function requirements. If this effect is generalized and described, it is as follows. That is, through the interface between the power supply IC 30H and the microcontroller 20, the processing contents of the first security processing circuit 52 and the second security processing circuit 53 can be easily programmed from the microcontroller 20.

[0104] In the prior art, it is known that the first security processing circuit 5 and the second security processing circuit 53 exist outside the power supply IC 30H, and are constructed by programmable circuits such as FPGAs and CPLDs. In this case, at the time of product shipment, programming is performed for each product, for example, using the JTAG (Joint Test Action Group) interface attached to the FPGA or CPLD, or the interface with external memory. However, this method has the problem that once the program is implemented and manufacturing is completed, or after the product is shipped to the market, it is difficult to change the program.

[0105] In this embodiment, the power supply IC 30H can configure the functions of the first security processing circuit 52 and the second security processing circuit 53 based on information received from the microcontroller 20 via communication. Therefore, for example, the first security processing circuit 52 and the second security processing circuit 53 can be reprogrammed after manufacturing. Furthermore, using OTA (Over-the-Air) technology for wirelessly updating automotive software, the first security processing circuit 52 and the second security processing circuit 53 can be reprogrammed even after the vehicle has left the factory and entered the market.

[0106] Furthermore, in this embodiment, the power supply IC 30H includes a first security processing circuit 52 and a second security processing circuit 53, but it is sufficient to include at least one of the first security processing circuit 52 and the second security processing circuit 53. Alternatively, if the power supply IC 30H includes both the first security processing circuit 52 and the second security processing circuit 53, it is also possible that only one of the first security processing circuit 52 and the second security processing circuit 53 is configured to have a logic gate.

[0107] —Ninth Implementation—

[0108] Reference Figure 12 The ninth embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the seventh embodiment, and the main differences will be explained. Points not specifically described are the same as in the seventh embodiment. The main difference from the seventh embodiment is that it does not have non-volatile memory.

[0109] Figure 12 This is a configuration diagram of the inverter 3I according to the ninth embodiment. However, in Figure 12 In, with Figure 7 Similarly, for ease of diagramming, some wiring is omitted, and dashed arrows are used to indicate the transmission and reception of information. The inverter 3I in this embodiment differs from that in the seventh embodiment; the power supply IC 30I does not have non-volatile memory, and the operation of the first logic gate 54 and the second logic gate 55 is determined by information stored in register 63. Therefore, in this embodiment, whenever the inverter 3I starts, the microcontroller 20 writes the information specifying the operation of the first logic gate 54 and the second logic gate 55 into register 63.

[0110] According to the ninth embodiment described above, the following effects can be obtained.

[0111] (12) A register 63 is mounted on the power supply IC 30I. The first security processing circuit 52 and the second security processing circuit 53 are configured with logic gates, which set the logic based on information written to the register 63 from the outside. Therefore, it is possible to respond to changes in security function requirements. If this effect is generalized and described, it is as follows. That is, through the interface between the power supply IC 30I and the microcontroller 20, the processing contents of the first security processing circuit 52 and the second security processing circuit 53 can be easily programmed from the microcontroller 20.

[0112] Furthermore, in this embodiment, the power supply IC 30I includes a first security processing circuit 52 and a second security processing circuit 53, but it is sufficient to include at least one of the first security processing circuit 52 and the second security processing circuit 53. Alternatively, if the power supply IC 30I includes both the first security processing circuit 52 and the second security processing circuit 53, it is also possible that only one of the first security processing circuit 52 and the second security processing circuit 53 is configured to include a logic gate.

[0113] —10th Implementation—

[0114] Reference Figure 13 A tenth embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same components as in the eighth embodiment; the main differences will be explained. Points not specifically described are the same as in the eighth embodiment. The main difference in this embodiment compared to the eighth embodiment lies in the control over whether the non-volatile memory can be rewritten.

[0115] Figure 13 This is a configuration diagram of the inverter 3J according to the tenth embodiment. However, in Figure 13 In, with Figure 7 Similarly, for ease of diagramming, some wiring is omitted, and dashed arrows are used to indicate the transmission and reception of information. The inverter 3J in this embodiment differs from the eighth embodiment in that the power supply IC 30J also includes a rewrite control circuit 60. Furthermore, in this embodiment, only the rewrite control circuit 60 can perform writes to the non-volatile memory 104.

[0116] The rewrite control circuit 60 writes information from a specific area of ​​register 63 to non-volatile memory 62. However, the rewrite control circuit 60 has a status setting input. When the status setting input is high, writing to non-volatile memory 62 is performed; when the status setting input is low, such as GND, writing to non-volatile memory 62 is not performed. The status setting input can be input from, for example, a terminal of power supply IC 30J, a communication input from microcontroller 20, or from register 63. Furthermore, it can also be input from non-volatile memory 62. In this case, the rewrite control circuit 60 uses the information stored in non-volatile memory 62 to determine whether writing to non-volatile memory 62 is permissible.

[0117] According to the 10th embodiment described above, the following effects can be obtained.

[0118] (13) The power supply IC 30J has a rewrite control circuit 60, which controls whether to disable or enable writing to the non-volatile memory 62. Therefore, it can also respond to changes in security function requirements, and can prevent accidental writing by setting it to disable writing.

[0119] Furthermore, in this embodiment, the power supply IC 30J includes a first security processing circuit 52 and a second security processing circuit 53, but it is sufficient to include at least one of the first security processing circuit 52 and the second security processing circuit 53. Alternatively, if the power supply IC 30J includes both the first security processing circuit 52 and the second security processing circuit 53, it is also possible that only one of the first security processing circuit 52 and the second security processing circuit 53 is configured to include a logic gate.

[0120] —11th Implementation—

[0121] Reference Figure 14 The eleventh embodiment of the inverter will be described. In the following description, the same reference numerals are used for the same constituent elements as in the first embodiment, and the main differences will be explained. Points not specifically described are the same as in the first embodiment. The main difference between this embodiment and the first embodiment lies in the fact that it includes a configuration of multiple embodiments following the second embodiment.

[0122] Figure 14This is a configuration diagram of the inverter 3K according to the 11th embodiment. The power supply IC 30K of the inverter 3K is the same as that of the 3rd embodiment in that it includes a first safety processing circuit 52 and a second safety processing circuit 53. Furthermore, the inverter 3K is the same as that of the 5th embodiment in that the first safety processing circuit 52 and the second safety processing circuit 53 receive power from the low-voltage battery 12 and the high-voltage battery 13. The power supply IC 30K includes a power generation unit 80, a redundant power supply circuit 32, and a functional safety processing circuit 50. The functional safety processing circuit 50 includes a non-volatile memory 62, a register 63, a selector 64, and an SPI interface circuit 65.

[0123] The voltage generated by the low-voltage battery 12, which serves as the first power source, is supplied to the power IC 30K mounted on the inverter 3K via the first power supply line 16 and the first diode 600 for battery reverse connection protection. Additionally, the voltage generated by the high-voltage battery 13, which serves as the second power source, is supplied to the power IC 30K via the second power supply line 17 through the high-voltage power supply switch 18. The power supplied to the power IC 30K from the low-voltage battery 12 is converted to a higher voltage level by the buck-boost circuit 31 and input to the redundant power supply circuit 32 via the second diode 601 for preventing reverse current flow.

[0124] Power supplied from the high-voltage battery 13 to the power IC 30K is input to the redundant power supply circuit 32. Additionally, power supplied from the low-voltage battery 12 to the power IC 30K has its voltage level converted by a buck-boost circuit 31. This power is then supplied via a second diode 601 to prevent reverse current flow to the first power supply circuit 40 through the sixth power supply circuit 45, and to a third voltage regulator 49, which is an external power supply circuit to the power IC.

[0125] The redundant power supply circuit 32 is a circuit that can continue to supply power using only the power from the other party even if one of the input power sources is not supplied. The redundant power supply circuit 32 supplies power to the functional safety processing circuit 50 via the redundant power supply line 33, and also supplies power to the second voltage regulator 48 mounted on the inverter 3K.

[0126] The functional safety processing circuit 50 outputs a control signal corresponding to the input from a combination of one or more input signals via a variable gate logic circuit 56. Input signals to the functional safety processing circuit 50 include, for example, a microcomputer error detection signal 309 indicating that the microcontroller 20 has detected an anomaly, the output of the microcomputer anomaly detection circuit 70, an abnormal current detection signal 306 indicating that the current sensor 302 has detected an abnormal current, a voltage level signal 305 indicating the voltage level observed by the voltage sensor 301, an abnormal temperature detection signal 307 indicating that the temperature sensor 303 has detected an abnormal temperature, an external sensor anomaly detection signal 131 indicating that an external sensor 304 located outside the inverter 3 has detected an anomaly, and signals from register 63.

[0127] The variable gate logic circuit 56 is a logic circuit that can reconstruct logic based on the value of register 63. The value of register 63 is selected and input by selector 64, either the value stored in non-volatile memory 62 or the value input via SPI interface circuit 65.

[0128] Because the functional safety processing circuit 50 has a non-volatile memory 62, the operation of the variable gate logic circuit 56 can be pre-programmed according to different control methods depending on the user. Because the functional safety processing circuit 50 has an SPI interface circuit 65 as an interface to the outside world, even after the non-volatile memory 62 has been programmed, the operation of the variable gate logic circuit 56 can be temporarily reconfigured by changing the value set in the register 63 from the microcontroller 20.

[0129] The non-volatile memory 62 is an MTP (Multi-Time Programmable) memory that can be written to multiple times after the power supply IC 30K is manufactured. However, the non-volatile memory 62 can be a ROM (Read Only Memory) in which the value is written and stored in the memory during the manufacturing process of the power supply IC 30K and cannot be rewritten, or it can be an OTP (One-Time Programmable) memory that can only be written to once after the power supply IC 30K is manufactured.

[0130] The SPI interface circuit 65 is connected to the microcontroller 20 via the SPI interface signal line 66, and writes to the register 63 through the microcontroller 20. Furthermore, the SPI interface circuit 65 can also program the non-volatile memory 62 and read the programmed values. Additionally, the SPI interface circuit 65 can also be an interface circuit corresponding to other communication protocols, such as an I2C interface.

[0131] Based on the received signals and the values ​​set in register 63, the functional safety processing circuit 50 outputs a discharge control signal 401, a first gate driver control signal 107, and a second gate driver control signal 108 from the variable gate logic circuit 56.

[0132] The discharge control signal 401 is transmitted to the discharge circuit 400 via the signal level conversion circuit 402. When the functional safety processing circuit 50 detects an abnormality, the high-voltage power supply switch 18, controlled by the high-voltage power supply control signal 19, opens, and the second power supply line 17 is disconnected from the high-voltage battery 13. At this time, the charge stored in the capacitor 403 of the second power supply line 17 is discharged through the discharge circuit 400.

[0133] The first gate driver control signal 107 and the second gate driver control signal 108 control the first power module 201 to the third power module 203 via the first gate driver 101 to the sixth gate driver 106. Therefore, when an abnormality is detected in the functional safety processing circuit 50, the motor 4 can be safely stopped.

[0134] In addition, the external sensor 304 is located outside the inverter 3 and can be used in the operation of the functional safety processing circuit 50 when it is desired to use information from outside the inverter, so it is not necessarily required to set it up.

[0135] According to the 11th embodiment described above, the effects of the 3rd, 5th, and 8th embodiments described above can be obtained. Furthermore, in this embodiment, the power supply IC 30K includes a first safety processing circuit 52 and a second safety processing circuit 53, but it is sufficient to include at least one of the first safety processing circuit 52 and the second safety processing circuit 53.

[0136] In the above embodiments and modifications, the representation of control lines and information lines is considered necessary for explanation, but may not necessarily represent all control lines and information lines in the product. Furthermore, the present invention is not limited to the above embodiments and includes various modifications. For example, the above embodiments have been described in detail for ease of understanding of the present invention, but are not necessarily limited to having all the described configurations. Additionally, a portion of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Furthermore, for a portion of the configuration of each embodiment, other configurations can be added, deleted, or replaced.

[0137] In the above-described embodiments and variations, the configuration of the functional block is merely one example.

[0138] Several functions, represented as separate functional blocks, can be combined into a single structure, or a structure represented by a single functional block diagram can be divided into two or more functions. Additionally, a portion of the functions possessed by each functional block can be incorporated into the structure of other functional blocks.

[0139] The above-described embodiments and modifications can also be combined separately. Various embodiments and modifications have been described above, but the present invention is not limited to these. Other methods conceivable within the scope of the technical concept of the present invention are also included within the scope of the present invention.

[0140] Symbol Explanation

[0141] 3. 3A~3K… Inverter

[0142] 4…motor

[0143] 12…Low-voltage batteries

[0144] 13…High-voltage storage batteries

[0145] 14…First Power Supply

[0146] 15…Second Power Supply

[0147] 20… microcontrollers

[0148] 50…Functional safety processing circuit

[0149] 51…Safety Processing Circuit

[0150] 52…First Security Processing Circuit

[0151] 53…Second security processing circuit

[0152] 54… First Logic Gate

[0153] 55…Second Logic Gate

[0154] 56…Variable Gate Logic Circuits

[0155] 60…Rewrite the control circuit

[0156] 61…Non-volatile memory

[0157] 62…Non-volatile memory

[0158] 63… register

[0159] 64…Selector

[0160] 70…Microcomputer anomaly detection circuit

[0161] 80…Power Generation Department

[0162] 100… Gate Driver Group

[0163] 200… power module group

[0164] 301…Voltage Sensor

[0165] 302… Current Sensor

[0166] 303…Temperature Sensor

[0167] 400…discharge circuit.

Claims

1. An electronic control device for power conversion, characterized in that, have: The power module converts DC power into AC power and supplies it to the motor; A gate driver that controls the power module; A microcontroller that controls the gate driver; A power supply IC that receives power from a low-voltage battery, raises or lowers the voltage level, adjusts the characteristics of the power, and supplies the adjusted power to at least one of the gate driver and the microcontroller. A discharge circuit to release the high voltage supplied to the power module; as well as sensor, The power IC includes: a microcomputer anomaly detection circuit, which detects anomalies in the microcontroller; And a safety processing circuit, which determines the necessity of safety processing based on the output of at least one of the microcomputer anomaly detection circuit and the sensor, and performs safety processing accordingly. The safety processing circuit stops the motor or uses the discharge circuit to release the high voltage.

2. The electronic control device for power conversion according to claim 1, characterized in that, The sensor is at least one of a temperature sensor for measuring the temperature of the power module, a current sensor for measuring the current supplied to the motor, and a voltage sensor for measuring the voltage of the high voltage. The safety processing circuit is a first safety processing circuit that directly controls the gate driver and stops the motor without relying on the microcontroller.

3. The electronic control device for power conversion according to claim 1, characterized in that, The sensor is a voltage sensor that measures the voltage of the high voltage. The safety processing circuit is a second safety processing circuit that discharges the discharge circuit as a safety processing step.

4. The electronic control device for power conversion according to claim 1, characterized in that, The sensor is at least one of a temperature sensor for measuring the temperature of the power module, a current sensor for measuring the current supplied to the motor, and a voltage sensor for measuring the voltage of the high voltage. The safety processing circuit is a first safety processing circuit that directly controls the gate driver and stops the motor without relying on the microcontroller, and a second safety processing circuit that discharges the discharge circuit.

5. The electronic control device for power conversion according to claim 1, characterized in that, The safety processing circuit is supplied with a first input power from a first power source and a second input power from a second power source different from the first power source.

6. The electronic control device for power conversion according to claim 5, characterized in that, The first power source is a low-voltage power source. The second power source is a high-voltage power source that supplies power to the power module and has a higher voltage than the first power source. The safety processing circuit continues to operate by being powered from either the first power source or the second power source.

7. The electronic control device for power conversion according to claim 1, characterized in that, The logic of the security processing circuit is set to an unwritable state.

8. The electronic control device for power conversion according to claim 1, characterized in that, The logic of the security processing circuit is configured to be rewritable using an interface mounted on an external microcontroller.

9. The electronic control device for power conversion according to claim 8, characterized in that, The power IC incorporates a non-volatile memory that can only be written once. The security processing circuit is constructed by logic gates that set logic based on information stored in the non-volatile memory.

10. The electronic control device for power conversion according to claim 8, characterized in that, The power IC incorporates a non-volatile memory capable of being written to multiple times. The security processing circuit is constructed by logic gates that set logic based on information stored in the non-volatile memory.

11. The electronic control device for power conversion according to claim 8, characterized in that, The power IC is equipped with a register. The security processing circuit is composed of logic gates that set logic based on information written from the outside into the register.

12. The electronic control device for power conversion according to claim 10, characterized in that, The power IC also includes a rewrite control circuit that controls whether to write to the non-volatile memory or to allow writing to the non-volatile memory.

13. The electronic control device for power conversion according to claim 1, characterized in that, The safety processing circuit is an electronic control device for power conversion that cuts off the power supply to the gate driver as part of the safety processing.

14. A power supply IC, characterized in that, have: The electronic control device for power conversion according to any one of claims 1 to 13.

Images