A method and system for high voltage functional safety architecture of electric drive system

Abstract

The present invention relates to a high-voltage functional safety architecture system for an electric drive system, the system comprising: a signal acquisition module, a processing module, a high-voltage safety control and monitoring module, a fault reporting module and a CAN message verification and E2E processing module; wherein the signal acquisition module collects the operating parameters of the electric drive system for high-voltage functional safety monitoring; the processing module is used to process the collected operating parameters and release signals; the high-voltage safety control and monitoring module is used to judge the voltage state of the electric drive system according to the released signals and generate judgment results; the fault reporting module merges the signals released after the operating parameters are processed and the judgment results; the CAN message verification and E2E processing module verifies and processes the merged results and transmits them to the CAN bus. The present invention can monitor the current of high-voltage discharge and report faults in time, with higher high-voltage safety performance, and achieves the development of safety targets of ASIL A level and higher levels.

Description

Technical Field

[0001] The present invention belongs to the technical field of safety of electric drive systems for electric vehicles, and in particular relates to a high-voltage functional safety architecture method and system for electric drive systems. Background Art

[0002] Electric vehicles use the electric energy stored in the battery as the only energy supply. They have the characteristics of high efficiency, energy saving, low noise and zero emission. They have incomparable advantages in energy saving and environmental protection. Therefore, they have gradually become one of the important development trends in the automotive industry. As an important part of electric vehicles, the electric drive system includes motor controllers, motors and reducers. It is the key to realize the mutual conversion of electric energy and mechanical energy. The reliability and safety of its work are particularly important. With the release and implementation of the functional safety international standard ISO26262 and the national standard GB / T34590, preventing injuries during vehicle maintenance and avoiding high-voltage electric shock after a serious vehicle collision are the most important safety goals of the electric drive system. The national standard GB / T18488.1-2015 stipulates that when the motor controller has an active discharge request, the drive motor controller supports the discharge time of the capacitor not exceeding 3s. The functional safety standard divides the ASIL level (Automotive Safety Integration Level) into four levels, namely ASIL A, ASIL B, ASIL C, and ASIL D. The ASIL level determines the safety requirements of the entire system. The higher the ASIL level, the stricter the development process, and the correspondingly increased development costs and longer development cycles.

[0003] At present, the electric drive industry usually conducts HARA (Hazard analysis and risk assessment) analysis based on the power system at the vehicle level, and according to the existing electric vehicle control strategy, the high-voltage safety target of the motor controller is ASIL A level.

[0004] Chinese patent CN108551255A discloses an electric vehicle and its high-voltage system, a high-voltage discharge circuit, including: a discharge unit, a discharge drive unit and a discharge control unit. Among them, the discharge unit may include a discharge switch tube D1 and a discharge resistor R5, and the discharge switch tube D1 and the discharge resistor R5 are connected in series between the positive terminal HV+ of the high-voltage bus of the electric vehicle and the ground terminal GND. The discharge drive unit is used to output a discharge drive signal to the discharge switch tube D1 so that the discharge switch tube D1 is repeatedly turned on and off. The discharge control unit is used to receive a discharge control signal Discharge and transmit the discharge control signal Discharge to the discharge drive unit to actively drive the discharge switch tube D1 through the discharge drive unit so that the discharge unit performs active discharge work. This technical solution can use the variable resistance area of ​​the discharge switch tube to discharge electric energy, improve the discharge efficiency, and at the same time ensure the normal operation or discharge of the high-voltage system of the electric vehicle, and improve the high-voltage safety of the electric vehicle, but does not provide discharge monitoring of high-voltage discharge.

[0005] Chinese patent CN102371911B discloses a method for discharging the electric charge of the high-voltage bus capacitor of a motor driver for a vehicle, comprising the following steps: when the vehicle key switch is turned off and the high-voltage relay of the vehicle is disconnected, the motor controller enters the active discharge program, otherwise the motor controller works normally; when the motor position angle value θ sampled by the motor position sensor is offset to θ1 each time; the motor controller enters the active discharge program, and the timer t1 starts timing. The technical problem solved by this technical solution is that the existing method for discharging the remaining electric charge of the capacitor by connecting the power discharge resistor in parallel at both ends of the high-voltage bus capacitor of the motor driver has the problem that the discharge time is long and the discharge monitoring of the high-voltage discharge is not provided.

[0006] In order to solve the above problems, it is necessary to design a high-voltage functional safety architecture method and system for an electric drive system. Summary of the invention

[0007] In view of the above problems, the present invention provides a high-voltage functional safety architecture system for an electric drive system, the system comprising:

[0008] Signal acquisition module, processing module, high voltage safety control and monitoring module, fault reporting module and CAN message verification and E2E processing module;

[0009] Wherein, the signal acquisition module acquires the operating parameters of the electric drive system for high-voltage functional safety monitoring;

[0010] The processing module is used to process the collected operating parameters and release a signal;

[0011] The high-voltage safety control and monitoring module is used to determine the voltage status of the electric drive system according to the released signal and generate a judgment result;

[0012] The fault reporting module combines the signal released after the operation parameters are processed and the judgment result;

[0013] The CAN message verification and E2E processing module verifies and processes the merged result and transmits it to the CAN bus.

[0014] Preferably, the signal acquisition module includes voltage analog sampling and voltage digital sampling;

[0015] Among them, the voltage analog sampling ADC obtains the high-precision bus voltage Vbus1;

[0016] The voltage digital sampling DI / O port obtains the low-precision bus voltage Vbus2;

[0017] The duty cycle corresponding to the bus voltage of 0V is a%, and the duty cycle corresponding to the maximum bus voltage is b%, a <b。

[0018] Preferably, the processing module includes a collision signal processing module and a signal processing module;

[0019] Among them, the collision signal processing module makes a validity judgment on the two sampling signals of the hard line;

[0020] The signal processing module performs range check and comparison check on the bus voltage signal.

[0021] Preferably, the CAN message transceiving and E2E processing module should receive a CAN message including a discharge request instruction and a discharge mode instruction from the CAN bus, and perform an E2E check on the received CAN message to determine whether the CAN message is complete.

[0022] Preferably, the electric drive system operating parameters include bus voltage signals, motor speed signals, hard-line sampling signals and CAN bus signals;

[0023] Wherein, the bus voltage signal includes the high-precision bus voltage of Vbus1 and the low-precision bus voltage of Vbus2;

[0024] The hard-line sampling signal includes a hard-line sampling signal 1 and a hard-line sampling signal 2.

[0025] Preferably, the E2E check includes checksum, rolling count and timeout check, and the check operation cycle is set to be equal to the message cycle;

[0026] If the E2E processing module receives five consecutive checksum error frames in one driving cycle, it determines that the checksum is faulty.

[0027] If the receiver receives five Rolling Count error frames in a row within one driving cycle, the E2E processing module determines that there is a Rolling Count fault.

[0028] If the E2E processing module does not receive 10 frames continuously within a driving cycle, it is determined that there is no timeout fault;

[0029] When the CAN message verification and E2E processing module confirms that an E2E fault has occurred, the CAN communication verification fault is output to the fault reporting module.

[0030] Preferably, the CAN message verification and E2E processing module should perform E2E processing on the fed-back discharge status signal and fault signal.

[0031] Preferably, the collision signal processing module performs validity judgment on the two hard-wire sampling signals. Specifically, both hard-wire sampling signals are digital quantities. For hard-wire sampling signal one, a high level is agreed to indicate a collision occurs, and a low level is agreed to indicate no collision. For hard-wire sampling signal two, a low level is agreed to indicate a collision occurs, and a high level is agreed to indicate no collision. If both hard-wire signals indicate that a collision occurs, it is determined that a collision occurs.

[0032] Preferably, the signal processing module performs range check on the sampled high-precision bus voltage Vbus1 and the low-precision bus voltage Vbus2, and converts the two bus voltages into actual values ​​for comparison and check. If an abnormality occurs, anti-shake processing is performed;

[0033] If the signal processing module detects a high-precision bus voltage range verification fault, a low-precision bus voltage range verification fault, and a two-way bus voltage comparison verification fault, the high-precision bus voltage range verification fault, the low-precision bus voltage range verification fault, and the voltage comparison verification fault are sent to the fault reporting module and the high-voltage safety control and monitoring module;

[0034] When the E2E check fails, the high-precision bus voltage range check fails, the low-precision bus voltage range check fails, and the bus voltage comparison check fails, the output functional safety fault signal is Fault to the CAN message check and E2E processing module, and the discharge status signal is sent to the CAN message check and E2E processing module.

[0035] Preferably, in the high-voltage safety control and monitoring module, the system first judges based on the hard-line collision signal, the discharge request signal, the discharge mode instruction, the speed being below the speed threshold, there being no bus voltage fault, and whether the bus voltage value is above 60V. If the conditions are met, the discharge control and discharge monitoring are entered.

[0036] Preferably, the discharge control design has two discharge modes, namely winding discharge and active resistance discharge;

[0037] Wherein, the winding discharge mode is realized by a motor control mode with a given Id current, Iq=0, and the winding discharge mode is designed to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within T1;

[0038] The resistor discharge method is to design a discharge resistor to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within the time T2.

[0039] The present invention also provides a high-voltage functional safety architecture method for an electric drive system, the method comprising:

[0040] Collect the operating parameters of the electric drive system for high-voltage functional safety monitoring and output parameter signals;

[0041] Process the collected operating parameters and release the signal;

[0042] Determine whether the electric drive system generates unexpected high voltage within a preset time according to the released signal, and generate a determination result;

[0043] The signal released after the operation parameter processing and the judgment result are combined, and a functional safety fault signal is output;

[0044] The combined result is checked and processed and transmitted to the CAN bus.

[0045] Preferably, the parameter signal includes a bus voltage signal, a motor speed signal, a hard-line sampling signal and a CAN bus signal;

[0046] Wherein, the bus voltage signal includes a high-precision bus voltage Vbus1 and a low-precision bus voltage Vbus2;

[0047] The hard-line sampling signal includes a hard-line sampling signal 1 and a hard-line sampling signal 2;

[0048] The processing of the collected operating parameters includes collision signal processing and signal processing;

[0049] Wherein, the collision signal processing includes determining the validity of hard-line sampling signal 1 and hard-line sampling signal 2;

[0050] The signal processing includes performing range check and comparison check on the high-precision bus voltage Vbus1 and the low-precision bus voltage Vbus2;

[0051] The step of judging whether the electric drive system generates unexpected high voltage within a preset time is specifically whether the bus voltage drops below a threshold voltage within 3 seconds;

[0052] Among them, the threshold voltage is 60V;

[0053] The CAN bus signal includes a discharge request signal and a discharge mode signal.

[0054] The present invention has the following beneficial effects:

[0055] The present invention collects and processes voltage signals and hard-line sampling signals, and then transmits them to the high-voltage safety control or monitoring module to monitor the operating parameters of the electric drive system, CAN communication signals and voltage. Moreover, after a fault is detected, the fault reporting module reports the fault and transmits the fault information to the CAN bus, so that the fault can be handled conveniently and promptly. That is, compared with the prior art, the present invention can monitor the current of high-voltage discharge and report the fault in time, with higher high-voltage safety performance, achieving the development of safety targets of ASIL A level and higher levels.

[0056] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A system diagram of a high-voltage functional safety architecture system for an electric drive system according to an embodiment of the present invention is shown;

[0059] Figure 2 An architecture diagram of a high-voltage functional safety architecture system for an electric drive system according to an embodiment of the present invention is shown;

[0060] Figure 3 A schematic diagram showing bus voltage processing in an embodiment of the present invention is shown;

[0061] Figure 4 The resistor discharge flow chart in the embodiment of the present invention is shown;

[0062] Figure 5 A method diagram showing a high-voltage functional safety architecture method for an electric drive system in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] like Figure 1 As shown, the present invention also provides a high-voltage functional safety architecture system for an electric drive system, the system comprising: a signal acquisition module, a processing module, a high-voltage safety control and monitoring module, a fault reporting module and a CAN message verification and E2E processing module; wherein the signal acquisition module acquires operating parameters of the electric drive system for high-voltage functional safety monitoring; the processing module is used to process the acquired operating parameters and release signals; the processing module comprises a collision signal processing module and a signal processing module, the collision signal processing module performs validity judgment on two sampling signals of the hard line, and the signal processing module performs range verification and comparison verification on the bus voltage signal; the high-voltage safety control and monitoring module is used to judge the voltage state of the electric drive system according to the released signal and generate a judgment result; the fault reporting module merges the signal released after the operating parameter processing and the judgment result; the CAN message verification and E2E processing module verifies and processes the merged result, and transmits it to the CAN bus.

[0065] like Figure 2As shown, the signal acquisition module includes voltage analog sampling and voltage digital sampling; among them, the voltage analog sampling ADC obtains the high-precision bus voltage Vbus1; the voltage digital sampling DI / O port obtains the low-precision bus voltage Vbus2; the Duty cycle corresponding to 0V of the bus voltage is a%, and the Duty cycle corresponding to the maximum value of the bus voltage is b%, where a < b. The operating parameters of the electric drive system include bus voltage signals, motor speed signals, hard wire sampling signals, and CAN bus signals; among them, the bus voltage signals include the high-precision bus voltage of Vbus1 and the low-precision bus voltage of Vbus2; the hard wire sampling signals include hard wire sampling signal 1 and hard wire sampling signal 2. The CAN message transceiver and E2E processing module should receive CAN messages containing discharge request instructions and discharge mode instructions from the CAN bus, and perform E2E verification on the received CAN messages to determine whether the CAN messages are complete. The E2E verification includes checksum, rolling count, and Timeout verification, and the verification operation cycle is set to be equal to the message cycle; within one driving cycle, if the receiver of the E2E processing module continuously receives 5 frames of Checksum error frames, it is determined that there is a Checksum fault; within one driving cycle, if the receiver built in the electric drive system of the E2E processing module continuously receives 5 frames of Rolling Count error frames, it is determined that there is a Rolling Count fault; within one driving cycle, if 10 frames are not received continuously, it is determined that there is no timeout fault; when the CAN message verification and E2E processing module confirms an E2E fault, it outputs a CAN communication verification fault to the fault reporting module. The CAN message verification and E2E processing module should perform E2E processing on the feedback discharge status signal and fault signal, specifically including Checksum and Rolling Count. Checksum is 8-bit data, and rolling count is 4-bit data. For example: the discharge status signal is RActDschrgSts, and the functional safety fault signal is Fault. Then, for the frame containing RActDschrgSts, Fault, and the defined Rolling Count counter Rcount, whose initial value is 0, increments by 1 for each frame sent, and cycles through 0 - 15. Fill RActDschrgSts, Fault, and RollingCount into the corresponding bits according to the communication protocol, calculate the Checksum value for this frame of information, then fill the Checksum into the corresponding bit, and send it to the CAN bus.The collision signal processing module judges the validity of the two hard-wire sampling signals. Specifically, both hard-wire sampling signals are digital quantities. For hard-wire sampling signal one, a high level is agreed to indicate a collision occurs, and a low level is agreed to indicate no collision. For hard-wire sampling signal two, a low level is agreed to indicate a collision occurs, and a high level is agreed to indicate no collision. If both hard-wire signals indicate that a collision occurs, it is determined that a collision has occurred.

[0066] like Figure 3 As shown, the signal processing module shall perform range check on the sampled high-precision bus voltage Vbus1 and the low-precision bus voltage Vbus2, and convert the two bus voltages into actual values ​​for comparison and verification. If an abnormality occurs, anti-shake processing shall be performed; the Vbus1 analog voltage sampling value range check method determines that the Vbus1 sampling value is greater than the upper threshold or less than the lower threshold. If this condition is met, it is determined that the Vbus1 bus voltage range check is abnormal and anti-shake processing is performed; the Vbus2 digital voltage sampling value range check method determines whether the duty cycle range of Vbus2 is between a% and b%. If it exceeds the range, it is determined that the Vbus2 bus voltage range check is abnormal and anti-shake processing is performed; the two bus voltage comparison and verification method adopts a segmented comparison method to divide the working voltage range of the electric drive system into three ranges: 0-allowed minimum working voltage, allowed minimum working voltage-intermediate voltage threshold, and intermediate voltage threshold-allowed maximum working voltage threshold. Wherein 0-allowed minimum working voltage threshold, compare whether the absolute value of the voltage difference is within the allowed minimum working voltage threshold * check coefficient 1; allowed minimum working voltage-intermediate voltage threshold, compare whether the absolute value of the voltage difference is within the current real-time high-precision voltage * (1 ± check coefficient 2); intermediate voltage threshold-allowed maximum working voltage, compare whether the absolute value of the voltage difference is within the real-time high-precision voltage * (1 ± check coefficient 3); preferably, the relationship of the check coefficients is check coefficient 1 = check coefficient 2 > check coefficient 3, and the check coefficient and the intermediate voltage threshold are calibrated according to the hardware circuit design; if the absolute value of the compared voltage difference is not within the specified range, it is determined that the bus voltage comparison check is abnormal, and anti-shake processing is performed;

[0067] The anti-shake processing method is as follows:

[0068] Set a total counter and an anti-shake counter. The range of the total counter is [0, m], and the range of the anti-shake counter is [0, n], where m>n;

[0069] When the first exception occurs, the total counter starts counting, and increases by 1 in each cycle. When the total count is greater than or equal to m times, it is cleared and starts counting again from 0. Otherwise, the total counter does not count;

[0070] Anti-shake counting is performed at the same time as the total count, that is, when a fault occurs, the anti-shake counter increases by 1, and when the fault disappears, the previous cycle count is maintained (that is, increased by 0). When the anti-shake count is greater than or equal to n times, a fault is reported, the fault is locked, and the fault anti-shake unit no longer runs; otherwise, the counting continues. When the total count is 0, the anti-shake count is cleared;

[0071] If a bus voltage range verification failure occurs during signal processing, the two-way voltage comparison verification will not be performed.

[0072] If the signal processing module detects high-precision and low-precision bus voltage range verification faults and two-way bus voltage comparison verification faults, the high-precision bus voltage range verification faults, low-precision bus voltage range verification faults and voltage comparison verification faults are sent to the fault reporting module and the high-voltage safety control and monitoring module. In the high-voltage safety control and monitoring module, the system first judges based on the hard-wire collision signal, discharge request signal, discharge mode instruction, speed below the speed threshold, no bus voltage fault, and whether the bus voltage value is above 60V. If the conditions are met, it enters discharge control and discharge monitoring. There are two discharge modes in the discharge control design, namely winding discharge and active resistance discharge; among them, the winding discharge mode is realized by the motor control mode with a given Id current and Iq=0, and the winding discharge mode is designed to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within T1; the resistance discharge mode is to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within T2 by designing the discharge resistor.

[0073] like Figure 4 As shown, when a discharge request instruction is received, the bus voltage is greater than 60V, there is no voltage fault and the motor speed is greater than the threshold, active discharge is started and a discharge status signal is reported within T3 time (the discharge status signal indicates that discharge is in progress);

[0074] Among them, the discharge request instruction includes active discharge request signal, mode request and Crash signal; if the E2E of any signal of "active discharge request instruction" or "mode request signal" fails or any signal E2E verification fails, the active discharge function will not be turned on, and the discharge status signal will be reported within T3 time (the discharge status signal is invalid);

[0075] Voltage faults include high-precision bus voltage range verification faults, low-precision bus voltage range verification faults and bus voltage comparison verification faults; if any of the high-precision bus voltage range verification faults, low-precision bus voltage range verification faults or voltage comparison verification faults occurs, active discharge and discharge monitoring will not be started, and the discharge status signal will be reported within T3 time (the discharge status signal is invalid).

[0076] If all the above conditions are met, determine whether the Crash signal is valid and whether it is a drive fault. If both of the above conditions are met, start the active discharge resistor discharge and resistor discharge monitoring, and report the discharge status signal within T3 (the discharge status signal is that discharge is in progress); then determine whether there is a bus voltage fault. If so, the discharge failure ends the state. If not, determine whether the bus voltage drops below 60V within T2. ​​If the bus voltage drops below 60V within T2, the discharge is successful. If the bus voltage does not drop below 60V within T2, report the discharge status signal within T3 (the discharge status signal is the discharge failure state), and report the discharge status signal within T3 (the discharge status signal is the discharge failure state), T1+T2+T3≤3s.

[0077] If the Crash signal is invalid and there is no drive fault, the winding discharge and winding discharge monitoring are turned on, and at the same time, it is determined whether there is a bus voltage fault. If there is a bus voltage fault, the winding discharge and discharge monitoring are stopped, and the discharge status signal is reported within T3 (the discharge status signal is a discharge failure state); if there is no bus voltage fault, it is determined whether there is a drive fault. If there is a drive fault, the winding discharge and winding discharge monitoring are stopped, and the active discharge resistor discharge and resistor discharge monitoring are turned on. If there is no drive fault, it is determined whether the absolute value of the bus voltage discharge slope is greater than the threshold within T4. If T4 If the absolute value of the time-monitored discharge slope is less than the threshold, the winding discharge mode and winding discharge monitoring are turned off, and the active resistor discharge mode is turned on. If the absolute value of the bus voltage discharge slope is greater than the threshold within T4 (T4≤T1), it is determined whether the bus voltage drops below 60V within T1. If the bus voltage drops below 60V within T1, a discharge status signal is reported within T3 (the discharge status signal indicates successful discharge). If the bus voltage does not drop below 60V within T1, the winding discharge and winding discharge monitoring are stopped, and the active discharge resistor discharge and resistor discharge monitoring are turned on.

[0078] like Figure 5 As shown, the present invention provides a high-voltage functional safety architecture method for an electric drive system, the method comprising: collecting operating parameters of the electric drive system for high-voltage functional safety monitoring, and outputting parameter signals; processing the collected operating parameters and releasing signals; judging whether the electric drive system generates unexpected high voltage within a preset time according to the released signals, and generating judgment results; merging the signals released after the operating parameter processing and the judgment results, and outputting a functional safety fault signal; verifying and processing the merged results, and transmitting them to the CAN bus.

[0079] The parameter signals include bus voltage signals, motor speed signals, hard-line sampling signals and CAN bus signals; wherein, the bus voltage signals include high-precision bus voltage Vbus1 and low-precision bus voltage Vbus2; the hard-line sampling signals include hard-line sampling signals 1 and hard-line sampling signals 2; and the CAN bus signals include discharge request signals and discharge mode signals. Processing the collected operating parameters includes collision signal processing and signal processing; wherein, collision signal processing includes judging the validity of hard-line sampling signals 1 and hard-line sampling signals 2; signal processing includes range verification and comparison verification of high-precision bus voltage Vbus1 and low-precision bus voltage Vbus2. Judging whether the electric drive system generates unexpected high voltage includes whether the bus voltage drops below the threshold voltage within 3s, and outputting a high-voltage discharge state signal; wherein, the threshold voltage is 60V. Verifying the merged result includes performing E2E verification on the received CAN bus signal; processing the merged result includes adding E2E processing to the high-voltage discharge state signal and functional safety fault signal.

[0080] Those skilled in the art should understand that although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible to modify the technical solutions described in the aforementioned embodiments, or to make equivalent replacements for some of the technical features therein; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A high voltage functional safety architecture system for an electric drive system, characterized in that: The system comprises: Signal acquisition module, processing module, high voltage safety control and monitoring module, fault reporting module and CAN message verification and E2E processing module; Wherein, the signal acquisition module acquires the operating parameters of the electric drive system for high-voltage functional safety monitoring; The processing module is used to process the collected operating parameters and release a signal; The high-voltage safety control and monitoring module is used to judge the voltage state of the electric drive system according to the released signal and generate a judgment result; the high-voltage safety control and monitoring module, the system first judges according to the hard line collision signal, the discharge request signal, the discharge mode instruction, the speed is below the speed threshold, there is no bus voltage fault, and whether the bus voltage value is above 60V. If the conditions are met, it enters the discharge control and discharge monitoring; the discharge control design has two discharge modes, namely winding discharge and active resistance discharge; among them, the winding discharge mode is realized by the motor control mode of given Id current, Iq=0, and the winding discharge mode is designed to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within T1; the resistance discharge mode is to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within T2 time by designing the discharge resistor; The fault reporting module combines the signal released after the operation parameters are processed and the judgment result; The CAN message verification and E2E processing module verifies and processes the merged result and transmits it to the CAN bus.

2. According to claim 1, a high voltage functional safety architecture system for an electric drive system is characterized in that: The signal acquisition module includes voltage analog sampling and voltage digital sampling; Among them, the voltage analog sampling ADC obtains the high-precision bus voltage Vbus1; The voltage digital sampling DI / O port obtains the low-precision bus voltage Vbus2; The duty cycle corresponding to the bus voltage of 0V is a%, and the duty cycle corresponding to the maximum bus voltage is b%. <b。 3. According to claim 1, a high voltage functional safety architecture system for an electric drive system is characterized in that: The processing module includes a collision signal processing module and a signal processing module; Among them, the collision signal processing module makes a validity judgment on the two sampling signals of the hard line; The signal processing module performs range check and comparison check on the bus voltage signal.

4. The high voltage functional safety architecture system of an electric drive system according to claim 3, characterized in that: The CAN message transceiver and E2E processing module should receive a CAN message including a discharge request instruction and a discharge mode instruction from the CAN bus, and perform an E2E check on the received CAN message to determine whether the CAN message is complete.

5. The high voltage functional safety architecture system of an electric drive system according to claim 1, characterized in that: The electric drive system operating parameters include bus voltage signal, motor speed signal, hard line sampling signal and CAN bus signal; Wherein, the bus voltage signal includes the high-precision bus voltage of Vbus1 and the low-precision bus voltage of Vbus2; The hard-line sampling signal includes a hard-line sampling signal 1 and a hard-line sampling signal 2.

6. The high voltage functional safety architecture system of an electric drive system according to claim 4, characterized in that: The E2E check includes checksum, rolling count and timeout check, and the check operation cycle is set to be equal to the message cycle; If the E2E processing module receives five consecutive checksum error frames in one driving cycle, it determines that the checksum is faulty. If the receiver receives five Rolling Count error frames in a row within one driving cycle, the E2E processing module determines that there is a Rolling Count fault. If the E2E processing module does not receive 10 frames continuously within a driving cycle, it is determined that there is no timeout fault; When the CAN message verification and E2E processing module confirms that an E2E fault has occurred, the CAN communication verification fault is output to the fault reporting module.

7. A high voltage functional safety architecture system for an electric drive system according to claim 1 or 4, characterized in that: The CAN message verification and E2E processing module should perform E2E processing on the fed-back discharge status signal and fault signal.

8. The high voltage functional safety architecture system of an electric drive system according to claim 3, characterized in that: The collision signal processing module judges the validity of the two hard-wire sampling signals. Specifically, both hard-wire sampling signals are digital quantities. For hard-wire sampling signal one, a high level is agreed to indicate a collision occurs, and a low level is agreed to indicate no collision. For hard-wire sampling signal two, a low level is agreed to indicate a collision occurs, and a high level is agreed to indicate no collision. If both hard-wire signals indicate that a collision occurs, it is determined that a collision occurs.

9. The high voltage functional safety architecture system of an electric drive system according to claim 4, characterized in that: The signal processing module shall perform range check on the sampled high-precision bus voltage Vbus1 and the low-precision bus voltage Vbus2, and convert the two bus voltages into actual values ​​for comparison and check. If an abnormality occurs, anti-shake processing shall be performed; If the signal processing module detects a high-precision or low-precision bus voltage range verification fault, or a two-way bus voltage comparison verification fault, the high-precision bus voltage range verification fault, the low-precision bus voltage range verification fault, and the voltage comparison verification fault are sent to the fault reporting module and the high-voltage safety control and monitoring module; When the E2E check fails, the high-precision bus voltage range check fails, the low-precision bus voltage range check fails, and the bus voltage comparison check fails, the output functional safety fault signal is Fault to the CAN message check and E2E processing module, and the discharge status signal is sent to the CAN message check and E2E processing module.

10. A high voltage functional safety architecture method for an electric drive system, characterized in that: The method comprises: Collect the operating parameters of the electric drive system for high-voltage functional safety monitoring and output parameter signals; Process the collected operating parameters and release the signal; According to the released signal, it is judged whether the electric drive system generates unexpected high voltage within the preset time, and a judgment result is generated; in the high-voltage safety control and monitoring module, the system first judges according to the hard-line collision signal, the discharge request signal, the discharge mode instruction, the speed is below the speed threshold, there is no bus voltage fault, and whether the bus voltage value is above 60V. If the conditions are met, it enters the discharge control and discharge monitoring; the discharge control design has two discharge modes, namely winding discharge and active resistance discharge; among them, the winding discharge mode is realized by the motor control mode with a given Id current and Iq=0, and the winding discharge mode is designed to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within T1; the resistance discharge mode is to reduce the bus voltage from the maximum allowable working voltage to below the threshold voltage within T2 time by designing the discharge resistor; The signal released after the operation parameter processing and the judgment result are combined, and a functional safety fault signal is output; The combined result is checked and processed and transmitted to the CAN bus.

11. A high voltage functional safety architecture method for an electric drive system according to claim 10, characterized in that: The parameter signals include bus voltage signals, motor speed signals, hard-line sampling signals and CAN bus signals; Wherein, the bus voltage signal includes a high-precision bus voltage Vbus1 and a low-precision bus voltage Vbus2; The hard-line sampling signal includes a hard-line sampling signal 1 and a hard-line sampling signal 2; The processing of the collected operating parameters includes collision signal processing and signal processing; Wherein, the collision signal processing includes determining the validity of the hard-line sampling signal 1 and the hard-line sampling signal 2; The signal processing includes performing range check and comparison check on the high-precision bus voltage Vbus1 and the low-precision bus voltage Vbus2; The determining whether the electric drive system generates unexpected high voltage within a preset time is specifically whether the bus voltage drops below a threshold voltage within 3 seconds; Among them, the threshold voltage is 60V; The CAN bus signal includes a discharge request signal and a discharge mode signal.

Images