Method for protecting a safety switch of an electric machine control unit

Abstract

The invention relates to a method for protecting a safety switch (Q7, Q8, Q9) of a control unit (11) of an electric machine, wherein the control unit (11) has a microcontroller (12) and a gate driver (13) which actuates a driver circuit (14) having 2n FETs (Q1, Q2, Q3, Q4, Q5, Q6), wherein n is the number of phase windings of the electric machine and the FETs are arranged in half-bridges and a safety switch is arranged between the driver circuit (14) and the phase windings of the electric machine in the middle of the head of each half-bridge, wherein the safety switch is a FET which is designed to interrupt the electrical connection between the driver circuit (14) and each phase winding in the event of a fault, and wherein the method comprises the following steps in the event of an electrical fault in the driver circuit (14): (a) activating one of the 2n FETs (Q1, Q2, Q3, Q4, Q5, Q6) of the driver circuit (14), (b) measuring the current in the supply line (19-) of the driver circuit (14) and detecting the current value, (c) deactivating the activated FET (Q1, Q2, Q3, Q4, Q5, Q6) of the driver circuit (14), (d) for the remaining 2n-1 FETs (Q1, Q2, Q3, Q4, Q5, Q6), performing a test switching mode successively according to steps (a) to (c), (e) analyzing the detected current values for the case that they are below a predefined threshold value, wherein the highest detected current value is not taken into account, (f) in the event of a threshold value being undershot, opening the electrical connection between the driver circuit (14) and at least one of the phase windings (u, v, w) by switching the safety switch (Q7, Q8, Q9). Furthermore, the invention relates to an electromechanical motor vehicle steering device having a control unit which is configured to carry out the method.

Description

TECHNICAL FIELD

[0001] The invention relates to a method for protecting a safety switch of an electric machine control unit and to an electromechanical motor vehicle steering device. BACKGROUND

[0002] Electromechanical steering devices usually have a permanent-magnet-excited synchronous machine as a servo machine. Servo machines of this construction are controlled by a control device via a set of MOSFETs, wherein, in the case of three phase windings, a total of six MOSFETs are provided. Each MOSFET switches the associated phase winding to the vehicle voltage or to ground potential. This takes place at a high frequency, so that the time average in the phase winding serves as the effective voltage.

[0003] Permanent-magnet-excited synchronous machines have the property of generating a braking torque in the event of an electrical fault, for example a short circuit in the machine or in the control device, so that such a fault can not only lead to a failure of the steering assistance, but the additional resistance also opposes the steering movement of the driver. This is not acceptable for safety reasons in a steering system for a motor vehicle.

[0004] It is known to avoid this state by separating the phase feed lines to the machine or in the star point of the machine. For this purpose, semiconductor switches are proposed in the prior art which act as safety switches and are connected in series between one end of the phase winding and the driver circuit of the machine. Here, overvoltages can occur due to the always present leakage inductance in the inverter and due to the electrical energy stored in the machine winding when the switching element is opened. If the current flowing through the semiconductor switch is interrupted, the voltage over the semiconductor switch between drain and source rises to a value which can be greater than the supply voltage. If the voltage occurring here exceeds the maximum blocking voltage of the semiconductor switch, damage to the semiconductor switch can result. It is therefore necessary to avoid too high a current flowing through the safety switch during switching off in order to protect the semiconductor switch from damage. SUMMARY

[0005] It is an object of the invention to propose a method for protecting a safety switch and an electromechanical motor vehicle steering device, in which damage to the safety switch when the line is opened is prevented.

[0006] This object is achieved by the method and the electromechanical motor vehicle steering device according to the invention. Advantageous embodiments of these solutions result from the description and the embodiments shown in the drawings.

[0007] A method for protecting a safety switch of a control unit of an electric machine is proposed, wherein the control unit has a microcontroller and a gate driver, which actuates a driver circuit with 2n FETs (FET: field effect transistor), wherein n is the number of phase windings of the electric machine and the FETs are arranged in half bridges, and a safety switch is arranged between the driver circuit and the phase windings of the electric machine in the middle of the head of each half bridge. The safety switch is a FET and is designed to interrupt the electrical connection between the driver circuit and each phase winding in the event of a fault. The method comprises the following steps in the event of an electrical fault in the driver circuit:

[0008] a) activating one of the 2n FETs of the driver circuit,

[0009] b) measuring the current in the supply line of the driver circuit and detecting the current value,

[0010] c) deactivating the activated FET of the driver circuit,

[0011] d) for the remaining 2n-1 FETs, i.e. for the remaining five FETs, for example, in the case of six FETs, performing a test switching pattern according to steps a) to c) successively,

[0012] e) analyzing the detected current values for the case that they are below a predefined threshold value, wherein the highest detected current value is not taken into account,

[0013] f) in the event of a value below the threshold value, disconnecting the electrical connection between the driver circuit and at least one of the phase windings by switching the safety switch.

[0014] The method advantageously only uses hardware that is already present. The measurement of the current is advantageously used to find the point in time at which the current of the safety switch falls below the threshold value, so that the safety switch can be disconnected without damage. The method is therefore very inexpensive and can be used for any electric machine for which it is important to protect the safety switch from damage. The FETs are preferably MOSFETs.

[0015] An advantageous refinement of the method provides that, if the threshold value is not undershot, i.e. is exceeded or is exactly reached, the method steps a) to f) are re-implemented. In this respect, the disconnection of the safety switch is advantageously further delayed until the current below which the safety switch is at risk.

[0016] According to a further advantageous embodiment, a predefined time interval exists between the activation of the FET and the deactivation of the FET, in particular a time interval between 0.5 μs (μs: microsecond) and 2 ms (ms: millisecond), further in particular a time interval between 1 μs and 1 ms, further in particular a time interval between 1 μs and 10 μs. Here, a time interval as short as possible proves to be particularly advantageous.

[0017] It is provided in particular that the analysis of the measured current takes place immediately before the FET is to be deactivated. Thus, the measuring of the current and / or the analysis of the measured current advantageously takes place at a point in time closer to the point in time at which the FET is to be deactivated than to the point in time at which the FET is activated, in particular at a point in time less than 10 μs before the FET is deactivated, preferably less than 2 μs before the FET is deactivated.

[0018] A further advantageous embodiment of the method provides that, when analysing the detected current values, a second highest current value and a third highest current value are determined from the detected current values. The second highest current value and the third highest current value can also be of the same size here. An and value is then advantageously generated from the values of the second highest current value and the third highest current value, and the and value is compared with a predefined threshold value. This step then advantageously corresponds to a more specific embodiment of the method step e) of analysing the detected current values for being below the predefined threshold value and in this respect. By means of the summing, it is possible to advantageously determine more reliably whether the safety switch can be opened, in particular because outliers in the measurement values are less important.

[0019] It is provided in particular a method for protecting a safety switch of a control unit of an electric machine, wherein the control unit comprises a microcontroller and a gate driver, which gate driver actuates a driver circuit comprising 2n FETs, wherein n is the number of phase windings of the electric machine and the FETs are arranged in half bridges, the safety switch is arranged in the middle tap of each half bridge between the driver circuit and the phase winding of the electric machine, wherein the safety switch is an FET designed to interrupt the electrical connection between the driver circuit and each phase winding in the event of a fault, and wherein in the event of an electrical fault in the driver circuit, the method comprises the following steps:

[0020] activating the 2n FETs of the driver circuit in succession in a test switching pattern,

[0021] measuring the current in the supply line of the driver circuit,

[0022] analysing the measured current immediately before the FETs are deactivated, respectively, wherein the 2n FETs are deactivated in succession,

[0023] forming an and value from the values of the second highest current value and the third highest current value,

[0024] the sum value is compared to a threshold value which can be predefined,

[0025] if the sum value is below the threshold value, the electrical connection between the driver circuit and the at least one phase winding is disconnected by switching the safety switch,

[0026] if the sum value is above the threshold value, the manipulation by means of the test commutation is repeated.

[0027] During the activation time of the FETs, the current flowing through the supply line is preferably measured by an analog-digital converter and is synchronized with the activation.

[0028] It is provided in particular that the threshold value is predefined in accordance with the electrical properties of the safety switch. The threshold value is preferably dependent on the capacity of the safety switch.

[0029] The measured current signal can be analyzed in order to localize an electrical fault of a FET in the driver circuit and to determine the resistance value of the faulty FET.

[0030] Preferably, the manipulation in accordance with the electrical angle of the electric machine is carried out with the test commutation at high rotor angular velocities, wherein the electrical angle is determined by means of a rotor position sensor.

[0031] At low rotor angular velocities, the manipulation can be carried out in the test commutation at time intervals which are asynchronous to the electrical angle of the electric machine, wherein in particular the electrical angle is not taken into account.

[0032] The body diode of the safety switch can be switched on in the on direction or in the off direction.

[0033] The electromechanical motor vehicle steering device likewise proposed comprises a multiphase, permanently excited electric machine which can be driven by a control unit and a supply line from a direct current vehicle electrical system of the motor vehicle, wherein the electric machine has at least three phase windings which are connected by lines to a driver circuit, wherein the driver circuit connects each of the lines respectively by a first FET of a first group to the positive supply line and respectively by a second FET of a second group to the negative supply line in accordance with a manipulation of the control unit, and wherein each line has a FET as a safety switch, and the control unit is configured to implement the method described previously, wherein the previously described embodiments and refinements of the method can be realized individually or in combination. The control unit preferably has a decision unit which decides on the basis of the measured current signal whether the safety switch can be safely disconnected. BRIEF DESCRIPTION OF DRAWINGS

[0034] The advantageous embodiments of the application are explained in detail below with the aid of the drawings. Identical or functionally identical parts are provided with the same reference numerals in the figures. Among others:

[0035] Figure 1 The schematic diagram illustrates an electromechanical vehicle steering system, which offers various possibilities for arranging servo motors.

[0036] Figure 2 The first circuit is shown for controlling a synchronous motor with permanent magnet excitation having six FETs for controlling the motor current.

[0037] Figure 3 A second circuit is shown for controlling a synchronous motor with a permanent excitation having six FETs for controlling the motor current.

[0038] Figure 4 It shows Figure 2 The first circuit has a short-circuited FET.

[0039] Figure 5 A graph of typical phase short-circuit current and the impact of test switching modes are shown.

[0040] Figure 6 It shows in Figure 5 The curve of the change in current value at time #1 activation, and

[0041] Figure 7 It shows in Figure 5 The curve showing the change in current value when #2 is activated. Detailed Implementation

[0042] exist Figure 1 The diagram schematically illustrates an electromechanical power steering system 1 for a motor vehicle, having a steering wheel 2 rotatably coupled to an upper steering shaft 3. The driver inputs a corresponding torque as a steering command into the steering shaft 3 via the steering wheel 2. The torque is then transmitted via the upper steering shaft 3 and the lower steering shaft 4 to a steering pinion 5. The pinion 5 meshes with the teeth of a rack 6 in a known manner. The rack 6 is movably supported in the steering housing along its longitudinal axis. The rack 6 is connected at its free end to a steering tie rod 7 via a ball joint (not shown). The steering tie rod 7 itself is connected to one of the steering wheels 8 of the motor vehicle via a steering knuckle in a known manner. Rotation of the steering wheel 2 causes longitudinal movement of the rack 6 via the connection of the steering shaft 3 and the pinion 5, and thus causes pivoting of the steering wheel 8. The steering wheel 8 experiences a reaction force across the lane 80, which acts in the opposite direction on the steering motion. Therefore, a force is required to pivot the wheel 8, resulting in a corresponding torque on the steering wheel 2. The motor 9 of the servo unit 10 is configured to assist the driver during this steering movement. The upper steering shaft 3 and the lower steering shaft 4 are rotatably and elastically coupled to each other via a torsion bar (not shown). The torque sensor unit detects the torsion of the upper steering shaft 3 relative to the lower steering shaft 4 as a measure of the torque manually applied to the steering shaft 3 or the steering wheel 2. Based on the torque measured by the torque sensor unit, inFigure 1 The control unit 11, which is only shown schematically, calculates a steering assist which is provided by the servo unit 10 to the driver. The servo unit 10 can here be coupled to the steering shaft 3, the steering pinion 5 or the rack 6 as a power assist device 10, 100, 101. The respective power assist device 10, 100, 101 introduces an assist torque into the steering shaft 3, the steering pinion 5 and / or the rack 6, thereby assisting the driver in the steering work. In Figure 1 The three different power assist devices 10, 100, 101 shown in the figure show, inter alia, alternative positions of their arrangement. In general, only one of the positions shown is occupied by a power assist device.

[0043] Figure 2 and Figure 3 An exemplary embodiment of the control unit 11 for the electric machine 9 is shown. A microcontroller 12 controls a driver circuit 14 by means of a gate driver 13. The microcontroller 12 sends PWM signals 15 and SPI configuration signals 16 to the gate driver 13. The gate driver 13 in turn sends diagnostic signals 17 and measured values 18 of current measurements to the microcontroller 12. A supply line 19+ is connected with the positive pole of the supply line, and a supply line 19- is connected with the negative pole or the ground connection of the on-board electronics of the motor vehicle, which is operated in the usual manner with a negative ground DC voltage.

[0044] The first group of FETs comprises three FETs Q1, Q3 and Q5 for applying the on-board voltage to the three phase windings u, v and w. A second group of a total of three further FETs Q2, Q4 and Q6 is provided for loading the phase windings u, v and w with ground potential. The two groups are fed for this purpose with a total of three lines, which correspond to the phases u, v, w, respectively.

[0045] The first and second groups of FETs are set up as drivers and form the driver circuit 14.

[0046] Each winding phase u, v, w is therefore equipped with an upper electronic switch Q1, Q3, Q5 (high side) and a lower electronic switch Q2, Q4, Q6 (low side). These driver FETs are usually switched on such that their body diode is switched into the blocking direction with respect to the on-board voltage. Depending on the control signals, the FETs either connect the individual phase windings u, v and w to the positive potential or to the ground potential. This takes place at a high frequency, so that the average over time in the respective winding u, v and w is effective as the operating voltage for generating the assist torque.

[0047] In the three lines leading to the phase windings, a third group of one FET each is provided as safety switches Q7, Q8, Q9. Thus, the safety switches Q7, Q8, Q9 are arranged between the driver circuit 14 and the motor windings u, v, w. In the event of an electrical fault, these safety switches Q7, Q8, Q9 should open the electrical connection between the driver circuit and the windings. The windings would then not be short-circuited and a braking torque would not be generated.

[0048] In the embodiment of Figure 2 the safety switches Q7, Q8, Q9 are n-channel FETs, which are self-conducting. The drain terminal is connected to the driver circuit 14 and the source terminal is connected to the phase winding u, v, w.

[0049] In contrast, in the embodiment of Figure 3 the drain terminal of the safety switches Q7, Q8, Q9 is connected to the phase winding u, v, w and the source terminal is connected to the driver circuit Q7, Q8, Q9.

[0050] The body diode of the safety switches Q7, Q8, Q9 between the drain terminal and the source terminal can be connected in the on direction or in the off direction.

[0051] Each of the nine illustrated semiconductor switches Q1, Q2, Q3, Q4, Q5, Q6, Q7, Q8, Q9 can preferably be individually actuated by means of the gate driver 13.

[0052] Figure 4 A fault situation in the embodiment of Figure 2 is illustrated. The FET Q1 of the driver circuit 14 is short-circuited.

[0053] For the case in which such an electrical fault is recognized and the safety switches Q7, Q8, Q9 should open the electrical connection between the driver circuit 14 and the windings u, v, w, the main microcontroller 12 of the control unit 11 issues a special test switching pattern. This switching pattern causes very short successive activation of the FETs Q1, Q2, Q3, Q4, Q5, Q6 of the driver circuit 14. That is to say, in the embodiments of Figure 2 and Figure 3 first Q1 and subsequently Q2, Q3, Q4, Q5 and Q6 are activated in the order mentioned for a few μs (μs: microseconds). In particular, the previous FET is deactivated before the next FET is activated. Thus, for example, if the FET Q1 is activated, the FET Q1 is deactivated before the activation of the FET Q2.

[0054] During the activation time, the current flowing through the supply line 19 is measured by the analog-digital converter 20 and is synchronized with the activation.

[0055] The sampled current values are used as input values for a decision unit 21 of the microcontroller 12, which decides whether the safety switches Q7, Q8, Q9 are to be disconnected.

[0056] If the drain current of the safety switches Q7, Q8, Q9 is less than a threshold value which can be predefined, the disconnection can be carried out without problems in order to protect the safety switches Q7, Q8, Q9 themselves from damage.

[0057] Figure 5 Typical time curves of the short-circuit current in one phase and the influence of the test commutation mode are shown. The vertical lines illustrate the time intervals in which the test commutation mode is switched on, respectively. The height of these lines represents the measured current. The curved lines indicate the winding current.

[0058] The actuation with the test commutation mode is preferably carried out in dependence on the electrical angle of the machine at high rotor angular velocities. A rotor position sensor is used to measure the mechanical angle and to determine the electrical angle therefrom.

[0059] The machine preferably has three phase windings. The commutation angle, i.e. the angle relative to the full electrical wave during which one phase winding is energized, is 120°. At short circuits, the actuation with the test commutation mode is carried out approximately every 60°.

[0060] At low rotor angular velocities, the actuation with the test commutation mode can be carried out in time intervals which are asynchronous to the electrical angle.

[0061] Furthermore, during the course of one complete electrical period, ideal points in time for disconnecting the safety switches can be found independently of the aforementioned triggering method.

[0062] Figure 6 and Figure 7 The time curves of the measured currents during the test commutation mode are shown, respectively. The highest measured current 22 is the current flowing through the short-circuited FET of the same half-bridge and the currently activated FET. In Figure 4 In the example of Fig. 2, this global maximum is associated with the faulty FET switch Q1 and the activated FET switch Q2.

[0063] Figure 6 The time curves of the measured currents in the first test commutation mode period #1 as represented in Figure 5 are shown. In Figure 7 the time curves of the measured currents in the second test commutation mode period #2 are shown. The currents are measured, respectively, before one FET is about to be deactivated.

[0064] If the FET Q1 is switched on for the aforementioned example, as Figure 6 and Figure 7As shown in Fig. 2, no current is detected, i.e. a current of 0 A (A: Ampere) or at least approximately 0 A is detected, because the other FETs are short-circuit-free and open, i.e. deactivated, and thus no current can flow between the motor and the ground potential 19-. If FET Q2 is then activated, there is a direct connection between the positive supply line 19+ and the ground potential 19- due to the short circuit in Q1, whereby the maximum 22 of the current is explained. If FET Q2 is now deactivated, i.e. the FET is switched off, and FET Q3 is activated, again no current can flow between the motor and the ground potential 19-, so that as shown in Fig. 3 a current value of 0 is detected. Figure 6 and Figure 7 If FET Q3 is deactivated and FET Q4 is activated, a current can flow between the motor and the ground potential 19- due to the electrical energy stored in the motor winding, and a current value corresponding to the second maximum shown is detected. After the current measurement, FET Q4 is then deactivated again and FET Q5 is activated. Here, again no current can flow and the current value is accordingly 0. After deactivating FET Q5, FET Q6 is then activated. Due to the electrical energy stored in the motor winding, a current flows between the motor and the ground potential 19-, and a current value corresponding to the third maximum 24 shown is detected, which in terms of magnitude approximately corresponds to the second maximum 23. Because Figure 7 the current change curve at a later point in time is shown than Figure 6 the second maximum 23 and the fourth maximum 24 are smaller here.

[0065] The detected current values of the second highest maximum 23 and the third highest maximum 24 are added together. As mentioned above, in the example of the faulty FET switch Q1, the second highest maximum 23 corresponds to the FET switch Q4 and the third highest local maximum 24 corresponds to the FET switch Q6.

[0066] From the analysis of the sum value it is decided whether the safety switches Q7, Q8, Q9 are open or not. If the sum value is below a predefined threshold value depending on the capacity of the safety switches Q7, Q8, Q9, all safety switches Q7, Q8, Q9 can be opened at the same time without being damaged. Furthermore, the short-circuited FET can be located and its resistance value determined by means of the time change curve of the current measured in the supply line.

[0067] In the test switching mode cycle #1, the sum value is high and above the threshold value, so that the safety switches Q7, Q8, Q9 cannot be opened without being damaged. Therefore, the decision unit 21 decides that the safety switches Q7, Q8, Q9 are not opened. In contrast, in the test switching mode cycle #2, the sum value is sufficiently low so that it is below the threshold value, and the safety switches Q7, Q8, Q9 can all be opened without being damaged.

[0068] The foregoing method can also be used in a steer-by-wire system.

Claims

1. A method for protecting a safety switch of a control unit (11) of an electric machine (9), wherein, The control unit (11) has a microcontroller (12) and a gate driver (13) which operates a driver circuit (14) with 2n FETs, where n is the number of phase windings of the electric machine (9) and the FETs are arranged in half bridges, and in the middle of each half bridge a head is tapped off, between the driver circuit (14) and the phase winding of the electric machine (9) a safety switch is arranged, where the safety switch is a FET which is designed to interrupt the electrical connection between the driver circuit (14) and the respective phase winding in the event of a fault, characterized in that the method comprises the following steps in the event of an electrical fault in the driver circuit (14): a) one of the 2n FETs of the driver circuit (14) is activated, b) the current in the supply line (19-) of the driver circuit (14) is measured and the current values are detected, c) the activated FET of the driver circuit (14) is deactivated, d) for the remaining 2n-1 FETs, a test switching mode is performed successively according to steps a) to c), e) the detected current values are analyzed for the case that they are below a predefined threshold value, wherein the highest detected current value (22) is not taken into account, f) in the case that the threshold value is undershot, the electrical connection between the driver circuit (14) and at least one of the phase windings is interrupted by switching the safety switch.

2. The method of claim 1, wherein, If the threshold value is not undershot, the method steps a) to f) are re-implemented.

3. The method according to the preceding claim 2, characterized in that, There is a predefined time interval between the activation of a FET and the deactivation of the FET.

4. The method according to the preceding claim 3, characterized in that, The predefined time interval is a time interval between 1 μs and 1 ms.

5. The method according to any of the preceding claims 1 - 4, characterized in that, The measured current is analyzed before the FET is to be deactivated.

6. The method according to any of the preceding claims 1 - 4, characterized in that, In the analysis of the detected current values, the second highest current value (23) and the third highest current value (24) are determined from the detected current values; a sum value is generated from the values of the second highest current value (23) and the third highest current value (24); and the sum value is compared with the predefined threshold value in the analysis.

7. The method according to any of the preceding claims 1 - 4, characterized in that, The threshold value is related to the electrical properties of the safety switch.

8. The method according to any of the preceding claims 1 - 4, characterized in that, The detected current values are analyzed in order to localize an electrical fault of a FET in the driver circuit (14) and to determine the resistance value of the faulty FET.

9. The method according to any of the preceding claims 1 - 4, characterized in that, The test switching mode is operated in dependence on the electrical angle of the electric machine (9) at high rotor angular velocities, wherein the electrical angle is determined by means of a rotor position sensor.

10. The method according to any of the preceding claims 1 - 4, characterized in that, At low rotor angular velocities, the test switching mode is operated with a time interval which is asynchronous to the electrical angle of the electric machine (9), wherein the rotor angular velocities are determined by means of a rotor position sensor.

11. The method according to any of the preceding claims 1 - 4, characterized in that, The operation of the safety switch is performed over the course of one complete electrical period of the electric machine (9).

12. The method according to any of the preceding claims 1 - 4, characterized in that, The body diode of the safety switch is connected in the on direction or in the off direction.

13. Electromechanical motor vehicle steering device with a multiphase, permanently excited electric machine (9), which can be driven by a direct-current vehicle electrical system of a motor vehicle via a control unit (12) and supply lines (19+, 19-), wherein the electric machine (9) has at least three phase windings, which are connected via lines to a driver circuit (14), wherein the driver circuit (14) connects each of the lines via a first FET of a first group to a positive supply line (19+) and via a second FET of a second group to a negative supply line (19-) respectively in accordance with a control by the control unit (12), and wherein each line has a FET as a safety switch, and the control unit (12) is configured to carry out a method according to any one of claims 1 to 12.

Images