A safety state processing circuit for electric vehicle motor controller

Abstract

The present invention relates to a safety state processing circuit of an electric vehicle motor controller, including a main safety state processing path, a spare safety state processing path and a high-voltage side redundant safety state control path, the main safety state processing path includes a main safety logic circuit and a PWM signal buffer, an IGBT drive circuit and a three-phase full-bridge circuit connected in sequence, the main safety logic circuit is connected to the signal transmission line between the PWM signal buffer and the IGBT drive circuit; the PWM signal buffer is used to receive the control signal of the main control chip for PWM control; the main safety logic circuit is used to receive the control signal of the main control chip when the main control chip detects a system safety-related fault, prohibit the PWM control of the PWM signal buffer, and control the three-phase full-bridge circuit through the IGBT drive circuit to enter the corresponding safety state. Compared with the prior art, the present invention has the advantages of circuit compliance with functional safety requirements, reasonable topology design, easy implementation, strong versatility and high cost performance.

Description

Technical Field

[0001] The invention relates to the field of electric vehicle motor controllers, and in particular to a safety state processing circuit of an electric vehicle motor controller. Background Art

[0002] The motor controller is the core power control system of electric vehicles. If the motor outputs unexpected torque or the DC bus voltage is unexpected due to the failure of some system components during driving, it may directly or indirectly cause safety hazards to personnel. The three-phase full-bridge shutdown of the power bridge and the active short circuit of the three-phase motor are two reliable and safe states of the motor control system. Timely and effective entry of the system into the above safe states can prevent the occurrence of safety hazards caused by the above two types of unexpected failures.

[0003] The invention with authorization announcement number CN104199370B discloses a safety monitoring circuit for a vehicle motor controller, including a chip power supply circuit, a chip monitoring circuit, and a fault diagnosis circuit, wherein the chip power supply circuit includes a main control chip power supply circuit and a monitoring chip power supply circuit, the main control chip power supply circuit is used to convert the power supply voltage into the voltage required by the main control chip, and the monitoring chip power supply circuit is used to convert the power supply voltage into the voltage required by the monitoring chip; the chip monitoring circuit includes a main control chip and a monitoring chip, the main control chip is connected to and controls the operation of the motor, and the monitoring chip is used to monitor the operating status of the main control chip; the fault diagnosis circuit includes a motor phase current overcurrent detection circuit, a power switch overtemperature detection circuit, a bus voltage overvoltage detection circuit, an IGBT enable signal a, an IGBT enable signal b, and a power bridge enable signal.

[0004] The safety monitoring circuit collects analog signals through the main control chip and controls the operation of the motor. It also monitors the digital signals of the fault diagnosis circuit to control the power switch tube. However, directly controlling the power switch tube through the main control chip has the following defects:

[0005] The main control chip itself is used to control the operation of the power switch tube. When the power switch tube needs to be controlled for safety protection based on the digital signal of the fault diagnosis circuit, this structure does not meet the requirements of high-level functional safety, and the safety protection control at this time is also difficult to ensure timeliness requirements. Summary of the invention

[0006] The purpose of the present invention is to provide a safety state processing circuit for an electric vehicle motor controller in order to overcome the defects of the above-mentioned prior art that the safety protection does not meet the high-level functional safety requirements, the safety protection timeliness is poor and the safety protection coverage is insufficient.

[0007] The purpose of the present invention can be achieved by the following technical solutions:

[0008] A safety state processing circuit of an electric vehicle motor controller includes a main safety state processing path, the main safety state processing path includes a main safety logic circuit and a PWM signal buffer, an IGBT drive circuit and a three-phase full-bridge circuit connected in sequence, and the output signal of the main safety logic circuit is connected to a signal transmission line between the PWM signal buffer and the IGBT drive circuit;

[0009] The PWM signal buffer is used to receive the control signal of the main control chip for PWM control; the main safety logic circuit is used to receive the control signal of the main control chip when the main control chip detects a system safety-related fault, prohibit the PWM control of the PWM signal buffer, and control the three-phase full-bridge circuit through the IGBT drive circuit to select to enter the corresponding safety state.

[0010] Furthermore, an anti-reverse isolation diode is connected to the output end line of the main safety logic circuit.

[0011] Furthermore, the control signal of the main control chip received by the main safety logic circuit includes a PWM control enable signal and a fast safety state control signal. The main safety logic circuit prohibits the PWM control of the PWM signal buffer according to the PWM control enable signal, controls the three-phase full-bridge circuit through the IGBT drive circuit according to the fast safety state control signal, and selects to enter the corresponding safety state.

[0012] Furthermore, the safety state processing circuit also includes a backup safety state processing path, which includes a backup safety logic circuit and a low-voltage side drive safety logic processing circuit connected in sequence, and the low-voltage side drive safety logic processing circuit is connected to the IGBT drive circuit.

[0013] The backup safety logic circuit is used to receive the main control chip status monitoring signal and the high-voltage overvoltage signal. When the main control chip status monitoring signal indicates that the main control chip fails, the backup safety logic circuit is activated, and the safety logic processing circuit is driven through the low-voltage side to prohibit the IGBT drive circuit from responding to the PWM control signal of the previous stage. The IGBT drive circuit is controlled according to the high-voltage overvoltage signal through the low-voltage side drive safety logic processing circuit, so that the three-phase full-bridge circuit selects to enter the corresponding safety state.

[0014] Furthermore, the standby safety logic circuit outputs a safety state enable signal, an upper three-bridge arm safety state control signal, and a lower three-bridge arm safety state control signal. The low-voltage side drive safety logic processing circuit prohibits the IGBT drive circuit from responding to the previous stage PWM control signal according to the safety state enable signal, and controls the IGBT drive circuit according to the upper three-bridge arm safety state control signal and the lower three-bridge arm safety state control signal, thereby enabling the three-phase full-bridge circuit to select and enter the corresponding safety state.

[0015] Further, the safety state processing circuit also includes a high-voltage side redundant safety state control path, which includes a fault logic processing circuit, a high-voltage side drive safety logic processing circuit, a high-voltage backup power supply and a switch tube, the fault logic processing circuit is respectively connected to the gate of the high-voltage side drive safety logic processing circuit and the switch tube, the high-voltage side drive safety logic processing circuit is also connected to the IGBT drive circuit, the source of the switch tube is connected to the high-voltage backup power supply, the drain of the switch tube is connected to the signal transmission line between the IGBT drive circuit and the three-phase full-bridge circuit, and the high-voltage backup power supply is connected to the high-voltage side drive safety logic processing circuit;

[0016] The fault logic processing circuit is used to receive a high-voltage overvoltage signal and a low-voltage undervoltage signal, the voltage of the high-voltage backup power supply is lower than the high-voltage side voltage of the IGBT drive circuit; the low-voltage undervoltage signal is a low-voltage side power supply voltage signal of the IGBT drive circuit;

[0017] The fault logic processing circuit enables the high-voltage side driving safety logic processing circuit according to the low-voltage undervoltage signal to output the current of the high-voltage backup power supply;

[0018] The fault logic processing circuit also performs detection based on the high-voltage overvoltage signal. If a high-voltage overvoltage is detected, the high-voltage side drive safety logic processing circuit is enabled to make the gate-level control signal on the output side of the IGBT drive circuit a high-impedance state; and after delay processing, the switch tube is turned on to control the three-phase full-bridge circuit to enter a corresponding safety state.

[0019] Furthermore, the safety state processing circuit also includes a high-voltage side overvoltage detection circuit, which is used to detect the bus voltage and generate the high-voltage overvoltage signal.

[0020] Furthermore, the fault logic processing circuit includes a logic combination unit, a filtering unit and a delay processing unit.

[0021] Furthermore, the drain of the switch tube is connected to the signal transmission line between the IGBT drive circuit and the three-phase full-bridge circuit through an anti-reverse isolation diode.

[0022] Furthermore, the safety state processing circuit also includes a signal isolation circuit, and the low-voltage undervoltage signal is connected to the fault logic processing circuit through the signal isolation circuit.

[0023] Compared with the prior art, the present invention has the following advantages:

[0024] (1) When the main control chip detects a safety-related fault, the main safety state processing path of the present invention prohibits the PWM control of the PWM signal buffer through the main safety logic circuit, and the main safety logic circuit selects to control the upper three bridge arms or the lower three bridge arms of the three-phase full bridge to enter the safe state according to the instruction of the main control chip;

[0025] This process overcomes the defects of the main control chip using the original PWM control path for protection control, which does not meet the high-level functional safety requirements, has poor timeliness and insufficient safety protection range; the main safety status processing path of the present invention can ensure the high-level functional safety integrity, and can quickly adjust according to the signal of the main control chip to start safety protection in time.

[0026] (2) Currently, few motor control systems at home and abroad have separately designed dedicated safety status processing circuits. After related faults occur or related functions fail, especially after the main control chip or main power supply fails, the controller cannot safely and reliably start the safety protection function and effectively maintain the safety state.

[0027] The present invention proposes to use external hardware monitoring independent of the main control chip, and adopts two main and auxiliary safety state execution paths. When the main control chip can work, the system can diagnose various functional failures and perform functional safety protection through the main safety path. When the main control chip cannot work, it can independently trigger the backup safety path through the hardware monitoring status signal and perform functional safety protection.

[0028] (3) The present invention fully considers the safe state processing after the main power supply is undervoltage or power failure, and uses a high-voltage backup power supply to maintain the power supply of the high-voltage side. When all components on the low-voltage side are undervoltage and cannot work normally, an independent high-voltage side detection circuit and control logic are used to ensure that the system enters and maintains a safe state; the backup circuit has low energy consumption when working under light load when the main power supply is in normal state, and has strong practicality.

[0029] (4) The present invention can choose to enter the safety state of three-phase full-bridge shutdown or active three-phase short circuit according to the actual operating conditions of the system. In the main safety path working mode, the system is prevented from overvoltage hazards by judging the high voltage value or the speed value to select whether to enter the three-phase active short circuit state; in the backup path working mode, the system is selected by judging the high voltage hardware overvoltage signal to select whether to enter the three-phase active short circuit safety state; when the low-voltage side circuit cannot work due to the failure of the main power supply, the high-voltage side redundant safety path can choose whether to force the driving lower three bridge arms to actively short circuit the safety state through the hardware detection logic. When the high-voltage overvoltage signal is released, the above three safety state paths can all switch to and maintain the three-phase full-bridge shutdown state, and the entire safety state processing circuit logic is reasonable, safe and reliable.

[0030] (5) The present invention only needs to add an independent detection and logic processing unit to the existing motor control circuit, and can be designed as a dedicated integrated circuit with adjustable parameters. It is easy to implement, low cost, highly portable, and convenient for debugging and promotion and application. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The present invention is a schematic diagram of the structure of a safety state processing circuit of a motor controller of an electric vehicle provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0033] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] Example 1

[0035] This embodiment provides a safety state processing circuit of an electric vehicle motor controller, including a main safety state processing path, the main safety state processing path includes a main safety logic circuit and a PWM signal buffer, an IGBT drive circuit and a three-phase full-bridge circuit connected in sequence, and the output signal of the main safety logic circuit is connected to the signal transmission line between the PWM signal buffer and the IGBT drive circuit;

[0036] The PWM signal buffer is used to receive the control signal of the main control chip for PWM control; the main safety logic circuit is used to receive the control signal of the main control chip when the main control chip detects a system safety-related fault, prohibit the PWM control of the PWM signal buffer, and control the three-phase full-bridge circuit through the IGBT drive circuit to select to enter the corresponding safety state.

[0037] Preferably, an anti-reverse isolation diode is also connected to the output end line of the main safety logic circuit.

[0038] like Figure 1 As shown, in this embodiment, the above-mentioned safety state processing circuit specifically includes: PWM control enable input PWM_EN, fast safety state control signals (FSH_1 and FSL_1), PWM signal buffer U1, IGBT drive circuit U2, main safety logic circuit U5, anti-reverse isolation diodes (D4, D5, D6, D7, D8, D9) and actuator three-phase full-bridge circuit U11;

[0039] The PWM control enable signal PWM_EN, the PWM signal buffer U1 and the IGBT drive circuit U2 form a normal 6-channel PWM control path. When the system has no faults, PWM_EN enables the U1 output and performs normal 6-channel PWM control through U2.

[0040] The PWM control enable signal PWM_EN, the fast safety state control input signals FSH_1 and FSL_1, the main safety logic circuit U5, the anti-reverse isolation diodes (D4, D5, D6, D7, D8 and D9) and the IGBT drive circuit U2 together constitute the main safety state processing path; when a safety-related fault is detected in the system, PWM_EN prohibits the above 6 PWM control paths, and at the same time, PWM_EN logic is inverted and U5 is enabled, and the level state of FSH_1 and FSL_1 are judged to select and control the upper three bridge arms (G1, G2 and G3) or the lower three bridge arms (G4, G5 and G6) of the three-phase full bridge to enter a safe state (active three-phase short circuit or three-phase full bridge shutdown).

[0041] As a preferred implementation, the safety state processing circuit further includes a backup safety state processing path for operating when the main control chip fails, specifically:

[0042] The backup safety state processing path includes a backup safety logic circuit and a low-voltage side drive safety logic processing circuit connected in sequence, and the low-voltage side drive safety logic processing circuit is connected to the IGBT drive circuit.

[0043] The backup safety logic circuit is used to receive the main control chip status monitoring signal and the high-voltage overvoltage signal. When the main control chip status monitoring signal indicates that the main control chip fails, the backup safety logic circuit is activated, and the safety logic processing circuit is driven through the low-voltage side to prohibit the IGBT drive circuit from responding to the PWM control signal of the previous stage. The safety logic processing circuit is driven through the low-voltage side according to the high-voltage overvoltage signal to control the IGBT drive circuit, so that the three-phase full-bridge circuit selects to enter the corresponding safety state.

[0044] The main control chip status monitoring signal can be obtained through a monitoring chip or other monitoring circuits independent of the main control chip.

[0045] In this embodiment, the independent monitoring chip status input signal, the high-voltage overvoltage signal, the backup safety logic circuit U6 and the low-voltage side drive safety logic processing circuit U3 constitute a backup safety status processing path; when the independent monitoring chip detects a main control chip failure, it judges the state of the low-voltage side high-voltage overvoltage signal and independently controls the upper three bridge arms (G1, G2 and G3) or the lower three bridge arms (G4, G5 and G6) of the three-phase full bridge through U6 and U3 to enter a safe state (active three-phase short circuit or three-phase full bridge shutdown).

[0046] The chip status input signal and the high voltage overvoltage signal can be independently monitored by the backup safety logic U6 to independently output the safety status enable signal FSEN_L, the upper three bridge arm safety status control signal FSH_2 and the lower three bridge arm safety status control signal FSL_2.

[0047] The low-voltage side drive safety logic processing circuit U3 can effectively prohibit the IGBT drive circuit U2 from responding to the input side signals (PWMH_1, PWMH_3, PWMH_5, PWML_2, PWML_4, PWML_6).

[0048] As a preferred embodiment, the safety state processing circuit also includes a high-voltage side redundant safety state control path, which is used for the backup power supply to intervene in time and maintain the high-voltage side power supply of the drive circuit when the system low-voltage main power supply fails;

[0049] Specifically, the high-voltage side redundant safety state control path includes a fault logic processing circuit, a high-voltage side driving safety logic processing circuit, a high-voltage backup power supply and a switch tube. The fault logic processing circuit is respectively connected to the high-voltage side driving safety logic processing circuit and the gate of the switch tube. The high-voltage side driving safety logic processing circuit is also connected to the IGBT driving circuit. The source of the switch tube is connected to the high-voltage backup power supply. The drain of the switch tube is connected to the signal transmission line between the IGBT driving circuit and the three-phase full-bridge circuit. The high-voltage backup power supply is connected to the high-voltage side driving safety logic processing circuit.

[0050] The fault logic processing circuit is used to receive a high-voltage overvoltage signal and a low-voltage undervoltage signal, the voltage of the high-voltage backup power supply is lower than the high-voltage side voltage of the IGBT drive circuit; the low-voltage undervoltage signal is a low-voltage side power supply voltage signal of the IGBT drive circuit;

[0051] When the main power supply of the IGBT drive circuit is not powered off, the high-voltage backup power supply is in a light-load working mode. At this time, the voltage of the high-voltage backup power supply is lower than the high-voltage side voltage of the IGBT drive circuit, and the high-voltage backup power supply is not used for power supply; after the main power supply is powered off, the voltage on the rear side of the diode D10 is lower than the backup power supply voltage, and the high-voltage backup power supply can be supplied through D10.

[0052] The fault logic processing circuit enables the high-voltage side driving safety logic processing circuit according to the low-voltage undervoltage signal to output the current of the high-voltage backup power supply;

[0053] The fault logic processing circuit also performs detection based on the high-voltage overvoltage signal. If a high-voltage overvoltage is detected, the high-voltage side drive safety logic processing circuit is enabled to make the gate-level control signal on the output side of the IGBT drive circuit a high-impedance state; and after delay processing, the switch tube is turned on to control the three-phase full-bridge circuit to enter a corresponding safety state.

[0054] Preferably, the drain of the switch tube is connected to the signal transmission line between the IGBT drive circuit and the three-phase full-bridge circuit through an anti-reverse isolation diode, and the high-voltage backup power supply is connected to the high-voltage side drive safety logic processing circuit through an anti-reverse isolation diode.

[0055] Preferably, the safety state processing circuit further includes a signal isolation circuit, and the low voltage undervoltage signal is connected to the fault logic processing circuit through the signal isolation circuit to achieve signal isolation between the high voltage and the signal low voltage of the IGBT drive circuit.

[0056] Preferably, the safety state processing circuit further includes a high-voltage side overvoltage detection circuit, and the high-voltage side overvoltage detection circuit is used to detect the bus voltage and generate a high-voltage overvoltage signal.

[0057] In this embodiment, the low-voltage undervoltage signal input, the signal isolation circuit U10, the high-voltage side overvoltage detection circuit U7, the fault logic processing U8, the high-voltage side drive safety logic processing circuit U4, the high-voltage backup power supply U9, the PMOS switch tube Q1 and the anti-reverse isolation diodes (D1, D2, D3 and D10) together constitute a high-voltage side redundant safety state control path; when the system low-voltage main power supply fails, the backup power supply intervenes in time and maintains the high-voltage side power supply of the drive circuit, judges the high-voltage overvoltage signal state and enables U4 and controls the conduction or shutdown of Q1 to make the system enter a safe state (active three-phase short circuit or three-phase full-bridge shutdown).

[0058] The high-voltage backup power supply U9, the switch tube Q1 and the anti-reverse isolation diodes (D1, D2, D3 and D10) realize redundant high-voltage side drive power supply control; U9 maintains a light-load working state when the low-voltage main power supply is not powered off, and the output voltage is slightly lower than the working voltage of the main power supply (+15V). When the main power supply is powered off, U9 outputs the backup power supply in time and supplies power to U4 through D10 to ensure the normal operation of the high-voltage side drive safety logic processing circuit.

[0059] The high-voltage side driving safety logic processing circuit U4 can effectively prohibit the IGBT driving circuit U2 from responding to the input side signals (PWMH_1, PWMH_3, PWMH_5, PWML_2, PWML_4, PWML_6), and make the output side signal of U2 a high impedance state.

[0060] By arbitrarily combining the above preferred implementation modes, a better implementation mode can be obtained. An optimal implementation mode is described in detail below.

[0061] A safety state processing circuit for an electric vehicle motor controller is described below in conjunction with the accompanying drawings. Figure 1 As shown, PWM_EN, FSH_1, FSL_1 and low voltage undervoltage signal are control signals from the main control chip, 6-PWMs are IGBT drive control signals output by the main control chip, U1 is a PWM signal buffer, U2 is an IGBT drive circuit, U3 is a low voltage side drive safety logic processing circuit, U4 is a high voltage side drive safety logic processing circuit, U11 is an actuator three-phase full-bridge circuit, U5 is a main safety logic circuit, U6 is a backup safety logic circuit, U7 is a high voltage overvoltage detection circuit, U9 is a high voltage backup power supply, and U10 is a logic signal isolation circuit. U8 is a fault logic processing circuit, D1~D10 are anti-reverse isolation diodes, Q1 is a PMOS power switch tube, in addition, PWMH_1, PWMH_3, PWMH_5, PWML_2, PWML_4 and PWML_6 are PWM signals output from U1 to U2, FSEN_L, FSH_2 and FSL_2 are logic control signals output from U6 to U3, FSEN_H is the enable signal output from U8 to U4, G1~G6 are gate-level drive signals of the three-phase full-bridge circuit, and 5V_H is the power supply for the high-voltage side detection circuit and logic processing circuit of the drive circuit.

[0062] The main safety path of the safety state processing circuit: PWM_EN, FSH_1 and FSL_1 are connected to the input of U5; the output of U5 is connected to the anodes of D4~D9; the cathodes of D4~D9 are respectively connected to the low-voltage side input of U2 (PWMH_1, PWMH_3, PWMH_5, PWML_2, PWML_4 and PWML_6); the high-voltage side output of U2 is connected to the gate-level control terminals G1~G6 of U11.

[0063] Backup safety path of the safety state processing circuit: the status signal of the independent monitoring chip and the high voltage overvoltage signal are connected to the input of U6; the output signals FSEN_L, FSH_2 and FSL_2 of U6 are connected to U3.

[0064] High-voltage side redundant safety path of the safety state processing circuit: the high-voltage side logic power supply 5V_H of the driving circuit is connected to the high-voltage side of U4, U7, U8 and U10; the low-voltage undervoltage signal and the high-voltage overvoltage signal are connected to the input of U8; one output signal FSEN_H of U8 is connected to U4; another output signal of U8 is connected to the gate-level control terminal of Q1; one power output of U9 is connected to the power supply terminal of U4 via D10; another power output of U9 is connected to the source of Q1, and the drain of Q1 is connected to the anodes of D1, D2 and D3; the cathodes of D1, D2 and D3 are connected to the gate-level control terminals G4, G5 and G6 of U11 respectively.

[0065] The working principle of the safety state processing circuit of the electric vehicle motor controller is explained below:

[0066] 1. During normal PWM control, PWEM_EN enables U1 to output conditioned 6-way PWM control signals, and outputs gate-level control signals (G1-G6) through the IGBT drive circuit U2 to control the on and off of the three-phase full-bridge power circuit U11.

[0067] 2. When the main control chip detects a system fault, the output of U1 is disabled through PWM_EN, and the main safety logic circuit U5 is enabled. The main control chip sets the levels of FSH_1 and FSL_1 according to the fault status and the status of the IGBT drive circuit. U5 sets the PWM signal level at the input of U2 through D4, D5, D6 or D7, D8, D9 according to different level combinations of FSH_1 and FSL_1, and then outputs the corresponding gate-level control signal through U2 to make U11 enter the safe state of active short circuit of the three phases of the upper three bridge arms or active short circuit of the three phases of the lower three bridge arms or three-phase full-bridge shutdown.

[0068] 3. Use an independent hardware monitoring unit to monitor the main control chip. When a failure state is detected, the backup safety logic U6 is activated. U6 outputs FSEN_L to enable the low-voltage side drive safety logic processing circuit U3. After U3 is enabled, U2 is immediately prohibited from responding to the PWM control signal of the previous stage. U6 sets the levels of FSH_2 and FSL_2 according to the high-voltage overvoltage signal. FSH_2 and FSL_2 set the gate-level control signal of U11 through U3, so that U11 chooses to enter the safe state of active short circuit of the three-phase of the lower three-bridge arm or shutdown of the three-phase full-bridge.

[0069] 4. When the main control power supply is working normally, the output voltage +15V_Backup of the high-voltage backup power supply is slightly lower than the high-voltage side main power supply +15V. The anti-reverse isolation diode D10 ensures that U9 maintains light load operation under normal working conditions. When the main power supply fails, U9 quickly intervenes through D10 to provide power to the high-voltage side of the driver, ensuring the normal operation of the high-voltage side driver safety logic processing circuit U4.

[0070] 5. The +15V power supply on the high-voltage side of the driving circuit is converted into 5V_H through the internal power supply of the driving circuit to provide a stable logic power supply to the high-voltage side detection circuit and the high-voltage side fault logic processing circuit, ensuring that the high-voltage side can effectively process the fault logic and enter a safe state.

[0071] 6. After the main control power supply fails, the low-voltage side circuit cannot work, and the above-mentioned safety state processing circuits 2 and 3 fail. U9 quickly intervenes to supply power, and 5V_H maintains the power supply to U10, U7 and U8. If high-voltage overvoltage is detected, U8 immediately enables the high-voltage side drive safety logic processing circuit U4 through FSEN_H, and makes the gate-level control signal of the drive circuit output side high-impedance state, and then FSEN_H controls the switch tube Q1 to turn on after delay processing, and the 15V_Backup power supply sets the gate-level control signals G4, G5 and G6 of the three lower bridge arms of U11 to high through D1, D2 and D3, so that the system enters the safety state of active short circuit of the three phases of the lower three bridge arms; if high-voltage overvoltage is not detected, Q1 is turned off to switch U11 to the safety state of three-phase full-bridge shutdown.

[0072] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A safety state processing circuit for an electric vehicle motor controller, characterized in that: It includes a main safety state processing path, which includes a main safety logic circuit and a PWM signal buffer, an IGBT drive circuit and a three-phase full-bridge circuit connected in sequence, and the output signal of the main safety logic circuit is connected to the signal transmission line between the PWM signal buffer and the IGBT drive circuit; The PWM signal buffer is used to receive the control signal of the main control chip to perform PWM control; the main safety logic circuit is used to receive the control signal of the main control chip when the main control chip detects a system safety-related fault, prohibit the PWM control of the PWM signal buffer, and control the three-phase full-bridge circuit through the IGBT drive circuit to select to enter the corresponding safety state; The safety state processing circuit also includes a high-voltage side redundant safety state control path, which includes a fault logic processing circuit, a high-voltage side drive safety logic processing circuit, a high-voltage backup power supply and a switch tube. The fault logic processing circuit is connected to the gate of the high-voltage side drive safety logic processing circuit and the switch tube respectively. The high-voltage side drive safety logic processing circuit is also connected to the IGBT drive circuit. The source of the switch tube is connected to the high-voltage backup power supply. The drain of the switch tube is connected to the signal transmission line between the IGBT drive circuit and the three-phase full-bridge circuit. The high-voltage backup power supply is connected to the high-voltage side drive safety logic processing circuit. The fault logic processing circuit is used to receive a high-voltage overvoltage signal and a low-voltage undervoltage signal, the voltage of the high-voltage backup power supply is lower than the high-voltage side voltage of the IGBT drive circuit; the low-voltage undervoltage signal is a low-voltage side power supply voltage signal of the IGBT drive circuit; The fault logic processing circuit enables the high-voltage side driving safety logic processing circuit according to the low-voltage undervoltage signal to output the current of the high-voltage backup power supply; The fault logic processing circuit also performs detection based on the high-voltage overvoltage signal. If a high-voltage overvoltage is detected, the high-voltage side drive safety logic processing circuit is enabled to make the gate-level control signal on the output side of the IGBT drive circuit a high-impedance state; and after delay processing, the switch tube is turned on to control the three-phase full-bridge circuit to enter a corresponding safety state.

2. The safety state processing circuit of the electric vehicle motor controller according to claim 1, characterized in that: An anti-reverse isolation diode is also connected to the output end line of the main safety logic circuit.

3. The safety state processing circuit of the electric vehicle motor controller according to claim 1, characterized in that: The control signal of the main control chip received by the main safety logic circuit includes a PWM control enable signal and a fast safety state control signal. The main safety logic circuit prohibits the PWM control of the PWM signal buffer according to the PWM control enable signal, controls the three-phase full-bridge circuit through the IGBT drive circuit according to the fast safety state control signal, and selects to enter the corresponding safety state.

4. The safety state processing circuit of the electric vehicle motor controller according to claim 1, characterized in that: The safety state processing circuit further includes a spare safety state processing path, the spare safety state processing path includes a spare safety logic circuit and a low-voltage side driving safety logic processing circuit connected in sequence, and the low-voltage side driving safety logic processing circuit is connected to the IGBT driving circuit; The backup safety logic circuit is used to receive the main control chip status monitoring signal and the high-voltage overvoltage signal. When the main control chip status monitoring signal indicates that the main control chip fails, the backup safety logic circuit is activated, and the safety logic processing circuit is driven through the low-voltage side to prohibit the IGBT drive circuit from responding to the PWM control signal of the previous stage. The IGBT drive circuit is controlled according to the high-voltage overvoltage signal through the low-voltage side drive safety logic processing circuit, so that the three-phase full-bridge circuit selects to enter the corresponding safety state.

5. The safety state processing circuit of the electric vehicle motor controller according to claim 4, characterized in that: The standby safety logic circuit outputs a safety state enable signal, an upper three-bridge arm safety state control signal, and a lower three-bridge arm safety state control signal. The low-voltage side drive safety logic processing circuit prohibits the IGBT drive circuit from responding to the previous stage PWM control signal according to the safety state enable signal, and controls the IGBT drive circuit according to the upper three-bridge arm safety state control signal and the lower three-bridge arm safety state control signal, thereby enabling the three-phase full-bridge circuit to select and enter the corresponding safety state.

6. The safety state processing circuit of the electric vehicle motor controller according to claim 1, characterized in that: The safety state processing circuit also includes a high-voltage side overvoltage detection circuit, which is used to detect the bus voltage and generate the high-voltage overvoltage signal.

7. The safety state processing circuit of the electric vehicle motor controller according to claim 1, characterized in that: The fault logic processing circuit includes a logic combination unit, a filtering unit and a delay processing unit.

8. The safety state processing circuit of the electric vehicle motor controller according to claim 1, characterized in that: The drain of the switch tube is connected to the signal transmission line between the IGBT drive circuit and the three-phase full-bridge circuit through an anti-reverse isolation diode.

9. The safety state processing circuit of the electric vehicle motor controller according to claim 1, characterized in that: The safety state processing circuit further includes a signal isolation circuit, and the low-voltage undervoltage signal is connected to the fault logic processing circuit through the signal isolation circuit.

Images