Control device, electric drive system and method for setting a safe operating state

Abstract

The invention relates to setting a speed-dependent safe operating state. For this purpose, two redundant control paths are provided, which can each set a forced short circuit or an idling as a speed-dependent safe operating state. In this way, the speed-dependent safe operating state can be set completely even in the event of a control path failure.

Description

TECHNICAL FIELD

[0001] The invention relates to a control device for a converter, to an electric drive system and to a method for setting a safe operating state in an electric drive system. BACKGROUND

[0002] Electric drive systems are becoming increasingly important. Electric drive systems are present, inter alia, in vehicles which are driven electrically, completely or at least partially. Here, it is necessary for safety reasons to set a safe operating state in the event of a fault, in particular in the event of a fault in the control of a converter in such a drive system. As such a safe operating state, for example, an active short circuit or a so-called freewheeling is known. In the case of an active short circuit, the phase terminals of an electric machine are electrically short-circuited by means of switching elements in the converter. In contrast, in the freewheeling, all switching elements of the converter can be opened, so that the phase terminals of the electric machine are not electrically connected to one another.

[0003] The document DE 102011081173 A1 describes an operating state circuit for an inverter and a method for setting an operating state in an inverter. Here, inter alia, it is proposed that, as a safe operating state, the freewheeling is switched in the inverter when the rotational speed of the electric machine is less than a predetermined rotational speed threshold value, and the inverter is switched into the active short circuit when the rotational speed sought of the electric machine is greater than or equal to the predetermined threshold rotational speed. SUMMARY

[0004] The invention discloses a control device for a converter in an electric drive system, an electric drive system and a method for setting a safe operating state in an electric drive system. Further advantageous embodiments are the subject of preferred solutions.

[0005] It is therefore provided that a control device for a converter in an electric drive system has a first control path and a second control path. The first control path and the second control path are here each designed for setting a safe operating state in a converter of an electric drive system. The first control path comprises a first safety mechanism. The first safety mechanism is designed for ascertaining a rotational speed of an electric machine of the electric drive system. Furthermore, the first safety mechanism is designed for setting an active short circuit or a freewheeling in the converter using the rotational speed sought of the electric machine. The second control path comprises a second safety mechanism. The second safety mechanism is designed for ascertaining a rotational speed of an electric machine in the electric drive system. Furthermore, the second safety mechanism is designed for setting an active short circuit or a freewheeling in the converter using the rotational speed sought of the electric machine by means of the second safety mechanism.

[0006] It is also provided that an electric drive system has an electric machine, a converter designed for controlling the electric machine and a control device for the converter according to the invention.

[0007] Finally, it is provided that a method for setting a safe operating state in an electric drive system. The method comprises a first taking of a rotational speed of an electric machine of the electric drive system and a first setting of a safe operating state in the electric machine by means of a first control path. Here, the safe operating state is set using the taken rotational speed. Here, an active short circuit or freewheeling is set in a converter of the electric drive system depending on the taken rotational speed. Furthermore, the method comprises a second taking of a rotational speed of an electric machine of the electric drive system and a second setting of a safe operating state in the electric machine. The second taking of the rotational speed and the second setting of the safe operating state are here carried out by means of a second control path. Similar to the first setting of the safe operating state, the safe operating state is also set second using the taken rotational speed, wherein an active short circuit or freewheeling is set in a converter of the electric drive system.

[0008] The present application is based on the insight that different safe operating states in an electric drive system depending on the rotational speed of an electric machine are advantageous. Therefore, it can be advantageous to select a respective suitable safe operating state in dependence on the rotational speed. A further insight of the present application is that in the event of a fault of a conventional system there can not be sufficient information about the rotational speed of the electric machine available or the evaluation of the rotational speed information cannot be carried out in a suitable manner.

[0009] Therefore, the idea of the present application is to take this insight into account and to further improve the safety and reliability of an electric drive system, in particular for setting a safe operating state in dependence on the rotational speed. For this purpose, it is provided that the setting of the safe operating state in dependence on the rotational speed is carried out by means of two separate control paths. The two control paths here form two redundant control paths for setting the safe operating state in dependence on the rotational speed. In this way, if a fault occurs in one of the two control paths, a respective suitable safe operating state can also be reliably set.

[0010] By redundantly implementing the safe operating state in dependence on the rotational speed, a respective suitable safe operating state can also be set in the event of a fault in one of the two control paths. In this way, for example, it can be ensured that dangerous voltage peaks are avoided in the electric drive system if necessary. The occurrence of undesired high currents can also be avoided by a suitable selection of the respective safe operating state. Furthermore, by redundantly implementing the safe operating state in dependence on the rotational speed, it can also be prevented that an operating state is set which would generate an undesirably high deceleration torque if necessary.

[0011] Therefore, the redundant selection and setting of the safe operating state in dependence on the rotational speed leads to an increased safety. Furthermore, voltage peaks or current peaks can be avoided which would lead to a destruction or at least premature aging of the components involved.

[0012] According to an embodiment, the first safety mechanism and / or the second safety mechanism is designed to set an active short circuit in the converter, if the determined rotational speed of the electric machine exceeds a first threshold value. Additionally or alternatively, the respective safety mechanism can set an idling, if the determined rotational speed of the electric machine is below a second threshold value.

[0013] In particular, the second threshold value can be greater than the first threshold value. In this way, a hysteresis between the transition of the idling and the active short circuit can be achieved. The active short circuit can result in an active braking torque of the electric machine. This braking torque can lead to a strong deceleration, in particular at low rotational speeds, which can result in a loss of traction and thus in a dangerous driving situation, for example in an electric vehicle. On the other hand, at high rotational speeds in the idling, undesired high voltage peaks can occur, which can lead to a dangerous state within the drive system, in particular within the voltage converter.

[0014] According to an embodiment, the control device is designed to operate the converter having a plurality of half-bridges. Typically, a half-bridge having an upper switching element and a lower switching element is provided in the converter for each phase of the electric machine. Here, the first safety mechanism and the second safety mechanism can be designed to operate the switching elements in the respective half-bridges using the phase current in the corresponding phase in order to set the idling. This way, it can be ensured that, when transitioning to the idling, even in the absence of a connection to an electrical energy source, for example a traction battery in an electric vehicle, no brief overvoltage occurs in the intermediate circuit capacitor of the converter. For example, the phase current in the respective phase can be detected and monitored. Thus, the respective switching element can be operated at or near the zero crossing of the respective phase current, wherein the operation for setting the idling in particular comprises opening the switching element in the respective half-bridge.

[0015] According to an embodiment, the first safety mechanism and / or the second safety mechanism is designed to operate the switching elements in the respective half-bridge using the phase voltage in the corresponding phase in order to set the active short circuit. For example, the respective switching element can be switched on to a phase angle at which a current is received through the respective switching element even in a steady-state operation. Thereby, an excessively high overvoltage of the phase current and a correspondingly strong load of the respective switch can be avoided. In particular, in order to determine a suitable point in time for operating the respective switching element, the detected voltage time area of the respective phase can be taken into account. Thus, for example, when the voltage time area of the respective phase reaches half of its maximum value, the switching element can be switched in the half-bridge. If necessary, it can also be switched earlier, as this has no effect due to the negative current direction.

[0016] According to one embodiment, the first safety mechanism is designed to verify the determined rotational speed of the electric machine using the rotational speed determined by the second safety mechanism. Thus, the detection of the rotational speed of the electric machine by means of the first and second safety mechanisms enables a functional check of the individual components during operation. In particular, a fault in the determination of the rotational speed can be detected, for example, by comparing the rotational speeds determined in the safety mechanisms. Of course, the second safety mechanism can also verify the determined rotational speed using the rotational speed determined by the first safety mechanism.

[0017] According to one embodiment, the first control path is designed to be fed from the low-voltage side of the electric drive system. The second control path can be designed to be fed from the high-voltage side of the electric drive system. In this way, a high degree of independence of the two control paths can be achieved. For example, even in the event of a failure of the supply voltage on the low-voltage side and thus a complete failure of the first control path, a safe operating state, in particular a safe rotational speed-related operating state, can be set by means of the second control path.

[0018] According to one embodiment, the second safety mechanism is designed to set an idling as a safe operating state if the intermediate circuit voltage of the converter is below a predefined first threshold voltage. In particular, when an active short circuit should be selected on the basis of the determined rotational speed, an idling can also be selected as a safe operating state. In this way, the intermediate circuit voltage can be increased by briefly setting an idling and thus the energy supply of the second control path can be ensured.

[0019] According to one embodiment, the second safety mechanism is designed to set an active short circuit as a safe operating state if the intermediate circuit voltage of the converter exceeds a predefined second threshold voltage and the determined rotational speed is greater than a first threshold value. In this way, a dangerous overvoltage on the intermediate circuit capacitor can be avoided. The second threshold voltage can in particular be set such that the intermediate circuit voltage is always less than the voltage of an energy source that can be connected to the intermediate circuit capacitor, for example a traction battery of an electric vehicle.

[0020] According to one embodiment, the second safety mechanism is designed to determine the rotational speed of the electric machine during an active short circuit using the on-state voltage of the switching elements in the converter. In particular, the on-state voltage of the switching elements that are set to the active short circuit, i.e. the switching elements that are closed during the active short circuit, can be taken into account here. Thus, the rotational speed of the electric machine can be determined on the high-voltage side without additional components.

[0021] According to one embodiment, the second safety mechanism is designed to determine the rotational speed of the electric machine during idling using at least two phase voltages of the electric machine. The at least two phase voltages can be evaluated in particular with respect to a predefined reference potential. Thus, the rotational speed of the electric machine can also be determined on the high-voltage side during idling without additional components.

[0022] The design solutions and refinements described above can be combined with one another arbitrarily, as far as this makes sense. Other design solutions, refinements and embodiments of the application also include combinations of the features described previously or hereinafter with respect to the embodiments which are not explicitly mentioned. In particular, the person skilled in the art will also add individual aspects as refinements or supplements to the respective basic form of the application. BRIEF DESCRIPTION OF DRAWINGS

[0023] Further features and advantages of the application will be described hereinafter on the basis of the drawings.

[0024] Figure 1 A schematic diagram of a block diagram of an electric drive system according to one embodiment is shown;

[0025] Figure 2 A schematic diagram of a curve of the braking torque with respect to the rotational speed during active short-circuiting is shown;

[0026] Figure 3 A schematic diagram of a block diagram of a safety mechanism for a control mechanism according to one embodiment is shown; and

[0027] Figure 4 A flowchart, on which a method for setting a safety operating state according to one embodiment is based, is shown. DETAILED DESCRIPTION

[0028] Figure 1 A schematic diagram of a block diagram of an electric drive system according to one embodiment is shown. The electric drive system can be, for example, an electric drive system of a fully or at least partially electrically driven vehicle. The electric drive system can be fed by an electric energy store 1, for example a traction battery of an electric vehicle. The energy provided by the electric energy store 1 can be provided at the input terminals of a converter device 2, if necessary, by means of a battery disconnect switch 1a. The converter device 2 can comprise, for example, an inverter 30 having a plurality of switching elements. An intermediate circuit capacitor 31 can be provided, for example, on the input terminals of the inverter 30. The output terminals of the converter device 2 can be connected, in particular, to the output terminals of the inverter 30. An electric machine 3 can be connected to the output terminals of the inverter 30. The device shown here having a three-phase electric machine 3 is used here only as an example for better understanding. Of course, an electric machine 3 having any other number of electrical phases is also possible.

[0029] The inverter 30 can comprise, for example, for each phase of the electric machine 3, a half-bridge with upper switching elements H1, H2, H3 and lower switching elements L1, L2, L3. During normal operating operation of the electric drive system, the inverter 30, in particular the switching elements in the inverter 30, can be controlled by means of a control mechanism in the first control path 10 by control signals. For this purpose, in the control mechanism, for example, target value specifications of operating parameters of the drive system and, if necessary, also sensor signals can be received. On the basis of these target value specifications S and sensor values, the control mechanism can generate suitable control signals for controlling the upper switching elements H1, H2, H3 and the lower switching elements L1, L2 and L3.

[0030] The control mechanism in the first control path 10 can be, for example, a main computer which, during operation of the electric drive system, sends the required operating parameters and generates suitable control signals for controlling the inverter 30. In certain cases, for example when a fault is detected in the electric drive system, it can be necessary to set a so-called safe operating state in the electric drive system, in particular in the inverter 30. This safe operating state can be, for example, a so-called freewheeling, in which all switching elements H1, H2, H3 and L1, L2, L3 of the inverter 30 are open. Alternatively, as a secure operating state, a so-called active short circuit can be set, in which the phase terminals of the electric machine 3 are electrically connected to one another by means of the upper switching elements H1, H2, H3 or the lower switching elements L1, L2, L3.

[0031] As will also be explained in detail below, it can be determined on the basis of the current rotational speed of the electric machine 3 whether the freewheeling or the active short circuit is to be set as the choice of the safe operating state. For this purpose, a first safety mechanism 11 can be provided in the first control path 10, which determines the rotational speed of the electric machine 3. The determined rotational speed can be used to decide whether the active short circuit or the freewheeling is to be set as the safe operating state. For example, a threshold value for the rotational speed can be determined, and if the rotational speed exceeds this threshold value, the active short circuit is set as the safe operating state. Below this threshold value, the freewheeling can be set as the safe operating state. If the rotational speed of the electric machine 3 changes during the time for which the safe operating state is to be set, a hysteresis can be provided for the transition between the active short circuit and the freewheeling. In this case, a first threshold value n1 can be provided, above which the transition from the freewheeling to the active short circuit takes place. In addition, a second threshold value n2 can be provided, below which the transition from the active short circuit to the freewheeling takes place. Here, the rotational speed for the first threshold value n1 can be less than the rotational speed for the second threshold value n2.

[0032] Figure 2A diagram showing the change curve of the braking torque M of the electric machine 3 as a function of the rotational speed n during active short-circuiting is shown. As can be seen here, active short-circuiting can cause a strong braking torque, especially at low rotational speeds. This strong braking torque can lead to a loss of traction between the wheels and the road surface in an electric vehicle, for example. In order to avoid this dangerous driving situation, active short-circuiting is set only at higher rotational speeds, while idling is set as a safe operating state at lower rotational speeds. As further shown in Figure 2 The aforementioned hysteresis can be provided between the rotational speed for the first threshold value n1 and the rotational speed for the second threshold value n2. Here, when setting the safe operating state for the first time, it can be decided whether active short-circuiting or idling should be set, taking into account the first threshold value n1 or the second threshold value n2. Furthermore, in principle any other solution is also possible, for example a range of rotational speeds between n1 and n2.

[0033] In order to set the safe operating state in idling or active short-circuiting for the first time and also for the transition between active short-circuiting and idling, in particular the voltage and the current in the inverter 30, in particular on the switching elements H1, H2, H3, L1, L2, L3, can be taken into account. In particular, the following time points can be provided here for opening or closing the individual switching elements, which avoid an excessive increase in voltage and / or current in a suitable manner. Thus, for example, it can be advantageous to open the switching elements at the zero crossing of the current or at least in the vicinity of the zero crossing, in order to avoid voltage peaks.

[0034] If only the first control path 10 is provided for controlling the inverter 30, the setting of the safe operating state and in particular the rotational speed-dependent transition between active short-circuiting and idling can also be achieved by the first safety mechanism 11 alone. Furthermore, if necessary, additional components can be provided, which set a fixedly predefined safe operating state, for example active short-circuiting, when the first control path 10 fails completely. However, in this case, a rotational speed-dependent setting of the safe operating state is not possible when the first control path 10 fails.

[0035] Thus, in the electric drive system according to Figure 1 a second control path 20 with a second safety mechanism 21 is provided. This second safety mechanism 21 can also take the rotational speed of the electric machine 3 and, if necessary, in particular in the event of a fault, set a rotational speed-dependent safe operating state in the converter device 2, in particular in the inverter 30. Here, the concept of setting the safe operating state as a function of the rotational speed largely corresponds to the previously described solution for setting idling or active short-circuiting as a function of the current rotational speed of the electric machine 3.

[0036] The first control path 10 can be fed, for example, by a low-voltage network. Such a low-voltage network is, for example, a voltage supply device separate from or independent of the energy source 1. In particular, the voltage level of the low-voltage network can be lower than the voltage level of the high-voltage network with the energy source 1 feeding the electric drive system.

[0037] The second control path 20 can be fed, for example, by the high-voltage side of the electric drive system. In this way, a safe operating state can also be set in the second control path 20 by means of the second safety mechanism 21 in the event of a failure or disturbance on the low-voltage side of the electric drive system.

[0038] Figure 3 A schematic diagram of a block diagram of the safety mechanism 20 according to one embodiment is shown. The safety mechanism 21 can detect, for example, the voltage U_ph on the phase terminals of the electric machine 3. The first evaluation mechanism 22 can evaluate the phase voltages U_ph, in particular in idling, and determine the rotational speed of the electric machine 3 using the phase voltages U_ph. In addition, the phase current I_ph can be provided on the second safety mechanism 21. The second evaluation mechanism 22 can detect the phase current I_ph and determine the rotational speed of the electric machine 3 on the basis of the phase current I_ph, for example. The rotational speed can be determined, in particular, on the basis of the phase current I_ph in an active short circuit. The rotational speed determined by the first evaluation mechanism 22 and / or the second evaluation mechanism 23 can be provided at the processing mechanism 25. The processing mechanism 25 can thus determine the appropriate safe operating state from the rotational speed, respectively, and, if necessary, control the switching elements H1, H2, H3, L1, L2, L3 in the inverter 30 accordingly.

[0039] If the electrical energy source 1 is separated from the inverter device 2 by opening the battery disconnect switch 1a during a safe operating state in the electrical drive system, the intermediate circuit capacitor 31 at the input of the inverter 30 can discharge over time, especially in the case of an active short circuit. There is thus the risk that, in the case of a too deep discharge of the intermediate circuit capacitor 31, there is no longer sufficient energy for the supply of the safety mechanism 21 in the second control path 20. The safety mechanism 21 can thus monitor the intermediate circuit voltage U_ZK of the intermediate circuit capacitor 31 in the second control path 20. If the intermediate circuit voltage U_ZK on the intermediate circuit capacitor 31 falls below a predefined threshold voltage, a short-time transition into the freewheeling mode can be carried out even in the case of a high rotational speed. The intermediate circuit capacitor 31 can thus be charged further. However, in order to avoid an excessive voltage increase on the intermediate circuit capacitor 31 precisely in the case of a high rotational speed, a transition back into the active short circuit can be carried out again in the case of an exceeding of a second threshold voltage. The second threshold voltage should preferably be less than the voltage provided by the electrical energy accumulator 1 here. As a voltage value for the transition from the active short circuit into the freewheeling mode, for example, a voltage can be selected which corresponds to the pole wheel voltage in the freewheeling mode in the transition point for the rotational speed-dependent safety state.

[0040] In order to further increase the reliability of the electrical drive system, the rotational speed of the electrical machine 3 ascertained by the first safety mechanism 11 and the rotational speed of the electrical machine 3 ascertained by the second safety mechanism 21 can be compared with one another during normal operation of the electrical drive system. If a significant difference between the two ascertained rotational speeds is detected here, this can give an indication of a fault in at least one of the two safety mechanisms.

[0041] Figure 4 A schematic diagram of a flow chart of a method for setting a safe operating state in an electrical drive system is shown. The method can in principle comprise any steps, as has already been described previously in connection with the electrical drive system. Correspondingly, the electrical drive system, in particular the control device, can also comprise any suitable components, as will be described below in connection with the method.

[0042] The method comprises two parallel steps S1 and S2. Here, step S1 is carried out by the first control path 10 and step S2 is carried out by the second control path 20. As has already been described previously, the first control path 10 can be fed by a low-voltage electrical network and the second control path 20 can be fed by a high-voltage electrical network. In step S1, the rotational speed of the electrical machine 3 is ascertained S11. Subsequently, a safe operating state of the electrical machine can be set S12. Here, the safe operating state can be set in dependence on the rotational speed, i.e. using the ascertained rotational speed. In particular, an active short circuit or a freewheeling mode can be set in the inverter of the electrical drive system in dependence on the ascertained rotational speed.

[0043] Similarly, step S2 comprises a step S21 for determining the rotational speed of the electric machine and a step S22 for setting a safe operating state. Here, too, the safe operating state can be set using the rotational speed determined in step S21, wherein, as safe operating state, a freewheeling or an active short circuit can be set in relation to the rotational speed.

[0044] In summary, the application relates to setting a safe operating state in relation to the rotational speed. For this purpose, two redundant control paths are provided, which can each set an active short circuit or a freewheeling as safe operating state in relation to the rotational speed. In this way, the safe operating state in relation to the rotational speed can be set completely even in the event of a failure of the control paths.

Claims

1. Control device for a converter (30) in an electric drive system, the control device having: a first control path (10) and a second control path (20), which are each designed to set a safe operating state in a converter (30) of the electric drive system, the first control path (10) comprising a first safety mechanism (11) which is designed to determine the rotational speed of an electric machine (3) of the electric drive system and to set an active short circuit or freewheeling in the converter (30) using the determined rotational speed of the electric machine (3); and wherein the second control path (20) comprises a second safety mechanism (21) which is designed to determine the rotational speed of an electric machine (3) of the electric drive system and to set an active short circuit or freewheeling in the converter (30) using the determined rotational speed of the electric machine (3), wherein the first safety mechanism (11) is designed to verify the determined rotational speed of the electric machine (3) using the rotational speed determined by the second safety mechanism (21), wherein the first control path (10) is designed to be fed from a low-voltage side of the electric drive system and the second control path (20) is designed to be fed from a high-voltage side of the electric drive system. The first safety mechanism (11) and / or the second safety mechanism (21) is designed to set an active short circuit in the converter (30) if the determined rotational speed of the electric machine (3) exceeds a first threshold value (n1) and to set a freewheeling if the determined rotational speed of the electric machine (3) is below a second threshold value (n2). wherein The control device is designed to control a converter (30) having a plurality of half-bridges, and wherein the first safety mechanism (11) and / or the second safety mechanism (21) is designed to control a switching element (L1, L2, L3, H1, H2, H3) in each half-bridge using a phase current in the corresponding phase in order to set a freewheeling. The control device is designed to control a converter (30) having a plurality of half-bridges, and wherein the first safety mechanism (11) and / or the second safety mechanism (21) is designed to control a switching element (L1, L2, L3, H1, H2, H3) in each half-bridge using a phase voltage in the corresponding phase in order to set an active short circuit. The second safety mechanism (21) is designed to set the freewheeling as a safe operating state if an intermediate circuit voltage of the converter (30) is below a predefined first threshold voltage. The second safety mechanism is designed to set the active short circuit as a safe operating state if the intermediate circuit voltage of the converter exceeds a predefined second threshold voltage and the determined rotational speed is greater than the first threshold value.

2. The control device of claim 1, wherein, ​ 3. The control device according to claim 1 or 2, wherein ​ 4. The control device according to claim 1 or 2, wherein ​ 5. The control device according to claim 1 or 2, wherein ​ 6. The control device of claim 5, wherein, ​ 7. The control device according to claim 1 or 2, wherein The second safety mechanism (21) is designed to determine the rotational speed of the electric machine (3) using the through-flow voltage of the switching elements in the converter (30) during active short-circuiting.

8. The control device according to claim 1 or 2, wherein The second safety mechanism (21) is designed to determine the rotational speed of the electric machine (3) during idling using at least two phase voltages of the electric machine (3).

9. An electric drive system having: an electric machine (3); a converter (30) designed to operate the electric machine (3); and a control device according to one of claims 1 to 8.

10. A method for setting a safe operating state in an electric drive system, the method having the following steps: The rotational speed of the electric machine (3) of the electric drive system is ascertained (S11) and a safe operating state is set (S12) in the electric machine (3) by means of a first control path (10), wherein setting (S12) of the safe operating state by a first safety mechanism (11) of a first operating path (10) setting an active short-circuit or idling in a converter (30) of the electric drive system using the determined rotational speed; and / or determining (S21) the rotational speed of an electric machine (3) of the electric drive system and setting (S22) a safe operating state in the electric machine (3) by means of a second operating path (20), wherein setting (S22) of the safe operating state is set by a second safety mechanism (21) of the second operating path (20) setting an active short-circuit or idling in a converter (30) of the electric drive system using the determined rotational speed, wherein the first safety mechanism (11) is designed to verify the determined rotational speed of the electric machine (3) using the rotational speed determined by the second safety mechanism (21), wherein the first operating path (10) is designed to be fed from a low-voltage side of the electric drive system and the second operating path (20) is designed to be fed from a high-voltage side of the electric drive system.

Images