Power module controller and driving control method of power module

Abstract

The application provides a power module controller and a driving control method of a power module, the power module controller comprising a micro control module, a logic processing module, a driving module and a peripheral power management module, the power module controller having a primary safety path, a secondary safety path and a tertiary safety path, and when a fault occurs, entering a safety state through the secondary safety path or the tertiary safety path.In the application, the micro control module and the peripheral power management module, which are two simple control chips, the logic processing module and the driving module, which are pure integrated circuit products, are combined to form a power module driving control scheme with multiple safety shutdown paths, so that pulse width modulation control can be realized in normal times, the driving module and the corresponding power module can enter a safety state when a fault occurs, and the safety and reliability of the power control product are improved; meanwhile, only simple control chips and a small number of logic electronic components are needed, the cost is low, the switching control speed is fast, and the stability and reliability are strong.

Description

Technical Field

[0001] This invention relates to the field of automotive control technology, specifically to a power module controller and a power module drive control method. Background Technology

[0002] High-voltage power modules are an important component of new energy vehicles, and power module controllers typically use DSPs or MCUs as control chips. With the development of new energy vehicles, the demand for core components is no longer limited to functional implementation, but also focuses on functional safety.

[0003] Traditional power module controllers rely on the control chip to output PWM waves to turn the circuit on or off. A more advanced approach involves configuring the control chip with a single safe shutdown path to disable the drive circuit. Both of these approaches rely on the control chip (MCU or DSP) to implement the shutdown function. When the chip experiences an internal fault, it becomes unreliable and should not be used to control the drive circuit.

[0004] To address this technical problem, the existing solutions are as follows: Existing technology one (CN 112297877 A) includes a shutdown control module, which is directly controlled by the main control chip. Even when the main control chip fails, the shutdown control module still controls the three-phase full-bridge drive circuit. Existing technology two (CN107910852B) includes two shutdown paths. The first shutdown path includes two contactors connected to the three phases of the vehicle motor, positioned between the UV phase and the VW phase, respectively. The output of the second shutdown path is connected to the IGBT of the vehicle motor. The shutdown control of the vehicle motor torque is achieved by controlling the opening and closing of the upper and lower three-bridges of the IGBT.

[0005] However, the safety shutdown control in the two schemes mentioned above requires the use of independent complex control chips or electrical control devices such as relays, which are relatively expensive. Furthermore, the switching control speed, stability, and reliability of independent electrical control devices need to be improved.

[0006] Therefore, there is an urgent need for a simple, efficient power module drive control technology solution with multiple safe shutdown paths. Summary of the Invention

[0007] In view of the shortcomings of the prior art described above, the present invention provides a power module drive control technology solution with multiple safety shutdown paths. Through a simple structural design of control chip and logic circuit, the status of control chip is monitored in real time. When the control chip fails, the drive circuit can be directly controlled to shut down by bypassing the control terminal of the control chip through an external device, thereby improving the safety and reliability of automotive power control products.

[0008] To achieve the above and other related objectives, the technical solution provided by this invention is as follows.

[0009] A power module controller, comprising:

[0010] Microcontroller module;

[0011] The logic processing module is electrically connected to the microcontroller module;

[0012] The driving module is electrically connected to the logic processing module and is used to drive the power module.

[0013] The peripheral power management module is electrically connected to the logic processing module, communicatively connected to the microcontroller module, and provides operating voltage to the microcontroller module, the logic processing module, and the drive module.

[0014] The power module controller has a primary safety path, a secondary safety path, and a tertiary safety path. The primary safety path is the pulse width modulation control path of the microcontroller module to the drive module after passing through the logic processing module. The secondary safety path is the safety state control path of the microcontroller module to the drive module after passing through the logic processing module. The tertiary safety path is the safety state control path of the peripheral power management module to the drive module after passing through the logic processing module.

[0015] When the power module controller is functioning normally, the drive module enters pulse width modulation control state through the first-level safety path; when the power module controller experiences a first-type fault, the drive module enters a safe state through the second-level safety path; when the power module controller experiences a second-type fault, the drive module enters a safe state through the third-level safety path.

[0016] Optionally, the peripheral power management module includes:

[0017] The power management and control unit receives the power supply voltage and converts it to obtain various specifications of operating voltage. It provides the operating voltage to the microcontroller module, the logic processing module, and the drive module. It is electrically connected to the logic processing module and communicatively connected to the microcontroller module.

[0018] The watchdog unit is communicatively connected to the power management and control unit and the microcontroller module, and is used to monitor the program flow of the primary security path and the secondary security path, and restart the microcontroller module that has failed and entered an infinite loop.

[0019] Optionally, the microcontroller module is also connected to a host computer for communication. The host computer sends a drive control command to the microcontroller module. After receiving the drive control command, the microcontroller module causes the drive module to enter the pulse width modulation control state through the primary safety path.

[0020] Optionally, the microcontroller module is also communicatively connected to the drive module, and the drive module has a fault self-diagnosis function. During power-on and operation, the drive module detects its own faults and feeds them back to the microcontroller module.

[0021] Optionally, the microcontroller module also collects the drive control data of the primary safety path and determines whether the power module controller has experienced the first type of fault based on the drive control data of the primary safety path; when the power module controller experiences the first type of fault, the microcontroller module enables the drive module to enter a safe state through the secondary safety path.

[0022] Optionally, the power management and control unit collects the drive control data of the secondary safety path and the operating data of the microcontroller module, and determines whether the power module controller has experienced the second type of fault based on the drive control data of the secondary safety path and the operating data of the microcontroller module; when the power module controller experiences the second type of fault, the power management and control unit enables the drive module to enter a safe state through the tertiary safety path.

[0023] Optionally, the drive control data of the primary safety path or the drive control data of the secondary safety path shall include at least: the temperature of the electronic components, the input DC voltage, and the inverter output AC voltage.

[0024] Optionally, the logic processing module includes a first logic processing unit, a second logic processing unit, and a third logic processing unit, which are arranged in parallel. The microcontroller module outputs a first pulse width modulation signal, a first enable signal, a first high-side safety signal, and a first low-side safety signal, and the power management and control unit outputs a power management signal. The first logic processing unit performs an AND operation on the first pulse width modulation signal and the first enable signal to obtain and output a second pulse width modulation signal to the driver module. The second logic processing unit performs an AND operation on the first high-side safety signal and the power management signal to obtain and output a second high-side safety signal to the driver module. The second logic processing unit performs a NAND operation on the overvoltage signal, the first low-side safety signal, and the power management signal to obtain and output a second low-side safety signal to the driver module. The third logic processing unit performs an AND operation on the first enable signal and the power management signal to obtain and output a second enable signal to the driver module.

[0025] Optionally, the first logic processing unit includes a two-input AND gate, the second logic processing unit includes a two-input AND gate and a three-input NAND gate, and the third logic processing unit includes a two-input AND gate.

[0026] Optionally, the driving module includes at least one driving chip, which is electrically connected to both the logic processing module and the power module. The driving chip drives and controls the power module under the control of the output signal of the logic processing module.

[0027] A method for driving and controlling a power module, comprising:

[0028] A power module and a power module controller are provided, wherein the power module controller has a primary safety path, a secondary safety path and a tertiary safety path;

[0029] The power module is electrically connected to the power module controller so that the power module can be driven and controlled by the power module controller.

[0030] The power module controller is monitored. If the power module controller is normal, the power module is controlled by pulse width modulation through the first-level safety path. If the power module controller experiences a first-type fault, the power module is put into a safe state through the second-level safety path. If the power module controller experiences a second-type fault, the power module is put into a safe state through the third-level safety path.

[0031] Optionally, the first type of fault includes at least the operational failure of the primary security path, and the second type of fault includes at least the operational failure of the secondary security path.

[0032] Optionally, when monitoring the power module controller, drive control data of the primary safety path is collected, and the power module controller is judged to have experienced a first-type fault based on the drive control data of the primary safety path.

[0033] Optionally, when monitoring the power module controller, the drive control data of the secondary safety path and the fault data of the control module in the power module controller are collected, and it is determined whether the power module controller has experienced a second type of fault based on the drive control data of the secondary safety path and the fault data of the control module in the power module controller.

[0034] The beneficial effects of this invention are as follows: The power module controller and power module drive control method of this invention are based on a power module controller formed by a microcontroller module, a logic processing module, a drive module, and a peripheral power management module. By combining the two simple control chips, the microcontroller module and the peripheral power management module, with pure integrated circuit products of the logic processing module and the drive module, a power module drive control technology solution with multiple safe shutdown paths is formed. It can realize pulse width modulation control under normal conditions and enable the drive module and the corresponding power module to enter a safe state in case of a fault, thereby improving the safety and reliability of the power control product. At the same time, it only requires simple control chips and a few logic electronic components, resulting in low cost, fast switching control speed, and strong stability and reliability.

[0035] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention. It is obvious that the drawings described below are merely some embodiments of the invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0037] Figure 1 This is a schematic diagram of the structure of a power module controller shown in an exemplary embodiment of the present invention;

[0038] Figure 2 This is an exemplary embodiment of the present invention. Figure 1 Circuit structure diagram of logic processing module 2;

[0039] Figure 3 This is a schematic diagram illustrating the triggering process of a primary security path according to an exemplary embodiment of the present invention;

[0040] Figure 4 This is a schematic diagram illustrating the triggering process of a secondary security path according to an exemplary embodiment of the present invention;

[0041] Figure 5 This is a schematic diagram illustrating the triggering process of a three-level security path according to an exemplary embodiment of the present invention;

[0042] Figure 6 This is a schematic diagram illustrating the steps of a power module drive control method according to an exemplary embodiment of the present invention. Detailed Implementation

[0043] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.

[0044] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0045] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0046] As described in the background section, the inventors have discovered that existing power module safety shutdown control requires independent, complex control chips or electrical control devices such as relays, resulting in relatively high costs. The slow switching speed of these electrical control devices may prevent the power module from entering a safe state in a timely manner, leading to uncontrollable hazards. Furthermore, the insufficient stability and reliability of these electrical control devices may prevent the power module from entering a safe state. Therefore, existing power module safety shutdown control technologies are relatively expensive and lack sufficient safety and reliability.

[0047] Based on this, the present invention proposes a power module drive control technology solution with multiple safe shutdown paths: combining a simple control chip and logic circuit, the status of the control chip is monitored in real time, and when the control chip fails, the drive circuit is directly controlled to shut down by bypassing the control terminal of the control chip through an external device, thereby improving the safety and reliability of power control products.

[0048] Specifically, embodiments of the present invention provide a power module controller and a power module drive control method, which will be described in detail below.

[0049] like Figure 1 As shown, in an exemplary embodiment of the present invention, a power module controller is provided, comprising:

[0050] Microcontroller module 1;

[0051] Logic processing module 2 is electrically connected to microcontroller module 1;

[0052] Drive module 3 is electrically connected to logic processing module 2 and is used to drive the power module;

[0053] The peripheral power management module 4 is electrically connected to the logic processing module 2, communicatively connected to the microcontroller module 1, and provides operating voltage to the microcontroller module 1, the logic processing module 2, and the driver module 3.

[0054] The power module controller has a first-level safety path, a second-level safety path and a third-level safety path. The first-level safety path is the pulse width modulation control path of the microcontroller module 1 to the drive module 3 after passing through the logic processing module 2. The second-level safety path is the safety state control path of the microcontroller module 1 to the drive module 3 after passing through the logic processing module 2. The third-level safety path is the safety state control path of the peripheral power management module 4 to the drive module 3 after passing through the logic processing module 2.

[0055] When the power module controller is functioning normally, the drive module 3 enters the pulse width modulation control state through the primary safety path; when the power module controller experiences a first-class fault, the drive module 3 enters the safe state through the secondary safety path; when the power module controller experiences a second-class fault, the drive module 3 enters the safe state through the tertiary safety path.

[0056] In detail, such as Figure 1 As shown, the peripheral power management module 4 includes:

[0057] The power management and control unit 41 receives the power supply voltage (not shown in the figure) and converts the power supply voltage to obtain various specifications of working voltage, providing working voltage for the microcontroller module 1, logic processing module 2 and drive module 3, and is electrically connected to the logic processing module 2 and communicatively connected to the microcontroller module 1.

[0058] The watchdog unit 42 is communicatively connected to the power management and control unit 41 and the microcontroller module 1. It is used to monitor the program flow of the primary security path and the secondary security path and restart the microcontroller module 1 that has failed and entered an infinite loop.

[0059] The peripheral power management module 4 can be a system base chip (SBC), a power management IC (PMIC), or a separate peripheral power management and control unit 41 and a separate watchdog unit 42. The following embodiments describe the integrated peripheral power management module 4. The control principle of the separate module is similar and will not be described in the embodiments.

[0060] In an optional embodiment of the present invention, the power management and control unit 41 can step down the voltage of a car battery, such as 14V, to obtain various operating voltages such as 1.25V, 1.3V, 3.3V, and 5V, so as to supply power to various electronic components in the microcontroller module 1, logic processing module 2, and drive module 3 and monitor the operating voltage.

[0061] In an optional embodiment of the present invention, the peripheral power management module 4 and the microcontroller module 1 are configured with a communication interface for signal interaction between the modules, including transmitting status information of the microcontroller module 1, transmitting fault information, and recording fault information; the peripheral power management module 4 is configured with a Reset interface, which monitors the microcontroller module 1 in real time through the watchdog unit 42. When the data in the registers and memory of the microcontroller module 1 is corrupted, causing the program pointer to fall into an infinite loop due to an error, the watchdog unit 42 is used to reset the microcontroller module 1 and erase the cold state fault.

[0062] In detail, in addition to the communication connection, the peripheral power management module 4 and the microcontroller module 1 are also electrically connected to transmit electrical signals and analog signals. It is equipped with output ports and input ports. The peripheral power management module 4 outputs analog signals and operating voltage to the microcontroller module 1.

[0063] In detail, the microcontroller module 1 is an integrated control chip that includes multiple functions such as logic self-test function, flash storage function and clock (OSC) function. It can be a microcontroller unit (MCU) or a single-chip microcomputer (SCM).

[0064] In detail, the microcontroller module 1 is also connected to a host computer (not shown in the figure). The host computer sends a drive control command to the microcontroller module 1. After receiving the drive control command, the microcontroller module 1 causes the drive module 3 to enter the pulse width modulation control state through the first-level safety path.

[0065] More in detail, such as Figures 1-2 As shown, in an optional embodiment of the present invention, the first-level security path is initiated by the microcontroller module 1 receiving a communication signal (transmitted by the host computer) and entering the working mode. The microcontroller module 1 outputs a first pulse width modulation signal (i.e., the first PWM signal) to the first logic processing unit 2a (i.e., the PWM transmission unit). The first logic processing unit 2a amplifies the signal through logic operations and outputs a stable second pulse width modulation signal (i.e., the second PWM signal) adapted to the driver chip. The second pulse width modulation signal controls the driver chip to operate, thus completing the normal control of the driver circuit.

[0066] In detail, the microcontroller module 1 is also connected to the drive module 3 (not shown in the figure). The drive module 3 has a fault self-checking function. During power-on and operation, the drive module 3 detects its own faults and feeds them back to the microcontroller module 1.

[0067] In detail, the microcontroller module 1 also collects the drive control data of the primary safety path and determines whether the power module controller has experienced a first-type fault based on the drive control data of the primary safety path; when the power module controller experiences a first-type fault, the microcontroller module 1 enables the drive module 3 to enter a safe state through the secondary safety path.

[0068] The secondary security path can be a monitoring unit of the primary security path.

[0069] More specifically, the microcontroller module 1 collects the drive control data of the primary safety path and performs backup or secondary calculation verification. The drive control data of the primary safety path can be information used for drive control, such as the temperature of electronic devices, the DC voltage at the input terminal, and the AC voltage at the inverter output. The microcontroller module 1 stores the collected information and determines and sets the threshold for the first type of fault. When the drive control data of the primary safety path triggers and reaches the preset fault threshold, the microcontroller module 1 transmits a safety signal to the logic processing module 2. The microcontroller module 1 then uses the secondary safety path to put the drive module 3 into a safe state.

[0070] In an optional embodiment of the present invention, such as Figure 2 As shown, the secondary safety path can also be configured with a first enable signal. If a system fault triggers the secondary safety path, the logic circuit inside the configured microcontroller module 1 and logic processing module 2 will process the logic circuit through the I / O ports to prevent the primary safety path from transmitting the second pulse width modulation signal, thus preventing the drive module 3 from continuing to respond to the control actions of the primary safety path.

[0071] In detail, the power management and control unit 41 collects the drive control data of the secondary safety path and the operating data of the microcontroller module 1, and determines whether the power module controller has a second type of fault based on the drive control data of the secondary safety path and the operating data of the microcontroller module 1; when the power module controller has a second type of fault, the power management and control unit 41 enables the drive module 3 to enter a safe state through the tertiary safety path.

[0072] The third-level security path can be the monitoring unit of the second-level security path. Simultaneously, the peripheral power management module 4 has a built-in watchdog unit 41 that monitors the program flow of the second-level and first-level security paths. It communicates with the microcontroller module 1 to receive feedback information from the microcontroller module 1, which may include fault information, power supply voltage information, etc. The output terminal is configured with a Reset signal to the microcontroller module 1. If the program flow of the microcontroller module 1 is faulty, a hot reset is attempted, but the process is quickly interrupted. If the system still reports a fault after the interruption, a cold reset is attempted, continuously pulling the Reset signal low so that the microcontroller module 1 cannot directly control the driver chip in the driver module 3. This indicates a fault in the microcontroller module 1, and the module bypasses the input terminal of the microcontroller module 1 and directly connects to the logic processing module 2, pulling the first enable signal low.

[0073] More specifically, the drive control data for the secondary safety path can be information used for drive control, such as the temperature of electronic devices, the DC voltage at the input terminal, and the AC voltage at the inverter output. The power management and control unit 41 stores the collected drive control data for the secondary safety path and determines and sets the threshold for the second type of fault. When the drive control data for the secondary safety path triggers and reaches the preset fault threshold, the power management and control unit 41 transmits a safety signal to the logic processing module 2. The power management and control unit 41 can also be configured to receive the operating data of the microcontroller module 1, especially the underlying fault information of the microcontroller module 1, which can be signal acquisition faults, logic signal processing faults, self-test faults, etc. The power management and control unit 41 can also be configured to receive the self-test faults of the peripheral power management module 4. When the power management and control unit 4 receives the underlying fault information of the microcontroller module 1 and the fault information of the peripheral power management module 4, the power management and control unit 41 pulls the electrical signal low to put the drive module 3 into a safe state according to the tertiary safety path.

[0074] In detail, such as Figures 1-2 As shown, the logic processing module 2 includes a first logic processing unit 2a, a second logic processing unit 2b, and a third logic processing unit 2c, which are arranged in parallel.

[0075] More in detail, such as Figure 2 As shown, the microcontroller module 1 outputs a first pulse width modulation signal (i.e., the first PWM signal), a first enable signal, a first high-side safety signal, and a first low-side safety signal; the power management and control unit 41 outputs a power management signal; the first logic processing unit 2a performs an AND operation on the first pulse width modulation signal (i.e., the first PWM signal) and the first enable signal to obtain and output a second pulse width modulation signal (i.e., the second PWM signal) to the drive module 3; the second logic processing unit 2b performs an AND operation on the first high-side safety signal and the power management signal to obtain and output a second high-side safety signal to the drive module 3; the second logic processing unit 2b performs a NAND operation on the overvoltage signal, the first low-side safety signal, and the power management signal to obtain and output a second low-side safety signal to the drive module 3; the third logic processing unit 2c performs an AND operation on the first enable signal and the power management signal to obtain and output a second enable signal to the drive module 3.

[0076] More specifically, in an optional embodiment of the invention, such as Figure 2 As shown, the first logic processing unit 2a includes a two-input AND gate, the second logic processing unit 2b includes a two-input AND gate and a three-input AND gate, and the third logic processing unit 2c includes a two-input AND gate.

[0077] More in detail, such as Figure 2 As shown, the first logic processing unit 2a serves as the logic circuit control unit of the first-level security path. The first logic processing unit 2a performs an AND operation on the first pulse width modulation signal and the first enable signal. Only when the first enable signal is high can the first logic processing unit 2a output the second pulse width modulation signal to control the normal operation of the driver chip in the driver module 3.

[0078] More in detail, such as Figure 2As shown, the second logic processing unit 2b acts as the logic circuit control unit for the secondary safety path. At this time, the power management signal is low. The second logic processing unit 2b performs an AND operation on the first high-side safety signal and the power management signal to obtain and output the second high-side safety signal to the drive module 3. The second logic processing unit 2b also performs a NAND operation on the overvoltage signal, the first low-side safety signal, and the power management signal to obtain and output the second low-side safety signal to the drive module 3. Outputting the second low-side safety signal and the second high-side safety signal to the drive module 3 controls the drive chip to enter the preset safety state. The second high-side safety signal and the second low-side safety signal are used by the drive chip in the drive module 3 to control the drive circuit to enter the safety state of the upper or lower bridge arm.

[0079] Optionally, an additional logic circuit unit can be configured, which consists of AND gates and is consistent with the input signal received by the second logic processing unit 2b above, outputting a second low-side safety signal to avoid signal conflicts. Alternatively, a NOT gate can be configured to achieve the same effect.

[0080] Meanwhile, the second logic processing unit 2b can detect overvoltage signals. These overvoltage signals are output by the hardware overvoltage acquisition circuit. The second logic processing unit 2b can determine whether there is an overvoltage in the hardware to decide which safe state channel to enter, thus protecting the power module. Besides being detected by the logic circuit, the overvoltage signal can also be processed by the microcontroller module 1 to achieve the same purpose.

[0081] More in detail, such as Figure 2 As shown, the second logic processing unit 2b and the third logic processing unit 2c serve as the logic circuit control unit for the three-level safety path. When the three-level safety path is triggered, they pull up the power management signal and output the second low-side safety signal and the second high-side safety signal to the drive module 3, thereby controlling the drive chip to enter the preset safety state.

[0082] More in detail, such as Figure 2 As shown, a second enable signal can also be configured. The input terminals of the second enable signal are the power management signal and the first enable signal, which serve as the input signal to the driver chip to control whether the driver chip can start working. This signal can be flexibly used according to the actual strategy or needs.

[0083] It should be noted that logic processing module 2 is not limited to, for example, Figure 2 The logic AND gate shown can also include NOT gates, OR gates and other logic components. They can be freely combined according to the actual project, which is highly flexible. However, the purpose is to make the signal more stable and enable the system to enter the preset safe state.

[0084] In detail, such as Figure 1As shown, the driving module 3 includes at least one driving chip, which is electrically connected to both the logic processing module 2 and the power module (not shown in the figure). The driving chip drives and controls the power module under the control of the output signal of the logic processing module 2. The number of driving chips in the driving module 3 can be configured according to actual needs, and can be 1 or n, where n is an integer greater than or equal to 2.

[0085] More in detail, such as Figure 3 The diagram shows the primary safety path triggering process of the power module controller in this invention. The specific triggering process includes:

[0086] Step S100: Detect the operation control request via communication;

[0087] In a practical embodiment, after receiving power supply or communication wake-up system, the input terminal of microcontroller module 1 detects the vehicle control request. The vehicle's communication request is generally a communication protocol (CAN). When a communication signal is detected, control information is responded to.

[0088] Step S101: Output the first PWM signal;

[0089] After receiving the control request, the microcontroller module 1 processes the communication signal and converts it into a first PWM signal, which is then transmitted to the first logic processing unit 2a.

[0090] Step S102: Detect the first enable signal;

[0091] The microcontroller module 1 and the power management and control unit 41 have fault acquisition functions. When the secondary safety path and the tertiary safety path are triggered, the microcontroller module 1 pulls down the first enable signal.

[0092] Step S103: Lock the PWM signal;

[0093] The first logic processing unit 2a receives a low-level first enable signal and locks the PWM signal output.

[0094] Step S104: Output the second PWM signal;

[0095] The first logic processing unit 2a receives a high-level first enable signal and outputs the second PWM signal normally.

[0096] Step S105: Determine the second enable signal;

[0097] The driver module 3 receives a second enable signal, which in this embodiment is narrowly defined as a signal used to determine whether to enter a secondary or tertiary security path.

[0098] Step S106: Lock into control state;

[0099] If the second enable signal is high, it is determined that the secondary or tertiary security path has been entered, and the drive module 3 is locked to prevent it from entering the control state.

[0100] Step S107: Enter control state.

[0101] If the second enable signal is low, it is determined that normal driving and controllable state can be entered.

[0102] More in detail, such as Figure 4 The diagram shows the secondary safety path triggering process of the power module controller in this invention. The specific triggering process includes:

[0103] Step S200: Real-time detection system of microcontroller module;

[0104] After receiving power supply or communication wake-up system, the input terminal of microcontroller module 1 detects the vehicle control request. The vehicle's communication request is generally a communication protocol (CAN). When a communication signal is detected, it responds with control information or performs a self-test or detects system faults.

[0105] Step S201: Has a fault preset by the secondary security path been detected?

[0106] The microcontroller module 1 can preset the faults that can be triggered by the secondary safety path, which are the first type of faults of the power module controller, such as system over-temperature, system over-voltage, partial communication frame loss or errors, etc. The microcontroller module 1 detects the preset faults of the secondary safety path in real time. If the preset faults are not detected, it returns to step S200 to continue monitoring the system.

[0107] Step S202: Pull the first enable signal low;

[0108] If the microcontroller module 1 detects a fault preset in the secondary safety path, it pulls down the first enable signal, preventing the first safety path from outputting a PWM signal, and returns to step S103 to lock the PWM output.

[0109] Step S203: Is a bridge arm fault detected?

[0110] The microcontroller module 1 receives bridge arm fault / drive fault signals from the drive module 3 at its input terminal. Based on the feedback fault information, the system enters a preset safety channel to ensure system safety.

[0111] Depending on the actual chip or MOSFET used, if the number of driver chips is less than 2, the bridge arm fault / drive fault signal can be ignored before entering the preset safety channel.

[0112] Steps S204 and S205: Input the first low-side security signal / Output the second high-side security signal;

[0113] The driver module 3 communicates with the microcontroller module 1 via SPI or CAN communication. If the microcontroller module 1 receives a lower bridge arm fault signal from the driver module 3, it outputs a first high-side safety signal.

[0114] If the microcontroller module 1 does not receive a drive fault signal from the drive module 3 or receives a fault in the upper bridge arm, it outputs the first low-side safety signal.

[0115] Steps S206 and S207: Detect power management signals;

[0116] The logic processing module 2 receives the power management signal transmitted by the peripheral power management module 4 at its input terminal, configures the logic gate circuit to judge the power management signal, and determines whether to enter the third-level security path or continue the second-level security path process.

[0117] Step S208: Enter the third-level security path;

[0118] If the input terminal of the logic processing module 2 receives a power management signal transmitted by the peripheral power management module 4, it enters the three-level safety path and jumps back to step S301 to detect the fault preset by the three-level safety path.

[0119] Steps S209 and S210: Output the second low-side security signal / Output the second high-side security signal;

[0120] The logic processing module 2 receives the first low-side safety signal from step S204 and the first high-side safety signal from step S205 at its input terminal, and makes a judgment based on the power management signal from step S208 through the logic circuit.

[0121] If no power management signal is detected, logic processing module 2 receives the first low-side safety signal and outputs the second low-side safety signal.

[0122] If no power management signal is detected, logic processing module 2 receives the first high-side safety signal and outputs the second high-side safety signal.

[0123] Steps S211 and S212: Determine the second enable signal;

[0124] The input terminal of the driver module 3 receives the second enable signal transmitted by the logic processing module 2.

[0125] If the driver module 3 receives a low level second enable signal, it returns to step S107 and enters the control state.

[0126] Step S213: Enter the preset safety state.

[0127] If the driver module 3 receives a high-level second enable signal, it determines the second high-side safety signal and the second low-side safety signal, and causes the system to enter a preset safety state.

[0128] More in detail, such as Figure 5 The diagram shows the three-level safety path triggering process of the power module controller in this invention. The specific triggering process includes:

[0129] Step S300: Real-time detection system for peripheral power management module;

[0130] The peripheral power management module 4 is used to detect the faults preset in the three-level safety path, namely the second type of fault of the power module controller, such as detecting partial system faults, signal faults, and microcontroller module 1 body faults.

[0131] Step S301: Has a fault preset in the three-level security path been detected?

[0132] If the peripheral power management module 4 fails to detect the fault preset by the three-level safety path, the feedback step S300 will continuously monitor the system.

[0133] If the peripheral power management module 4 detects a fault preset in the three-level safety path, it pulls down the first enable signal to prevent the first safety path from outputting the PWM signal, returns to step S103, and locks the PWM output.

[0134] Step S303: Pull the power management signal low;

[0135] The peripheral power management module 4 detected a fault preset in the three-level safety path and raised the power management signal, preventing the system from entering the first-level and second-level safety paths.

[0136] Step S304: Determine the overvoltage signal;

[0137] The input terminal of logic processing module 2 receives the overvoltage signal output by the hardware overvoltage comparison circuit.

[0138] By detecting overvoltage signals, the system protects the safety of its power devices and allows the system to enter a preset safety channel.

[0139] Step S305: Output the second high-side security signal and the second low-side security signal;

[0140] The logic circuit of logic processing module 2 judges the overvoltage signal and the input first low-voltage safety signal and first high-side safety signal, and outputs the second high-side safety signal and the second low-side safety signal.

[0141] In an optional embodiment of the present invention, the safety channels are divided into two categories: if the system is over-voltage, the second high-side safety signal and the second low-side safety signal are controlled to make the system enter the first type of safety channel; if the system is not over-voltage, the second high-side safety signal and the second low-side safety signal are controlled to make the system enter the second type of safety channel.

[0142] Step S306: Determine the second enable signal;

[0143] The input terminal of the driver module 3 receives the second enable signal transmitted by the logic processing module 2.

[0144] If the driver module 3 receives a low level second enable signal, it returns to step S107 and enters the control state.

[0145] Step S307: Enter the preset safety state.

[0146] If the driver module 3 receives a high-level second enable signal, it determines the second high-side safety signal and the second low-side safety signal, causing the system to enter a preset safety state.

[0147] In the aforementioned power module controller, a three-level safety path is formed by combining a simple control chip and logic circuit. When the power module controller is normal, the drive module 3 enters the pulse width modulation control state through the first-level safety path. When the power module controller experiences a first-type fault, the drive module 3 enters a safe state through the second-level safety path. When the power module controller experiences a second-type fault, the drive module 3 enters a safe state through the third-level safety path. Through the two-level acquisition, logic self-test, and judgment of the microcontroller module 1 and the peripheral power management module 4, the status of the control chip (microcontroller module 1 and peripheral power management module 4) can be monitored in real time. When the control chip (such as microcontroller module 1) fails, other modules such as peripheral power management module 4 and logic processing module 2 bypass the control terminal of the control chip and directly control the drive circuit to enter a safe state, improving the safety and reliability of the power control product. At the same time, it only requires a simple control chip and a few logic electronic components, resulting in low cost, fast switching control speed, and strong stability and reliability.

[0148] Based on the design concept of the power module controller described above, such as Figure 6 As shown, in another exemplary embodiment of the present invention, a driving control method for a power module is proposed, which includes the following steps:

[0149] S1. Provide a power module and a power module controller. The power module controller has a primary safety path, a secondary safety path, and a tertiary safety path.

[0150] S2. Connect the power module to the power module controller so that the power module can be driven and controlled by the power module controller.

[0151] S3. Monitor the power module controller. If the power module controller is normal, perform pulse width modulation control on the power module through the first-level safety path. If the power module controller experiences a first-type fault, bring the power module into a safe state through the second-level safety path. If the power module controller experiences a second-type fault, bring the power module into a safe state through the third-level safety path.

[0152] In detail, in step S1, a power module controller and a power module as described in the above embodiments are provided. The power module controller has a primary safety path, a secondary safety path, and a tertiary safety path. When the power module controller is normal, the drive module enters a pulse width modulation control state through the primary safety path. When the power module controller experiences a first-type fault, the drive module enters a safe state through the secondary safety path. When the power module controller experiences a second-type fault, the drive module enters a safe state through the tertiary safety path. For details, please refer to the description of the relevant embodiments of the power module controller described above, which will not be repeated here.

[0153] The first type of fault includes at least a failure of the first-level security path, and the second type of fault includes at least a failure of the second-level security path.

[0154] Specifically, in step S2, the power module is electrically connected to the power module controller so that the power module can be driven and controlled by the power module controller. The power module can be various power devices in the car.

[0155] Specifically, in step S3, when monitoring the power module controller, drive control data of the primary safety path is collected, and the power module controller is judged to have experienced a first-type fault based on the drive control data of the primary safety path.

[0156] In detail, in step S3, when monitoring the power module controller, the drive control data of the secondary safety path and the fault data of the control module (such as microcontroller 1 or peripheral power management module 4) in the power module controller are collected, and the power module controller is judged to have a second type of fault based on the drive control data of the secondary safety path and the fault data of the control module in the power module controller.

[0157] Similar to the power module controller described above, the drive control method for the power module adds a second-level and a third-level safety path for safety shutdown (or entering a safe state) to the pulse width modulation drive control based on the first-level safety path. This forms a two-level superimposed safety monitoring mechanism, which monitors the operating status of the first-level safety path or the status of the upper-level control chip in real time. When the control chip fails, the drive circuit or power module is directly controlled to enter a safe state through the second-level or third-level safety path, thereby improving the safety and reliability of the power control product.

[0158] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A power module controller, characterized in that, include: Microcontroller module; The logic processing module is electrically connected to the microcontroller module; The driving module is electrically connected to the logic processing module and is used to drive the power module; The peripheral power management module is electrically connected to the logic processing module, communicatively connected to the microcontroller module, and provides operating voltage to the microcontroller module, the logic processing module, and the drive module. The power module controller has a primary safety path, a secondary safety path, and a tertiary safety path. The primary safety path is the pulse width modulation control path of the microcontroller module to the drive module after passing through the logic processing module. The secondary safety path is the safety state control path of the microcontroller module to the drive module after passing through the logic processing module. The tertiary safety path is the safety state control path of the peripheral power management module to the drive module after passing through the logic processing module. The secondary security path is the monitoring unit of the primary security path, and the tertiary security path is the monitoring unit of the secondary security path; When the power module controller is functioning normally, the drive module enters pulse width modulation control state through the primary safety path. When the power module controller experiences a first-type fault, the drive module enters a safe state through the secondary safety path. When the power module controller experiences a second-type fault, the drive module enters a safe state through the tertiary safety path. The first-type fault includes system over-temperature, system over-voltage, and communication frame loss or errors. The peripheral power management module is used to detect the second-type fault, which includes system faults, signal faults, and microcontroller module body faults.

2. The power module controller according to claim 1, characterized in that, The peripheral power management module includes: The power management and control unit receives the power supply voltage and converts it to obtain various specifications of operating voltage. It provides the operating voltage to the microcontroller module, the logic processing module, and the drive module. It is electrically connected to the logic processing module and communicatively connected to the microcontroller module. The watchdog unit is communicatively connected to the power management and control unit and the microcontroller module, and is used to monitor the program flow of the primary security path and the secondary security path, and restart the microcontroller module that has failed and entered an infinite loop.

3. The power module controller according to claim 2, characterized in that, The microcontroller module is also connected to a host computer. The host computer sends a drive control command to the microcontroller module. After receiving the drive control command, the microcontroller module causes the drive module to enter the pulse width modulation control state through the first-level safety path.

4. The power module controller according to claim 2, characterized in that, The microcontroller module is also communicatively connected to the drive module. The drive module has a fault self-diagnosis function. During power-on and operation, the drive module detects its own faults and feeds them back to the microcontroller module.

5. The power module controller according to claim 3, characterized in that, The microcontroller module also collects the drive control data of the primary safety path and determines whether the power module controller has experienced the first type of fault based on the drive control data of the primary safety path; when the power module controller experiences the first type of fault, the microcontroller module enables the drive module to enter a safe state through the secondary safety path.

6. The power module controller according to claim 5, characterized in that, The power management and control unit collects the drive control data of the secondary safety path and the operating data of the microcontroller module, and determines whether the power module controller has experienced the second type of fault based on the drive control data of the secondary safety path and the operating data of the microcontroller module; when the power module controller experiences the second type of fault, the power management and control unit enables the drive module to enter a safe state through the tertiary safety path.

7. The power module controller according to claim 6, characterized in that, The drive control data for the primary safety path or the drive control data for the secondary safety path shall include at least the temperature of the electronic components, the input DC voltage, and the output AC voltage of the inverter.

8. The power module controller according to claim 2, characterized in that, The logic processing module includes a first logic processing unit, a second logic processing unit, and a third logic processing unit, which are arranged in parallel. The microcontroller module outputs a first pulse width modulation signal, a first enable signal, a first high-side security signal, and a first low-side security signal. The power management and control unit outputs a power management signal. The first logic processing unit performs an AND operation on the first pulse width modulation signal and the first enable signal to obtain and output a second pulse width modulation signal to the driving module; the second logic processing unit performs an AND operation on the first high-side safety signal and the power management signal to obtain and output a second high-side safety signal to the driving module; the second logic processing unit performs a NAND operation on the overvoltage signal, the first low-side safety signal, and the power management signal to obtain and output a second low-side safety signal to the driving module; the third logic processing unit performs an AND operation on the first enable signal and the power management signal to obtain and output a second enable signal to the driving module.

9. The power module controller according to claim 8, characterized in that, The first logic processing unit includes a two-input AND gate, the second logic processing unit includes a two-input AND gate and a three-input NAND gate, and the third logic processing unit includes a two-input AND gate.

10. The power module controller according to claim 2, characterized in that, The driving module includes at least one driving chip, which is electrically connected to the logic processing module and the power module respectively. The driving chip drives and controls the power module under the control of the output signal of the logic processing module.

11. A driving control method for a power module, characterized in that, include: A power module and a power module controller as described in any one of claims 1 to 10 are provided, wherein the power module controller has a primary security path, a secondary security path and a tertiary security path, wherein the secondary security path is a monitoring unit of the primary security path and the tertiary security path is a monitoring unit of the secondary security path; The power module is electrically connected to the power module controller so that the power module can be driven and controlled by the power module controller. The power module controller is monitored. If the power module controller is normal, the power module is controlled by pulse width modulation through the first-level safety path. If the power module controller experiences a first-type fault, the power module is put into a safe state through the second-level safety path. If the power module controller experiences a second-type fault, the power module is put into a safe state through the third-level safety path. The first-type fault includes system over-temperature, system over-voltage, and communication frame loss or errors. The second-type fault includes system faults, signal faults, and microcontroller module body faults.

12. The driving control method for the power module according to claim 11, characterized in that, The first type of fault includes at least the operational failure of the primary security path, and the second type of fault includes at least the operational failure of the secondary security path.

13. The driving control method for the power module according to claim 12, characterized in that, When monitoring the power module controller, the drive control data of the primary safety path is collected, and the power module controller is judged to have experienced a first-type fault based on the drive control data of the primary safety path.

14. The driving control method for the power module according to claim 12, characterized in that, When monitoring the power module controller, the drive control data of the secondary safety path and the fault data of the control module in the power module controller are collected, and the power module controller is judged to have a second type of fault based on the drive control data of the secondary safety path and the fault data of the control module in the power module controller.

Images