Motor controller failure shutdown system and pure electric vehicle

Abstract

The application discloses a motor controller fault shutdown system and a pure electric vehicle, and relates to the technical field of motor controllers, and in particular relates to a motor controller fault shutdown system and a pure electric vehicle. The system comprises a power conversion module, a drive circuit, a logic circuit, a power supply chip and a main control chip. The main control chip outputs a first control signal to the drive circuit, so that the motor outputs an expected torque, monitors the fault state of itself, and outputs a fault signal to the power supply chip and a fault control signal to the logic circuit when an abnormality is found, and monitors the output torque of the motor and outputs a second control signal to the drive circuit when an abnormality is found. The logic circuit performs logical processing on the fault shutdown signal and the fault control signal, and outputs a logic control signal to the drive circuit. The corresponding switching tubes in the power conversion module are controlled to be shut down by the drive circuit. Thus, through the shutdown control, the drive system can quickly and reliably enter a safe state under a fault state, and no unexpected power output is generated.

Description

Technical Field

[0001] This invention relates to the field of pure electric vehicle technology, and in particular to a motor controller fault shutdown system and a pure electric vehicle. Background Technology

[0002] Currently, with the continuous development of pure electric vehicles towards intelligence and connectivity, vehicle electronic and electrical systems are becoming increasingly complex. Ensuring the functional safety of these systems has become a key focus of industry attention and research. As a core component of vehicle power control, the motor controller is responsible for the control and management of the vehicle's power output. Its control and handling of fault conditions are of paramount importance to vehicle safety. Against this backdrop, the development of functionally safe electric vehicle motor controllers has become the mainstream development approach.

[0003] Currently, most motor controllers developed based on functional safety adopt the EGAS (ECCMA Global Attribute Schema) architecture. The main design concept of this architecture is to design the control system in layers: a functional layer (Level 1), a functional monitoring layer (Level 2), and a processor monitoring layer (Level 3). The Level 1 functional layer mainly implements torque control of the motor controller; the Level 2 functional monitoring layer mainly implements the monitoring function of the motor controller's output torque; and the Level 3 processor monitoring layer implements chip-level monitoring functions. This three-layer system architecture ensures the safety of the entire vehicle under system failure conditions. Specifically, for the drive system, the safe state under failure conditions is to cut off power output and ensure that the drive motor does not generate unexpected output torque during the power output cutoff process. Therefore, implementing the power shutdown process after a drive system failure is crucial for achieving functional safety design of the drive system. Summary of the Invention

[0004] This invention aims to at least partially solve one of the technical problems in related technologies. Therefore, the first objective of this invention is to provide a motor controller fault shutdown system that, through shutdown control, ensures that the drive system can quickly and reliably enter a safe state in a fault condition, while preventing unexpected power output, thereby meeting the design requirements for system functional safety and protecting the safety of the entire vehicle.

[0005] The second objective of this invention is to provide a pure electric vehicle.

[0006] To achieve the above objectives, a first aspect of the present invention provides a motor controller fault shutdown system, the system comprising: a power conversion module, the DC terminal of which is connected to a high-voltage power supply and the AC terminal of which is connected to a motor; a drive circuit connected to the control terminal of the power conversion module, for outputting a drive signal to the power conversion module to control the switching transistors in the power conversion module; a logic circuit connected to the drive circuit; a power supply chip connected to the logic circuit, for supplying power to the system and, upon receiving a fault signal from a main control chip, outputting a fault shutdown signal to the logic circuit; and a main control chip connected to the logic circuit, the power supply chip, and the drive circuit respectively. The system is configured to output a first control signal to the drive circuit to enable the motor to output the expected torque, monitor its own fault status, and output a fault signal to the power chip and a fault control signal to the logic circuit when an abnormality is detected. It also monitors the output torque of the motor and outputs a second control signal to the drive circuit when an abnormality is detected, so as to control the corresponding switching transistor in the power conversion module to be turned off through the drive circuit. The logic circuit is used to perform logical processing on the fault turn-off signal and the fault control signal, and output a logic control signal to the drive circuit, so as to control the corresponding switching transistor in the power conversion module to be turned off through the drive circuit.

[0007] According to the motor controller fault shutdown system of the present invention, the drive system can quickly and reliably enter a safe state in a fault state by shutting down the control, while not generating unexpected power output, thereby meeting the design requirements of system functional safety and protecting the safety of the whole vehicle.

[0008] To achieve the above objectives, a second aspect of the present invention provides a pure electric vehicle, including a motor controller, wherein the motor controller includes the motor controller fault shutdown system.

[0009] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0010] Figure 1 This is a schematic diagram of the structure of a motor controller fault shutdown system according to an embodiment of the present invention;

[0011] Figure 2 This is a topology diagram of a motor controller fault shutdown system according to a specific embodiment of the present invention;

[0012] Figure 3 This is a schematic diagram of the structure of a pure electric vehicle according to an embodiment of the present invention. Detailed Implementation

[0013] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0014] The following is a reference appendix. Figure 1-3 This invention describes a motor controller fault shutdown system and a pure electric vehicle according to embodiments of the present invention.

[0015] Figure 1 This is a schematic diagram of the structure of a motor controller fault shutdown system according to an embodiment of the present invention. Figure 1-2 As shown, the motor controller fault shutdown system 100 includes: a power conversion module 110, a drive circuit 120, a logic circuit 130, a power supply chip 140, and a main control chip 150. The power conversion module 110 has a DC terminal for connecting to a high-voltage power supply and an AC terminal for connecting to the motor; the drive circuit 120 is connected to the control terminal of the power conversion module 110 and outputs drive signals (18, 19) to the power conversion module 110 to control the switching transistors in the power conversion module 110; the logic circuit 130 is connected to the drive circuit 120; the power supply chip 140 is connected to the logic circuit 130 and supplies power to the system 100, and outputs a fault shutdown signal (4) to the logic circuit 130 when it receives a fault signal (2) from the main control chip 150; the main control chip 150... Chip 150 is connected to logic circuit 130, power chip 140 and drive circuit 120 respectively. It is used to output a first control signal (9, 10) to drive circuit 120 so that the motor outputs the expected torque, monitor its own fault status, and output a fault signal (2) to power chip 140 and output fault control signals (5, 6, 7) to logic circuit 130 when an abnormality is detected. It also monitors the output torque of the motor and outputs a second control signal (9, 10) to drive circuit 120 when an abnormality is detected, so as to control the corresponding switching transistor in power conversion module 110 to be turned off through drive circuit 120.

[0016] In this example, logic circuit 130 is used to perform logical processing on fault shutdown signal (4) and fault control signals (5, 6, 7), and output logic control signals (11, 12, 14) to drive circuit 120 so as to control the corresponding switching transistors in power conversion module 110 to be turned off through drive circuit 120.

[0017] Specifically, see Figure 2The main control chip 150 outputs the first control signal (9, 10) to the drive circuit 120 to enable the motor to output the expected torque and monitor its own fault status. When the main control chip 150 detects an abnormality, it outputs a fault signal (2) to the power chip 140. After receiving the fault signal (2), the power chip 140 outputs a fault shutdown signal (4) to the logic circuit 130. When the main control chip 150 detects an abnormality, it also outputs fault control signals (5, 6, 7) to the logic circuit 130. The logic circuit 130 performs logical processing on the fault shutdown signal (4) output by the power chip 140 and the fault control signals (5, 6, 7) output by the main control chip 150, and outputs a logic control signal to the drive circuit 120 to control the corresponding switching transistors in the power conversion module 110 to be turned off through the drive circuit 120. In addition, the main control chip 150 outputs a first control signal (9, 10) to the drive circuit 120 so that when the motor outputs the expected torque, it also monitors the output torque of the motor and outputs a second control signal (9, 10) to the drive circuit 120 when an abnormality is detected, so as to control the corresponding switching transistor in the power conversion module 110 to be turned off through the drive circuit 120.

[0018] It should be noted that the power chip 140 provides the low-voltage power supply (5V, 3.3V, 1.3V, etc.) required for the normal operation of the motor controller fault shutdown system 100, so as to ensure that the system can work normally.

[0019] Therefore, by shutting down the control, the drive system can be quickly and reliably brought into a safe state in the event of a fault, without generating unexpected power output, thereby meeting the design requirements for system functional safety and protecting the safety of the entire vehicle.

[0020] See Figure 2 The main control chip 150 may include a functional safety management module 151, a torque monitoring module 152, and a PWM control command output module 153. The PWM control command output module 153 is connected to the drive circuit 120 and is used to output a first control signal (9, 10) to the drive circuit 120 so that the motor outputs the expected torque. The functional safety management module 151 is connected to the logic circuit 130 and the power chip 140 respectively and is used to monitor the fault status of the main control chip 150. When an abnormality is detected, it outputs a fault signal (2) to the power chip 140 and outputs fault control signals (5, 6, 7) to the logic circuit 130. The torque monitoring module 152 is connected to the PWM control command output module 153 and is used to monitor the output torque of the motor. When an abnormality is detected, it outputs a torque abnormality signal (8) to the PWM control command output module 153 so that the PWM control command output module 153 outputs a second control signal (9, 10) to the drive circuit 120.

[0021] Specifically, the motor controller fault shutdown system 100 is designed according to the EGAS architecture, comprising three levels: Level 1, Level 2, and Level 3. Level 1 is used to implement torque control of the drive system, i.e., controlling the motor to output the expected torque. The PWM control command output module 153 implements the functions of Level 1, i.e., by outputting the first control signals (9, 10) of the upper and lower bridge arms of the U, V, and W phases to the drive circuit 120, the motor outputs the expected torque. The basic functions of the motor controller are implemented in this level. Signal 9 represents the control signal of the upper bridge arm of the U, V, and W phases of the power conversion module 110, and signal 10 represents the control signal of the lower bridge arm of the U, V, and W phases of the power conversion module 110.

[0022] Level 3 is the processor monitoring layer, which implements chip-level monitoring functions. The functional safety management module 151 implements the functions of Level 3, that is, it monitors the fault status of the main control chip 150 through the functional safety mechanism inside the main control chip 150. The functional safety management module 151 belongs to chip-level monitoring. When the abnormality of the motor controller shutdown system 100 is detected, the fault signal (2) and the fault control signal (5, 6, 7) are output to realize the hardware-level shutdown of the system, so that the system enters a safe state to ensure the safety of the whole vehicle. When the functional safety management module 151 detects an abnormality, it sends a fault signal (2) to the power chip 140 to inform that the main control chip 150 is malfunctioning. The fault control signal (5, 6, 7) is the external control signal output of the functional safety management module 151. The hardware-level system shutdown is realized through the fault control signal (5, 6, 7) and the logic circuit 130.

[0023] Level 2 independently monitors the motor's output torque. When situations such as excessive or insufficient output torque, or unexpected power output that violate functional safety objectives are detected, the system enters a safe state through a shutdown path. The torque monitoring module 152 implements the functions of Level 2. By monitoring excessive or insufficient output torque, or unexpected power output, it monitors the execution status of Level 1 functions and, in conjunction with the functional safety fault mechanism, enables emergency shutdown in abnormal system conditions. When an abnormal output torque is detected, this level outputs a torque abnormality signal (8), which enters the PWM control command output module 153 (i.e., Level 1). This causes the PWM control command output module 153 to output a second control signal (9, 10) to the drive circuit 120, thereby achieving system shutdown in fault conditions.

[0024] See Figure 2The driving circuit 120 includes an upper bridge arm driving chip 121 and a lower bridge arm driving chip 122. The output terminal PWM_OUT of the upper bridge arm driving chip 121 is connected to the control terminal of the upper bridge arm switching transistor of the power conversion module 110, and the output terminal PWM_OUT of the lower bridge arm driving chip 122 is connected to the control terminal of the lower bridge arm switching transistor of the power conversion module 110. There are three fault control signals, which are respectively denoted as the first fault control signal (5), the second fault control signal (6), and the third fault control signal (7). The logic circuit 130 may include: a first AND gate circuit 131, a second AND gate circuit 132, a third AND gate circuit 133, a fourth AND gate circuit 134, an inverter circuit 135, and an OR gate circuit 136, wherein,

[0025] The first input terminal of the first AND gate circuit 131 is used to input a fault shutdown signal (4), the second input terminal of the first AND gate circuit 131 is used to input a first fault control signal (5), and the output terminal of the first AND gate circuit 131 is connected to the safety fault enable pin FSENB of the upper bridge arm driver chip 121 and the safety fault enable pin FSENB of the lower bridge arm driver chip 122, respectively.

[0026] The first input terminal of the second AND gate circuit 132 is used to input a fault shutdown signal (4), the second input terminal of the second AND gate circuit 132 is used to input a second fault control signal (6), and the output terminal of the second AND gate circuit 132 is connected to the fault-safe state pin FSSTATE of the upper bridge arm driver chip 121.

[0027] The first input terminal of the third AND gate circuit 133 is used to input the fault shutdown signal (4), the second input terminal of the third AND gate circuit 133 is used to input the third fault control signal (7) and is connected, the output terminal of the third AND gate circuit 133 is connected to the first input terminal of the OR gate circuit 136, and the output terminal of the OR gate circuit 136 is connected to the fault-safe status pin FSSTATE of the lower bridge arm driver chip 122.

[0028] The input terminal of the inverter circuit 135 is used to input the fault shutdown signal (4), the output terminal of the inverter circuit 135 is connected to the first input terminal of the fourth AND gate circuit 134, the second input terminal of the fourth AND gate circuit 134 is used to input the motor speed signal (16), and the output terminal of the fourth AND gate circuit 134 is connected to the second input terminal of the OR gate circuit 136.

[0029] Specifically, see Figure 2The drive circuit 120 spans the low-voltage and high-voltage domains of the motor controller. This drive circuit 120 receives six PWM low-voltage control commands (i.e., second control signals 9 and 10) from the main control chip 150, and then outputs drive signals (18 and 19) on the high-voltage side. These are the drive signals for the switching transistors in the three-phase upper and lower bridges of the power conversion module 110. By controlling the on / off state of the switching transistors within the bridge arms of the power conversion module 110, the motor operates according to the expected state. The drive circuit 120 has an independent functional safety core that can monitor input and output signals and its own operating status, achieving ASIL (Automotive Safety Integrity Level) D level. The drive circuit 120 can cut off the output of the PWM control signal through control signals on both the low-voltage and high-voltage sides, bringing the system into a safe state. Therefore, by controlling the low-voltage side of the drive circuit 120, the system's power output is shut off.

[0030] It should be noted that both the fault shutdown signal (4) and the first fault control signal (5) are active low, meaning they output a low level when a fault occurs and a high level when there is no fault. When the second fault control signal (6) is high, the switching transistors in the three-phase upper bridge arm of the power conversion module 110 are turned on; when this signal is low, the switching transistors in the three-phase upper bridge arm are turned off. When the third fault control signal (7) is high, the switching transistors in the three-phase lower bridge arm of the power conversion module 110 are turned on; when this signal is low, the switching transistors in the three-phase lower bridge arm are turned off. The motor speed signal (16) is an externally independent motor speed level signal. When the motor speed is higher than the threshold K, this signal is high; when it is lower than the threshold K, this signal is low, thereby realizing the switching of the drive system's safe state under fault conditions.

[0031] As an example, when a low-level signal is input to the FSENB pin, if a high-level signal is input to the FSSTATE pin, the corresponding driver chip outputs a high-level drive signal to make the corresponding bridge arm switches all in the on state; if a low-level signal is input to the FSSTATE pin, the corresponding driver chip outputs a low-level drive signal to make the corresponding bridge arm switches all in the off state.

[0032] Specifically, the upper bridge arm drive chip 121 receives the switching control signals (9) from the three-phase upper bridge arms of the power conversion module 110 (U, V, W) via the PWM_IN pin, enabling the motor to operate in the expected state (off or normal torque output). The FSENB pin is the low-voltage side functional safety state enable pin, used in conjunction with the FSSTATE pin to control the system into a safe state. When the FSENB pin receives a low-level signal, the low-voltage side functional safety protection function is enabled. At this time, the output pin PWM_OUT of the upper bridge arm drive chip 121 is not controlled by the PWM_IN pin input control signal (9), but depends on the input of the functional safety state pin FSSTATE. When the FSSTATE pin receives a high-level signal, the PWM_OUT pin outputs a high-level drive signal. At this time, all the switching transistors in the three-phase upper bridge arms of the power conversion module 110 are in the on state; when the FSSTATE pin is low, the PWM_OUT pin outputs a low-level drive signal. At this time, all the switching transistors in the three-phase upper bridge arms of the power conversion module 110 are in the off state. The lower bridge arm driver chip 122 receives the switching transistor control signals (10) from the three-phase lower bridge arm of the power conversion module 110U, V, and W through the PWM_IN pin, enabling the motor to operate in the expected state (off or normal output torque). The FSENB pin is the low-voltage side functional safety enable pin.

[0033] It works in conjunction with the FSSTATE pin to control the system into a safe state. When a low-level signal is input to the FSENB pin, the low-voltage side functional safety protection function is enabled. At this time, the output pin PWM_OUT of the lower bridge arm driver chip 122 will...

[0034] It is not controlled by the PWM_IN pin input control signal (10), but depends on the input of the functional safety state pin FSSTATE. When the FSSTATE pin input is high, the PWM_OUT pin outputs a high-level drive signal. At this time, the power conversion...

[0035] In the power conversion module 110, all the switches in the three-phase lower bridge arm are in the ON state. When the FSSTATE pin is low, the PWM_OUT pin outputs a low-level drive signal. At this time, all the switches in the three-phase lower bridge arm of the power conversion module 110 are in the OFF state. Thus, the system shutdown under fault conditions is achieved by utilizing this function of the upper bridge arm driver chip 121 and the lower bridge arm driver chip 122.

[0036] 0 See Figure 2The motor controller fault shutdown system 100 may further include a signal isolation circuit 160, which may include a first isolation sub-circuit 161 and a second isolation sub-circuit 162. The input terminal of the first isolation sub-circuit 161 is connected to the power supply chip 140, and the output terminal of the first isolation sub-circuit 161 is connected to the input terminal of the inverter sub-circuit 135. The input terminal of the second isolation sub-circuit 162 is connected to the output terminal of the fourth AND gate circuit 134, and the output terminal of the second isolation sub-circuit 162 is connected to the power supply chip 140.

[0037] The terminal is connected to the first input terminal of the OR gate circuit 136. This achieves signal isolation between the low-voltage side and the high-voltage side of the motor controller.

[0038] As an example, the control of the main control chip 150 includes two categories: system shutdown control under normal conditions and system shutdown control under fault conditions. The shutdown control under fault conditions is further divided into shutdown control under normal fault conditions, fault shutdown control under controllable conditions, and fault shutdown control under uncontrollable conditions, according to the fault type. The above shutdown controls will be explained in detail below.

[0039] It should be noted that system shutdown is achieved through two methods: ASC (Active Short Circuit) and SPO (StopPWM Output). The Active Short Circuit ASC is further divided into upper-bridge ASC (all three upper-phase arms of the power conversion module 110 are in the ON state, and all three lower-phase arms are in the OFF state) and lower-bridge ASC (all three upper-phase arms of the power conversion module 110 are in the OFF state, and all three lower-phase arms are in the ON state). The SPO shutdown method...

[0040] All bridge arms in the power conversion module 110 are in the disconnected state. ASC and SPO are both safe states of the drive system. ASC is the system safe state under high motor speed conditions, and SPO is the safe state under low motor speed conditions.

[0041] In the first embodiment of the present invention, both the first control signal and the second control signal may include a first control sub-signal (9) input to the upper bridge arm drive chip 121 and a second control sub-signal (10) input to the lower bridge arm drive chip 122. In the normal state and when a conventional fault occurs in the main control chip 150, the main control chip 150 is specifically used to: detect the drive circuit 120.

[0042] Whether a fault occurs; when the drive circuit 120 does not fail, or the upper bridge arm drive chip 121 fails, or both the upper bridge arm drive chip 121 and the lower bridge arm drive chip 122 fail, a low-level first control sub-signal (9) and a high-level second control sub-signal (10) are output. If the motor speed is lower than the threshold K, the low-level second control sub-signal (10) is output. When the lower bridge arm drive chip 122 fails, a high-level first control sub-signal (9) and a low-level second control sub-signal (10) are output. If the motor speed is lower than the threshold K, the low-level first control sub-signal (9) is output.

[0043] Specifically, in normal conditions and during routine faults, the system shutdown control of the main control chip 150 includes: detecting whether the drive circuit 120 has failed. When the drive circuit 120 has not failed, or the upper bridge arm drive chip 121 has failed, or both the upper bridge arm drive chip 121 and the lower bridge arm drive chip 122 have failed, a low-level first control sub-signal (9) and a high-level second control sub-signal (10) are output. At this time, the power conversion module 110 is controlled by the drive circuit 120 to make the motor controller fault shutdown system 100 enter the lower bridge ASC safety state. Then, the motor speed is judged. When the motor speed is lower than the threshold K, the main control chip 150 outputs a low-level second control sub-signal (10). At this time, the motor controller fault shutdown system 100 enters the SPO safety state. When the lower bridge arm drive chip 122 fails, the PWM control command output module 153 outputs a high-level first control sub-signal (9) and a low-level second control sub-signal (10). At this time, the drive circuit 120 controls the power conversion module 110, causing the motor controller fault shutdown system 100 to first enter the upper bridge ASC safety state, and then the motor speed is judged. When the motor speed is lower than the threshold K, the low-level first control sub-signal (9) is output. At this time, the motor controller fault shutdown system 100 enters the SPO safety state. Thus, in the normal state of the main control chip 150 and when a regular fault occurs, the high-level first control sub-signal (9) and the low-level second control sub-signal (10) output by the PWM control command output module 153 in the main control chip 150 cause the system to enter the high-speed ASC and low-speed SPO safety state, realizing system shutdown.

[0044] It should be noted that the normal state refers to the motor controller shutdown system 100 not experiencing a fault or experiencing a non-functional safety fault that does not affect vehicle safety objectives. This state includes modes such as normal motor output torque. Shutdown control under conventional fault conditions refers to a situation where the system has experienced a fault affecting vehicle safety objectives, such as overcurrent faults, overvoltage faults, or drive circuit 120 faults, but the functional safety mechanism in the main control chip 150 does not detect a fault in the chip itself; that is, the main control chip 150 is functioning normally. This invention defines the fault shutdown control under this condition as shutdown control under conventional fault conditions. Furthermore, the threshold K is the switching speed point between ASC and SPO safety states.

[0045] In the second embodiment of the present invention, when the main control chip 150 experiences a controllable fault, and the first fault control signal (5) is at a low level, the main control chip 150 is specifically used to: detect whether the drive circuit 120 has failed; when the drive circuit 120 has not failed, or the upper bridge arm drive chip 121 has failed, or both the upper bridge arm drive chip 121 and the lower bridge arm drive chip 122 have failed, the main control chip 150 outputs a low-level second fault control signal (6) and a high-level third fault control signal (7), and then if the motor speed is lower than the threshold K, the third fault control signal (7) is output; when the lower bridge arm drive chip 122 fails, the main control chip 150 outputs a high-level second fault control signal (6) and a low-level third fault control signal (7), and then if the motor speed is lower than the threshold K, the second fault control signal (6) is output.

[0046] Specifically, when a fault occurs under controllable conditions, the system shutdown control of the main control chip 150 includes: under the action of the low-level first fault control signal (5) output by the functional safety management module 151 in the main control chip 150, the signal 11 output by the first AND gate circuit 131 is low. At this time, the fault safety enable pin FSENB of the upper bridge arm driver chip 121 and the lower bridge arm driver chip 122 is pulled low. In this way, the output of the PWM_OUT pin of the upper bridge arm driver chip 121 and the lower bridge arm driver chip 122 will depend only on the input of the fault-safe state pin FSSTATE. Further, it detects whether the drive circuit 120 has failed. When the drive circuit 120 does not fail, or when the upper arm drive chip 121 fails, or when both the upper arm drive chip 121 and the lower arm drive chip 122 fail, a low-level second fault control signal (6) and a high-level third fault control signal (7) are output. At this time, the FSSTATE pin of the upper arm drive chip 121 is low (corresponding to signal 12 being low), and the FSSTATE pin of the lower arm drive chip 122 is high (corresponding to signal 14 being high). Based on the working characteristics of the upper arm drive chip 121 and the lower arm drive chip 122, the motor controller fault shutdown system 100 enters the lower bridge ASC safety state to realize system shutdown. Then, the main control chip 150 judges the motor speed. When the motor speed is lower than the threshold K, a low-level third fault control signal (7) is output. At this time, the motor controller fault shutdown system 100 enters the SPO safety state. When the lower bridge arm drive chip 122 fails, it outputs a high-level second fault control signal (6) and a low-level third fault control signal (7). At this time, it enters the upper bridge ASC safety state. Then, the main control chip 150 judges the motor speed. When the motor speed is lower than the threshold K, it outputs a low-level second fault control signal (6). At this time, the motor controller fault shutdown system 100 enters the SPO safety state. Thus, when the main control chip 150 fails under controllable conditions, the fault control signals (5, 6, 7) output by the functional safety management module 151 in the main control chip 150 are used to control the low-voltage side of the upper bridge arm drive chip 121 and the lower bridge arm drive chip 122. Combined with the motor speed, the system enters the high-speed ASC and low-speed SPO safety state, realizing system shutdown.

[0047] It should be noted that fault shutdown control under controllable conditions refers to the main control chip 150 detecting an anomaly through its own functional safety kernel (i.e., functional safety management module 151), but at this time, the functional safety management module 151 can work normally, and the software program flow inside the main control chip 150 is normal. This invention defines fault shutdown control under controllable conditions as fault shutdown control under controllable conditions. When a fault occurs under controllable conditions, this invention no longer uses the output of the PWM control command output module 153 to put the motor controller fault shutdown system 100 into a safe state, but instead uses the output of the functional safety management module 151 to shut down the motor controller fault shutdown system 100.

[0048] In the third embodiment of the present invention, when the main control chip 150 fails under uncontrollable conditions, the power supply chip 140 controls the system to enter a safe state. The power supply chip 140 determines whether the main control chip 150 has failed by using the "feed the dog" signal (1) and the fault signal (2) sent by the main control chip 150.

[0049] Specifically, the main control chip 150 is also used to periodically send a dog feed signal (1) to the power chip 140; the power chip 140 determines whether the main control chip 150 has a hardware failure based on the dog feed signal (1), and outputs a fault shutdown signal (4) to the logic circuit 130 when the main control chip 150 has a hardware failure, and outputs a reset signal (3) to the main control chip 150 when the main control chip 150 has a hardware failure or when a fault signal (2) is received, so that the main control chip 150 performs a hardware reset operation.

[0050] Specifically, when the power supply chip 140 detects an abnormality in the "watchdog" signal (1) sent by the main control chip 150 or when the main control chip 150 issues a fault signal (2), it considers the main control chip 150 to have failed hardware and outputs a reset signal (3) to the main control chip 150 to enable the main control chip 150 to perform a hardware reset operation. At the same time, it outputs a fault shutdown signal (4) to the logic circuit 130. Thus, by periodically sending the watchdog signal (1) to the power supply chip 140, the working status of the main control chip 150 is monitored in real time, realizing the "watchdog" function; by outputting the reset signal (3) from the power supply chip 140 to the main control chip 150, a Level 3 fault shutdown is achieved, enabling the system to enter a safe state and providing safety protection for the entire vehicle.

[0051] Furthermore, at this time, the low-level signal (11) output by the first AND gate circuit 131 in the logic circuit 130 pulls the fault-safe enable pin FSENB of the upper arm driver chip 121 and the lower arm driver chip 122 low. As a result, the output of the PWM_OUT pin of the upper arm driver chip 121 and the lower arm driver chip 122 will depend only on the input of the fault-safe state pin FSSTATE.

[0052] Among them, after the power chip 140 outputs the fault shutdown signal (4) to the logic circuit 130, the following two system shutdown paths are also included:

[0053] See Figure 2 The fault shutdown signal (4) and the second fault control signal (6) are processed by the second AND gate circuit 132 in the logic circuit 130 to obtain signal 12. Since the fault shutdown signal (4) is low, signal 12 is low regardless of the state of the second fault control signal (6). The low-level signal 12 enters the FSSTATE pin of the upper bridge arm driver chip 121, thus ensuring that the switching transistors in the three-phase upper bridge arm of the power conversion module 110 are always in the off state.

[0054] See Figure 2 After the power chip 140 outputs a low-level fault shutdown signal (4), the low-level fault shutdown signal (4) passes through Figure 1 The signal isolation circuit 160 shown in the diagram becomes a high-level signal (15) after the first isolation sub-circuit 161 and the inverting sub-circuit 135 (this high-level signal (15) indicates a fault state). This high-level signal (15) and the motor speed signal (16) pass through the fourth AND gate circuit 134. When the motor speed is higher than the threshold K, the signal (16) is high-level. After passing through the fourth AND gate circuit 134, a high-level signal (17) is output. This high-level signal (17) passes through the second isolation sub-circuit 162 and enters the OR gate circuit 136 to obtain a high-level signal (14). This high-level signal (14) enters the FSSTATE pin of the lower bridge arm driver chip 122. At this time, the switching transistors in the three-phase lower bridge arm of the power conversion module 110 are in the conducting state, thereby enabling the system to enter the lower bridge ASC safety state. When When the motor speed is lower than the threshold K, the signal (16) is low level. After passing through the fourth AND gate circuit 134, the low level signal (17) is output. The signal (17) passes through the second isolation sub-circuit 162 and enters the OR gate circuit 136 with the low level signal (13) to obtain the low level signal (14). The low level signal (14) enters the FSSTATE pin of the lower bridge arm driver chip 122. At this time, the switching transistor of the three-phase lower bridge arm of the power conversion module 110 is in the open state, so that the system enters the SPO safe state.

[0055] Therefore, when the main control chip 150 fails under uncontrollable conditions, the low-voltage side of the upper bridge arm drive chip 121 and the lower bridge arm drive chip 122 is controlled by the fault shutdown signal (4) output by the power supply chip 140 and the motor speed signal (16), so that the system enters the safe state of high speed ASC and low speed SPO, and the system is shut down.

[0056] It should be noted that fault shutdown control under uncontrollable conditions refers to a situation where the main control chip 150 detects an anomaly through the functional safety management module 151, and the functional safety management module 151 is no longer functioning properly. In this case, the software program flow within the main control chip 150 may malfunction. This invention defines fault shutdown control under such circumstances as fault shutdown control under uncontrollable conditions. When this type of fault occurs, this invention controls the system to enter a safe state and achieves shutdown through the power supply chip 140.

[0057] In addition, the power chip 140 is also used to monitor its own fault status and output a reset signal (3) to the main control chip 150 when an abnormality is detected, so that the main control chip 150 performs a hardware reset operation and outputs a fault shutdown signal (4) to the logic circuit 130. Thus, the power chip 140 monitors its own fault status through an internal functional safety mechanism. It should be noted that the shutdown control of the power chip 140 when it detects an abnormal fault status is the same as the segment control when the main control chip 150 experiences a fault under uncontrollable conditions.

[0058] In summary, the motor controller fault shutdown system 100 enables the system to enter a safe state in a reasonable manner based on the type of fault in the drive system, thereby ensuring driving safety. Specifically, the system shutdown is achieved using the first and second control signals (9, 10) output by the PWM control command output module 153; the functional safety management module 151 of the main control chip 150 controls the upper arm drive chip 121 and the lower arm drive chip 122, and, combined with the motor speed, enables the system to enter a safe state, meeting the functional safety requirements for rapid and reliable shutdown of the system under fault conditions; the power supply chip 140 monitors the main control chip 150, and upon detecting a failure of the main control chip 150, directly controls the system to enter a safe state through a hardware reset operation based on the motor speed information, realizing high-speed ASC active short-circuit control and low-speed SPO shutdown control, thus achieving the optimal combination of system safety state control after a fault. In other words, the motor controller fault shutdown system 100 has the characteristics of clear architecture, simple structure, and easy engineering implementation. It can realize three independent shutdown paths under fault conditions, ensuring that the drive system can effectively and reliably enter a safe state under fault conditions, while not generating unexpected power output, thereby meeting the design requirements of system functional safety and thus having good engineering promotion value.

[0059] Figure 3 This is a schematic diagram of the structure of a pure electric vehicle according to an embodiment of the present invention. Figure 3 As shown, the pure electric vehicle 200 includes a motor controller 210, which includes the aforementioned motor controller fault shutdown system 100.

[0060] Therefore, the pure electric vehicle 200, through its motor controller 210 including the aforementioned motor controller fault shutdown system 100, can realize three independent shutdown paths under fault conditions, ensuring that the drive system can effectively and reliably enter a safe state under fault conditions, while not generating unexpected power output, thereby achieving the design requirements of system functional safety.

[0061] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0062] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0063] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0064] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0065] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can mean that the first feature is in direct contact with the second feature, or that the first feature is in indirect contact with the second feature through an intermediate medium. Furthermore, "above," "over," and "on top" of the second feature can mean that the first feature is directly above or diagonally above the second feature, or simply that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature can mean that the first feature is directly below or diagonally below the second feature, or simply that the first feature is at a lower horizontal level than the second feature.

[0066] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A motor controller fail-safe system, characterized by, The system comprises: a power conversion module, whose direct current end is used for connecting a high-voltage power supply, and whose alternating current end is used for connecting a motor; a drive circuit, which is connected with the control end of the power conversion module, and is used for outputting a drive signal to the power conversion module to control the on-off of a switch tube in the power conversion module; a logic circuit, which is connected with the drive circuit; a power supply chip, which is connected with the logic circuit, and is used for supplying power for the system, and outputting a fault shutdown signal to the logic circuit when a fault signal sent by a master control chip is received; a master control chip, which is connected with the logic circuit, the power supply chip and the drive circuit respectively, and is used for outputting a first control signal to the drive circuit to make the motor output an expected torque, monitoring the fault state of itself, and outputting the fault signal to the power supply chip and a fault control signal to the logic circuit when an abnormality is found, and monitoring the output torque of the motor, and outputting a second control signal to the drive circuit to control the off of the corresponding switch tube in the power conversion module through the drive circuit when an abnormality is found; wherein the logic circuit is used for logically processing the fault shutdown signal and the fault control signal, and outputting a logic control signal to the drive circuit to control the off of the corresponding switch tube in the power conversion module through the drive circuit; the drive circuit comprises an upper bridge arm drive chip and a lower bridge arm drive chip, the output end of the upper bridge arm drive chip is connected with the control end of the upper bridge arm switch tube of the power conversion module, the output end of the lower bridge arm drive chip is connected with the control end of the lower bridge arm switch tube of the power conversion module, the number of the fault control signals is three, which are respectively a first fault control signal, a second fault control signal and a third fault control signal; the logic circuit comprises a first AND gate sub-circuit, a second AND gate sub-circuit, a third AND gate sub-circuit, a fourth AND gate sub-circuit, an inverter sub-circuit and an OR gate sub-circuit, wherein the first input end of the first AND gate sub-circuit is used for inputting the fault shutdown signal, the second input end of the first AND gate sub-circuit is used for inputting the first fault control signal, and the output end of the first AND gate sub-circuit is connected with the safety fault enable pin FSENB of the upper bridge arm drive chip and the safety fault enable pin FSENB of the lower bridge arm drive chip respectively; the first input end of the second AND gate sub-circuit is used for inputting the fault shutdown signal, the second input end of the second AND gate sub-circuit is used for inputting the second fault control signal, and the output end of the second AND gate sub-circuit is connected with the fault safety state pin FSSTATE of the upper bridge arm drive chip; The first input end of the third AND gate sub-circuit is used to input the fault shutdown signal, the second input end of the third AND gate sub-circuit is used to input the third fault control signal, the output end of the third AND gate sub-circuit is connected with the first input end of the OR gate sub-circuit, and the output end of the OR gate sub-circuit is connected with the fault safety state pin FSSTATE of the lower bridge arm drive chip; The input end of the NOT sub-circuit is used to input the fault shutdown signal, the output end of the NOT sub-circuit is connected with the first input end of the fourth AND gate sub-circuit, the second input end of the fourth AND gate sub-circuit is used to input the motor speed signal, and the output end of the fourth AND gate sub-circuit is connected with the second input end of the OR gate sub-circuit.

2. The motor controller fault shutdown system according to claim 1, characterized in that, The master control chip is further configured to send a watchdog signal to the power supply chip at a timing; The power supply chip is configured to judge whether the master control chip is hardware failure according to the watchdog signal, and output the fault shutdown signal to the logic circuit when judging that the master control chip is hardware failure, and output a reset signal to the master control chip to make the master control chip perform a hardware reset operation when judging that the master control chip is hardware failure or when receiving the fault signal.

3. The motor controller fail-safe system of claim 2, wherein, The power supply chip is further configured to monitor a fault state of itself, and output the reset signal to the master control chip to make the master control chip perform a hardware reset operation when an abnormality is found, and output the fault shutdown signal to the logic circuit.

4. The motor controller fail-safe system of claim 1, wherein, The master control chip comprises a functional safety management module, a torque monitoring module and a PWM control command output module, wherein, The PWM control command output module is connected with the drive circuit, and is configured to output the first control signal to the drive circuit to make the motor output an expected torque; The functional safety management module is connected with the logic circuit and the power supply chip respectively, and is configured to monitor a fault state of the master control chip, and output the fault signal to the power supply chip and output the fault control signal to the logic circuit when an abnormality is found; The torque monitoring module is connected with the PWM control command output module, and is configured to monitor an output torque of the motor, and output a torque abnormality signal to the PWM control command output module to make the PWM control command output module output the second control signal to the drive circuit when an abnormality is found.

5. The motor controller fail-safe system of claim 1, wherein, When the FSENB pin inputs a low-level signal, If the FSSTATE pin inputs a high-level signal, the corresponding drive chip outputs a high-level drive signal to make the corresponding bridge arm switch tube be in a conducting state; If the FSSTATE pin inputs a low-level signal, the corresponding drive chip outputs a low-level drive signal to make the corresponding bridge arm switch tube be in a disconnected state.

6. The motor controller fail-safe system of claim 5, wherein, The first control signal and the second control signal each comprise a first control sub-signal input to the upper bridge arm drive chip and a second control sub-signal input to the lower bridge arm drive chip, and the master control chip is specifically configured to: detect whether the drive circuit fails; When the driving circuit is not faulty, or the upper bridge arm driving chip is faulty, or both the upper bridge arm driving chip and the lower bridge arm driving chip are faulty, the first control sub-signal is output as low level and the second control sub-signal is output as high level, and then if the rotating speed of the motor is lower than the threshold K, the second control sub-signal is output as low level; When the lower bridge arm driving chip is faulty, the first control sub-signal is output as high level and the second control sub-signal is output as low level, and then if the rotating speed of the motor is lower than the threshold K, the first control sub-signal is output as low level.

7. The motor controller fail-safe system of claim 5, wherein, When the first fault control signal is low level, the main control chip is specifically used for: detecting whether the driving circuit is faulty; When the driving circuit is not faulty, or the upper bridge arm driving chip is faulty, or both the upper bridge arm driving chip and the lower bridge arm driving chip are faulty, the second fault control signal is output as low level and the third fault control signal is output as high level, and then if the rotating speed of the motor is lower than the threshold K, the third fault control signal is output as low level; When the lower bridge arm driving chip is faulty, the second fault control signal is output as high level and the third fault control signal is output as low level, and then if the rotating speed of the motor is lower than the threshold K, the second fault control signal is output as low level.

8. The motor controller fail-safe system of claim 1, wherein, The system further comprises: a signal isolation circuit, the signal isolation circuit comprising a first isolation sub-circuit and a second isolation sub-circuit, an input end of the first isolation sub-circuit being connected with the power supply chip, an output end of the first isolation sub-circuit being connected with an input end of the NOT sub-circuit, an input end of the second isolation sub-circuit being connected with an output end of the fourth AND gate sub-circuit, and an output end of the second isolation sub-circuit being connected with a first input end of the OR gate sub-circuit.

9. A pure electric vehicle, characterized by The motor controller comprises the motor controller fault shutdown system according to any one of claims 1-8.

Images