Vehicle and electric motor controller system therefor

Abstract

The application discloses a vehicle and a motor controller system thereof, the system comprising: a three-phase current sensor; a rotary transformer; a driving circuit; an inverter circuit; a motor; a shutdown path sub-circuit; a main processor for: generating and outputting a first PWM control instruction to the driving circuit according to a motor three-phase current signal, a motor position signal and a motor torque instruction, so that the driving circuit drives and controls the motor through the inverter circuit; estimating the output torque of the motor according to the motor position signal and the motor three-phase current signal, and outputting a non-enable signal to the driving circuit when the output torque is abnormal, so that the driving circuit stops driving and controlling the motor through the inverter circuit; when a hardware exception of the main processor is detected, the shutdown path sub-circuit outputs an active short-circuit signal to the driving circuit, so that the driving circuit stops driving and controlling the motor through the inverter circuit, and the system can enter a safe state through the above three-level shutdown paths when an event contrary to a functional safety target occurs, so that the system safety is ensured.

Description

Technical Field

[0001] This invention relates to the field of vehicle technology, and more particularly to a vehicle and its motor controller system. Background Technology

[0002] With the rapid development of my country's new energy vehicle industry, especially pure electric vehicles, the functions of automotive electronic and electrical systems are becoming increasingly complex. Ensuring the functional safety of these systems has become a key focus and research hotspot in the industry. In 2011, ISO (International Organization for Standardization) officially released the ISO 26262 standard, "Functional safety of road vehicles." This standard provides a complete functional safety design process and certification system covering systems (including hardware and software) and their manufacturing to ensure vehicle safety. It has become a widely accepted and comprehensive assessment method in the automotive industry and has been recognized and promoted by major global automakers and parts suppliers.

[0003] As a core power component of pure electric vehicles, the motor controller is responsible for controlling the vehicle's power output. It controls the current state in the three-phase windings of the drive motor to generate torque consistent with the driver's needs, thus enabling the vehicle's driving functions. As a power conversion control component, the motor controller operates under conditions of high current, high voltage, high power, and high temperature for extended periods. Failure to do so could endanger the safety of the entire vehicle, the driver, passengers, and people outside the vehicle. Therefore, the proper implementation of its functional safety is of paramount importance.

[0004] Although the ISO 26262 standard, "Functional safety of road vehicles," provides a complete design process for functional safety and plays a crucial role in introducing the concept of functional safety, it does not involve the specific design of any particular product. Therefore, how to correctly implement a product-level motor controller that meets functional safety requirements is currently a hot topic and a challenge in the field of pure electric vehicle drive systems. Summary of the Invention

[0005] This invention aims to at least partially solve one of the technical problems in related technologies. Therefore, the first objective of this invention is to propose a vehicle motor controller system that implements three-level shutdown paths (Level 1, Level 2, and Level 3) to ensure that the system can enter a safe state through these shutdown paths when an event violating functional safety objectives occurs, thereby ensuring system safety.

[0006] The second objective of this invention is to provide a vehicle.

[0007] To achieve the above objectives, a first aspect of the present invention provides a vehicle motor controller system, the system comprising: a main processor, a power supply circuit, a three-phase current sensor, a rotary transformer, a drive circuit, an inverter circuit, a motor, and a shutdown path circuit, the shutdown path circuit including a shutdown path sub-circuit; the power supply circuit is connected to the main processor to provide low-voltage power to the main processor; the three-phase current sensor is used to collect the three-phase current of the motor, and the rotary transformer is used to collect the motor position signal; the main processor is connected to the vehicle controller and is connected to the three-phase current sensor, the rotary transformer, the drive circuit, and the shutdown path sub-circuit respectively, for: based on the three-phase current signal of the motor, the motor position signal, and the vehicle... The vehicle controller sends a motor torque command to generate and output a first PWM control command to the drive circuit, so that the drive circuit can drive and control the vehicle's motor through the inverter circuit; the output torque of the motor is estimated based on the motor position signal and the motor's three-phase current, and when the output torque is abnormal, a non-enable signal for the three-phase bridge arm on the primary side of the drive circuit is output to the drive circuit, so that the drive circuit can stop driving and controlling the motor through the inverter circuit; and when a hardware abnormality of the main processor is detected, an active short-circuit enable signal is output to the shutdown path sub-circuit, so that the shutdown path sub-circuit outputs an active short-circuit signal to the drive circuit, so that the drive circuit can stop driving and controlling the motor through the inverter circuit.

[0008] The vehicle motor controller system according to an embodiment of the present invention implements three-level shutdown paths: Level 1, Level 2, and Level 3, to ensure that when an event that violates functional safety objectives occurs, the system can enter a safe state through the above shutdown paths, thereby ensuring system safety.

[0009] To achieve the above objectives, a second aspect of the present invention provides a vehicle including a motor controller system for the vehicle.

[0010] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the E-gas three-layer functional safety architecture according to an embodiment of the present invention;

[0012] Figure 2 This is a schematic diagram of the structure of a vehicle motor controller system according to an embodiment of the present invention;

[0013] Figure 3This is a schematic diagram of the structure of a vehicle motor controller system according to a specific embodiment of the present invention;

[0014] Figure 4 This is a schematic diagram of the structure of a vehicle motor controller system according to another specific embodiment of the present invention;

[0015] Figure 5 This is a schematic diagram of the structure of a vehicle according to an embodiment of the present invention. Detailed Implementation

[0016] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0017] First, let's introduce the safety integrity levels of electric vehicle motor controllers:

[0018] The ISO 26262 standard defines ASIL (Automotive Safety Integration Level) to describe the probability that a system can achieve a specified safety objective. The definition of ASIL level is intended to assess and quantify the risks posed by a failure in order to achieve the safety objective.

[0019] The ISO 26262 standard defines functional safety as "the absence of unreasonable risk arising from the failure of an electrical / electronic system." ASIL establishes safety requirements that comply with the ISO 26262 standard based on the probability and tolerance of harm to automotive components.

[0020] ISO 26262 defines four ASIL levels: ASIL A, B, C, and D. ASIL A represents the lowest level of automotive hazard, ASIL D represents the highest level of automotive hazard, and there is also a level called QM (Quality Management Level), which indicates that no safety requirements are specified.

[0021] The three basic factors that influence ASIL levels are severity, exposure, and controllability.

[0022] These security levels are determined based on three key parameters:

[0023] Severity (S): Defines the severity of the damage or consequences to the life or property of people (passengers and road users) and property due to the violation of safety goals. The order of severity is: S1 for minor and moderate injuries; S2 for severe and life-threatening injuries, and S3 for life-threatening events.

[0024] Exposure rate (E): This is a measure of the likelihood that a vehicle in a dangerous or hazardous condition may cause harm to people and property. Exposure levels at each level (e.g., E1: very low probability, E2: low probability, E3: medium probability, E4: high probability) are assigned to the automotive components to be evaluated.

[0025] Controllability (C): Determines the degree to which the vehicle driver can control the vehicle when a safety goal is violated due to the failure or malfunction of any automotive component to be evaluated. The order of controllability is defined as: C1 < C2 < C3 (C1 is easy to control, C3 is difficult to control).

[0026] Assign ASIL levels ASIL A, B, C, and D in the manner defined by the ISO 26262 standard

[0027] Table 1 ASIL level assignment table

[0028]

[0029] It can be seen that ASIL D is the highest functional safety level that the current motor controller can achieve. A motor controller with an ASIL D level can provide a high level of safety guarantee for the vehicle. Therefore, it has a very broad application prospect in the field of pure electric vehicles. For this reason, the present invention focuses on this problem and provides a system architecture for a pure electric vehicle motor controller that can meet the ASIL D level.

[0030] Secondly, introduce the implementation architecture of harmonic suppression control for permanent magnet synchronous motors:

[0031] In the automotive field, the E-gas three-layer functional safety monitoring architecture is commonly used in the industry. The core of the E-gas monitoring concept is the three-layer safety architecture design, specifically as Figure 1 shown, and its overall design is divided into Level1, Level2, and Level3. For the motor controller, which is the carrier of the technical achievements of the present invention, Figure 1The intermediate functional layer (Level 1) primarily implements the system's basic functions, including signal acquisition, drive motor output torque control, fault diagnosis and handling, etc. The functional monitoring layer (Level 2) is responsible for monitoring the output conclusions of the Level 1 functional layer. Simply put, it performs software redundancy checks, i.e., monitoring the Level 1 layer, including: monitoring the correctness of the Level 1 layer's output torque control, judging the correctness of the Level 1 software by monitoring the actual output value of the calculated torque, and detecting and handling faults that violate system safety objectives. The hardware monitoring layer (Level 3) primarily ensures that the hardware environment for Level 1 and Level 2 is normal. An abnormal operating environment will cause the Level 2 design to fail to achieve its intended effect; therefore, Level 3 plays an irreplaceable role in the overall monitoring architecture. Figure 1 It can also be seen that Level 1, Level 2 and Level 3 each have independent control signals connected to the actuators. For the motor controller, each level has a corresponding shutdown path to ensure that the system can enter a safe state according to the predetermined goal. Among them, the shutdown command of Level 2 has a higher priority than that of Level 1, while the shutdown command of Level 3 has the highest priority.

[0032] The motor controller system architecture provided by this invention is based on Figure 1 The E-gas three-layer functional safety architecture shown is implemented.

[0033] The motor controller involved in this invention can achieve functional safety ASIL D level. Therefore, the safety objective of the motor controller is determined as follows:

[0034] ①Avoid unexpected loss of acceleration of the vehicle (ASIL A);

[0035] ②Avoid unintended vehicle movement (ASIL B);

[0036] ③ Avoid unintended acceleration of the vehicle (ASIL D);

[0037] ④ Avoid reverse acceleration (ASIL B);

[0038] ⑤ Avoid unexpected vehicle deceleration (ASIL D)

[0039] ⑥ Avoid unexpected loss of vehicle deceleration (ASIL A).

[0040] This invention provides a functional safety-based electric vehicle motor controller system architecture. The motor controller designed using this architecture can achieve the highest level, ASILD, in the ISO 26262 Automotive Safety Integrity Level (ASIL), thus possessing broad application prospects. The motor controller provided by this invention establishes a three-layer functional safety architecture (Level 1, Level 2, and Level 3) based on six torque safety objectives, realizing Level 1 torque control, Level 2 software-level torque monitoring, and Level 3 hardware-level system monitoring functions.

[0041] The following is a reference appendix. Figure 1-5 This invention describes a vehicle and its motor controller system according to embodiments of the present invention.

[0042] Figure 2 This is a schematic diagram of the structure of a vehicle motor controller system according to an embodiment of the present invention. Figure 2 As shown, the vehicle's motor controller system 100 includes: a main processor 11, a power supply circuit 12, a three-phase current sensor 13, a rotary transformer 14, a drive circuit 15, an inverter circuit 16, a motor 17, and a shutdown path circuit 18, which includes a shutdown path sub-circuit 181. The power supply circuit 12 is connected to the main processor 11 to provide low-voltage power to the main processor 11; the three-phase current sensor 13 is used to acquire the three-phase current signals of the motor (S006, S007, S008 → S016, S017, S018); and the rotary transformer 14 is used to acquire the motor position signals (S019 → S020).

[0043] Specifically, see Figure 2 The main processor 11 (at functional safety ASIL D level) is the main control chip of the motor controller (using the TC377 series chip). It communicates with peripheral devices via CAN (Controller Area Network) and SPI (Serial Peripheral Interface) to obtain information such as the three-phase current, bus voltage, and rotor position of the motor, implements motor control, outputs PWM control signals (i.e., the first PWM control command), performs system fault detection and protection processing, and simultaneously implements functional safety architectures at Level 1, Level 2, and Level 3.

[0044] The power supply circuit 12 (at functional safety ASIL D level) provides low-voltage power to the main processor 11. The core of the power supply circuit 12 is a power chip (using the TLE35584 series chip). In addition, the power supply circuit 12 also provides low-voltage power to the motor controller required for the operation of the entire vehicle.

[0045] The three-phase current sensor 13 (at functional safety ASIL D level) converts the three-phase current of the motor into a low-voltage signal, acquires the three-phase current signals of the motor (original voltage signal S006 from the U-phase current sensor, original voltage signal S007 from the V-phase current sensor, and original voltage signal S008 from the W-phase current sensor), and then samples and filters the signals (S006, S007, S008) output by the three-phase current sensor 13 through the three-phase current sampling and filtering circuit B12 (at functional safety ASIL D level). The processed signals (U-phase current filtered sampling signal S016, V-phase current filtered sampling signal S017, and W-phase current filtered sampling signal S018) are output to the main processor 11 (main control chip). The main processor 11 realizes the analysis of the three-phase current of the motor (analyzing to obtain the U-phase, V-phase, and W-phase current values) and related control logic. Among them, the original voltage signal S006 of the U-phase current sensor is used to analyze the U-phase current value and determine overcurrent, the original voltage signal S007 of the V-phase current sensor is used to analyze the V-phase current value and determine overcurrent, and the original voltage signal S008 of the W-phase current sensor is used to analyze the W-phase current value and determine overcurrent.

[0046] The resolver 14 (at functional safety ASIL QM level) is used for motor speed detection and outputs motor position signals S019 (i.e., four motor position signals: sin+, sin-, cos+, and cos-) based on the motor rotor position. The four motor position signals S019 (sin+, sin-, cos+, and cos-) output by the resolver 14 are then acquired, amplified, and filtered by the motor resolver signal sampling circuit B13 (at functional safety ASIL D level). The processed signal S020 is then output to the main processor 11 (main control chip). The main processor 11 analyzes the signal S020 to obtain the motor rotor position.

[0047] The drive circuit 15 (at functional safety ASIL D level) controls the on / off switching of the upper and lower arms of the three phases (U, V, W) of the IGBT power module according to the PWM control instructions output by the main processor 11; it also works with the turn-off path circuit to implement Level 1, Level 2, and Level 3 turn-off protection; and detects faults in the drive circuit. This drive circuit 15 consists of GD3160 series chips and peripheral circuitry, using six GD3160 drive chips to generate six PWM drive signals for the IGBT modules.

[0048] The inverter circuit 16 (at functional safety ASIL D level) mainly includes IGBT power modules. Based on the drive signal output by the drive circuit 15, it controls the state of the three-phase bridge arms of the IGBT power modules. It is connected to the motor 17 through the motor U-phase line (P003), motor V-phase line (P004), and motor W-phase line (P005) to realize the control of the motor 17. At the same time, the inverter circuit 16 feeds back the temperature signal of the IGBT power modules. This temperature signal is collected by the drive circuit 15 and transmitted to the main processor 11 via SPI communication for the implementation of relevant control logic.

[0049] Motor 17 provides power for the vehicle's movement and is at the functional safety ASIL QM level.

[0050] The shutdown path circuit 18 (at functional safety ASIL D level) is designed according to the functional safety architecture and implements Level 3 PWM output shutdown (Level 1 and Level 2 shutdown paths are implemented through 6 PWM control signals (i.e., the first PWM control instruction) output by the main processor 11); at the same time, the shutdown path also has emergency stop fault summary and Level 3 shutdown anti-shoo-through control function.

[0051] In this example, the main processor 11 is connected to the vehicle controller and is connected to the three-phase current sensor 13, the resolver 14, the drive circuit 15, and the shutdown path sub-circuit 181, respectively. It is used to: generate and output a first PWM control command (S049, S050, S051, S052) based on the motor three-phase current signals (S016, S017, S018), the motor position signal (S020), and the motor torque command sent by the vehicle controller (S004). The inverter circuit 16 outputs a three-phase bridge arm de-enabled signal (S036 and / or S037) to the drive circuit 15, which in turn outputs a short-circuit enable signal (S033) to the shutdown path sub-circuit 181, which outputs a short-circuit enable signal (S035) to the drive circuit 15, which in turn outputs a short-circuit enable signal (S035) to the drive circuit 15, which in turn outputs a short-circuit enable signal (S035) to the drive circuit 15, which in turn outputs a short-circuit enable signal (S052, S053, S054) to the drive circuit 15, which in turn drives the motor 17 through the inverter circuit 16. When a hardware abnormality is detected in the main processor 11, the main processor 11 outputs an active short-circuit enable signal (S033) to the shutdown path sub-circuit 181, which outputs an active short-circuit enable signal (S035) to the drive circuit 15, which in turn drives the motor 17 through the inverter circuit 16.

[0052] Specifically, the main processor 11 is divided into three layers according to the functional safety architecture: Level 1, Level 2, and Level 3. Level 1 primarily implements torque control of the motor 17. (See also...) Figure 3 The Level 1 layer obtains the three-phase current values ​​(S016, S017, S018) of motor 17 through dual-channel A / D sampling, and the main processor 11 acquires the motor position signal (S020) fed back from the resolver 14 through a dedicated DSADC sampling interface. See also Figure 2 The main processor 11 combines the three-phase current signals of the motor collected by the three-phase current sensor 13 (S016, S017, S018), the motor position signal collected by the rotary transformer 14 (S020), and the motor torque command sent by the vehicle controller through the vehicle CAN communication signal (S004) (this communication signal passes through the CAN transceiver to realize CAN communication between the vehicle, the motor controller, and the main processor 11). The Level 1 layer implements drive torque control according to the predetermined control algorithm and outputs the first PWM control command (S049, S050, S051, S052, S053, S054) to the drive circuit 15. After receiving the six PWM control commands (S049, S050, S051, S052, S053, S054) from the main processor 11, the drive circuit 15 outputs six PWM drive signals (S059, S060, S061, S062, S063, S064) to the IGBT power module in the direct drive inverter circuit 16, thereby controlling the motor 17 to generate the expected torque. The first PWM control command is the IGBT bridge arm control signal (i.e., U-phase upper bridge arm PWM control command S049, U-phase lower bridge arm PWM control command S050, V-phase upper bridge arm PWM control command S051, V-phase lower bridge arm PWM control command S052, W-phase upper bridge arm PWM control command S053, and W-phase lower bridge arm PWM control command S054); the six PWM drive signals are U-phase upper bridge arm PWM drive signal S059, U-phase lower bridge arm PWM drive signal S060, V-phase upper bridge arm PWM drive signal S061, V-phase lower bridge arm PWM drive signal S062, W-phase upper bridge arm PWM drive signal S063, and W-phase lower bridge arm PWM drive signal S064.

[0053] Level 2 primarily implements monitoring functions (software level), including torque monitoring and fault monitoring. The Level 2 layer of the main processor is independent of Level 1. It estimates the output torque of motor 17 based on the position signal (S020) and the three-phase current signals (S016, S017, S018) of motor 17, and uses the estimation results to determine whether the previously determined safety target is violated. When the output torque is abnormal (i.e., violating the safety target), the Level 2 layer controls the system to enter a safe state, that is, outputting the three-phase bridge arm de-enabled signals (S036 and / or S037) of the primary side of the drive circuit to the drive circuit 15, so that the drive circuit 15 stops driving the motor 17 through the inverter circuit 16. Specifically, the three-phase upper bridge arm enable signal S036 on the primary side of the drive circuit is used to control the enabling state of the three-phase upper bridge arm of the drive circuit, and simultaneously forms an IGBT shoot-through circuit with the turn-off path; the three-phase lower bridge arm enable signal S037 on the primary side of the drive circuit is used to control the enabling state of the three-phase lower bridge arm of the drive circuit. It should be noted that when the output torque is abnormal, the main processor 11 can output an enable signal for the three-phase bridge arm on the primary side of the drive circuit and an enable signal for the three-phase bridge arm on the primary side of the drive circuit. When the enable signal is output, the PWM drives normally. When the enable signal is output, the safety protection is activated.

[0054] Level 3 primarily implements hardware-level monitoring functions. The main processor 11 has a functional safety core capable of detecting hardware status. When a hardware anomaly is detected in the main processor 11 (i.e., the main processor 11 detects an event that violates its own safety mechanisms, such as excessive, insufficient, or reversed output torque), it outputs an active short-circuit enable signal (S033) to the shutdown path sub-circuit 181 (so that the system directly enters a safe state through the Level 3 shutdown path). This causes the shutdown path sub-circuit 181 to output an active short-circuit signal (S035). After being isolated by the Level 3 shutdown signal isolation circuit B18 (at the functional safety ASILD level), the active short-circuit signal (S035) outputs a Level 3 hardware-level active short-circuit control signal (S058), which directly acts on the drive circuit 15, causing the drive circuit 15 to stop driving the motor 17 through the inverter circuit 16. It should be noted that the active short-circuit enable signal (S033) can achieve Level 3 level shutdown. The active short-circuit signal (S035) is at the Level 3 level. Thus, the system can be directly put into the ASC active short-circuit safety state through hardware actions.

[0055] It should be noted that when Level 2 detects a fault that cannot be effectively handled at this level, it sends an ASC request (S034) to Level 3. Upon receiving this signal, Level 3 also uses the Level 3 shutdown path to put the system into a safe state. It can be seen that the main processor's Level 3 layer primarily implements hardware-level functional monitoring and fault handling.

[0056] Therefore, the vehicle's motor controller system implements three-level shutdown paths: Level 1, Level 2, and Level 3. This ensures that when an event that violates functional safety objectives occurs, the system can enter a safe state through these shutdown paths, thus guaranteeing system safety.

[0057] As an example, see Figure 3-4 The vehicle's motor controller system 100 may further include: a motor resolver excitation signal generation circuit 19 (at functional safety ASIL D level), connected to the resolver 14 and the main processor 11 respectively, for receiving the excitation feedback signal (S024) sent by the resolver 14, and generating and outputting an excitation feedback signal (S025) to the main processor 11 based on the excitation feedback signal (S024), so that the main processor 11 can determine whether the system is working normally based on the excitation feedback signal (S025), and receiving the excitation output control signal (S022) sent by the main processor 11, and generating and outputting an excitation drive signal (S023) to the resolver 14 based on the excitation output control signal (S022), so as to drive the resolver 14 to work normally.

[0058] Specifically, the motor resolver excitation signal generation circuit 19 receives the excitation output control signal (S022) output by the main processor 11, amplifies and shapes it, and generates the high-frequency excitation signal (i.e., excitation drive signal S023) required for the normal operation of the resolver 14, so that the resolver 14 can operate normally.

[0059] Therefore, the main processor determines whether the system is working properly based on the excitation feedback signal output by the motor resolver excitation signal generation circuit; the resolver works normally when it receives the excitation drive signal output by the motor resolver excitation signal generation circuit.

[0060] See Figure 3-4 The vehicle's motor controller system 100 may further include: a DC bus current sensor 20, a current overcurrent protection circuit 21, a DC bus voltage sampling circuit 22, and a DC bus voltage overvoltage protection circuit 23. The current overcurrent protection circuit 21 is connected to the DC bus current sensor 20, the three-phase current sensor 13, and the main processor 11, respectively. The DC bus voltage overvoltage protection circuit 23 is connected to the DC bus voltage sampling circuit 22 and the main processor 11, respectively.

[0061] Specifically, the DC bus current sensor 20 (at functional safety ASIL QM level) converts the DC bus current into a low-voltage signal (DC bus current sensor voltage signal S009), which is then sampled and filtered by the DC bus current sampling and filtering circuit B15 (at functional safety ASIL QM level). The processed DC bus current filtered sampling signal (S026) is output to the main processor 11, which analyzes the signal (S026) to obtain the DC bus current value. The overcurrent protection circuit 21 (at functional safety ASIL QM level) receives the three-phase currents (U, V, W) of the motor 17 and the DC bus current signal, and detects the overcurrent state through hardware comparison. The DC bus voltage sampling circuit 22 (at functional safety ASIL B level) is mainly used for A / D acquisition of the DC bus voltage of the motor controller, and transmits the acquired voltage signal to the main processor 11 via SPI communication for the implementation of relevant control strategies. The DC bus voltage overvoltage protection circuit 23 (at functional safety ASIL B level) performs hardware overvoltage detection on the DC bus voltage and outputs the overvoltage signal to the main processor 11 and the shutdown path circuit 18 for system protection. It should be noted that the vehicle's motor controller system 100 may also include: a bus voltage divider and filter circuit B25 (at functional safety ASIL B level), which divides and filters the high-voltage DC bus power supply (P002) output from the DC high-voltage bus B29, then outputs the processed DC bus voltage divider and filter signal (S067) to the DC bus voltage sampling circuit 22, and outputs the processed DC bus voltage divider signal (S066) to the DC bus voltage overvoltage protection circuit 23. The DC high-voltage bus B29 (at functional safety ASIL D level) is connected to the high-voltage power battery, providing high-voltage power to the drive system. The DC bus voltage divider signal S066, the low-voltage signal after the DC bus voltage is divided, is used for hardware overvoltage fault detection. The DC bus voltage divider filter signal S067 is the low-voltage signal after the DC bus voltage is divided and filtered, and is used for A / D sampling of the low-voltage DC bus voltage signal.

[0062] In this example, the main processor 11 is also used to output a three-phase bridge arm de-enable signal (S037) to the drive circuit 15 when any of the following occurs: motor three-phase current overcurrent (S010, S011, S012), DC bus overcurrent (S013), or DC bus overvoltage (S056), so that the drive circuit 15 stops driving control of the motor 17 through the inverter circuit 16.

[0063] Specifically, the motor experiences three-phase current overcurrent, namely, the motor U-phase current hardware overcurrent signal S010, the motor V-phase current hardware overcurrent signal S011, and the motor W-phase current hardware overcurrent signal S012. The main processor Level 2 layer also collects overcurrent signals (S010, S011, S012), DC bus overcurrent (S013), and DC bus overvoltage (S056) through a dedicated TIM signal capture port for post-fault protection processing. When a three-phase current overcurrent, a DC bus overcurrent (S013), or a DC bus overvoltage (S056) occurs, the main processor 11 outputs a three-phase bridge arm de-enabled signal (S037, S036, and / or S037) to the drive circuit 15, so that the drive circuit 15 stops driving control of the motor 17 through the inverter circuit 16.

[0064] Therefore, the main processor 11 uses the DC bus current sensor 20, the current overcurrent protection circuit 21, the DC bus voltage sampling circuit 22, and the DC bus voltage overvoltage protection circuit 23 to determine whether the motor three-phase current overcurrent, DC bus overcurrent (S013), and DC bus overvoltage (S056) have occurred, and performs post-fault protection processing when any of the three occurs.

[0065] As an example, the drive circuit 15 is also used to detect its own faults and the bridge arm faults (S044, S045) of the inverter circuit 16, and send the detection results to the main processor 11.

[0066] Specifically, the main processor 11 obtains the fault status of the drive circuit 15 by collecting the detection results of the drive circuit 15, so as to complete the subsequent fault handling; it also obtains the bridge arm fault status of the inverter circuit 16 by collecting the three-phase upper bridge arm fault signal (S044) and the three-phase lower bridge arm fault signal (S045) fed back by the drive circuit in the detection results, so as to complete the subsequent fault handling.

[0067] It should be noted that the drive circuit 15 also utilizes the GD3160 and the main processor 11 to acquire the DC bus voltage (S046) and IGBT module temperature signal (S065), and then sends them to the main processor 11 via hardwire (S046) and SPI communication (S047) for the implementation of related control logic. Specifically, the DC bus voltage signal (S046) is output by the drive circuit 15 in the form of a PWM wave, and the main processor 11 obtains the DC bus voltage value by parsing this PWM signal. The IGBT module temperature signal (S065) is acquired by the drive circuit 15, and then the drive circuit 15 sends the IGBT temperature sample value to the main processor 11 via SPI communication (S047). The main processor 11 parses the sample to obtain the IGBT temperature physical quantity, which is then used for system control. The main processor interacts with the drive chip via SPI communication (S047), including configuring the drive chip and obtaining drive circuit fault status information.

[0068] In this example, the main processor 11 is also configured to: sample the first PWM control command to obtain PWM sampling signals (S038, S039, S040, S041, S042, S043) and sample the active short circuit signal, and when any of the following occurs, such as bridge arm fault (S044, S045), power supply circuit fault (S032), drive circuit fault (S047), abnormal PWM sampling signal, or abnormal active short circuit signal sampling, output a three-phase bridge arm inactivation signal (S037) to the drive circuit 15, so that the drive circuit 15 stops driving control of the motor 17 through the inverter circuit 16.

[0069] Specifically, firstly, the main processor 11Level2 layer collects the three-phase upper arm fault signal (S044) and the three-phase lower arm fault signal (S045) fed back by the drive circuit through the TIM dedicated signal capture port, and determines whether there is an arm fault based on the signals (S044, S045).

[0070] Second, as an example, the power supply circuit 12 is also used to monitor the operating status of the low-voltage power supply and the main processor 11, and when an abnormality is detected in the low-voltage power supply or the operating status of the main processor 11, outputs a power supply fault signal (S032) to the shutdown path sub-circuit 181, so that the shutdown path sub-circuit 181 outputs an active short-circuit signal to the drive circuit 15, so that the drive circuit 15 stops the drive control of the motor 17 through the inverter circuit 16.

[0071] Specifically, the core component of the power supply circuit 12 uses the TLE35584 power chip, which meets the ASILD functional safety level. The power supply circuit 12 generates the low-voltage power required for the normal operation of the motor controller, and monitors the supplied power. When the functional safety core of the power supply circuit 12 detects an abnormality in the output power, it outputs a power supply fault signal (S032), causing the system to directly enter a safe state through the Level 3 shutdown path.

[0072] In addition, the power supply circuit 12 is also linked with the main processor 11 for functional safety. The main processor 11 sends a "feed the dog" signal to the power supply circuit 12 at regular intervals according to its own software execution cycle (S031). At the same time, when the main processor 11 detects a serious fault, it sends a fault signal to the power supply circuit 12 (S028). When the power supply circuit 12 detects that the main processor 11's "feed the dog" action is abnormal (indicating that there is a problem in the software execution process of the main processor 11) or the main processor 11 is faulty, it outputs a hardware reset (S029) or an interrupt signal (S030) to make the main processor 11 perform a reset and restart or a special interrupt to provide protection for the system. At the same time, the power supply circuit 12 outputs a power supply fault signal (S032) to make the system directly enter a safe state through the Level 3 shutdown path. The power supply chip in the power supply circuit 12 monitors the output power according to its own functional safety logic. When a serious fault is detected, it outputs a hardware reset signal (S029) to reset the main processor 11. The power supply chip in the power supply circuit 12 monitors the output power according to its own functional safety logic. When an abnormality is detected, it outputs an interrupt signal (S030) to cause the main processor 11 to introduce a predetermined interrupt and execute the safety policy in the interrupt.

[0073] It should be noted that when the power supply circuit 12 detects a serious internal fault, a fault request from the main processor 11, or a failure to feed the dog (dog timer) to the main processor 11, it outputs a power supply fault signal (S032). This power supply fault signal (S032) enables Level 3 shutdown. Simultaneously, this power supply fault signal (S032) is sampled back by the main processor 11 for monitoring. Furthermore, the main processor 11 and the power supply circuit 12 communicate via SPI. Upon receiving the fault signal (S028), the SBC power chip in the low-voltage power supply circuit controls the system to enter a Level 3 safety state.

[0074] Therefore, the power supply circuit not only provides power to the low-voltage control board of the motor controller, but also uses its own safety mechanism to monitor the output of its own power supply and the working status of the main processor 11, ensuring that the system enters a safe state through the Level 3 shutdown path in abnormal conditions, thus guaranteeing system safety.

[0075] Furthermore, the main processor 11 determines whether there is a power supply circuit fault through the power supply fault signal S032.

[0076] Third, the drive circuit 15 outputs the first PWM control instruction to the main processor 11, namely 6 PWM control signals (S038, S039, S040, S041, S042, S043), which are used by the drive circuit 15 to monitor the 6 PWM control signals. At the same time, the functional safety target is achieved by relying on the functional safety core of GD3160. The main processor 11 Level 2 layer uses a dedicated GTM port to sample the first PWM control commands (U-phase upper arm PWM control command S049, U-phase lower arm PWM control command S050, V-phase upper arm PWM control command S051, V-phase lower arm PWM control command S052, W-phase upper arm PWM control command S053, W-phase lower arm PWM control command S054), obtaining PWM sampled signals (IGBT module U-phase upper arm control command sampled signal S038, IGBT module U-phase lower arm control command sampled signal S039, IGBT module V-phase upper arm control command sampled signal S040, IGBT module V-phase lower arm control command sampled signal S041, IGBT module W-phase upper arm control command sampled signal S042, IGBT module W-phase lower arm control command sampled signal S043). The sampled PWM signals are then compared with the issued IGBT arm control commands to determine if there are any abnormalities in the PWM sampled signals.

[0077] Fourth, the main processor 11 re-samples the active short-circuit signal (S035), compares the re-sampled active short-circuit signal with the active short-circuit signal output by the shutdown path sub-circuit 181, and determines whether there is an abnormality in the active short-circuit signal re-samples.

[0078] Furthermore, when the main processor 11 detects any of the following: bridge arm fault (S044, S045), power supply circuit fault (S032), drive circuit fault (S047), PWM retrieval signal abnormality, or active short circuit signal retrieval abnormality, it outputs a three-phase bridge arm inactivation signal (S037) to the drive circuit 15, so that the drive circuit 15 stops driving the motor 17 through the inverter circuit 16.

[0079] In addition, the main processor 11 is also used to output an active short-circuit enable signal (S033) to the shutdown path sub-circuit 181 when the failure of the three-phase bridge arm in the primary side of the output drive circuit to be detected (S037) is detected, so that the shutdown path sub-circuit 181 outputs an active short-circuit signal to the drive circuit 15, so that the drive circuit 15 stops the drive control of the motor 17 through the inverter circuit 16.

[0080] See Figure 3-4The vehicle's motor controller system 100 may also include a motor temperature sensor 24, which is connected to the main processor 11 and is used to collect motor temperature data.

[0081] Specifically, the motor temperature sensor 24 (at the functional safety ASIL QM level) outputs a corresponding raw temperature voltage signal (S014) based on the temperature value. This signal is sampled and filtered by the motor temperature sampling and filtering circuit B11 (at the functional safety ASIL QM level) and then output to the main processor 11. The main processor 11 then analyzes the filtered temperature voltage signal (S015) to obtain the motor stator temperature.

[0082] See Figure 3-4 The shutdown path circuit 18 also includes an emergency stop fault summary sub-circuit 182, which is connected to the drive circuit 15, the DC bus voltage overvoltage protection circuit 23, the current overcurrent protection circuit 21 and the main processor 11 respectively. When any of the following is detected, such as a bridge arm fault of the drive circuit 15 (S044, S045), three-phase current overcurrent of the motor (S010, S011, S012), DC bus overcurrent (S013), or DC bus overvoltage (S056), an emergency stop fault signal (S055) is output to the main processor 11.

[0083] Specifically, the emergency stop fault summary sub-circuit 182 summarizes seven hardware-level fault signals, namely: ① Three-phase upper bridge arm summary fault of the drive circuit (S044), ② Three-phase lower bridge arm summary fault of the drive circuit (S045), ③ U-phase current hardware overcurrent fault (S010), ④ V-phase current hardware overcurrent fault (S011), ⑤ W-phase current hardware overcurrent fault (S012), ⑥ DC bus current overcurrent (S013), and ⑦ DC bus overvoltage fault (S056). When any of the above hardware faults occurs, the emergency stop fault summary sub-circuit 182 outputs an emergency stop fault signal (S055). This signal is received by the Emergency "Emergency Stop" pin of the Level 1 functional layer of the main processor and subsequent fault handling is performed. In the Level 1 layer of the main processor 11, when the Emergency "Stop" pin of the main processor 11 receives an emergency stop fault signal (S055), it enters a special interrupt and enters the SPO temporary safe state through the special interrupt control system, so as to carry out fine-grained handling of subsequent faults.

[0084] Therefore, the Level 2 layer of the main processor also collects signals such as three-phase current overcurrent (S010, S011, S012), DC bus overcurrent (S013), DC bus overvoltage (S056), and drive circuit bridge arm fault (S044, S045) through the dedicated TIM signal capture port. Simultaneously, it collects six PWM control signals (S038 to S043) through a dedicated GTM port for fault diagnosis. Upon detecting any of these faults, the main processor's powerful computing capabilities are used to bring the system to a safe state via either the Level 2 or Level 3 shutdown path, depending on the fault status. It can be seen that the Level 2 layer of the main processor primarily implements the functional monitoring and fault handling of the software-level motor controller.

[0085] In this embodiment, the main processor 11 is also used to output a second PWM control command to the drive circuit 15 when the motor temperature is abnormal or when an emergency stop fault signal (S055) is received, so that the inverter circuit 16 enters the safety pulse shutdown SPO or active short circuit ASC safety state through the drive circuit 15.

[0086] Therefore, the Level 1 layer of the main processor also implements state management and fault management of the drive system based on the collected motor temperature, emergency stop fault signals, etc.

[0087] See Figure 3-4 The shutdown path circuit 18 may further include a shutdown path anti-straight-through processing sub-circuit 183, which is connected to the shutdown path sub-circuit 181, the main processor 11 and the drive circuit 15 respectively. When receiving an active short circuit signal (S035) and the main processor 11 outputs an enable signal for the three-phase upper bridge arm on the primary side of the drive circuit (S036), the drive circuit 15 outputs a safety state enable shutdown signal (S057) for the three-phase upper bridge arm on the primary side of the drive circuit to the drive circuit 15, so that the three-phase upper bridge arm in the inverter circuit 16 is in the off state through the drive circuit 15. At the same time, the drive circuit 15 causes the three-phase lower bridge arm in the inverter circuit 16 to enter the active short circuit ASC safety state according to the active short circuit signal.

[0088] Specifically, the purpose of the cut-through prevention sub-circuit 183 is to prevent the IGBT module from shooting through during Level 3 hardware-level shutdown (when the cut-through sub-circuit 181 outputs the S035 signal), thus preventing a short circuit. The cut-through prevention sub-circuit 183 receives the Level 3 active short-circuit signal (S035) and the enable signal (S036) for the three-phase upper bridge arm on the primary side of the drive circuit issued by the Level 2 monitoring layer of the main processor 11. During normal system operation, the enable signal (S036) for the three-phase upper bridge arm on the primary side of the drive circuit issued by the Level 2 monitoring layer of the main processor 11 is enabled. At this time, the three-phase upper bridge arm in the drive circuit 15 is working normally, meaning it may be in an on or off state. When the cut-off path anti-snap-through processing sub-circuit 183 receives a valid Level 3 active short-circuit signal (S035) and the enable signal (S036) for the three-phase upper bridge arm on the primary side of the drive circuit is enabled, it outputs a safety state enable cut-off signal (S057) for the three-phase upper bridge arm on the primary side of the drive circuit. This causes all three phase upper bridge arms of the IGBT module in the inverter circuit 16 to be in the off state. At this time, the drive circuit 15, based on the Level 3 hardware-level active short-circuit control signal (S058), directly controls the system to enter the lower bridge arm ASC active short-circuit safety state through hardware action. Since the three phase upper bridge arms of the IGBT are in the off state at this time, shoot-through between the upper and lower bridge arms of the IGBT is avoided during the process of entering the ASC safety state through hardware action. Among them, the Level 3 hardware-level active short-circuit control signal (S058) directly acts on the high side of the drive chip in the drive circuit.

[0089] It should be noted that the priority of the active short-circuit signal is higher than the priority of the non-enable signal of the three-phase bridge arm on the primary side of the drive circuit, and the priority of the non-enable signal of the three-phase bridge arm on the primary side of the drive circuit is higher than the priority of the second PWM control command.

[0090] Specifically, in the motor controller system architecture provided by this invention, a safe state can be entered through Level 1, Level 2, and Level 3 shutdown paths. Level 1 and Level 2 safe states include SPO (Safety Pulse Off) and ASC (Active Short Circuit), meaning the system enters a safe state by controlling the six PWM control signals output by the main processor 11. The Level 3 safe state is achieved by directly controlling the system to enter the ASC active short circuit safe state (downbridge ASC) through hardware, and has the highest priority. The Level 1 safe state is determined by… Figure 1 The middle functional layer software implementation, that is, entering the safe state through the shutdown path 1; the Level 2 safe state is implemented by... Figure 1The system is implemented in the mid-level functional monitoring layer software. For example, when the Level 2 layer detects an anomaly in the Level 1 layer software, causing excessive or insufficient motor output torque, the Level 2 safety mechanism is activated. Relying on the functional safety response mechanism of the main processor 11, it controls the output of 6 PWM signals to bring the system into a safe state, i.e., through shutdown path 2. In the system architecture involved in this invention, shutdown paths 1 and 2 are both 6 PWM signals output by the main processor 11. The difference is that shutdown path 1 is implemented through Level 1 layer software, while shutdown path 2 is implemented through Level 2 layer software. The Level 3 level safety state is directly implemented through hardware actions. As mentioned earlier, the system architecture provided by this invention utilizes the Level 3 hardware diagnostic mechanism of the main processor 11 and power supply circuit 12 to diagnose the system. When a Level 2 layer software failure is detected, the system is directly controlled to enter the ASC active short-circuit safety state through hardware actions, i.e., shutdown path 3. Compared with shutdown paths 1 and 2, shutdown path 3 has the highest priority.

[0091] Additionally, see Figure 3B1 is a low-voltage battery (at functional safety ASIL D level), providing the motor controller with the 12V low-voltage DC power required for normal operation (P001); B2 is the vehicle wake-up interface (at functional safety ASIL C level), through which the vehicle controller sends a wake-up signal to the motor controller to wake it up and put it into normal operation; B3 is the vehicle CAN interface (at functional safety ASIL D level), through which the motor controller communicates with the vehicle controller via CAN to transmit information; B7 is the motor controller EEPROM (Electrically Erasable Programmable Read-Only Memory, at functional safety ASIL QM level), which communicates with the main processor 11 via the SPI interface and is used to store non-volatile data; B8 is the vehicle CAN communication circuit (at functional safety ASIL... The QM level circuit is used to convert the CAN bus physical layer message signals into TXD (Transmit(tx)Data) and RXD (Receive(rx)Data) signals that the main processor 11 can accept. The motor controller uses this circuit to realize information interaction with the vehicle controller. B10 is the motor controller temperature sensor and sampling filter circuit (at functional safety ASIL D level), used to collect the ambient temperature and internal circuit board temperature of the motor controller. The temperature signal is sampled, filtered and then output to the main processor (main control chip) for motor controller temperature analysis and related logic implementation. B19 is the motor controller driver board power supply circuit (at functional safety ASIL D level), used to receive 12V low-voltage battery power to provide power to the high-voltage driver board of the motor controller (such as IGBT modules, etc.). At the same time, this circuit can also draw power from the DC high-voltage bus and convert it into backup power for system backup power supply when the 12V low-voltage power supply of the motor controller is abnormal. Active discharge circuit B22 (at functional safety ASIL D level) B30 is a low-voltage signal connector for the motor controller (at functional safety ASIL D level), used to receive the active discharge command (S048) from the main processor 11 and execute the active discharge function of the motor controller to ensure high-voltage safety after the system is powered off; B31 is a high-voltage connector for the motor controller (at functional safety ASIL D level), used to connect the low-voltage signal of the motor controller; B32 is a high-voltage connector for the motor controller (at functional safety ASIL D level), used to connect the high-voltage wiring of the motor controller.

[0092] See Figure 3S001 is the SPI communication signal between the main processor 11 and the E2 PROM, realizing communication between the main processor and the E2 PROM chip; S002 is the vehicle CAN communication signal, realizing CAN communication between the vehicle, the motor controller, and the main processor; S003 is the CAN wake-up signal, used to wake up the low-voltage power supply circuit of the motor controller; S005 is the SPI communication signal between the main processor and the AD acquisition circuit of the driver board, realizing SPI communication between the main processor and the AD acquisition circuit of the driver board; S021 is the motor controller temperature signal, which the main processor 11 acquires and then parses to obtain the motor controller temperature.

[0093] In summary, the vehicle's motor controller system has the following three shutdown paths, corresponding to Level 1, Level 2, and Level 3, respectively:

[0094] The Level 1 shutdown path is implemented through six PWM control signals output by the main processor. When the Level 1 functional layer of the main processor detects a fault, it first uses six control signals (S049, S050, S051, S052, S053, and S054, i.e., the first PWM control instruction) to put the system into an SPO or ASC safe state. In the Level 1 layer of the main control chip, an emergency stop fault signal (S055) is also received through the chip's Emergency pin. Upon receiving this fault signal, a special interrupt is triggered, and the system is controlled to enter the SPO temporary safe state for subsequent fine-grained fault handling.

[0095] The Level 2 shutdown path is also implemented using the six PWM control signals (S049, S050, S051, S052, S053, S054) of the main processor's Level 1 layer. These six signals are used to put the system into a SPO or ASC safe state. For example, when the main processor's Level 2 layer detects an abnormality in the motor output torque (such as excessive, insufficient, or reverse torque), violating functional safety objectives, it controls the system to enter a safe state through the Level 2 shutdown path, taking into account the system fault status. The Level 2 shutdown path has a higher priority than the Level 1 shutdown path. To achieve independence between the Level 1 and Level 2 shutdown paths, this invention samples the six PWM control signals (S038, S039, S040, S041, S042, S043) through the main processor's GTM port, monitoring the correctness of the six PWM control commands to ensure the final motor controller's ASIL D functional safety level.

[0096] The Level 3 shutdown path is implemented by shutdown path circuit 18. In this circuit 18, shutdown path sub-circuit 181 receives the power supply fault signal (S032) from the power supply circuit and the active short-circuit enable signal (S033) from the main processor's Level 3, and performs an OR operation. That is, if either one fails, a Level 3 active short-circuit signal (S035) is output. This signal, after isolation processing (S058), directly acts on the drive circuit, enabling the system to enter a safe state through hardware action. Simultaneously, the main control chip's Level 2 monitoring layer tracks and monitors the Level 3 active short-circuit signal (S035) to achieve its own monitoring function.

[0097] This achieves three-level shutdown paths: Level 1, Level 2, and Level 3. This ensures that when an event violates functional safety objectives, the system can enter a safe state through these shutdown paths, guaranteeing system safety. It can achieve the functional safety ASIL D level while ensuring the system's complete functionality. Furthermore, it has the advantages of simplified hardware and lower cost compared to current mainstream motor controllers, thus possessing greater engineering application value.

[0098] Figure 5 This is a schematic diagram of the structure of a vehicle according to an embodiment of the present invention. Figure 5 As shown, vehicle 200 includes the aforementioned vehicle motor controller system 100.

[0099] According to the vehicle of the present invention, the motor controller system of the vehicle implements three-level shutdown paths of Level 1, Level 2 and Level 3, which ensures that when an event that violates the functional safety objective occurs, the system can enter a safe state through the above shutdown paths, thereby ensuring system safety.

[0100] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0101] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0102] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0103] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0104] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can mean that the first feature is in direct contact with the second feature, or that the first feature is in indirect contact with the second feature through an intermediate medium. Furthermore, "above," "over," and "on top" of the second feature can mean that the first feature is directly above or diagonally above the second feature, or simply that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature can mean that the first feature is directly below or diagonally below the second feature, or simply that the first feature is at a lower horizontal level than the second feature.

[0105] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A motor controller system for a vehicle, characterized in that, The system includes: a main processor, a power supply circuit, a three-phase current sensor, a rotary transformer, a drive circuit, an inverter circuit, a motor, and a shutdown path circuit, wherein the shutdown path circuit includes a shutdown path sub-circuit. The power supply circuit is connected to the main processor to provide low-voltage power to the main processor; The three-phase current sensor is used to collect the three-phase current signal of the motor, and the rotary transformer is used to collect the position signal of the motor. The main processor is connected to the vehicle controller and is also connected to the three-phase current sensor, the rotary transformer, the drive circuit, and the shutdown path sub-circuit. It is used to: generate and output a first PWM control command to the drive circuit based on the motor three-phase current signal, the motor position signal, and the motor torque command sent by the vehicle controller, so that the drive circuit can drive the vehicle's motor through the inverter circuit; estimate the motor's output torque based on the motor position signal and the motor three-phase current signal, and when the output torque is abnormal, output a non-enable signal for the primary side three-phase bridge arm of the drive circuit to the drive circuit, so that the drive circuit can drive the motor. The system stops driving control of the motor through the inverter circuit; and when a hardware malfunction of the main processor is detected, an active short-circuit enable signal is output to the shutdown path sub-circuit, so that the shutdown path sub-circuit outputs an active short-circuit signal to the drive circuit, so that the drive circuit stops driving control of the motor through the inverter circuit; the system also includes: a DC bus current sensor, a current overcurrent protection circuit, a DC bus voltage sampling circuit, and a DC bus voltage overvoltage protection circuit, wherein the current overcurrent protection circuit is connected to the DC bus current sensor, the three-phase current sensor and the main processor respectively, and the DC bus voltage overvoltage protection circuit is connected to the DC bus. The voltage sampling circuit is connected to the main processor. The main processor is further configured to output a non-enable signal for the three-phase bridge arm on the primary side of the drive circuit to the drive circuit when any of the following occurs: three-phase current overcurrent of the motor, DC bus overcurrent, or DC bus overvoltage. This causes the drive circuit to stop driving the motor via the inverter circuit. The system also includes a motor temperature sensor connected to the main processor for collecting motor temperature data. The shutdown path circuit further includes an emergency stop fault summary sub-circuit, which is connected to the drive circuit, the DC bus overvoltage protection circuit, the current overcurrent protection circuit, and the main processor. The connection is configured to output an emergency stop fault signal to the main processor when any of the following occurs: a drive circuit bridge arm fault, a three-phase motor current overcurrent, a DC bus overcurrent, or a DC bus overvoltage. The main processor is further configured to output a second PWM control command to the drive circuit when the motor temperature is abnormal or when the emergency stop fault signal is received, so that the inverter circuit enters a safety pulse shutdown (SPO) or active short-circuit (ASC) safety state via the drive circuit. The priority of the active short-circuit signal is higher than the priority of the three-phase bridge arm disabling signal on the primary side of the drive circuit, and the priority of the three-phase bridge arm disabling signal on the primary side of the drive circuit is higher than the priority of the second PWM control command.

2. The vehicle motor controller system according to claim 1, characterized in that, The system also includes: The motor resolver excitation signal generation circuit is connected to both the resolver and the main processor. It receives the excitation feedback signal sent by the resolver, generates and outputs an excitation feedback signal to the main processor based on the excitation feedback signal, so that the main processor can determine whether the system is working normally based on the excitation feedback signal. It also receives the excitation output control signal sent by the main processor, generates and outputs an excitation drive signal to the resolver based on the excitation output control signal, so as to drive the resolver to work normally.

3. The vehicle motor controller system according to claim 1, characterized in that, The drive circuit is also used to detect its own faults and bridge arm faults of the inverter circuit, and send the detection results to the main processor; The main processor is further configured to: sample the first PWM control command to obtain a PWM sampling signal and sample the active short-circuit signal; and when any of the following occurs—a bridge arm fault, a power supply circuit fault, a drive circuit fault, an abnormal PWM sampling signal, or an abnormal active short-circuit signal sampling—output a three-phase bridge arm de-enabled signal to the drive circuit, so that the drive circuit stops driving the motor through the inverter circuit.

4. The motor controller system for a vehicle according to any one of claims 1-3, characterized in that, The main processor is also configured to output the active short-circuit enable signal to the shutdown path sub-circuit when it detects that the output of the non-enable signal of the three-phase bridge arm on the primary side of the drive circuit has failed, so that the shutdown path sub-circuit outputs an active short-circuit signal to the drive circuit, so that the drive circuit stops driving the motor through the inverter circuit.

5. The vehicle motor controller system according to claim 1, characterized in that, The power supply circuit is also used to monitor the working status of the low-voltage power supply and the main processor, and when an abnormality is detected in the low-voltage power supply or the working status of the main processor, output a power supply fault signal to the shutdown path sub-circuit, so that the shutdown path sub-circuit outputs an active short-circuit signal to the drive circuit, so that the drive circuit stops driving the motor through the inverter circuit.

6. The vehicle motor controller system according to claim 5, characterized in that, The shutdown path circuit also includes: A shutdown path anti-shoo-through processing sub-circuit is connected to the shutdown path sub-circuit, the main processor, and the drive circuit, respectively. When the active short-circuit signal is received and the main processor outputs the three-phase upper bridge arm enable signal on the primary side of the drive circuit, the drive circuit outputs the three-phase upper bridge arm safety state enable shutdown signal to the drive circuit. This allows the drive circuit to put the three-phase upper bridge arm in the inverter circuit into a shutdown state. At the same time, the drive circuit, based on the active short-circuit signal, causes the three-phase lower bridge arm in the inverter circuit to enter the active short-circuit ASC safety state.

7. A vehicle, characterized in that, Including the motor controller system of the vehicle according to any one of claims 1-6.

Images