Method and system for electric drive system safety state switching strategy

Abstract

The embodiment of the application provides a kind of electric drive system safety state switching strategy method and system, belong to electric vehicle electric drive system functional safety technical field.The method includes determining the kind of unexpected torque safety failure, and according to the kind, determine the safety state that current electric drive system needs to enter.The method and device enter the corresponding safety state by determining the kind of unexpected torque safety failure, reasonably arrange electric drive system;And can be in the case where corresponding safety state enters fails, according to preset, enter the safety state of next level;Engineering application value is better, while realizing safety protection, reduce the negative influence that this safety state brings to electric drive system, guarantee the driving comfort of driver and avoid unnecessary safety hazard.

Description

Technical Field

[0001] This invention relates to the field of functional safety technology for electric vehicle electric drive systems, and more specifically to a method and system for a safety state switching strategy for an electric drive system. Background Technology

[0002] As a crucial component in the conversion of electrical and mechanical energy in electric vehicles, the electric drive system's operating state directly impacts the reliability and safety of the vehicle's operation. Preventing the generation of unexpected torque is a fundamental and vital safety objective of the electric drive system. When an unexpected torque fault occurs in the electric drive system, it needs to enter a safe state to ensure the safety of both the electric drive system and the entire vehicle. Common safety states are categorized into three types: Active Short Circuit (ASC), Free Wheeling (FW), and Torque Limiting Control. ASC safety state involves turning off the three transistors of the upper IGBT arm while simultaneously turning on the three transistors of the lower IGBT arm. This generates significant braking torque at low speeds, affecting the user's driving experience. The continuous current generated by the back electromotive force may cause motor overheating, potentially leading to demagnetization, inverter damage, and other faults. At high speeds, it generates less braking torque and no back electromotive force. FW safety state generates less braking torque at low speeds but generates greater braking torque and a larger back electromotive force at high speeds, potentially causing impact damage to components on the bus. Torque Limiting Control refers to the electric drive system limiting torque output when certain faults occur, even when high and low voltage power supplies are normal. This has benefits such as reducing motor output to alleviate battery load and keeping the electric drive system operating within a safe temperature range. In existing technologies, when faced with different faults, only a single ASC safety state or FW safety state is used, without implementing a safety state mode that limits torque output. Furthermore, safety state control is only based on whether the IGBT module has failed, without selecting according to the operating conditions of the electric vehicle. This results in unreasonable switching of safety states, causing unnecessary safety hazards or a poor driving experience for the driver. Summary of the Invention

[0003] To overcome the above-mentioned technical problems, embodiments of the present invention provide a method and system for switching safety states of an electric drive system. This method and system can quickly, timely and reasonably implement safety state switching strategies according to the fault type, ensuring the driver's driving comfort and avoiding unnecessary safety hazards.

[0004] To achieve the above objectives, embodiments of the present invention provide a method for a safety state switching strategy of an electric drive system, comprising:

[0005] Identify the types of safety faults caused by unexpected torque;

[0006] The required safe state for the current electric drive system is determined based on the aforementioned type.

[0007] Preferably, determining the safe state that the current electric drive system needs to enter based on the type includes:

[0008] In the event of a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safety state.

[0009] Preferably, determining the safe state that the current electric drive system needs to enter based on the type includes:

[0010] In the event of at least one of the following: phase current range verification fault, phase current sum verification fault, resolver range verification fault, resolver square sum verification fault, the electric drive system is controlled to enter either the pre-stage ASC / FW safety state or the post-stage ASC safety state.

[0011] Preferably, the method further includes:

[0012] Determine the hardware information of the front-end ASC / FW security status or the rear-end ASC security status;

[0013] If the hardware information is faulty, it is determined that the electric drive system is faulty.

[0014] Preferably, determining the safe state that the current electric drive system needs to enter based on the type includes:

[0015] In the event of a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safety state.

[0016] Determine whether the electric drive system can enter a torque-limiting control safety state;

[0017] If the electric drive system is unable to enter the torque-limiting control safety state, control the electric drive system to enter the preceding ASC / FW safety state;

[0018] Determine whether the electric drive system can enter the front-stage ASC / FW safe state;

[0019] If the electric drive system is unable to enter the preceding ASC / FW safety state, the electric drive system is controlled to enter the following ASC safety state.

[0020] On the other hand, the present invention provides a system for a safety state switching strategy of an electric drive system, comprising:

[0021] The fault diagnosis module is used to determine the type of unexpected torque safety fault.

[0022] The selection module is used to determine the safety state that the current electric drive system needs to enter based on the type.

[0023] A safety status determination module is used to provide the safety status.

[0024] Preferably, the selection entry module is used for:

[0025] In the event of a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safety state.

[0026] Preferably, the selection entry module is used for:

[0027] In the event of at least one of the following: phase current range verification fault, phase current sum verification fault, resolver range verification fault, resolver square sum verification fault, the electric drive system is controlled to enter either the pre-stage ASC / FW safety state or the post-stage ASC safety state.

[0028] Preferably, the system includes a self-test module for:

[0029] Determine the hardware information of the front-end ASC / FW security status or the rear-end ASC security status;

[0030] If the hardware information is faulty, it is determined that the electric drive system is faulty.

[0031] Preferably, the system includes a security status monitoring module, used for:

[0032] In the event of a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safety state.

[0033] Determine whether the electric drive system can enter a torque-limiting control safety state;

[0034] If the electric drive system is unable to enter the torque-limiting control safety state, control the electric drive system to enter the preceding ASC / FW safety state;

[0035] Determine whether the electric drive system can enter the front-stage ASC / FW safe state;

[0036] If the electric drive system is unable to enter the preceding ASC / FW safety state, the electric drive system is controlled to enter the following ASC safety state.

[0037] Through the above technical solution, the method and system can quickly and reasonably switch the safety state according to the fault type when an electric vehicle experiences an unexpected torque-related fault; and can enter the next level of safety state according to the preset if the corresponding safety state fails to enter; it has good engineering application value, and while achieving safety protection, it reduces the negative impact of the safety state on the electric drive system, ensures the driver's driving comfort and avoids unnecessary safety hazards.

[0038] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0039] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0040] Figure 1 This is a flowchart of a method for a safety state switching strategy of an electric drive system according to an embodiment of the present invention.

[0041] Figure 2 This is a schematic block diagram of a method for a safety state switching strategy of an electric drive system according to an embodiment of the present invention;

[0042] Figure 3 This is a block diagram of a safety state switching strategy for an electric drive system according to an embodiment of the present invention. Detailed Implementation

[0043] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0044] like Figure 1 The diagram shows a flowchart of a method for a safety state switching strategy in an electric drive system according to an embodiment of the present invention. Figure 1 In this method, the method includes:

[0045] In step S10, the type of unexpected torque safety fault is determined.

[0046] In step S11, the safety state that the current electric drive system needs to enter is determined according to the type.

[0047] exist Figure 1In step S10, the type of unexpected torque safety fault is determined. The types of unexpected torque safety fault may include CAN signal E2E fault, unexpected torque fault, phase current range verification fault, phase current sum verification fault, resolver range verification fault, resolver square sum verification fault, etc.

[0048] Step S11 is used to determine the safety state that the electric drive system needs to enter based on the type of unexpected torque safety fault, and to switch the safety state reasonably. The safety state may include the torque limiting control safety state, the front-stage ASC / FW safety state, and the rear-stage ASC safety state.

[0049] Through the above technical methods, the designed safety state switching strategy can reasonably select the most suitable safety state according to the current operating conditions. While achieving safety protection, it can reduce the negative impact of the safety state on the electric drive system, ensure the driver's driving comfort, and avoid unnecessary safety hazards.

[0050] exist Figure 1 In one embodiment of the present invention, to ensure a reasonable switching of safety states, when determining the safety state that the electric drive system needs to enter based on its type, if a CAN signal E2E fault and / or an unexpected torque fault are encountered, the electric drive system should be able to enter a torque-limiting control safety state. CAN signal E2E faults can include three types: Rolling Count, Checksum, and Timeout verification faults. Within a driving cycle, if the receiver receives 5 consecutive Rolling Count error frames, a Rolling Count fault is determined; if the receiver receives 5 consecutive Checksum error frames, a Checksum fault is determined; if 10 consecutive frames are not received, a Timeout fault is determined. Unexpected torque faults can include unexpected acceleration, unexpected deceleration, unexpected reversal, and unexpected start faults. Upon encountering the above faults, the electric drive system should immediately switch to the torque-limiting control safety state.

[0051] exist Figure 1In one embodiment of the present invention, in order to ensure that the safety state can be switched reasonably, when the safety state that the current electric drive system needs to enter is determined according to the type, if at least one of the following is encountered: phase current range verification fault, phase current sum verification fault, resolver range verification fault, and resolver square sum verification fault, the electric drive system should be able to be controlled to enter the pre-stage ASC / FW safety state or the post-stage ASC safety state; at the same time, when the current operating condition is low speed, it enters the FW safety state, and when the current operating condition is high speed, it enters the ASC safety state, and the ASC / FW safety state is switched in real time according to the rotational speed. Phase current range verification faults can include situations where the current range of phase U, phase V, and phase W exceeds the upper or lower limit; phase current sum verification faults can refer to situations where the current sum and absolute value exceed the range (>90A) 150 times within a 200ms sliding window during detection; resolver range verification faults can include resolver sampling sine signal amplitude exceeding the range, resolver sampling cosine signal amplitude exceeding the range, sine signal amplitude offset exceeding the range, cosine signal amplitude offset exceeding the range, resolver signal degradation fault, resolver signal loss fault, resolver signal excitation fault, resolver signal sampling out-of-range verification fault, and resolver excitation signal sampling out-of-range verification fault; resolver square sum verification faults refer to situations where the sum of the squares of the cosine or sine of the resolver angle exceeds the set range; when encountering the above faults, the electric drive system should immediately switch to the front-end ASC / FW safety state or the rear-end ASC safety state.

[0052] exist Figure 1 In one embodiment of the present invention, to ensure that the electric drive system can enter the pre-stage ASC / FW safety state or the post-stage ASC safety state, the method can determine the hardware information of the pre-stage ASC / FW safety state or the post-stage ASC safety state. If the hardware information is faulty, it is determined that the electric drive system is faulty. During the initialization of the electric drive system, it can be confirmed whether the shutdown path is activated by inputting a fault into the electric drive system. At the same time, the fault injected during the detection is cleared after the detection is completed. This ensures the accessibility of the pre-stage ASC / FW safety state or the post-stage ASC safety state, facilitating the operation of the electric drive system.

[0053] like Figure 2 The diagram shown is a schematic block diagram illustrating the safety state switching method of an electric drive system safety state switching strategy according to an embodiment of the present invention. Figure 2In order to ensure that the electric drive system can enter a safe state in a timely manner and to avoid unreasonable switching to a safe state or even failing to enter a safe state due to certain factors after an unexpected torque safety-related fault occurs, in one embodiment of the present invention, when encountering a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safe state; it is determined whether the electric drive system can enter the torque-limiting control safe state; if the electric drive system cannot enter the torque-limiting control safe state, it is controlled to enter the preceding ASC / FW safe state; it is determined whether the electric drive system can enter the preceding ASC / FW safe state; if the electric drive system cannot enter the preceding ASC / FW safe state, it is controlled to enter the subsequent ASC safe state. When switching to the corresponding safe state fails, the system sequentially enters the next safe state. Simultaneously, after completing the safety state switching, the electric drive system can also report the relevant execution information of the safe state to the assembly control system, thereby enabling the assembly control system to monitor the electric drive system throughout the entire process.

[0054] On the other hand, the present invention also provides a system for a safety state switching strategy for an electric drive system, such as... Figure 3 The diagram shown is a block diagram of a safety state switching strategy for an electric drive system according to an embodiment of the present invention. Figure 2 and Figure 3 The system may include a fault diagnosis module, an entry selection module, and a safety status judgment module. Specifically, the fault diagnosis module determines the type of unexpected torque safety fault, the entry selection module determines the required safety status for the electric drive system based on the type, and the safety status judgment module provides the safety status. Unexpected torque safety fault types may include CAN signal E2E faults, unexpected torque faults, phase current range verification faults, phase current sum verification faults, resolver range verification faults, and resolver square sum verification faults. Safety statuses may include torque limit control safety status, pre-stage ASC / FW safety status, and post-stage ASC safety status. After the fault diagnosis module determines the faults, the entry selection module selects the appropriate entry point based on the fault, and the safety status judgment module determines the corresponding safety status. Furthermore, after completing the safety status switch, the electric drive system can report the relevant execution information of the safety status to the powertrain control system, enabling the powertrain control system to monitor the electric drive system throughout the entire process.

[0055] Through the aforementioned technical system, various modules within the system can rationally select the most suitable safety state based on the current operating conditions. While achieving safety protection, this reduces the negative impact of the safety state on the electric drive system, ensuring the driver's driving comfort and avoiding unnecessary safety hazards.

[0056] exist Figure 3 In one embodiment of the present invention, to ensure a reasonable switching of the safety state, when the selection module encounters a CAN signal E2E fault and / or an unexpected torque fault, it should be able to control the electric drive system to enter the torque-limiting control safety state. CAN signal E2E faults can include three types: Rolling Count, Checksum, and Timeout verification faults. Within a driving cycle, if the receiver receives 5 consecutive Rolling Count error frames, a Rolling Count fault is determined; if the receiver receives 5 consecutive Checksum error frames, a Checksum fault is determined; if 10 consecutive frames are not received, a timeout fault is determined. Unexpected torque faults can include unexpected acceleration, unexpected deceleration, unexpected reversal, and unexpected start faults. Upon encountering the above faults, the electric drive system should immediately switch to the torque-limiting control safety state.

[0057] exist Figure 3 In one embodiment of the present invention, in order to ensure that the safety state can be switched reasonably, when the selection module encounters at least one of the following types of faults: phase current range verification fault, phase current sum verification fault, resolver range verification fault, and resolver square sum verification fault, the electric drive system should be able to enter either the pre-stage ASC / FW safety state or the post-stage ASC safety state. At the same time, when the current operating condition is low speed, it enters the FW safety state, and when the current operating condition is high speed, it enters the ASC safety state. The ASC / FW safety state is switched in real time according to the rotational speed. Phase current range verification faults can include situations where the current range of phase U, phase V, and phase W exceeds the upper or lower limit; phase current sum verification faults can refer to situations where the current sum and absolute value exceed the range (>90A) 150 times within a 200ms sliding window during detection; resolver range verification faults can include resolver sampling sine signal amplitude exceeding the range, resolver sampling cosine signal amplitude exceeding the range, sine signal amplitude offset exceeding the range, cosine signal amplitude offset exceeding the range, resolver signal degradation fault, resolver signal loss fault, resolver signal excitation fault, resolver signal sampling out-of-range verification fault, and resolver excitation signal sampling out-of-range verification fault; resolver square sum verification faults refer to situations where the sum of the squares of the cosine or sine of the resolver angle exceeds the set range; when encountering the above faults, the electric drive system should immediately switch to the front-end ASC / FW safety state or the rear-end ASC safety state.

[0058] exist Figure 3In one embodiment of the present invention, to ensure that the electric drive system can enter the pre-stage ASC / FW safety state or the post-stage ASC safety state, the system may further include a self-test module. This module can determine the hardware information of the pre-stage ASC / FW safety state or the post-stage ASC safety state, and if a hardware fault exists, it determines that the electric drive system is faulty. During the initialization of the electric drive system, by inputting a fault into the electric drive system, it can be confirmed whether the shutdown path is activated, thereby ensuring the accessibility of the pre-stage ASC / FW safety state or the post-stage ASC safety state, ensuring the normal operation of the hardware information, and clearing the fault injected during the detection after the detection is completed, facilitating the operation of the electric drive system.

[0059] exist Figure 2 and Figure 3 In order to ensure that the electric drive system can enter the safe state in a timely manner and to avoid unreasonable switching to the safe state or even failing to enter the safe state due to certain factors after an unexpected torque safety-related fault occurs, in one embodiment of the present invention, the system may further include a safety state monitoring module. When encountering a CAN signal E2E fault and / or an unexpected torque fault, the selection module controls the electric drive system to enter the torque-limiting control safe state. The safety state monitoring module determines whether the electric drive system can enter the torque-limiting control safe state. If the electric drive system cannot enter the torque-limiting control safe state, the safety state monitoring module controls the electric drive system to enter the preceding ASC / FW safe state. The safety state monitoring module determines whether the electric drive system can enter the preceding ASC / FW safe state. If the electric drive system cannot enter the preceding ASC / FW safe state, the safety state monitoring module controls the electric drive system to enter the subsequent ASC safe state. And when switching to the corresponding safe state fails, it sequentially enters the next safe state.

[0060] Through the above technical solution, the method and system can quickly and reasonably switch safety states according to the fault type when an electric vehicle experiences an unexpected torque-related fault; and can enter the next level of safety state according to a preset method if the corresponding safety state fails to be entered; it has good engineering application value, and while achieving safety protection, it reduces the negative impact of the safety state on the electric drive system, ensures the driver's driving comfort, and avoids unnecessary safety hazards.

[0061] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0062] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for a safety state switching strategy in an electric drive system, characterized in that, include: Identify the types of safety faults caused by unexpected torque; Determine the safe state that the current electric drive system needs to enter based on the aforementioned type; In the event of a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safety state. In the event of at least one of the following: phase current range verification fault, phase current sum verification fault, resolver range verification fault, resolver square sum verification fault, the electric drive system is controlled to enter either the pre-stage ASC / FW safety state or the post-stage ASC safety state. In the event of a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safety state. Determine whether the electric drive system can enter a torque-limiting control safety state; If the electric drive system is unable to enter the torque-limiting control safety state, control the electric drive system to enter the preceding ASC / FW safety state; Determine whether the electric drive system can enter the front-stage ASC / FW safe state; If the electric drive system is unable to enter the preceding ASC / FW safety state, the electric drive system is controlled to enter the following ASC safety state.

2. The method according to claim 1, characterized in that, The method further includes: Determine the hardware information of the front-end ASC / FW security status or the rear-end ASC security status; If the hardware information is faulty, it is determined that the electric drive system is faulty.

3. A system for a safety state switching strategy of an electric drive system, characterized in that, include: The fault diagnosis module is used to determine the type of unexpected torque safety fault. The selection module is used to determine the safety state that the current electric drive system needs to enter based on the type. A security status determination module is used to provide the security status; The selected entry module is used to control the electric drive system to enter a torque-limiting control safety state in the event of a CAN signal E2E fault and / or an unexpected torque fault. The selection entry module is used to control the electric drive system to enter the pre-stage ASC / FW safety state or the post-stage ASC safety state when at least one of the following conditions is met: phase current range verification fault, phase current sum verification fault, resolver range verification fault, and resolver square sum verification fault. The system includes a security status monitoring module for: In the event of a CAN signal E2E fault and / or an unexpected torque fault, the electric drive system is controlled to enter a torque-limiting control safety state. Determine whether the electric drive system can enter a torque-limiting control safety state; If the electric drive system is unable to enter the torque-limiting control safety state, control the electric drive system to enter the preceding ASC / FW safety state; Determine whether the electric drive system can enter the front-stage ASC / FW safe state; If the electric drive system is unable to enter the preceding ASC / FW safety state, the electric drive system is controlled to enter the following ASC safety state.

4. The system according to claim 3, characterized in that, The system includes a self-test module, used for: Determine the hardware information of the front-end ASC / FW security status or the rear-end ASC security status; If the hardware information is faulty, it is determined that the electric drive system is faulty.

Images