A method for power-on self-test on a safety path of a motor controller

Abstract

The application relates to a safety path power-on self-test method of a motor controller, and the steps comprise the following: after power-on, the main safety path input signal and the power drive unit output signal are detected; if the main safety path input signal or the main safety path output signal does not conform to the first preconfigured state, the path failure is reported; if the standby safety path input signal and the power drive unit output signal are in the off state, the next step is executed; if the standby safety path input signal or the standby safety path output signal does not conform to the second preconfigured state, the path failure is reported; if the redundant safety path input signal and the power drive unit output signal are in the off state, the next step is executed; if the redundant safety path input signal or the redundant safety path output signal does not conform to the third preconfigured state, the path failure is reported. Compared with the prior art, the application has the advantages of automatically detecting the safety path integrity and being easy to implement.

Description

Technical Field

[0001] This invention relates to the field of safety path self-test methods, and in particular to a safety path power-on self-test method for a motor controller. Background Technology

[0002] With technological advancements, automotive performance and functional requirements are increasing, leading to greater vehicle complexity. To ensure safety in complex systems, the International Organization for Standardization (ISO) published ISO 26262, "Functional Safety Standard for Road Vehicles," to improve vehicle safety. Currently, global OEMs, Tier 1 component manufacturers, automotive chip suppliers, and development tool vendors have begun incorporating the ISO 26262 standard into their product development to ensure compliance with functional safety standards. Compliance with functional safety standards and obtaining third-party certifications have become standard practice for companies, and products that do not meet functional safety requirements face significant disadvantages in bidding. Automotive component suppliers are correspondingly launching products that comply with functional safety standards to meet customers' ASIL C and even ASIL D automotive safety integrity level requirements.

[0003] The motor controller is the core power control system of an electric vehicle. During driving, if certain system components fail, leading to unexpected torque output from the motor or unexpected DC bus overvoltage, it could directly or indirectly cause safety hazards to personnel. Motor controllers must meet ASIL C or even ASIL D requirements, and the diagnosis of potential dual-point failures must also meet certain coverage requirements. Current electric vehicle safety systems are configured with a primary safety path, a backup safety path, and a high-voltage redundant safety path to ensure the electric vehicle enters the corresponding safe state in the event of a fault. However, due to potential hidden faults in these three safety paths, they cannot meet the high requirements of vehicle safety integrity. If a problem occurs in a safety path before driving begins and cannot be diagnosed, when a fault occurs in the electric vehicle, although protection is triggered, it cannot effectively enter the corresponding safe state of the safety path. Therefore, it is necessary to design a method that can perform self-checks on the safety path after the electric vehicle is powered on. Summary of the Invention

[0004] The purpose of this invention is to overcome the defects of the prior art by providing an easy-to-implement method for automatically detecting the integrity of the safety path of a motor controller during power-on self-test.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] A method for power-on self-test of a motor controller with a safe path, comprising the following steps:

[0007] S1. After power-on, the main control module detects the main safety path input signal received by the power drive unit and the output signal of the power drive unit through the drive logic combination processing unit. If the main safety path input signal and the output signal of the power drive unit are in the off state, step S2 is executed.

[0008] S2. After receiving the main safety enable signal sent by the main control module, the main safety path conditioning module sends the main safety path input signal to the power drive unit. After receiving the main safety path input signal, the power drive unit sends the main safety path output signal to the power module. The main control module detects the main safety path input signal and the main safety path output signal through the drive logic combination processing unit. If the main safety path input signal or the main safety path output signal does not conform to the first pre-configuration state, the main safety path fault is reported and step S3 is executed. Otherwise, step S3 is executed directly.

[0009] S3. Turn off the main safety enable signal. The main control module detects the backup safety path input signal received by the power drive unit and the output signal of the power drive unit through the drive logic combination processing unit. If the backup safety path input signal and the output signal of the power drive unit are in the off state, execute step S4.

[0010] S4. After receiving the overvoltage fault signal sent by the main control module, the high-voltage side logic processing unit sends an overvoltage signal to the digital signal isolation unit. After receiving the overvoltage signal, the digital signal isolation unit sends a high-voltage overvoltage signal to the backup safety logic processing unit. After receiving the high-voltage overvoltage signal and the status signal of the enabled independent monitoring chip, the backup safety path input signal is sent to the power drive unit. After receiving the backup safety path input signal, the power drive unit sends a backup safety path output signal to the power module. The main control module detects the backup safety path input signal and the backup safety path output signal through the drive logic combination processing unit. If the backup safety path input signal or the backup safety path output signal does not conform to the second pre-configuration state, a backup safety path fault is reported and step S5 is executed. Otherwise, step S5 is executed directly.

[0011] S5. Turn off the overvoltage fault signal and the status signal of the independent monitoring chip. The main control module detects the redundant safety path input signal received by the power drive unit and the output signal of the power drive unit through the drive logic combination processing unit. If the redundant safety path input signal and the output signal of the power drive unit are in the off state, execute step S6.

[0012] S6. After receiving the overvoltage fault signal and undervoltage signal from the main control module, the high-voltage side logic processing unit sends a redundant safety path input signal to the power drive unit. After receiving the redundant input signal from the power drive unit, the power drive unit sends a redundant safety path output signal to the power module. The main control module detects the redundant safety path input signal and the redundant safety path output signal through the drive logic combination processing unit. If the redundant safety path input signal or the redundant safety path output signal does not conform to the third pre-configuration state, a redundant safety path fault is reported, and the overvoltage fault signal and undervoltage signal are turned off. Otherwise, the overvoltage fault signal and undervoltage signal are directly turned off.

[0013] Furthermore, the method also includes:

[0014] In step S1, after power-on, the main control module detects the main safety path input signal received by the power drive unit and the output signal of the power drive unit through the drive logic combination processing unit. If the main safety path input signal or the output signal of the power drive unit is not in the off state, a path fault is reported.

[0015] Furthermore, the method also includes:

[0016] In step S3, after the main safety enable signal is turned off, the main control module detects the output signal of the power drive unit through the drive logic combination processing unit. If the output signal of the power drive unit is not in the off state, a path fault is reported.

[0017] Furthermore, the method also includes:

[0018] In step S5, after shutting down the overvoltage fault signal and the status signal of the independent monitoring chip, the main control module detects the output signal of the power drive unit through the drive logic combination processing unit. If the output signal of the power drive unit is not in the off state, a path fault is reported.

[0019] Furthermore, the shutdown state is when the signal is off and the shutdown time exceeds a first time threshold.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] (1) Self-tests were implemented on the main safety path, backup safety path and high-voltage redundant safety path after power-on. By eliminating the influence of the other two paths on the remaining path, the feasibility of one path was tested separately, ensuring the integrity of the safety path and the accuracy of the safety path self-test, and meeting the requirements of the higher level of safety integrity of functional safety vehicles for the diagnosis of hidden faults.

[0022] (2) The self-test signal is enabled by the main control module. The self-test circuit is simple, easy to implement and highly portable, making it easy to debug and promote its application. Attached Figure Description

[0023] Figure 1 This is a flowchart of the present invention;

[0024] Figure 2 This is a circuit diagram of the safe path self-test of the present invention;

[0025] In the diagram, M1 is the main control module, M2 is the main safety path conditioning module, M3 is the power module, U1 is the drive logic combination processing unit, U2 is the power drive unit, U3 is the backup safety logic processing unit, U4 is the high-voltage side logic processing unit, and U5 is the digital signal isolation unit. Detailed Implementation

[0026] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0027] The circuit structure of the present invention is as follows: Figure 2 As shown.

[0028] This embodiment provides a method for a safe path power-on self-test of a motor controller, such as... Figure 1 As shown, the steps include:

[0029] S1. After power-on, the main control module M1 detects the main safety path input signal and the output signal of the power drive unit U2 received by the power drive unit U2 through the drive logic combination processing unit U1. If the main safety path input signal and the output signal of the power drive unit U2 are in the off state, step S2 is executed.

[0030] S2. After receiving the main safety enable signal sent by the main control module M1, the main safety path conditioning module M2 sends the main safety path input signal to the power drive unit U2. After receiving the main safety path input signal, the power drive unit U2 sends the main safety path output signal to the power module M3. The main control module M1 detects the main safety path input signal and the main safety path output signal through the drive logic combination processing unit U1. If the main safety path input signal or the main safety path output signal does not conform to the first pre-configuration state, it reports a main safety path fault and executes step S3. Otherwise, if the main safety path input signal and the main safety path output signal conform to the first pre-configuration state, it directly executes step S3.

[0031] S3. Turn off the main safety enable signal. The main control module M1 detects the backup safety path input signal and the output signal of the power drive unit U2 through the drive logic combination processing unit U1. If the backup safety path input signal and the output signal of the power drive unit U2 are in the off state, execute step S4.

[0032] S4. After receiving the overvoltage fault signal sent by the main control module M1, the high-voltage side logic processing unit U4 sends an overvoltage signal to the digital signal isolation unit U5. After receiving the overvoltage signal, the digital signal isolation unit U5 sends a high-voltage overvoltage signal to the backup safety logic processing unit U3. After receiving the high-voltage overvoltage signal and the status signal of the enabled independent monitoring chip, the backup safety path input signal is sent to the power drive unit U2. After receiving the backup safety path input signal, the power drive unit U2 sends a backup safety path output signal to the power module M3. The main control module M1 detects the backup safety path input signal and the backup safety path output signal through the drive logic combination processing unit U1. If the backup safety path input signal or the backup safety path output signal does not conform to the second pre-configuration state, a backup safety path fault is reported and step S5 is executed. Otherwise, if the backup safety path input signal and the backup safety path output signal conform to the second pre-configuration state, step S5 is executed directly.

[0033] S5. Turn off the overvoltage fault signal and the status signal of the independent monitoring chip. The main control module M1 detects the redundant safety path input signal and the output signal of the power drive unit U2 through the drive logic combination processing unit U1. If the redundant safety path input signal and the output signal of the power drive unit U2 are in the off state, execute step S6.

[0034] S6. After receiving the overvoltage fault signal and undervoltage signal from the main control module M1, the high-voltage side logic processing unit U4 sends a redundant safety path input signal to the power drive unit U2. After receiving the redundant input signal from the power drive unit, the power drive unit U2 sends a redundant safety path output signal to the power module M3. The main control module M1 detects the redundant safety path input signal and the redundant safety path output signal through the drive logic combination processing unit U1. If the redundant safety path input signal or the redundant safety path output signal does not conform to the third pre-configuration state, a redundant safety path fault is reported, and the overvoltage fault signal and the undervoltage signal are turned off. Conversely, if the redundant safety path input signal and the redundant safety path output signal conform to the third pre-configuration state, the overvoltage fault signal and the undervoltage signal are directly turned off.

[0035] In step S1 of some embodiments, the main control module M1 detects the main safety path input signal and the output signal of the power drive unit U2 received by the drive logic combination processing unit U1. If the main safety path input signal or the output signal of the power drive unit U2 is not in a shutdown state, a path fault is reported and the self-test ends.

[0036] In step S3 of some embodiments, after the main safety enable signal is turned off, the main control module M1 detects the output signal of the power drive unit U2 through the drive logic combination processing unit U1. If the output signal of the power drive unit U2 is not in the off state, a path fault is reported and step S5 is executed.

[0037] In step S3 of some embodiments, after the main safety enable signal is turned off, the main control module M1 detects the output signal of the power drive unit U2 through the drive logic combination processing unit U1. If the output signal of the power drive unit U2 is not in the off state, the overvoltage fault signal, the independent monitoring chip status signal and the low voltage / undervoltage signal are turned off. After being turned off, if the output signal of the power drive unit U2 is in the off state, step S4 is executed. If the output signal of the power drive unit is still not in the off state, a path fault is reported and step S5 is executed.

[0038] In step S5 of some embodiments, after shutting down the overvoltage fault signal and the independent monitoring chip status signal, the main control module M1 detects the output signal of the power drive unit U2 through the drive logic combination processing unit U1. If the output signal of the power drive unit U2 is not in the off state, a path fault is reported.

[0039] In step S5 of some embodiments, after shutting down the overvoltage fault signal and the independent monitoring chip status signal, the main control module M1 detects the output signal of the power drive unit U2 through the drive logic combination processing unit U1. If the output signal of the power drive unit U2 is not in a shutdown state, the main safety enable signal is shut down. After shutdown, if the output signal of the power drive unit U2 is in a shutdown state, step S6 is executed. If the output signal of the power drive unit U2 is still not in a shutdown state, a path fault is reported.

[0040] In some embodiments, when the signal is turned off and the off time exceeds a first time threshold, it is determined that the signal is in an off state.

[0041] In some embodiments, when a signal is turned off, it is immediately determined that the signal is in an off state.

[0042] In some embodiments, the drive logic combination processing unit U1, the main safety path conditioning module M2, the backup safety logic processing unit U3, the high-voltage side logic processing unit U4, and the digital signal isolation unit U5 are processing units composed of commonly used gate circuits.

[0043] In some embodiments, the drive logic combination processing unit U1, the main safety path conditioning module M2, the backup safety logic processing unit U3, the high-voltage side logic processing unit U4, and the digital signal isolation unit U5 are software-implemented processing units.

[0044] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for power-on self-test of a motor controller with a safe path, characterized in that the steps include: include: S1. After power-on, the main control module (M1) detects the main safety path input signal and the output signal of the power drive unit (U2) received by the power drive unit (U2) through the drive logic combination processing unit (U1). If the main safety path input signal and the output signal of the power drive unit (U2) are in the off state, step S2 is executed. S2. After receiving the main safety enable signal sent by the main control module (M1), the main safety path conditioning module (M2) sends the main safety path input signal to the power drive unit (U2). After receiving the main safety path input signal, the power drive unit (U2) sends the main safety path output signal to the power module (M3). The main control module (M1) detects the main safety path input signal and the main safety path output signal through the drive logic combination processing unit (U1). If the main safety path input signal or the main safety path output signal does not conform to the first pre-configuration state, a main safety path fault is reported and step S3 is executed. Otherwise, step S3 is executed directly. S3. Turn off the main safety enable signal. The main control module (M1) detects the backup safety path input signal and the output signal of the power drive unit (U2) received by the power drive unit (U2) through the drive logic combination processing unit (U1). If the backup safety path input signal and the output signal of the power drive unit (U2) are in the off state, execute step S4. S4. After receiving the overvoltage fault signal sent by the main control module (M1), the high-voltage side logic processing unit (U4) sends an overvoltage signal to the digital signal isolation unit (U5). After receiving the overvoltage signal, the digital signal isolation unit (U5) sends a high-voltage overvoltage signal to the backup safety logic processing unit (U3). After receiving the high-voltage overvoltage signal and the status signal of the enabled independent monitoring chip, the backup safety path input signal is sent to the power drive unit (U2). After receiving the backup safety path input signal, the power drive unit (U2) sends a backup safety path output signal to the power module (M3). The main control module (M1) detects the backup safety path input signal and the backup safety path output signal through the drive logic combination processing unit (U1). If the backup safety path input signal or the backup safety path output signal does not conform to the second pre-configuration state, a backup safety path fault is reported and step S5 is executed. Otherwise, step S5 is executed directly. S5. Turn off the overvoltage fault signal and the status signal of the independent monitoring chip. The main control module (M1) detects the redundant safety path input signal and the output signal of the power drive unit (U2) received by the power drive unit (U2) through the drive logic combination processing unit (U1). If the redundant safety path input signal and the output signal of the power drive unit (U2) are in the off state, execute step S6. S6. After receiving the overvoltage fault signal and undervoltage signal from the main control module (M1), the high-voltage side logic processing unit (U4) sends a redundant safety path input signal to the power drive unit (U2). After receiving the redundant input signal from the power drive unit, the power drive unit (U2) sends a redundant safety path output signal to the power module (M3). The main control module (M1) detects the redundant safety path input signal and the redundant safety path output signal through the drive logic combination processing unit (U1). If the redundant safety path input signal or the redundant safety path output signal does not conform to the third pre-configuration state, a redundant safety path fault is reported, and the overvoltage fault signal and undervoltage signal are turned off. Otherwise, the overvoltage fault signal and undervoltage signal are directly turned off.

2. The method for power-on self-test of a motor controller with a safe path according to claim 1, characterized in that, The method also includes: In step S1, after power-on, the main control module (M1) detects the main safety path input signal received by the power drive unit (U2) and the output signal of the power drive unit (U2) through the drive logic combination processing unit (U1). If the main safety path input signal or the output signal of the power drive unit (U2) is not in the off state, a path fault is reported.

3. The method for power-on self-test of a motor controller with a safe path according to claim 1, characterized in that, The method also includes: In step S3, after the main safety enable signal is turned off, the main control module (M1) detects the output signal of the power drive unit (U2) through the drive logic combination processing unit (U1). If the output signal of the power drive unit (U2) is not in the off state, a path fault is reported.

4. The method for power-on self-test of a motor controller with a safe path according to claim 1, characterized in that, The method also includes: In step S5, after shutting down the overvoltage fault signal and the independent monitoring chip status signal, the main control module (M1) detects the output signal of the power drive unit (U2) through the drive logic combination processing unit (U1). If the output signal of the power drive unit (U2) is not in the off state, a path fault is reported.

5. A method for power-on self-test of a motor controller with a safe path according to any one of claims 1-4, characterized in that, The shutdown state is when the signal is off and the shutdown time exceeds a first time threshold.

Images