Safety diagnostic method and motor control system

Abstract

The application provides a safety diagnosis method and a motor control system. The safety diagnosis method comprises: when it is judged that an abnormality occurs in a voltage sensor, comparing voltage difference values of two paths of voltage sensors and BMS voltage to locate which path of the voltage sensor has an abnormality; and selecting a path of the voltage sensor which has not yet had an abnormality as a main path voltage sensor to limp work. In this way, the BMS voltage signal is introduced to distinguish the abnormal voltage sensor, and the voltage sensor which has not yet had an abnormality is fully utilized to enable the system to continue to operate, so that the problem that in the prior art, it is not possible to distinguish which path of the sensor fails, and the robustness of the system is not strong is solved.

Description

Technical Field

[0001] This invention relates to the field of new energy vehicle technology, and in particular to a safety diagnostic method and a motor control system. Background Technology

[0002] As the market penetration rate of new energy vehicles continues to increase, the cost and robustness requirements of electric vehicles are also constantly rising. As a core component of the electric drive system, the cost of the motor controller is increasing year by year. Simultaneously, motor controller failure can lead to vehicle breakdown, affecting the driving experience, and posing significant safety risks if it occurs on highways or other specific road sections. Currently, electric drive systems typically use motor controllers with two bus voltage sensors to meet functional safety requirements. The main voltage value is used for motor control, while the auxiliary voltage value is used for functional safety verification. If either voltage sensor fails, current methods cannot diagnose which sensor is faulty. The electric drive system can only cut off power output, rendering the vehicle immobile. The strategy block diagram is shown below. Figure 1 As shown.

[0003] In summary, existing technologies cannot distinguish which sensor has failed, nor can they make reasonable use of the unfailed sensors, resulting in weak system robustness. Summary of the Invention

[0004] The purpose of this invention is to provide a safety diagnostic method and a motor control system to solve the problem in the prior art that it is impossible to distinguish which sensor has failed, thus resulting in poor system robustness.

[0005] To address the aforementioned technical problems, this invention provides a safety diagnostic method applied to a motor control system based on two voltage sensors, wherein the two voltage sensors are configured as a main voltage sensor and an auxiliary voltage sensor. The safety diagnostic method includes: when an anomaly is detected in one of the voltage sensors, comparing the voltage difference between the two voltage sensors and the BMS voltage to pinpoint which specific voltage sensor is malfunctioning; and selecting the voltage sensor that has not yet malfunctioned as the main voltage sensor for limp-out operation.

[0006] Optionally, the safety diagnostic method further includes: performing a two-point failure diagnosis during the limp operation phase; and cutting off power to the electric drive system if the two-point failure diagnosis result is a failure.

[0007] Optionally, the safety diagnostic method includes: determining whether the voltage sensor is malfunctioning based on the main and auxiliary circuit voltage diagnostics.

[0008] The main and auxiliary circuit voltage diagnosis includes: main and auxiliary circuit voltage sensor rationality verification. The main and auxiliary circuit voltage sensor rationality verification includes: obtaining a first voltage difference between the main circuit voltage sensor and the auxiliary circuit voltage sensor; if the first voltage difference is less than a first preset difference, whether the voltage sensor is abnormal is determined by other diagnostic results; if the voltage difference is greater than the first preset difference, comparing the voltage difference between the two circuit voltage sensors and the BMS voltage; if a second voltage difference between the main circuit voltage sensor and the BMS voltage is greater than a third voltage difference between the auxiliary circuit voltage sensor and the BMS voltage, the main circuit voltage sensor is determined to be abnormal; and if the third voltage difference is greater than the second voltage difference, the auxiliary circuit voltage sensor is determined to be abnormal.

[0009] Specifically, the actual voltage physical value is calculated based on the sampled value of the voltage sensor for each channel, and the first voltage difference, the second voltage difference, and the third voltage difference are all calculated based on the actual voltage physical value.

[0010] Optionally, the main and auxiliary circuit voltage diagnosis further includes: short-to-ground and short-to-power supply detection, which includes: detecting whether the sampled value of the voltage sensor in each circuit exceeds a first preset range, wherein the minimum value of the first preset range is set based on the theoretical value when the voltage sensor is short-circuited to ground, and the maximum value of the first preset range is set based on the theoretical value when the voltage sensor is short-circuited to power supply; and if it exceeds the first preset range, then the corresponding voltage sensor is determined to be abnormal; otherwise, whether the voltage sensor is abnormal is determined by other diagnostic results.

[0011] Optionally, the main and auxiliary circuit voltage diagnosis further includes: voltage amplitude detection, which includes: determining whether the actual voltage physical value exceeds a second preset range; and if it exceeds the second preset range, determining that the corresponding voltage sensor is abnormal; otherwise, whether the voltage sensor is abnormal is determined by other diagnostic results.

[0012] Optionally, the two-point failure diagnosis includes BMS voltage communication fault detection, which includes: performing checksum verification and communication timeout diagnosis on the BMS voltage. If the checksum verification or communication timeout diagnosis fails, the BMS voltage is determined to be in communication abnormality. The two-point failure diagnosis includes: if two of the following three are abnormal, the result of the two-point failure diagnosis is failure: whether the BMS voltage communication is abnormal, whether the main voltage sensor is abnormal, and whether the auxiliary voltage sensor is abnormal.

[0013] Optionally, the two-point failure diagnosis includes a rationality test, which includes: obtaining a fourth voltage difference between the current main circuit voltage sensor and the BMS voltage; and if the fourth voltage difference is greater than a second preset voltage difference, the result of the two-point failure diagnosis is failure.

[0014] Specifically, the actual voltage physical value is calculated based on the sampled value of the main voltage sensor; the fourth voltage difference is calculated based on the actual voltage physical value.

[0015] Optionally, the safety diagnostic method further includes: if it is determined that two of the voltage sensors are simultaneously malfunctioning, the electric drive system cuts off power.

[0016] Optionally, the motor control system performs motor control based on the signal from the main voltage sensor.

[0017] To address the aforementioned technical problems, the present invention also provides a motor control system, which includes a control module and two voltage sensors. The control module is used to control the motor based on the signals from the two voltage sensors, and the control module is also used to implement the aforementioned safety diagnostic method.

[0018] Compared with existing technologies, the present invention provides a safety diagnostic method and a motor control system. The safety diagnostic method includes: when a voltage sensor is determined to be abnormal, comparing the voltage difference between the voltages of two voltage sensors and the BMS voltage to pinpoint which specific voltage sensor is malfunctioning; and selecting the voltage sensor that has not yet malfunctioned as the main voltage sensor for limp-out operation. This configuration, by introducing the BMS voltage signal to distinguish the malfunctioning voltage sensor and fully utilizing the voltage sensor that has not yet malfunctioned to allow the system to continue operating, solves the problem in existing technologies where it is impossible to distinguish which sensor has failed, leading to weak system robustness. In some embodiments of the present invention, when a single voltage sensor is operating, additional two-point failure diagnosis further ensures the safety of the system. Attached Figure Description

[0019] Those skilled in the art will understand that the accompanying drawings are provided to better understand the invention and do not constitute any limitation on the scope of the invention. Wherein:

[0020] Figure 1 This is a schematic diagram of the safety strategy of a motor control system in the prior art;

[0021] Figure 2 This is a flowchart of a safety diagnosis method according to an embodiment of the present invention;

[0022] Figure 3This is a flowchart of a safety diagnosis method according to an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, advantages, and features of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the drawings are all in a very simplified form and are not drawn to scale, and are only used to facilitate and clarify the explanation of the embodiments of this invention. Furthermore, the structures shown in the drawings are often part of the actual structures. In particular, different figures may emphasize different aspects and may sometimes use different scales.

[0024] As used in this invention, the singular forms “a,” “an,” and “the” include plural objects; the term “or” is generally used to mean “and / or”; the term “a number” is generally used to mean “at least one”; and the term “at least two” is generally used to mean “two or more”. Furthermore, the terms “first,” “second,” and “third” are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as “first,” “second,” or “third” may explicitly or implicitly include one or at least two of that feature. “One end” and “the other end,” as well as “proximal end” and “distal end,” generally refer to two corresponding parts, including not only endpoints. The terms “installed,” “connected,” and “joined” should be interpreted broadly, for example, as a fixed connection, a detachable connection, or an integral part; a mechanical connection or an electrical connection; a direct connection or an indirect connection through an intermediate medium; or a connection within two elements or an interaction between two elements. Furthermore, as used in this invention, the phrase "one element is disposed on another element" generally only indicates that there is a connection, coupling, cooperation, or transmission relationship between the two elements, and the connection, coupling, cooperation, or transmission between the two elements can be direct or indirect through an intermediate element. It should not be construed as indicating or implying a spatial positional relationship between the two elements, i.e., one element can be located arbitrarily inside, outside, above, below, or to one side of the other element, unless otherwise explicitly stated. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0025] The core idea of ​​this invention is to provide a safety diagnostic method and a motor control system to solve the problem in the prior art that it is impossible to distinguish which sensor has failed, thus resulting in poor system robustness.

[0026] The following description refers to the accompanying drawings.

[0027] This embodiment provides a safety diagnostic method applied to a motor control system based on two voltage sensors, designated as a main voltage sensor and an auxiliary voltage sensor. The motor control system is installed in a new energy vehicle. The safety level of the safety diagnostic method is ASIL C. Automotive functional safety levels are defined according to the ISO 26262 standard, used to assess and quantify the risks arising from the failure of automotive electronic and electrical systems, and to guide the requirements for risk reduction to achieve safety objectives. This standard primarily addresses the functional safety of road vehicles, defining a risk classification system, namely the Automotive Safety Integrity Level (ASIL), divided into four levels: A, B, C, and D. ASIL A represents the lowest level of safety integrity, while ASIL D represents the highest level.

[0028] Please refer to Figure 2 The safety diagnostic method includes:

[0029] S10, determine whether the voltage sensor is malfunctioning based on the main and auxiliary circuit voltage diagnosis.

[0030] S20, when it is determined that the voltage sensor is malfunctioning, the voltage difference between the two voltage sensors and the BMS (Battery Management System) voltage is compared to pinpoint which voltage sensor is malfunctioning. The BMS voltage refers to the battery voltage value transmitted by the power battery system via CAN communication; it is a physical value.

[0031] S30, select one of the voltage sensors that has not yet experienced an anomaly as the main voltage sensor and enable it to operate in limp mode.

[0032] S40, during the phase of performing the limp operation, additional two-point failure diagnosis is performed.

[0033] S50, if the diagnosis result of the two-point failure diagnosis is "not passed", then the electric drive system cuts off the power.

[0034] And, S60, if it is determined that two of the voltage sensors are malfunctioning simultaneously, the electric drive system cuts off power.

[0035] When neither voltage sensor fails, the main and auxiliary voltage diagnosis includes: verification of the rationality of the main and auxiliary voltage sensors, short-to-ground and short-to-power supply detection, and voltage amplitude detection.

[0036] The main and auxiliary circuit voltage diagnosis includes: comparing the difference between the main circuit sensor voltage value and the auxiliary circuit sensor voltage value to determine whether a voltage sensor failure has occurred. If there is a large difference between the two voltages, it indicates that a voltage sensor failure has occurred.

[0037] To accurately determine which voltage sensor has failed, a BMS voltage with a functional safety level of at least ASIL B is introduced for diagnosis. If the difference between the main voltage and the BMS voltage is greater than the difference between the auxiliary voltage and the BMS voltage, it indicates that the main voltage sensor has failed. If there is a large difference between the main voltage sensor and the auxiliary voltage sensor, and the difference between the auxiliary voltage and the BMS voltage is greater than the difference between the main voltage and the BMS voltage, it indicates that the auxiliary voltage sensor has failed.

[0038] The above logic can be summarized as follows: the main and auxiliary circuit voltage diagnosis includes: main and auxiliary circuit voltage sensor rationality verification. The main and auxiliary circuit voltage sensor rationality verification includes: obtaining a first voltage difference between the main circuit voltage sensor and the auxiliary circuit voltage sensor; if the first voltage difference is less than a first preset difference, whether the voltage sensor is abnormal is determined by other diagnostic results; if the voltage difference is greater than the first preset difference, comparing the voltage difference between the two circuit voltage sensors and the BMS voltage; if a second voltage difference between the main circuit voltage sensor and the BMS voltage is greater than a third voltage difference between the auxiliary circuit voltage sensor and the BMS voltage, the main circuit voltage sensor is determined to be abnormal; and if the third voltage difference is greater than the second voltage difference, the auxiliary circuit voltage sensor is determined to be abnormal.

[0039] The first voltage difference, the second voltage difference, and the third voltage difference are all calculated based on the sampled values ​​of the voltage sensor.

[0040] The short-to-ground / short-power supply detection includes: when the sensor output is short-circuited to power supply Scb or short-circuited to ground Scg, the MCU samples the AD value U. Sample If the maximum or minimum value is fixed, then by detecting U... Sample Whether it is within a reasonable range can detect whether a short circuit failure has occurred. Short-to-ground and short-supply detection is performed on the main and auxiliary circuit voltage sampling AD values ​​respectively. When U Sample If the value is outside the reasonable range, it indicates that the corresponding sensor has a short circuit fault.

[0041] That is, the short-to-ground and short-to-power detection includes: detecting whether the sampled value of each voltage sensor exceeds a first preset range, wherein the minimum value of the first preset range is set based on the theoretical value when the voltage sensor is short-circuited to ground (but the two are not limited to being equal), and the maximum value of the first preset range is set based on the theoretical value when the voltage sensor is short-circuited to power (but the two are not limited to being equal); and if it exceeds the first preset range, the corresponding voltage sensor is determined to be abnormal; otherwise, whether the voltage sensor is abnormal is determined by other diagnostic results, that is, it is assumed to be normal.

[0042] The voltage amplitude detection includes: voltage out-of-range high detection: if the voltage sensor gain setting is abnormally high or the sensor sampling value is abnormally large, the actual physical voltage value U is obtained. phy A large voltage value indicates that the sensor has an Out-of-range high fault.

[0043] Voltage Out-of-range low detection: When the main relay of the electric drive system is closed and the BMS voltage is high, if the voltage sensor gain setting is abnormally low or the sensor sampling value is abnormally low, the actual physical value of the voltage U obtained will be low. phy If the voltage value is lower than the Out-of-range low threshold, it indicates that the sensor has an Out-of-range low fault.

[0044] Perform out-of-range high and out-of-range low amplitude diagnoses on the actual voltage values ​​of the main and auxiliary circuits respectively. When U phy If the value is outside the reasonable range, it indicates that the corresponding sensor has an amplitude abnormality fault.

[0045] That is, the main and auxiliary circuit voltage diagnosis also includes: voltage amplitude detection, which includes: calculating the actual physical voltage value based on the sampled value of the voltage sensor of each circuit, and determining whether the actual physical voltage value exceeds a second preset range; and if it exceeds the second preset range, determining that the corresponding voltage sensor is abnormal; otherwise, whether the voltage sensor is abnormal is determined by other diagnostic results.

[0046] The actual voltage physical value U phy From the sampled value U Sample Calculated, for example, it can be obtained from U phy =Gain*U Sample The result is calculated, where Gain is the conversion coefficient. In other embodiments, other methods may also be used for calculation.

[0047] When a fault occurs, the motor can continue to work by switching or keeping the main circuit voltage sensor on, improving the robustness of the electric drive system and allowing the vehicle to continue limping.

[0048] The dual-point failure diagnosis includes BMS voltage communication fault detection and rationality detection.

[0049] The BMS voltage communication fault detection includes: performing check code verification and communication timeout diagnosis on the BMS voltage. If the check code verification or communication timeout diagnosis fails, the BMS voltage is judged to be in communication abnormality. The two-point failure diagnosis includes: if two of the following three are abnormal, the result of the two-point failure diagnosis is failure: whether the BMS voltage communication is abnormal, whether the main voltage sensor is abnormal, and whether the auxiliary voltage sensor is abnormal.

[0050] The checksum verification can be performed using methods such as E2E verification or checksum verification. If one voltage sensor fails, and the BMS voltage also experiences communication problems, the BMS voltage becomes unreliable, making it impossible to determine whether the other voltage sensor has failed. For driving safety, the vehicle's power output should be cut off.

[0051] The rationality detection includes: obtaining the fourth voltage difference between the current main voltage sensor and the BMS voltage; and if the fourth voltage difference is greater than the second preset voltage difference, the result of the dual-point failure diagnosis is failure. If the difference is large, it indicates that the remaining voltage sensor has also failed, and the electric drive system motor control has no available high-precision voltage. At this time, for driving safety, the power output of the entire vehicle is cut off.

[0052] The fourth voltage difference is calculated based on the sampled value of the voltage sensor.

[0053] By incorporating the above two detections into the electric drive system diagnostic scheme, when a bus voltage limpness fault is detected, the motor can be controlled to enter an active short-circuit or active open-circuit state, bringing the electric drive system into a safe state. This avoids the occurrence of undesirable torque and meets the functional safety requirements for torque safety in electric drive systems.

[0054] The above logic can also be referenced. Figure 3 To understand, Figure 3 In this context, uTnet represents the output voltage signal of the voltage sensor. Figure 3 It can be seen that the motor control system controls the motor based on the signal from the main voltage sensor. The logic for selecting one of the voltage sensors that has not yet experienced an anomaly as the main voltage sensor includes: if the auxiliary voltage sensor is abnormal, the current main voltage sensor is maintained; if the main voltage sensor is abnormal, the auxiliary voltage sensor is switched to the main voltage sensor.

[0055] This embodiment also provides a motor control system, which includes a control module and two voltage sensors. The control module is used to control the motor based on the signals from the two voltage sensors, and the control module is also used to implement the above-mentioned safety diagnosis method.

[0056] Because the control module employs the aforementioned safety diagnostic method, the motor control system also has sensors capable of detecting faults and its robustness is improved.

[0057] The safety diagnostic method and motor control system provided in this embodiment have the following beneficial effects:

[0058] 1) It can accurately determine which voltage sensor has failed, and can continue to operate after one bus voltage sensor fails, perform fault degradation processing, and switch to another voltage sensor in real time, thereby improving the robustness of the system.

[0059] 2) Based on the system functional safety scheme, the BMS voltage is introduced into the diagnostics, and the diagnostic coverage is increased to achieve the ASIL C functional safety level during limpness.

[0060] In summary, this embodiment provides a safety diagnostic method and a motor control system. The safety diagnostic method includes: when a voltage sensor is determined to be malfunctioning, comparing the voltage differences between the voltages of the two voltage sensors and the BMS voltage to pinpoint which specific voltage sensor is malfunctioning; selecting the voltage sensor that has not yet malfunctioned as the main voltage sensor for limp-out operation. This configuration, by introducing the BMS voltage signal to distinguish the malfunctioning voltage sensor and fully utilizing the voltage sensor that has not yet malfunctioned to allow the system to continue operating, solves the problem in the prior art of not being able to distinguish which sensor has failed, thus leading to weak system robustness. In a preferred embodiment, when a single voltage sensor is operating, additional two-point failure diagnosis further ensures the safety of the system.

[0061] The above description is only a description of preferred embodiments of the present invention and is not intended to limit the scope of the present invention in any way. Any changes or modifications made by those skilled in the art based on the above disclosure shall fall within the protection scope of the present invention.

Claims

1. A safety diagnostic method, characterized in that, The safety diagnostic method, applied to a motor control system based on two voltage sensors (a main voltage sensor and an auxiliary voltage sensor), includes: When it is determined that the voltage sensor is abnormal, the voltage difference between the voltage of the two voltage sensors and the BMS voltage is compared to locate which voltage sensor is abnormal. The voltage sensor is determined to be malfunctioning based on the main and auxiliary circuit voltage diagnosis. The main and auxiliary circuit voltage diagnosis includes: verification of the rationality of the main and auxiliary circuit voltage sensors, which includes: Obtain the first voltage difference between the main voltage sensor and the auxiliary voltage sensor; If the first voltage difference is less than the first preset difference, then whether the voltage sensor is abnormal is determined by other diagnostic results; If the voltage difference is greater than the first preset difference, compare the voltage difference between the voltage of the two voltage sensors and the BMS voltage. If the second voltage difference between the main voltage sensor and the BMS voltage is greater than the third voltage difference between the auxiliary voltage sensor and the BMS voltage, then the main voltage sensor is determined to be abnormal; and, If the third voltage difference is greater than the second voltage difference, the auxiliary voltage sensor is determined to be abnormal. The actual voltage physical value is calculated based on the sampled value of the voltage sensor for each channel, and the first voltage difference, the second voltage difference, and the third voltage difference are all calculated based on the actual voltage physical value. as well as, Select the voltage sensor that has not yet experienced an anomaly as the main voltage sensor and set it for limp operation; The BMS voltage refers to the battery voltage value transmitted by the power battery system via CAN communication.

2. The safety diagnostic method according to claim 1, characterized in that, The safety diagnostic method further includes: performing a two-point failure diagnosis during the limp operation phase; and cutting off power to the electric drive system if the two-point failure diagnosis result is a failure.

3. The safety diagnostic method according to claim 1, characterized in that, The main and auxiliary circuit voltage diagnosis further includes: short-to-ground / short-to-power supply detection, which includes: The sampled value of each voltage sensor is checked to see if it exceeds a first preset range. The minimum value of the first preset range is set based on the theoretical value when the voltage sensor is short-circuited to ground, and the maximum value of the first preset range is set based on the theoretical value when the voltage sensor is short-circuited to the power supply; and, If the voltage exceeds the first preset range, the corresponding voltage sensor is determined to be abnormal; otherwise, whether the voltage sensor is abnormal is determined by other diagnostic results.

4. The safety diagnostic method according to claim 1, characterized in that, The main and auxiliary circuit voltage diagnosis further includes: voltage amplitude detection, which includes: Determine whether the actual voltage physical value exceeds the second preset range; and, If the voltage exceeds the second preset range, the corresponding voltage sensor is determined to be abnormal; otherwise, whether the voltage sensor is abnormal is determined by other diagnostic results.

5. The safety diagnostic method according to claim 2, characterized in that, The two-point failure diagnosis includes BMS voltage communication fault detection, which includes: The BMS voltage is subjected to check code verification and communication timeout diagnosis. If the check code verification or communication timeout diagnosis fails, the BMS voltage is judged to be in communication abnormal. The two-point failure diagnosis includes the following: if two of the following three are abnormal, the result of the two-point failure diagnosis is failure: whether the BMS voltage communication is abnormal, whether the main voltage sensor is abnormal, and whether the auxiliary voltage sensor is abnormal.

6. The safety diagnostic method according to claim 2, characterized in that, The two-point failure diagnosis includes a rationality test, which includes: Obtain the fourth voltage difference between the current main voltage sensor and the BMS voltage; and, If the fourth voltage difference is greater than the second preset voltage difference, the result of the two-point failure diagnosis is failure. Specifically, the actual voltage physical value is calculated based on the sampled value of the main voltage sensor; the fourth voltage difference is calculated based on the actual voltage physical value.

7. The safety diagnostic method according to claim 1, characterized in that, The safety diagnostic method also includes: If it is determined that two of the voltage sensors are malfunctioning simultaneously, the electric drive system will cut off power.

8. The safety diagnostic method according to claim 1, characterized in that, The motor control system controls the motor based on the signal from the main voltage sensor.

9. A motor control system, characterized in that, The motor control system includes a control module and two voltage sensors. The control module is used to control the motor based on the signals from the two voltage sensors. The control module is also used to implement the safety diagnostic method as described in any one of claims 1 to 8.

Images