Inverter for controlling an electric machine, method for operating an inverter, and safety control device

Abstract

The invention relates to an inverter (100) for controlling an electric machine (500), comprising a high-voltage branch (110), a low-voltage branch (120) and a replacement supply branch (130), the high-voltage branch (110) being connected to the low-voltage branch (120) by means of an operating DC voltage converter (10), the low-voltage branch (120) being connected to the replacement supply branch (130) by means of a replacement supply DC voltage converter (20), wherein the inverter circuit (115) is connected to the high-voltage branch (110), the inverter circuit (115) and the safety control device (123) are supplied with energy by the low-voltage branch (120), and the safety control device (123) is arranged to switch the inverter circuit (115) into a safety state in the case of switching off. Wherein the inverter circuit (115) and the safety control device (123) are supplied with energy or can be supplied with energy by the alternative supply branch (130).

Description

Technical Field

[0001] The invention relates to an inverter for controlling an electric machine, a method for operating an inverter and a safety control device. Background Art

[0002] In modern vehicle applications with electric drive, the energy supply circuit of the inverter or in the inverter is also called PDN or PDTN (power distribution network or power distribution network tree, English: Power Distribution Network or Power Distribution Network Tree). The task of this distribution network is to distribute power to the various power devices of the inverter, such as sensors, communication circuits (such as CAN, LIN transceivers), especially the gate driver circuits of high-side (HS) and low-side (LS) switches, and functional safety circuits or MCU (microcontroller unit, English: microcontoller unit), etc. In this sense, an inverter is a device that has an internal energy supply circuit and the components it supplies, including switches, for example in the form of half-bridges, and connections for connecting external power supplies and motors.

[0003] Today, due to functional safety requirements, a PDN may have two main power sources. A common power source for electric vehicles (EVs) is a low-voltage battery (e.g. 12 V), also called a KL30 grid or low-voltage grid. The second power source can be a high-voltage DC battery or a high-voltage DC bus (high-voltage grid) with a nominal voltage of, for example, 800 V or 400 V. Such a high-voltage or high-voltage system can be used in particular as an energy source for electric vehicle drives, such as permanent magnet synchronous motors (PMSMs), which are connected to the high-voltage grid via an inverter.

[0004] In the event of an accident or emergency stop, the inverter should be transferred to a predefined safe state. In order to avoid that the intermediate circuit capacitors are charged by the motor (especially when using PMSM), active short circuit (active short circuit, English: active short circuit, ASC) technology is usually used, in which usually all low-side (LS) switches or all high-side (HS) switches are closed, thus stopping the energy transfer from the motor to the intermediate circuit.

[0005] The present invention aims to improve this concept so that a safe state can be reliably achieved even in the event of problems with the power supply to the components involved. Summary of the invention

[0006] According to the invention, an inverter for controlling an electric machine, in particular an electric machine in a vehicle, a method for operating an inverter and a safety control device are proposed with the features of the independent claims. Advantageous developments are the subject of the dependent claims and the following description. It should be emphasized that the features and advantages described below also apply to the inverter and the method for operating the inverter.

[0007] The invention describes a possibility for improving the power supply in an inverter so that a safe state of an inverter or an electric machine in a vehicle can be reliably achieved even in the event of a fault.

[0008] Specifically, the inverter has at least three different energy supply branches, namely a high-voltage branch, a low-voltage branch and an alternative supply branch. The high-voltage branch is designed to be connected to a high-voltage grid (especially in a vehicle), and the low-voltage branch is designed to be connected to a low-voltage grid (especially in a vehicle), wherein the nominal voltage level of the high-voltage grid is higher than the nominal voltage level of the low-voltage grid. The high-voltage branch and the low-voltage branch have corresponding connections for connecting to the high-voltage grid or the low-voltage grid. These connections are particularly drawn from the housing of the inverter.

[0009] The nominal voltage level of the high-voltage grid (hereinafter also referred to as high-voltage level) can, for example, be significantly higher than the permissible contact voltage of, in particular, 60 V, for example up to several hundred volts. For example, high voltage levels of 400 V or 800 V are often used in current electric vehicles. The nominal voltage levels of the low-voltage grid and the alternative supply branch can in particular be substantially identical, that is, they can differ from each other by a maximum threshold of, for example, 5 V, and can, for example, correspond to common vehicle low voltages, for example 12 V or 24 V.

[0010] The high voltage branch is connected to the low voltage branch by operating the DC voltage converter, and the low voltage branch is connected to the replacement supply branch by a replacement supply DC current converter different from the operating DC voltage converter. In this way, even if there is a problem with the high voltage branch or the operating DC voltage converter, if the DC voltage converter operates accordingly, the electrical equipment in the low voltage branch can also obtain power or energy. If the operating DC voltage converter fails, the replacement supply branch can still be powered. The inverter circuit or rectifier circuit for the motor is connected in the high voltage branch. Since the replacement supply DC voltage converter is powered by the low voltage branch or the low voltage power grid, it has a suitable voltage in principle. It can be easily designed in terms of electrical and safety technology. For example, it can be stipulated that the replacement supply DC voltage converter converts the low voltage of 12V (nominal voltage) into a slightly higher value, such as 15V to 20V, which is more suitable for powering electronic components, etc.

[0011] As is known, an inverter circuit or rectifier circuit is used to connect the AC voltage connection of the electric machine to the DC voltage connection of the high voltage network. To this end, the inverter circuit has a plurality of semiconductor switches, each of which can be opened (non-conducting) and closed (conducting) according to a control signal. The semiconductor switches can include MOSFETs and IGBTs, such as gallium nitride (GaN) or silicon carbide (SiC) FETs.

[0012] The inverter circuit is supplied with energy or power by the low-voltage branch. In one embodiment, the inverter circuit may have a plurality of high-side semiconductor switches and a plurality of low-side semiconductor switches and at least one gate driver circuit for one or more semiconductor switches, respectively, wherein the at least one gate driver circuit for the high-side or low-side semiconductor switch is supplied with energy by the low-voltage branch. The gate driver circuit is used to apply a control signal to the control connection portion (e.g., the gate connection portion of the MOSFET) of the semiconductor switch. In one embodiment, at least the gate driver circuit of the LS semiconductor switch (hereinafter referred to as the LS gate driver circuit) and / or the gate driver circuit of the HS semiconductor switch (hereinafter referred to as the HS gate driver circuit) is supplied by or can be supplied by a replacement supply branch. Therefore, for example, in the case of a fault or failure of the low-voltage branch, a safe state can still be achieved by an active short circuit. At least one gate driver circuit for a high-side or low-side semiconductor switch can be supplied with voltage by at least one bias voltage supply circuit, which is supplied by or can supply energy by a replacement supply branch. Alternatively, at least one gate driver circuit for a high-side or low-side semiconductor switch may also be supplied with energy directly from the alternative supply branch, bypassing the bias voltage supply circuit.

[0013] The inverter also has a safety control device, which is also supplied with energy from the low-voltage branch. The safety control device is set to switch the inverter circuit to a safe state when a shutdown situation exists. This can especially lead to active short circuits (determine the type of active short circuit (HS / LS) and close all HS switches or close all LS switches). In particular, the existence of a shutdown situation is determined when a fault occurs or is detected.

[0014] In order to increase the functional safety, the inverter circuit and the safety controller are now also supplied or can be supplied with energy from the alternative supply branch.

[0015] The method according to the invention for operating an inverter according to the invention comprises bringing the inverter circuit into a safe state in the presence of a switch-off situation.

[0016] In particular, in terms of program and / or circuit technology, a safety control device according to the invention, for example an integrated circuit (eg IC, ASIC or FPGA), is configured to carry out the method according to the invention.

[0017] The invention significantly improves the functional safety of the inverter, which has particular advantages in terms of personal safety, especially in the case of high-voltage branches. The invention requires only a few conventional components to implement and can therefore be implemented very easily and cost-effectively.

[0018] In one embodiment, each of the operating DC voltage converter and the replacement supply DC voltage converter can be a non-insulated DC voltage converter, such as a buck converter (step-down converter, English: buck converter), a synchronous converter, a SEPIC converter (single ended primary inductance converter, English: single ended primary inductance converter), Converter, Zeta converter etc. In non-isolated DC voltage converters there is no galvanic separation between the input grid and the output grid. These are usually cheap to use.

[0019] In one embodiment, each of the operating DC voltage converter and the replacement supply DC voltage converter can also be an isolated DC voltage converter, such as a flyback converter (fly-back converter, English: fly-backconverter), a forward converter (forward converter, English: forward converter), a push-pull flow converter (push-pull converter, English: push-pull converter), etc. The isolated DC voltage converter has a current separation between the input grid and the output grid, which is usually implemented using a transformer. These improve safety, but are more complex in terms of weight, installation space and cost. In the high voltage range (> 60V), it is advantageous to use an isolated DC voltage converter for safety reasons, or, if necessary, an isolated DC voltage converter must be used.

[0020] In one embodiment, a blocking circuit is provided between the low-voltage branch and the replacement supply branch, which blocks the energy flow between the low-voltage branch and the replacement supply branch. This can prevent an error in one of the two branches from affecting the other branch. Such a blocking circuit can, in particular, have one or more diodes and / or switches at an existing connection point if necessary. The switch can comprise a semiconductor switch or a mechanical switch (relay). A connection point can be present if the supplied component (e.g. an inverter circuit) has only one power connection that must be connected or can be connected to the low-voltage branch and the replacement supply branch. This is a very simple measure in terms of design and circuit technology to achieve a universal but non-reacting power supply.

[0021] In one embodiment, the low voltage branch has an inverter branch and a supply branch, wherein the inverter circuit and the safety control device are supplied with energy by the inverter branch, and wherein the supply branch is arranged to be connected to a voltage supply, such as a low voltage grid. A second blocking circuit, such as a diode, is arranged between the inverter branch and the operating DC voltage converter, which prevents energy from flowing from the inverter branch into the operating DC voltage converter, and / or is arranged between the inverter branch and the supply branch, which prevents energy from flowing from the inverter branch into the supply branch. Thus, a fault in the low voltage grid or the operating DC voltage converter can be separated from the inverter branch.

[0022] In one embodiment, the operating DC voltage converter can be separated from the remaining low-voltage branch by a first safety disconnect circuit and / or can be separated from the remaining high-voltage branch by a high-voltage disconnect circuit. Therefore, if a low-voltage branch fails, damage to the operating DC voltage converter or the high-voltage branch can be avoided, or if a fault occurs in the operating DC voltage converter, damage to the low-voltage branch or the high-voltage branch can be avoided.

[0023] In one embodiment, the gate driver circuit for the high-side (HS) semiconductor switch can be separated from the remaining low-voltage branch by the second safety disconnect circuit. Therefore, if the HS gate driver circuit fails, damage to the low-voltage branch can be avoided.

[0024] In one embodiment, the gate driver circuit for the low-side (LS) semiconductor switch can be separated from the remaining low-voltage branch by a third safety disconnect circuit. Therefore, when the LS gate driver circuit fails, damage to the low-voltage branch can be avoided, and when the low-voltage branch fails, damage to the LS gate driver circuit can be avoided. As described above, the LS gate driver circuit is particularly also powered by the replacement supply branch or can be powered by the replacement supply branch, so that in the event of a fault in the low-voltage branch, it can or will be separated.

[0025] In one embodiment, the low voltage branch can be separated from the voltage supply (e.g., the low voltage grid) by a fourth safety disconnect circuit. In particular, the inverter branch can be separated from the replacement supply branch by a fourth safety disconnect circuit. Therefore, in the event of a failure of the low voltage branch, damage to the replacement supply DC voltage converter or the replacement supply branch can be avoided.

[0026] In error-free operation, each of the safety disconnect circuit and the high-voltage disconnect circuit can be closed or turned on so that all branches are connected and function as described above. Each of the safety disconnect circuit and the high-voltage disconnect circuit can be optionally configured to disconnect, i.e. switch to a non-conducting state, in response to an external disconnect signal and / or when an error is detected, for example, when a current value of the current flowing therethrough is exceeded.

[0027] Each of the safety disconnection circuit and the high-voltage disconnection circuit may optionally include one or more semiconductor switches or mechanical switches (relays). In particular, the high-voltage disconnection circuit may also be passively disconnectable and designed in the form of a fuse, such as a blown fuse.

[0028] In one embodiment, the safety control device is arranged to determine the presence of a shutdown condition when at least one of the first, second, third and fourth safety disconnect circuits is in a non-conducting state. This means that a shutdown condition can be reliably detected.

[0029] In one embodiment, the safety control device is arranged to determine the existence of a shutdown situation if the operating DC voltage converter and / or the replacement supply DC voltage converter is faulty. This means that a safe state can be reliably established in such fault situations.

[0030] In one embodiment, the safety control device and / or the inverter circuit each have at least two power supply circuits, wherein the first of the at least two power supply circuits is supplied with energy by a low voltage branch or can be supplied with energy by a low voltage branch and the second of the at least two power supply circuits is supplied with energy by a replacement supply branch or can be supplied with energy by a replacement supply branch. This solution with two (especially redundant) power supply circuits can avoid the connection point between the low voltage branch and the replacement supply branch, which also simplifies or may make the above-mentioned blocking circuit unnecessary. The power supply circuit is used to generate the required voltage in the supplied component from the input voltage (in this case, a low voltage level). Typically, the power supply circuit itself can include a DC voltage converter, a low dropout linear regulator (LDO), etc.

[0031] Further advantages and improvements of the invention are apparent from the description and the accompanying drawings.

[0032] The invention is schematically illustrated in the drawings using exemplary embodiments and is described below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematically shows an embodiment of an inverter according to the present invention;

[0034] Figure 2 Schematically shows another embodiment of the inverter according to the present invention;

[0035] Figure 3 schematically shows an embodiment of an inverter circuit which can be used in an inverter according to the present invention;

[0036] Figure 4 Schematically shows another embodiment of the inverter according to the present invention;

[0037] Figure 5 Schematically shows that Figure 4 Another embodiment of the inverter circuit used in the inverter according to the present invention;

[0038] Figure 6 Schematically shows that Figure 4 Another embodiment of the inverter circuit used in the inverter according to the present invention;

[0039] Figure 7 Schematically shows another embodiment of the inverter according to the present invention;

[0040] Figure 8 Schematically shows another embodiment of the inverter according to the present invention;

[0041] Fig. 9 An embodiment of a safety disconnection circuit which can be used in an inverter according to the invention is schematically shown. DETAILED DESCRIPTION

[0042] The following is a coherent and comprehensive description of the embodiments of the present invention in conjunction with the accompanying drawings. In order to reduce the complexity of the drawings, all connections and signal flows are not shown. The signal flow shown in the figure is for a safe state request (a safe state request or an ASC request for HS and LS gate drivers). The return line or ground line or negative line is also not shown.

[0043] Figure 1 , 2 , 4, 7 and 8 schematically show slightly different embodiments of the inverter 100 according to the invention. In a vehicle, an inverter is generally a component or device that controls an electric machine. The inverter can in particular implement torque and speed control, and convert a DC voltage on the vehicle electrical system side into an AC voltage on the machine side, and during recovery, convert the AC voltage on the machine side back into a DC voltage on the vehicle electrical system side and feed it into the vehicle electrical system.

[0044] The inverter 100 has a high voltage branch 110, a low voltage branch 120 and a replacement supply branch 130 with a low voltage level, the high voltage branch 110 has high voltage connections HV+, HV- for connecting to a high voltage grid with a high voltage level, and the low voltage branch 120 has low voltage connections B+, B- for connecting to a voltage grid with a low voltage level (so-called K1.30 grid). The high voltage level is, for example, in the range of 40V to 1000V. The low voltage level can be, for example, 12V or 24V.

[0045] The high voltage branch 110 is connected to the low voltage branch 120 via an operating DC voltage converter 10 .

[0046] The low voltage branch 120 has an inverter branch 120a and a supply branch 120b, the inverter branch 120a is used in the broadest sense to supply energy to the components of the inverter 1, and the supply branch 120b is connected to the low voltage grid. The inverter branch 120a can also be referred to as a PDN (see above). Via diodes 122a, 122b as a second blocking circuit, the inverter branch 120a is connected to the operating DC voltage converter 10 on one side and to the supply branch 120b on the other side. The supply branch 120b is connected to the replacement supply branch 130 via the replacement supply DC voltage converter 20.

[0047] The inverter circuit 115 is used to connect the (three in the example shown) AC voltage connections U, V, W of the electric machine 500 (which is not part of the inverter 100) to the positive DC voltage connection HV+ and the negative DC voltage connection HV- of the high-voltage branch 110. For this purpose, the inverter circuit 115 may include a logic circuit 118 for generating a control signal and a plurality of semiconductor switches 116a, 116b to be controlled by means of the control signal.

[0048] The inverter 100 has a housing from which the connections HV+, HV-, B+, B-, U, V, W and in particular communication connections (e.g. CAN, LIN, etc.) and / or sensor connections (e.g. speed, angular position, temperature, etc.) and / or other connections are led. The inverter 100 can advantageously be structurally connected to the electric machine 500, i.e. in particular fastened to the electric machine 500.

[0049] The inverter circuit 115 has a so-called high-side HS switch 116a (between each AC voltage connection U, V, W of the motor 500 and the positive DC voltage connection HV+) and a so-called low-side LS switch 116b (between each AC voltage connection U, V, W of the motor 500 and the negative DC voltage connection HV-). In the present case, an HS supply circuit 200 is provided to operate the HS switch 116a, and in the present case, an LS supply circuit 300 is provided to operate the LS switch 116b. The elements of the HS supply circuit 200 and the LS supply circuit 300 are each provided with reference numerals increased by 100 and are described together below.

[0050] Each switch 116a, 116b has a control connection 117 (eg a gate connection of a MOSFET or IGBT), to which a so-called gate driver circuit 210, 310 (hereinafter also simply referred to as a gate driver) applies a control signal for switching the switch.

[0051] The primary side of a modern isolated gate driver typically requires a low voltage supply VCC1. This voltage may typically be 5V or 3.3V and is generated from a low voltage, for example, by a low dropout regulator (LDO) 220, 320.

[0052] In order to switch on and off power semiconductor switches such as SiC-MOSFET and IGBT, each gate driver typically requires two different voltage levels on the secondary side (i.e., on the side connected to the gate 117 of the switch 116a, 116b): a positive level VCC2 (e.g. +20V for SiC-MOSFET) and a negative level VEE (e.g. -4V for SiC-MOSFET), but is not limited to these two voltage levels.

[0053] In order to safely control the switches 116a, 116b under normal conditions and even during active short circuits, an isolated gate driver power supply, also referred to as an isolated bias or bias voltage supply, is used. To increase the reliability of the system, three HS bias voltage supply circuits 230 are used for the HS gate driver 210, and three LS bias voltage supply circuits 330 are used for the LS gate driver 310. It should be noted that other ways of implementing the bias voltage supply may also be used, such as using a flyback converter with multiple windings as the HS bias voltage supply circuit, and using another flyback converter also with multiple windings as the LS bias voltage supply circuit, which also results in an isolated bias voltage supply.

[0054] In order to realize the bias voltage supply, a voltage higher than the nominal voltage level of the low voltage branch 120 or the replacement supply branch 130 may be necessary. In this case, if the bias voltage supply circuit 230, 330 cannot increase the voltage accordingly, a pre-regulator power supply 240, 340 can be used to power the bias voltage supply circuit 230, 330. These pre-regulator power supplies 240, 340 specifically also include a DC voltage converter and convert the low voltage (e.g. 12V or 15V) into a higher voltage (e.g. 24V). If the isolated bias voltage supply circuit has the possibility of sufficiently increasing the voltage (e.g. using a boost-flyback converter), these pre-regulator power supplies 240, 340 are not necessary.

[0055] Since modern gate drivers can receive safety requests (e.g. ASC) on both the primary and secondary sides (the primary chip is isolated from the gate driver's secondary chip), it can receive two (safe status) signals S1, S2 or S3, S4; one (S2, S4) for the primary and one (S1, S3) for the secondary. These signals are shown with dashed lines.

[0056] Modern isolated gate drivers may be able to receive two types of safety signals: an ASC enable signal (ASC_EN) requesting a safe state and an ASC state signal (ASC_ST) specifying the type of safe state. To reduce the complexity of the drawings, only one signal S1 to S4 is always shown per side (primary, secondary). However, it should be noted that each of the signals S1 to S4 may internally include multiple types of safety signals.

[0057] One or more low-voltage consumers 121 of the inverter 100 , which are only schematically shown, are also arranged in the inverter branch 120a , such as sensors (eg speed, angular position, temperature, etc.), communication devices (CAN transceivers, LIN transceivers, etc.), etc.

[0058] In addition, a (functional) safety control device 123 is arranged in the inverter branch 120a, that is, a functional safety (English: safety) control device. The task of this safety control device is specifically to monitor the inverter 100, determine the state of the inverter 100, and if necessary, gather signals S1 to S4 for the safe state, so that the inverter circuit can work with normal drive control or transition to a safe state (such as ASC or similar state). In order to achieve this, it is advantageous that the safety control device 123 communicates with as many components or structural modules of the inverter 100 as possible, and also communicates with a higher-level controller 124 such as a so-called MCU, in order to achieve the required "Automotive Safety Integrity Level" (Automotive Safety Integrity Level, ASIL) (depending on the functional safety target). The communication and signal transmission between the safety control device 123 and the upper controller 124 are shown as double arrows with dashed lines.

[0059] For increased safety, the controller 124 is provided with an energy management circuit 125 for the power supply, for example in the form of a so-called PMIC (power management IC (integrated circuit) or a safety PMIC. A safety PMIC integrates a number of DC voltage converters in a housing. The device usually has built-in protection functions, such as soft start, pulse current limitation, independent voltage monitoring, temperature measurement and shutdown in the event of excessive power loss. A PMIC usually has a watchdog timer to ensure the integrity of the microcontroller used in the system.

[0060] The safety control device 123 is supplied with current or energy by the power supply circuit 126. To increase safety, the safety control device 123 is also powered by the energy management circuit 125. In order to achieve the goal of functional safety (e.g., ASIL D), the safety control device 123 may have two independent safety logic circuits 123a and 123b, which have two independent power supplies. The first safety logic circuit 123a is powered by the power supply circuit 126, and the second safety logic circuit 123b is powered by the power management circuit 125. If a power failure occurs in one of the two safety logic circuits, the other safety logic circuit can ensure a transition to a safe state.

[0061] In some concepts, the safety control device 123 and the upper controller 124 are powered only by the energy management circuit 125, although it is generally believed that a second power supply can improve reliability and ensure the achievement of functional safety goals.

[0062] In order to achieve the desired level of functional safety, different measurement signals can be provided to the safety control device 123 and the upper controller 124, such as temperature, speed, voltage of various parts of the inverter circuit or the vehicle electrical system, errors or health status / signals from the power supply, sensors, gate drivers, main switches, etc.

[0063] In the case of an inverter not according to the invention without replacing the supply branch 130, an error (interruption or short circuit) may cause an interruption of the power supply of the inverter branch 120a or cause a latent error and affect the power supply of the safety control device 123 or the gate driver, so that the inverter circuit 115 cannot be transferred to a safe state. In order to advantageously handle this situation, additional precautions are taken in the inverter, as described below.

[0064] Safety disconnect circuits 31 to 34 are also added to the inverter to protect the entire power supply and isolate the fault area from the rest of the grid. The safety disconnect circuits 31 to 34 prevent the fault from propagating in the inverter and also prevent potential faults. The safety disconnect circuits 31 to 34 can communicate with the safety control device 123 and the upper controller 124 (communication connection not shown).

[0065] The safety controller 123 is configured to bring the inverter circuit 115 into a safe state when a shutdown situation exists, wherein the presence of a shutdown situation is determined in particular when at least one of the safety disconnection circuits 31 to 34 is in the disconnected state.

[0066] A first safety disconnection circuit 31 is added in series with the operating DC voltage converter 10. If a fault occurs in the operating DC voltage converter 10, the first safety disconnection circuit 31 can be disconnected, thereby protecting the inverter branch 120a and interrupting the fault current, and notifying the safety control device 123 and / or the superior controller 124 of the fault (if necessary). Then the LS power supply circuit 300 and the safety control device 123 can be powered from the supply branch 120b and / or from the replacement supply branch 130.

[0067] A second safety disconnect circuit 32 is added in series with the HV power supply circuit 200. If a fault occurs in the HS power supply circuit 200, the second safety disconnect circuit 32 can be disconnected, thereby protecting the inverter branch 120a from error propagation and interrupting the error current, as well as notifying the safety control device 123 and / or the superior controller 124 of the error (if necessary).

[0068] A third safety disconnection circuit 33 is added in series with the LS power supply circuit 300. If a fault occurs in the LS power supply circuit 300, the third safety disconnection circuit 33 can be disconnected, thereby protecting the inverter branch 120a and interrupting the fault current, and notifying the safety control device 123 and / or the upper controller 124 of the error (if necessary). Then, power can be supplied from the high voltage branch 110 to the LS power supply circuit 300 through the replacement supply branch 130.

[0069] A fourth safety disconnection circuit 34 is added to the supply branch 120b. If a fault occurs in the inverter branch 120a, the fourth safety disconnection circuit 34 can be disconnected to protect the low voltage grid and replace the supply branch 130 and interrupt the fault current, and notify the safety control device 123 and the upper controller 124 of the fault (if necessary).

[0070] All of these safety disconnection circuits 31 to 34 can be designed as diagnostic and monitoring modules with integrated control circuits and are protected against short circuits, short circuits to ground, reverse current blocking, overvoltages and undervoltages. Fig. 9 An example of a simplified safety disconnection circuit 400 is shown. In general, the safety disconnection circuit 400 can be implemented using electronic switches 401, 402, such as MOSFETs, and a control circuit 403, which receives signals from an input terminal 404 and an output terminal 405, in particular about current and / or voltage, and controls the gate of the MOSFET. The control circuit 403 is alternatively or additionally configured to open or close the electronic switches 401, 402 according to a control signal, in particular a control signal from the safety control device 123 or a superordinate controller 124.

[0071] like Figure 1 , 2, 4, 7 and 8, the low voltage branch 120 or the low voltage grid is connected to the replacement supply branch 130 via the replacement supply DC voltage converter 20. This converts the low voltage (e.g., close to 12V, or even lower in some cases) to a slightly higher low voltage (e.g., 15-20V). The replacement supply branch 130 establishes a connection with the LS power supply circuit 300 and the safety control device 123. Alternatively (not shown), the replacement supply branch 130 can also be connected to the HS power supply circuit 200 and the safety control device 123.

[0072] The power supply circuit 300 is Figure 1 and Figure 2 The LS power circuit 300 is connected to the replacement supply branch 130 via the blocking circuit 40a. In one embodiment, the blocking circuit 40a may include two diodes, as shown. When the inverter branch 120a is powered, the LS power circuit 300 is fed by the inverter branch 120a. If the power supply of the inverter branch 120a fails, the third safety disconnection circuit 33 disconnects the LS power circuit 300 from the inverter branch 120a, and the replacement supply branch 130 supplies power to the LS power circuit 300.

[0073] exist Figure 1 In the embodiment, the safety control device 123 is connected to the replacement supply branch 130 via the blocking circuit 40b. In one embodiment, the blocking circuit 40b may include two diodes, as shown.

[0074] Reference Figure 2 , 4 , 7 and 8, the safety control device 123 is connected to the replacement supply branch 130 through the first power circuit 126a, and is connected to the inverter branch 120a through the second power circuit 126b. The blocking circuit 40b is omitted.

[0075] Figure 4 , 7 8 schematically show another embodiment of the inverter 100 according to the present invention, which is different from the inverter 100 according to the present invention. Figure 2 The embodiment of FIG. 4 is different in that the blocking circuit 40 a is omitted.

[0076] Figure 1 , 2 , 4 and 8 show embodiments in which at least one gate driver circuit 310 for at least the low-side semiconductor switch 116 b is supplied with energy or can be supplied with energy by the alternative supply branch 130 . Figure 7 An embodiment is shown in which at least one gate driver circuit 210 for the high-side semiconductor switch 116 a is supplied or can be supplied by the alternative supply branch 130 .

[0077] When the inverter branch 120a is powered, the safety control device 123 is fed by the inverter branch 120a, which in turn is fed by the low-voltage grid and the high-voltage branch 110. If the power supply from the inverter branch 120a fails, the replacement supply branch 130 supplies power to the safety control device 123 or its first safety logic circuit 123a.

[0078] Another option, not shown in the figure, is to connect the energy management circuit 125 to the replacement supply branch 130 also via a further blocking circuit.

[0079] The blocking circuit helps prevent current from flowing to other parts of the inverter, which could cause the replacement supply DC voltage converter 20 to overload or feed faults into other sub-grids.

[0080] In order to protect the primary and secondary sides of the operating DC voltage converter 10, a fuse F1 is provided as a high-voltage disconnect circuit so that in the event of a fault on the primary side, for example in the event of a short circuit in the transformer winding of a galvanically isolated DC voltage converter or in the event of a shorted switch, the fuse isolates the faulty section.

[0081] As shown in conjunction with another embodiment of the inverter circuit Figure 5 It can be seen that in Figure 4 In the embodiment, the alternative supply branch 130 can be connected to each voltage supply line VCC2 between the three LS bias voltage supply circuits 330 and the LS gate driver 310 through the alternative supply DC voltage converter 20 and a blocking diode.

[0082] As shown in conjunction with another embodiment of the inverter circuit Figure 6 It can be seen that alternatively Figure 4 In the embodiment, the replacement supply branch 130 can also supply power to the three LS bias voltage supply circuits 330 via the replacement supply DC voltage converter 20 .

[0083] This only guarantees the power supply required for the LS gate driver 310 to start the safe state and is not suitable for continuous operation. Therefore, it is sufficient to only contact the voltage supply line VCC2 to only energize the gate driver to bring it into the safe state.

[0084] As shown in conjunction with another embodiment of the inverter circuit Figure 6 It can be seen that alternatively Figure 4 In the embodiment, the replacement supply branch 130 can also supply power to the three LS bias voltage supply circuits 330 via the replacement supply DC voltage converter 20 .

[0085] This also only guarantees the power supply required for the LS gate driver 310 to start the safe state and is not suitable for continuous operation. Therefore, it is sufficient to only power the three LS bias voltage supply circuits 330 to only provide energy for the gate driver to enter the safe state.

[0086] The replacement supply branch 130 can also be connected to the first power supply circuit 126a and the first safety logic circuit 123a of the (functional) safety control device 123. This connection powers the first safety logic circuit 123a in all operating states. In the event of a fault in the inverter branch 120a, the second safety logic circuit 123b may be de-energized, but the first safety logic circuit 123a can be activated and start the safe state of the LS gate drivers because they are also powered by the backup power supply.

[0087] In accordance with Figure 7 In the inverter 100 of FIG. 1 , the HS power supply circuit 200 is powered by the replacement supply branch 130. The second safety disconnection circuit 32 is omitted. The first safety logic circuit 123a is also powered by the replacement supply branch 130 as before.

[0088] In accordance with Figure 8 In the inverter 100 of FIG. 1 , the LS power supply circuit 300 is supplied by the replacement supply branch 130. The third safety disconnection circuit 33 is omitted. The first safety logic circuit 123a is also supplied by the replacement supply branch 130 as before.

[0089] In all the variants shown, faults in the inverter branch 120a and the replacement supply branch 130 are isolated from each other. Therefore, faults cannot be transmitted from the inverter branch 120a to the replacement supply branch 130 and vice versa.

[0090] If a fault occurs in the inverter branch 120a or the high voltage branch 110, the replacement supply branch 130 can ensure supply to the first safety logic circuit 123a and the corresponding LS or HS power supply circuit 200, 300 (only one of them). Thus, the execution of the safe state is guaranteed.

[0091] The invention can improve functional safety and reliability without having to prove that the inverter is completely redundant, which would otherwise increase the cost by a factor of 2. Advantageously, the capacity of the replacement supply DC voltage converter does not have to be powerful enough to power the entire inverter, which leads to reduced costs when implementing the concept.

[0092] Reference numerals list

[0093] 10 Operating the DC voltage converter

[0094] 20 Replace the supply DC voltage converter

[0095] 31-34 Safety disconnect circuit

[0096] 40a, 40b Blocking circuit

[0097] 100 Inverter

[0098] 110 High voltage branch

[0099] 500 Motor

[0100] 115 Inverter Circuit

[0101] 116a, 116b Semiconductor switch

[0102] 117 Control connection

[0103] 118 Logic Circuit

[0104] 120 Low voltage branch

[0105] 120a Inverter branch

[0106] 120b Supply branch

[0107] 122a, 122b diodes

[0108] 123 Safety control device

[0109] 123a, 123b Safety logic circuit

[0110] 124 Upper controller

[0111] 125 Energy Management Circuit

[0112] 126, 126a, 126b Power supply circuit

[0113] 130 Replacement of supply branch

[0114] 200, 300 HS power supply circuit

[0115] 210, 310 Gate driver circuit

[0116] 220, 320 Low Dropout Regulator (LDO)

[0117] 230, 330 Bias voltage supply circuit

[0118] 240, 340 Pre-regulator Power Supply

[0119] 400 Safety disconnect circuit

[0120] 401, 402 MOSFET

[0121] 403 Control Circuit

[0122] 404 Input

[0123] 405 Output

[0124] F1 High voltage disconnect circuit

[0125] S1-S4 Signals

[0126] HV+ Positive DC voltage connection

[0127] HV - Negative DC voltage connection

[0128] B+ Positive DC voltage connection

[0129] B - Negative DC voltage connection

[0130] U, V, W AC voltage connection

Claims

1. An inverter (100) for controlling an electric motor (500), the inverter (100) comprising: - a high pressure branch (110), a low pressure branch (120) and an alternative supply branch (130), - operating a DC voltage converter (10), wherein one side of the DC voltage converter is connected to a high voltage branch (110) and the other side is connected to a low voltage branch (120), - a replacement supply DC voltage converter (20), the replacement supply DC voltage converter being connected on one side to the low voltage branch (120) and on the other side to the replacement supply branch (130), - an inverter circuit (115) for connecting the high-voltage branch (110) to the alternating voltage connections (U, V, W) for the electric machine (500), in, The inverter circuit (115) and the safety control device (123) are supplied with energy by the low voltage branch (120). The safety control device (123) is configured to switch the inverter circuit (115) to a safe state in a shutdown state. The inverter circuit (115) and the safety control device (123) are supplied with energy by the replacement supply branch (130) or can be supplied with energy by the replacement supply branch (130).

2. The inverter (100) according to claim 1, wherein: A blocking circuit (40a, 40b) is arranged between the low-voltage branch (120) and the replacement supply branch (130), and the blocking circuit prevents energy flow between the low-voltage branch (120) and the replacement supply branch (130).

3. The inverter (100) according to claim 1 or 2, wherein: The low voltage branch (120) comprises an inverter branch (120a) and a supply branch (120b), wherein the inverter circuit (115) and the safety control device (123) are supplied with energy by the inverter branch (120a), wherein the supply branch (120b) is designed to be connected to a voltage supply, The second blocking circuit (122a, 122b, 31, 34) is arranged between the inverter branch (120a) and the operating DC voltage converter (10) to prevent energy from flowing from the inverter branch (120a) to the operating DC voltage converter (10), and / or is arranged between the inverter branch (120a) and the supply branch (120b) to prevent energy from flowing from the inverter branch (120a) to the supply branch (120b).

4. The inverter (100) according to any one of the preceding claims, wherein: The operating DC voltage converter (10) can be disconnected from the remaining low-voltage branch (120) via a first safety disconnection circuit (31) and / or can be disconnected from the remaining high-voltage branch (110) via a first high-voltage disconnection circuit (F1).

5. The inverter (100) according to any one of the preceding claims, wherein: The inverter circuit (115) has a plurality of high-side semiconductor switches (116a) and a plurality of low-side semiconductor switches (116b) and at least one gate driver circuit (210; 310) for the high-side and low-side semiconductor switches, wherein the at least one gate driver circuit (210; 310) is supplied with energy from a low-voltage branch (120) or an inverter branch (120a).

6. The inverter (100) according to claim 5, wherein: At least one gate driver circuit (210) for a high-side semiconductor switch (116a) can be disconnected from the remaining low-voltage branch (120) by a second safety disconnection circuit (32).

7. The inverter (100) according to claim 5 or 6, wherein: At least one gate driver circuit (310) for a low-side semiconductor switch (116b) can be disconnected from the remaining low-voltage branch (120) by means of a third safety disconnection circuit (33).

8. The inverter (100) according to any one of claims 5 to 7, wherein: At least one gate driver circuit (310) for a low-side semiconductor switch (116b) and / or at least one gate driver circuit (210) for a high-side semiconductor switch (116a) is supplied with energy by an alternative supply branch (130) or can be supplied with energy by an alternative supply branch (130).

9. The inverter (100) according to any one of claims 5 to 8, wherein: At least one gate driver circuit (210; 310) for a semiconductor switch each has exactly one gate driver circuit (210; 310) for each of a high-side semiconductor switch (116a) and / or a low-side semiconductor switch (116b).

10. The inverter (100) according to any one of claims 5 to 9, wherein: At least one gate driver circuit (210; 310) for a high-side and a low-side semiconductor switch is supplied with voltage by at least one bias voltage supply circuit (230; 330), wherein at least one gate driver circuit (210; 310) and / or at least one bias voltage supply circuit (230; 330) is supplied with energy by a low-voltage branch (120).

11. The inverter (100) according to claim 10, wherein: A connection line (VCC2) between at least one gate driver circuit (210) for a high-side semiconductor switch and / or at least one gate driver circuit (310) for a low-side semiconductor switch and at least one bias voltage supply circuit (230; 330) is connected to a low-voltage branch (120).

12. The inverter (100) according to any one of the preceding claims, wherein: The inverter branch (120a) can be separated from the supply branch (120b) and / or the replacement supply branch (130) by means of a fourth safety disconnection circuit (34).

13. The inverter (100) according to any one of claims 4 to 12, wherein: The safety control device (123) is configured to determine the presence of a shutdown condition when at least one of the first, second, third and fourth safety disconnect circuits (31-34) is in a non-conducting state.

14. The inverter (100) according to any one of claims 4 to 13, wherein: At least one of the first, second, third and fourth safety disconnection circuits (31-34) has at least one electronic switch (401, 402) between an input terminal (404) and an output terminal (405) and has a control circuit (403), wherein the control circuit (403) is designed to open or close the at least one electronic switch (401, 402) according to a control signal.

15. The inverter (100) according to any one of the preceding claims, wherein: The safety control device (123) and / or the inverter circuit (115) has at least two safety logic circuits (123a, 123b), wherein a first safety logic circuit (123a) of the at least two safety logic circuits is supplied with energy by a low-voltage branch (120) or can be supplied with energy by the low-voltage branch (120), and a second safety logic circuit (123b) of the at least two safety logic circuits is supplied with energy by a replacement supply branch (130) or can be supplied with energy by a replacement supply branch (130).

16. A method for operating an inverter (100) according to any one of the preceding claims, comprising: When a shutdown condition exists, the inverter circuit (115) is brought into a safe state.

17. The method according to claim 16, comprising: A shutdown condition is identified when at least one of the first, second, third and fourth safety disconnect circuits (31-34) detects a fault and / or when at least one of the first, second, third and fourth safety disconnect circuits (31-34) is in an open state.

18. The method according to claim 16 or 17, comprising: When a fault occurs in an operating DC voltage converter (10) and / or a replacement supply DC voltage converter (20), it is recognized that a shutdown situation exists.

19. A method according to any one of claims 16 to 18 when dependent on claim 5, comprising: The presence of a switch-off situation is identified when at least one gate driver circuit (210; 310) for a high-side semiconductor switch and a low-side semiconductor switch detects a fault, in particular in the energy supply from a low-voltage branch (120).

20. A safety control device (123), configured to execute the method according to any one of claims 16-19.

Images