A control method for avoiding the influence of energy storage converter DSP failure on device reliability

Abstract

The application relates to a control method for avoiding the influence of energy storage converter DSP failure on equipment reliability, belongs to the technical field of energy storage converters, adopts a controller composed of a DSP and a FPGA combined with CPU1 and CPU2, and executes the following steps: heartbeat packets are sent between CPU1 and CPU2 and are checked, heartbeat packets are sent between CPU1 and the FPGA and are checked, when it is judged that CPU1 fails, at least one of pulse enable switches 1, 2 and 3 is turned off by the FPGA, when it is judged that CPU2 fails, one of pulse enable switches 1 and 3 is turned off by CPU1 or the FPGA, at least one component of an AC relay, an IGBT and a DC relay is disconnected, and when it is judged that the FPGA fails, pulse enable switches 1, 2 and 3 are all turned off. The application fully utilizes the platform advantages of multi-core heterogeneity, avoids misoperation and refusal of a single intelligent device to control a relay, and improves equipment reliability.

Description

Technical Field

[0001] The present invention belongs to the technical field of energy storage converters, and in particular relates to a control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability. Background Art

[0002] A power conversion system (PCS) is a device in an electrochemical energy storage system that connects the battery system to the grid and / or loads, enabling bidirectional conversion of electrical energy. It controls the battery's charging and discharging processes, converting AC to DC. During battery discharge, the DC power generated by the battery pack is inverted into three-phase AC power, feeding the energy back into the grid or providing a stable, suitable voltage and frequency for loads within an isolated grid. During battery charging, the PCS rectifies the three-phase AC power from the grid into DC power, which is then fed into the DC bus.

[0003] Therefore, when the control system chip DSP of the energy storage converter fails, it is necessary to take timely and reliable measures to disconnect several primary electrical devices such as AC relays, DC relays, IGBTs, etc. to protect personnel safety and PCS key components and prevent the scope of the accident from further expanding.

[0004] However, the current control method does not take into account the situation where the DSP or FPAG chip cannot control the AC and DC relays when it malfunctions due to program errors, crystal failures, power supply fluctuations, etc. As a result, a DSP failure in the energy storage converter affects the control of the equipment and the equipment cannot be shut down, causing the scope of the accident to expand. Summary of the Invention

[0005] The purpose of the present invention is to address the problems existing in the prior art and provide a control method to prevent the DSP failure of the energy storage converter from affecting the reliability of the equipment. By utilizing the advantages of a multi-core heterogeneous platform, the method avoids malfunction and refusal to operate caused by a single intelligent device controlling the relay, thereby improving the reliability of the equipment.

[0006] The technical solution is as follows:

[0007] A control method for preventing DSP failures in an energy storage converter from affecting equipment reliability uses a controller consisting of a DSP and an FPGA, each composed of CPUs 1 and 2. The DSP and FPGA both control the on / off of an AC relay via pulse enable switch 1 and the on / off of a DC relay via pulse enable switch 3. The FPGA controls whether a bus level converter outputs PWM pulses to the IGBT and drive circuit via pulse enable switch 2. The method performs the following steps:

[0008] Step S1: CPU1 and CPU2 of the DSP send heartbeat packets to each other through the inter-core bus and verify each other to determine the status of each other. If it is determined that CPU1 is faulty, it goes to step S3; if it is determined that CPU2 is faulty, it goes to step S4; if both are normal, it goes to step S2;

[0009] Step S2: CPU1 and FPGA send heartbeat packets to each other through the external memory interface bus and verify each other's status. If it is determined that the CPU1 is faulty, the process goes to step S3. If it is determined that the FPGA is faulty, the process goes to step S5. If both are normal, the process returns to step S1.

[0010] Step S3: The FPGA turns off at least one of the pulse enable switch 1, the pulse enable switch 2, and the pulse enable switch 3, thereby disconnecting at least one component of the AC relay, the IGBT, and the DC relay, thereby stopping the operation of the energy storage converter;

[0011] Step S4: The CPU 1 or the FPGA turns off one of the pulse enable switches 1 and 3, or the FPGA turns off the bus level converter via the pulse enable switch 2, thereby disconnecting at least one of the AC relay, the IGBT, and the DC relay, thereby stopping the operation of the energy storage converter.

[0012] Step S5: Pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 are all turned off due to the loss of the pulse enable signal provided by the FPGA, so that the AC relay, IGBT and DC relay are all disconnected, thereby stopping the operation of the energy storage converter.

[0013] Furthermore, CPU1 is used for abnormal protection logic and external communication, CPU2 is used for grid-connected control algorithm, and FPGA is responsible for suppressing three-phase PWM narrow pulses, internal and external tube protection interlocking, and monitoring DSP operating status.

[0014] Furthermore, in step S1, when CPU1 does not receive the heartbeat sent by CPU2 within two Task1 cycles, it is determined that CPU2 is faulty; when CPU2 does not receive the heartbeat sent by CPU1 within two Task1 cycles, it is determined that CPU1 is faulty.

[0015] Furthermore, in step S2, when the FPGA does not receive the heartbeat sent by the CPU1 within 1.5 Task1 cycles, it is determined that the CPU1 is faulty; when the CPU1 does not receive the heartbeat sent by the FPGA within 2 Task1 cycles, it is determined that the FPGA is faulty.

[0016] Furthermore, the Task 1 period is 35μs.

[0017] Further, in step S3, the FPGA controls the pulse enable switch 1, the pulse enable switch 2 and the pulse enable switch 3 to be turned on by sending the pulse enable signal 1, 2, 3, and controls the pulse enable switch 1, the pulse enable switch 2 and the pulse enable switch 3 to be turned off by stopping sending the pulse enable signal 1, 2, 3.

[0018] Further, in step S4, the CPU1 controls the pulse enable switch 1 and the pulse enable switch 3 by the on / off relay signal.

[0019] Advantages:

[0020] 1) The present application can monitor the state of each core in real time and make corresponding processing through mutual verification of the dual-core CPU of the DSP and mutual transmission of heartbeat packets between the CPU1 of the DSP and the FPGA. The DSP instruction and the FPGA instruction jointly control the relay. Only when the FPGA works normally, the DSP can close and open the relay, and the FPGA can forcibly close the pulse enable switch to disconnect the relay, thereby avoiding misoperation and refusal of the relay controlled by a single intelligent device and improving the reliability of the equipment.

[0021] 2) The DSP is responsible for grid-connected algorithm control, and the FPGA is responsible for PWM pulse failure and abnormal protection, which can quickly block the PWM pulse and fully utilize the platform advantage of multi-core heterogeneity to quickly respond to abnormal conditions.

[0022] 3) If any single core of the CPU1, the CPU2 and the FPGA is abnormal or both cores are abnormal, the remaining core can normally trip the AC relay, the DC relay and block the IGBT device. Even if all three cores are abnormal, the tripping can still be realized through the pulse enable switch and the hardware drive circuit to disconnect the electrical side device, so as to protect the personnel safety and the key components of the PCS and prevent the accident range from further expanding. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 The logic block diagram of the method of the present application is shown in the figure.

[0024] Figure 2 The overall system structure diagram of the present application is shown in the figure. DETAILED DESCRIPTION

[0025] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention. The directions or positional relationships indicated by the terms "upper", "lower", "front", "back", "left", "right", "bottom", "inner", "outer", etc. are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present invention. They do not indicate or imply that the devices or components referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0026] like Figure 1 、 Figure 2 A control method for preventing a DSP failure in an energy storage converter from affecting device reliability is shown. The method uses a controller composed of a DSP and an FPGA, which are composed of CPU1 and CPU2. Both the DSP and the FPGA control the on / off of the AC relay through a pulse enable switch 1 and the DC relay through a pulse enable switch 3. The FPGA controls whether the bus level converter outputs PWM pulses to the IGBT and drive circuit through a pulse enable switch 2, and performs the following steps:

[0027] Step S1: CPU1 and CPU2 of the DSP send heartbeat packets to each other through the inter-core bus and check and judge each other's status. When CPU1 does not receive the heartbeat sent by CPU2 within 2 Task1 cycles, it is determined that CPU2 is faulty; when CPU2 does not receive the heartbeat sent by CPU1 within 2 Task1 cycles, it is determined that CPU1 is faulty. The Task1 cycle is 35μs. When it is determined that CPU1 is faulty, step S3 is entered. When it is determined that CPU2 is faulty, step S4 is entered. If there is no fault, step S2 is entered.

[0028] Step S2: CPU1 and FPGA send heartbeat packets to each other through the external memory interface bus and verify each other to determine the status of each other. If FPGA does not receive the heartbeat packets sent by CPU1 within 1.5 Task1 cycles, it is determined that CPU1 is faulty. If CPU1 does not receive the heartbeat packets sent by FPGA within 2 Task1 cycles, it is determined that FPGA is faulty. The Task1 cycle is 35μs. If CPU1 is faulty, the process goes to step S3. If FPGA is faulty, the process goes to step S5. If both are normal, the process returns to step S1.

[0029] Step S3: At least one of the pulse enable switch 1, the pulse enable switch 2 and the pulse enable switch 3 is turned off by the FPGA, so that at least one component of the AC relay, the IGBT and the DC relay is disconnected, and the energy storage converter is stopped. The pulse enable switch 1, the pulse enable switch 2 and the pulse enable switch 3 are turned on by the FPGA through the pulse enable signals 1, 2 and 3, and are turned off by stopping the pulse enable signals 1, 2 and 3.

[0030] Step S4: One of the pulse enable switch 1 and the pulse enable switch 3 is turned off by the CPU1 or the FPGA, or the bus level converter is turned off by the FPGA through the pulse enable switch 2, so that at least one component of the AC relay, the IGBT and the DC relay is disconnected, and the energy storage converter is stopped.

[0031] Step S5: The pulse enable switch 1, the pulse enable switch 2 and the pulse enable switch 3 are turned off due to the loss of the pulse enable signals provided by the FPGA, so that the AC relay, the IGBT and the DC relay are all disconnected, and the energy storage converter is stopped.

[0032] The CPU1 is used for abnormal protection logic and external communication, the CPU2 is used for grid-connected control algorithm, and the FPGA is responsible for suppression of three-phase PWM narrow pulses, internal and external tube protection interlocking and monitoring of DSP running state.

[0033] In embodiment 1, the energy storage converter control system adopts a dual-core DSP+FPGA architecture, the DSP chip includes the CPU1 and the CPU2, the CPU1 is used for abnormal protection logic and external communication, the CPU2 is used for grid-connected control algorithm, and the FPGA is mainly responsible for suppression of three-phase PWM narrow pulses, internal and external tube protection interlocking and monitoring of DSP running state.

[0034] When the energy storage converter is normally started and operated, the DC relay, the AC relay and the IGBT are normally actuated according to the grid-connected algorithm. The dual-core inside the DSP checks each other through the inter-core bus, the CPU1 and the CPU2 send heartbeat packets to each other, judge the state of the other party, when the CPU1 does not receive the heartbeat sent by the CPU2 within 2 Task1 periods, it is judged that the CPU2 fails, when the CPU2 does not receive the heartbeat sent by the CPU1 within 2 Task1 periods, it is judged that the CPU1 fails; the CPU1 and the FPGA check each other through the external memory interface (EMIF) bus, the CPU1 and the FPGA send heartbeats to each other, judge the state of the other party, when the FPGA does not receive the heartbeat sent by the CPU1 within 1.5 Task1 periods, it is judged that the CPU1 fails, when the CPU1 does not receive the heartbeat sent by the FPGA within 2 Task1 periods, it is judged that the FPGA fails, wherein the Task1 scheduling period is 35μs.

[0035] When CPU1 fails, CPU1 cannot send a trip signal and cannot control the AC and DC relays. At this time, the FPGA and CPU2 are normal and can identify the CPU1 failure through the heartbeat packet. The FPGA can control the forced trip signal 1 to a low level, turning off the pulse enable switch 1, deactivating the AC relay drive, de-energizing the coil, and disconnecting the AC relay. The FPGA can also sequentially shut down the PWM pulses or force the pulse enable switch to output a high level by forcing the pulse signal 2, turning off the bus level converter and prohibiting the PWM pulse output IGBT. The FPGA simultaneously controls the forced trip signal 3 to a low level, turning off the pulse enable switch 3, de-energizing the DC relay drive and controlling the relay coil, and shutting down the DC relay.

[0036] When CPU2 fails, the PWM wave sent by CPU2 is abnormal or disordered. If not handled properly, the IGBT may explode. CPU1 and FPGA are normal. When CPU1 detects that CPU2 is abnormal, the CPU normally sends the open / close relay signals 1 and 3 to turn off the DC relay and AC relay. At the same time, it can notify the FPGA through the EMIF bus to turn off the PWM pulse, turning off the external tube first and then the internal tube signal.

[0037] When the FPGA fails, the enable signals for pulse enable switches 1, 2, and 3 are derived from the FPGA pulses. The internal trigger pins of these switches input fixed pulses that meet the trigger timing requirements. The pulse triggering time must be less than 0.45*10*3300 / 1000 = 14.85 μs, which means the trigger frequency must be greater than 1 / 14.85 = 67.34 kHz. The actual FPGA frequency is set to 200 kHz. The trigger enable buffer is activated, and the relay driver is controlled by CPU1. When the FPGA fails, the fixed pulses (or pulse enable signals) cannot be output. Pulse enable switches 1, 2, and 3 are closed, meaning the buffers are in the off state. Consequently, the entire pulse enable switch is in the off state. Pulse enable switch 1 is turned off, disabling the AC relay driver, de-energizing the coil, and allowing the AC relay to disconnect. Pulse enable switch 2 is turned off, shutting down the bus level converter and blocking the PWM pulses. Pulse enable switch 3 is turned off, disabling the DC relay driver, de-energizing the coil, and allowing the DC relay to disconnect.

[0038] Therefore, if any single core of CPU1, CPU2, or FPGA is abnormal or abnormal at the same time, the other cores can normally trip the AC relay, DC relay, and block the IGBT devices. Even if all three cores are abnormal, they can still be tripped through the pulse enable switch and hardware drive circuit to disconnect the primary electrical side devices to protect personnel safety and PCS key components and prevent the scope of the accident from further expanding.

[0039] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the principles and spirit of the present invention should be included in the scope of protection of the present invention.

Claims

1. A control method for preventing a DSP failure in an energy storage converter from affecting equipment reliability, characterized by: The grid side is connected to the battery side via an AC relay, an IGBT and drive circuit, and a DC relay. A controller consisting of a DSP and FPGA, consisting of CPU1 and CPU2, is used. Both the DSP and FPGA control the AC relay on and off via pulse enable switch 1 and the DC relay on and off via pulse enable switch 3. The FPGA controls whether the bus level converter outputs PWM pulses to the IGBT and drive circuit via pulse enable switch 2, and executes the following steps: Step S1: CPU1 and CPU2 of the DSP send heartbeat packets to each other through the inter-core bus and verify each other to determine the status of each other. If it is determined that CPU1 is faulty, it goes to step S3; if it is determined that CPU2 is faulty, it goes to step S4; if both are normal, it goes to step S2; Step S2: CPU1 and FPGA send heartbeat packets to each other through the external memory interface bus and verify each other's status. If it is determined that the CPU1 is faulty, the process goes to step S3. If it is determined that the FPGA is faulty, the process goes to step S5. If both are normal, the process returns to step S1. Step S3: The FPGA turns off at least one of the pulse enable switch 1, the pulse enable switch 2, and the pulse enable switch 3, thereby disconnecting at least one component of the AC relay, the IGBT, and the DC relay, thereby stopping the operation of the energy storage converter; Step S4: The CPU 1 or the FPGA turns off one of the pulse enable switches 1 and 3, or the FPGA turns off the bus level converter via the pulse enable switch 2, thereby disconnecting at least one of the AC relay, the IGBT, and the DC relay, thereby stopping the operation of the energy storage converter. Step S5: Pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 are all turned off due to the loss of the pulse enable signal provided by the FPGA, so that the AC relay, IGBT and DC relay are all disconnected, thereby stopping the operation of the energy storage converter.

2. The control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability according to claim 1, wherein: The CPU1 is used for abnormal protection logic and external communication, the CPU2 is used for grid-connected control algorithm, and the FPGA is responsible for suppressing three-phase PWM narrow pulses, protecting internal and external tubes interlocking, and monitoring DSP operating status.

3. The control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability according to claim 1, wherein: In step S1, when CPU1 does not receive the heartbeat sent by CPU2 within two Task1 cycles, it is determined that CPU2 is faulty; when CPU2 does not receive the heartbeat sent by CPU1 within two Task1 cycles, it is determined that CPU1 is faulty.

4. The control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability according to claim 1, wherein: In step S2, when the FPGA does not receive the heartbeat sent by the CPU1 within 1.5 Task1 cycles, it is determined that the CPU1 is faulty; when the CPU1 does not receive the heartbeat sent by the FPGA within 2 Task1 cycles, it is determined that the FPGA is faulty.

5. The control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability according to claim 3 or 4, characterized in that: The Task 1 cycle is 35 μs.

6. The control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability according to claim 1, wherein: In step S3, the FPGA controls the pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 to be turned on by sending pulse enable signals 1, 2 and 3, and controls the pulse enable switch 1, pulse enable switch 2 and pulse enable switch 3 to be turned off by stopping sending pulse enable signals 1, 2 and 3.

7. The control method for preventing a DSP failure of an energy storage converter from affecting equipment reliability according to claim 1, wherein: In step S4, the CPU 1 controls the pulse enable switch 1 and the pulse enable switch 3 through the on / off relay signal.

Images