Rectifier device for controlling electric machine and method for operating rectifier device
By designing rectifier equipment with multiple energy supply branches, the problem of difficulty in achieving a safe state in the event of failure is solved, reliable and safe switching in high-voltage systems is achieved, and the functional safety of rectifier equipment is improved.
Patent Information
- Application Number
- CN202411392146.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-10-05
- Filing Date
- 2024-10-08
- Publication Date
- 2025-04-08
AI Technical Summary
It is difficult for existing rectifier equipment to reliably achieve a safe state in the event of a failure, especially in high-voltage systems, which may cause the intermediate circuit capacitor to be charged by the motor, causing safety hazards.
A rectifier device is designed, which has a plurality of energy supply branches, including a high voltage branch, a first low voltage branch and a second low voltage branch. The high-voltage power grid is connected to the first low-voltage branch through a DC-DC converter and the second low-voltage branch is independently connected to the low-voltage power grid, ensuring that a safe state can still be achieved through active short circuit in the event of a fault.
It improves the functional safety of the rectifier equipment, especially in high-voltage systems, which can be reliably switched to a safe state in the event of a fault, preventing the intermediate circuit capacitor from being charged by the motor, and enhancing personal safety.
Smart Images
Figure CN119787921A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a rectifier device for controlling an electric machine and to a method for operating the rectifier device. Background Art
[0002] In modern automotive applications with electric drives, the energy supply circuit of a rectifier device (so-called inverter) or in a rectifier device is also referred to as PDN or PDTN (English: Power Distribution Network, or Power Distribution Network Tree). The task of the distribution network is to distribute the current to different loads of the rectifier device (such as sensors, communication circuits (such as CAN transceivers, LIN transceivers)), and especially for high-side (HS) switches and low-side (LS) switches. Gate driver circuits, as well as functional safety circuits or MCUs (English: microcontroller units, controllers), etc. In this sense, a rectifier device or inverter is a device that has an energy supply circuit internally, and components powered by the energy supply circuit, including switches (for example, in the form of a half-bridge), and terminals for connecting external current sources and motors.
[0003] Currently, due to the requirements for functional safety, there are two main current sources for PDN. A common current source in electric vehicles (EV) is a low-voltage battery (e.g. 12V), which is also called a KL30 grid or a low-voltage grid. The second power source can be a high-voltage DC battery or a high-voltage DC bus (high-voltage grid) with a rated voltage of, for example, 800V or 400V. Such a high voltage or high-voltage system can be used in particular as a power supply for electric driving devices, such as permanent magnet synchronous motors (PMSMs) connected to the high-voltage grid via an inverter.
[0004] In the event of an accident or emergency shutdown, the rectifier device should be transferred to a predefined safe state. In order to prevent the intermediate circuit capacitor from being charged by the motor (especially when using PMSM), active short circuit technology (ASC) is usually used, most of which closes all low-voltage side (LS) switches or all high-voltage side (HS) switches, thereby stopping the power supply from the motor to the intermediate circuit.
[0005] The present invention aims to improve this concept so that a safe state can be reliably achieved even when problems occur in the power supply of the components involved. Summary of the invention
[0006] According to the invention, a rectifier device for controlling an electric machine, in particular in a vehicle, having the features of the independent claims, and a method for operating the rectifier device having the features of the independent claims are proposed. The dependent claims and the subject matter of the following description are advantageous embodiments. It should be emphasized that the features and advantages described below apply equally to the rectifier device and the method for operating the rectifier device.
[0007] The invention describes a concept for improving the power supply or mains supply in a rectifier device, so that in the event of a fault, a rectifier device or an electric machine in a vehicle can also reliably achieve a safe state.
[0008] Specifically, the rectifier device has a rectifier circuit, a safety controller, and an energy supply circuit for supplying the rectifier circuit and the safety controller.
[0009] As is well known, an inverter circuit or a rectifier circuit is used to connect the AC voltage terminals of a motor to the DC voltage terminals, or to generate an AC voltage for the motor from a DC voltage (especially from a high-voltage grid or a high-voltage branch). To this end, the rectifier circuit has a plurality of semiconductor switches, which can be opened (non-conductive) and closed (conductive) according to a control signal. The semiconductor switch can include a MOSFET and an IGBT, such as a gallium nitride (GaN) or silicon carbide (SiC) field effect transistor.
[0010] The energy supply circuit in the rectifier device has at least three different branches, namely a high-voltage branch, a first low-voltage branch and a second low-voltage branch. The high-voltage branch is configured to be connected to a high-voltage power grid (especially in a vehicle), and the first low-voltage branch is supplied by the high-voltage branch via a DC-DC converter, wherein the rated voltage level of the high-voltage power grid is higher than the rated voltage level of the low-voltage power grid. The second low-voltage branch is neither electrically connected to the high-voltage branch nor to the first low-voltage branch, and is configured to be connected to a low-voltage power grid (especially in a vehicle). The high-voltage branch and the second low-voltage branch have corresponding terminals for being connected to the high-voltage power grid or the low-voltage power grid. In particular, these terminals are drawn out from the housing of the rectifier device.
[0011] For example, the rated voltage level of the high-voltage grid (hereinafter also referred to as the high-voltage level) can be significantly higher than the permissible contact voltage, in particular 60 V, for example up to several hundred volts. For example, in current electric vehicles, high voltage levels of 400 V or 800 V are often used. In particular, the rated voltage levels of the low-voltage grid and the second low-voltage branch can be substantially the same, that is, for example, differ from each other by a threshold value of at most 5 V, and can be adapted to commonly used low-voltage (e.g. 12 V or 24 V) vehicles, for example.
[0012] The rectifier circuit (ie, its components) and the safety controller are supplied with energy or current from the first low-voltage branch and the second low-voltage branch. This increases the functional safety.
[0013] In one design solution, the rectifier circuit may include a plurality of high-side semiconductor switches and a plurality of low-side semiconductor switches, as well as a gate driver circuit for the high-side HS semiconductor switch (hereinafter referred to as the HS gate driver circuit) and a gate driver circuit for the low-side LS semiconductor switch (hereinafter referred to as the LS gate driver circuit). The gate driver circuit is used to apply a control signal to a control terminal of the semiconductor switch (e.g., a gate terminal of a MOSFET).
[0014] In one design, a first gate driver circuit of the HS gate driver circuit and the LS gate driver circuit is powered by a first low-voltage branch, and a second gate driver circuit of the HS gate driver circuit and the LS gate driver circuit is powered by a second low-voltage branch. This means that, in the event of a fault or failure in one of the first low-voltage branch or the second low-voltage branch, a safe state can still be achieved by an active short circuit.
[0015] In at least one design scheme, the HS and LS gate driver circuits can be supplied with voltage by at least one bias voltage supply circuit (that is, HS and LS), respectively, wherein a first bias voltage supply circuit in the HS and LS bias voltage supply circuits is supplied with energy by a first low-voltage branch, and a second bias voltage in the HS and LS bias voltage supply circuits is supplied with energy by a second low-voltage branch supply circuit.
[0016] The safety controller is configured to switch the rectifier circuit into a safe state when a shutdown situation exists. In particular, this can cause an active short circuit (determine the type of active short circuit (HS / LS) and close all HS switches or close all LS switches). In particular, the presence of a shutdown situation is determined when a fault situation occurs or is detected.
[0017] Through the present invention, the loads related to safety can be supplied not only by the first low-voltage branch but also by the second low-voltage branch independently of each other, and thus current or energy can be supplied when problems occur in the high-voltage branch or the DC-DC converter. Therefore, when the DC-DC converter fails, there is still supply from the second low-voltage branch. Because the second low-voltage branch is supplied by a low-voltage power grid that already has a suitable voltage in principle, the design of the second low-voltage branch in terms of electronic technology and safety technology is very simple. However, it can be provided that, for example, a DC voltage converter converts a low voltage of 12V (rated voltage) into a slightly higher value, for example 15V to 20V, which is more suitable for supplying electronic components, etc.
[0018] The method according to the invention for operating a rectifier arrangement according to the invention comprises, when a switch-off situation exists, bringing the rectifier circuit into a safe state.
[0019] The present invention significantly improves the functional safety of the rectifier device, especially in the case of a high-voltage branch, and has a special advantage in terms of personal safety. The present invention requires only very few conventional components, and therefore can be implemented very simply and at low cost.
[0020] In one embodiment, the DC-DC converter may be a non-isolated DC voltage converter, such as a step-down converter (buck converter), a synchronous converter, or a SEPIC converter (single ended primary inductance converter). Converters, Zeta converters, etc. In non-isolated DC converters, there is no galvanic isolation between the input grid and the output grid. These converters are usually available at low cost.
[0021] In one embodiment, the DC-DC converter can also be an isolated DC voltage converter, such as a flyback converter, a forward converter, a push-pull converter, etc. In an isolated DC converter, there is a galvanic isolation between the input grid and the output grid, which is usually achieved with the aid of a transformer. Such a converter has a higher safety, but is more expensive in terms of weight, space structure and cost. In the high voltage range (>60V), it is beneficial or even mandatory to use an isolated DC voltage converter for safety reasons.
[0022] In one design, the DC-DC converter can be disconnected from the first low-voltage branch by means of a first safety isolation circuit of the first low-voltage branch, and / or disconnected from the high-voltage branch by means of a high-voltage isolation circuit. This means that in the event of a fault in the first low-voltage branch, damage to the DC-DC converter or the high-voltage branch can be avoided, or in the event of a fault in the DC-DC converter, damage to the first low-voltage branch or the high-voltage branch can be avoided.
[0023] In one design solution, the first gate driver circuit can be disconnected from the first low-voltage branch by means of the second safety isolation circuit, which means that in the event of a failure of the first gate driver circuit, damage to the first low-voltage branch can be avoided, and vice versa.
[0024] In one design, the second low-voltage branch can be disconnected from the low-voltage grid (supply side) by means of a third safety isolation circuit. This means that in the event of a low-voltage grid failure, damage to the second low-voltage branch can be avoided, and vice versa.
[0025] In fault-free operation, each of the safety isolation circuit and the high-voltage isolation circuit (if present) can be closed or conductive, so that all branches are connected and function as described above. Each of the safety isolation circuit and the high-voltage isolation circuit (if present) can be selectively set to open according to an external opening signal and / or when a fault is determined (such as, for example, exceeding the current value of the current flowing through it), that is, switch to a non-conductive state.
[0026] Each of the safety isolation circuit and the high-voltage isolation circuit (if present) can optionally include one or more semiconductor switches or mechanical switches (relays). In particular, the high-voltage isolation circuit can also be opened passively and is completed in the form of a safety device (such as a fuse).
[0027] In one embodiment, the safety controller is configured to determine that a shutdown situation exists when at least one of the first, second and third safety isolating circuits (if present) is in a non-conducting state. This means that a shutdown situation can be reliably detected.
[0028] In one embodiment, the safety control device is configured to determine the presence of a shutdown situation when a fault occurs in the DC-DC converter, which means that in this fault situation a safe state is reliably established.
[0029] In one design solution, the safety control device and / or the rectifier circuit each have at least two power supply circuits, wherein the first of the at least two power supply circuits is or can be supplied with energy by a first low-voltage branch, and the second of the at least two power supply circuits is or can be supplied with energy by a second low-voltage branch. By means of this solution with two (especially redundant) power supply circuits, a connection point between the first low-voltage branch and the second low-voltage branch can be avoided. The power supply circuit is used to generate the voltage required by the supplied component from the input voltage (which has a low voltage level in this solution). Usually, the power supply circuit itself can have a DC voltage converter, a low dropout regulator (LDO), etc.
[0030] Further advantages and embodiments of the present invention are apparent from the description and the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] The invention is schematically illustrated by means of exemplary embodiments in the drawings and is described below with reference to the drawings.
[0032] Figure 1 An embodiment of a rectifier arrangement according to the invention is shown schematically.
[0033] Figure 2 A further embodiment of a rectifier arrangement according to the invention is schematically shown.
[0034] Figure 3 A further embodiment of a rectifier arrangement according to the invention is schematically shown.
[0035] Figure 4 An embodiment of a rectifier circuit is schematically shown, which can be used in the rectifier device according to the invention.
[0036] Figure 5 A further embodiment of a rectifier circuit is schematically shown, which can be used in the rectifier arrangement according to the invention.
[0037] Figure 6 A further embodiment of a rectifier arrangement according to the invention is schematically shown.
[0038] Figure 7 A further embodiment of a rectifier circuit is schematically shown, which can be used in the rectifier arrangement according to the invention.
[0039] Figure 8 An embodiment of a safety isolation circuit is schematically shown, which can be used in a rectifier arrangement according to the invention. DETAILED DESCRIPTION
[0040] Embodiments of the invention are described below in a coherent and comprehensive manner with reference to the accompanying drawings. In order to reduce the complexity of the drawings, not all connections and signal flows are shown here. The signal flows shown in the figures are used to request a safe state (safe state request (Safe-to-State-Anforderung) or ASC request for HS and LS gate drivers). The return line or ground line or negative line are also not shown.
[0041] Figure 1 , Figure 2 , Figure 3 and Figure 6 A number of slightly different embodiments of a rectifier device 100 according to the invention are schematically shown. In vehicles, components or devices that control an electric machine are usually referred to as rectifier devices or inverters. In this case, the inverter can, in particular, implement torque and speed control and in doing so convert a DC voltage on the vehicle electrical system side into an AC voltage on the motor side and - for reuse - conversely convert the AC voltage on the motor side into a DC voltage on the vehicle electrical system side and feed it into the vehicle electrical system.
[0042] The rectifier device 100 has an energy supply circuit, which has a high-voltage branch 110, which has high-voltage terminals HV+, HV- (DC voltage) for connecting to a high-voltage grid with a high voltage level; a second low-voltage branch 130, which has low-voltage terminals B+, B- (DC voltage) for connecting to a low-voltage grid with a low voltage level (so-called K1.30 grid) and a first low-voltage branch 120 with a low voltage level. For example, the high voltage level is in the range of 40V to 1000V. For example, the low voltage level can be 12V or 24V.
[0043] The high-voltage branch 110 is connected to the first low-voltage branch 120 via a DC-DC converter 10 , wherein the first low-voltage branch 120 is powered or supplied by the high-voltage branch 110 .
[0044] exist Figure 1 , Figure 2 and Figure 3 In the broadest sense, the first low-voltage branch 120 is used to supply energy to the components of the rectifier device. The first low-voltage branch 120 can also be referred to as a PDN (see above). The second low-voltage branch 130 is used as a backup supply or a safety power supply. Figure 6 An embodiment of a rectifier device 100 is shown in FIG. Figure 1 , Figure 2 and Figure 3 The main difference between the embodiments of the present invention is that the second low-voltage branch 130 is used for power supply of components of the rectifier device, and the first low-voltage branch 120 is used as a backup supply or a safety power supply.
[0045] The rectifier circuit 115 is used to connect the AC voltage terminals U, V, W (three in the example shown) of the motor 500 that does not belong to the rectifier device 100 to the positive DC voltage terminal HV+ and the negative DC voltage terminal HV- of the high-voltage branch 110. In addition, the rectifier circuit 115 may include a logic circuit 118 for generating a control signal (see Figure 4 , Figure 5 , Figure 7 ) and a plurality of semiconductor switches 116a, 116b which are to be controlled by means of control signals.
[0046] The rectifier device 100 has a housing, from which the terminals HV+, HV-, B+, B-, U, V, W and in particular the terminals for communication (e.g. CAN, LIN, etc.) and / or the terminals for sensors (e.g. rotation speed sensor, angular position sensor, temperature sensor, etc.) and / or other terminals are led. Advantageously, the rectifier device 100 can be structurally connected to the motor 500, that is, in particular, fastened to the motor.
[0047] The rectifier circuit 115 is Figure 4 , Figure 5 and Figure 7 , is shown in a schematic circuit diagram and has a so-called high-voltage side, HS-switch 116a (between each AC voltage terminal U, V, W of the motor 500 and the positive DC voltage terminal HV+) and a so-called low-voltage side, LS-switch 116b (between each AC voltage terminal U, V, W of the motor 500 and the negative DC voltage terminal HV-).
[0048] The HS power supply circuit 200 is provided for operating the HS switch 116a, and the LS power supply circuit 300 is provided for operating the LS switch 116b. The reference numerals of the elements of the HS power supply circuit 200 and the LS power supply circuit 300 are increased by 100, respectively, and are described together below.
[0049] Each of the switches 116a, 116b has a control terminal 117 (eg, a gate terminal of a MOSFET or an IGBT), and in order to switch the switch, a control signal is applied to a so-called gate driver circuit 210, 310 (hereinafter also simply referred to as a gate driver).
[0050] Modern insulated gate drivers usually require a low voltage supply VCC1 on the primary side. This low voltage supply can typically be 5V or 3.3V, for example, generated by a low dropout regulator (LDO) 220, 320. It is also possible to use a gate driver with an integrated LDO, so that a separate LDO can be omitted in this case.
[0051] In order to close and open power semiconductor switches such as SiC-MOSFET and IGBT, each gate driver typically requires two different voltage levels on the secondary side (that is, on the side connected to the gate 117 of the switch 116a, 116b): a positive level VCC2 (e.g., +20V for SiC-MOSFET) and a negative level VEE (e.g., -4V for SiC-MOSFET), but is not limited to these two voltage levels.
[0052] exist Figure 4 In order to safely control the switches 116a, 116b under normal conditions and also during an active short circuit, an isolated gate driver power supply is used, which is also called an isolated bias voltage supply or voltage supply. To increase the reliability of the system, three HS-bias voltage supply circuits 230 are used for the HS gate driver 210, and three LS-bias voltage supply circuits 330 are used for the LS gate driver 310.
[0053] exist Figure 5 and Figure 7Another scheme for realizing bias voltage supply is shown in the figure, namely, using a flyback converter (Fly-Back converter) 540 having multiple windings as the HS-bias voltage supply circuit, and using another flyback converter 640 also having multiple windings as the LS-bias voltage supply circuit, which also obtains an isolated bias voltage supply.
[0054] In order to realize the bias voltage supply, a voltage higher than the rated voltage level of the first low-voltage branch 120 or the second low-voltage branch 130 may be required. If in this case, the bias voltage supply circuit 230, 330 cannot increase the voltage accordingly, a pre-regulator power supply 240, 340 can be used to supply the bias voltage supply circuit 230, 330. In particular, the pre-regulator power supply 240, 340 also includes a DC voltage converter and converts the low voltage (e.g., 12V or 15V) into a higher voltage (e.g., 24V). If the isolated bias voltage supply circuit is able to sufficiently increase the voltage (e.g., by means of a boost flyback converter or SEPIC (English: single ended primary inductance converter), the pre-regulator power supply 240, 340 is not required.
[0055] Since modern gate drivers can receive safety requests (e.g. for ASC) not only on the primary side but also on the secondary side (primary chip is isolated from the secondary chip of the gate driver), the gate driver can receive two (safe state) signals S1, S2 or S3, S4; one signal (S2, S4) for the primary side and one signal (S1, S3) for the secondary side. These signals are shown with dashed lines.
[0056] Modern insulated gate drivers are able to receive two types of safety signals: an ASC enable signal (ASC_EN), which requests a safe state; and an ASC state signal (ASC_ST), which presets the type of safe state. In order to reduce the complexity of the drawings, only one signal S1 to S4 is shown for each side (primary side, secondary side). However, it should be noted that each signal S1 to S4 may include multiple types of safety signals.
[0057] In the first low-voltage branch 120 ( Figure 1 , Figure 2 , Figure 3 ) or the second low-voltage branch 130 ( Figure 6 ), one or more low-voltage loads 121 of the rectifier device, which are only indicated schematically, are also arranged, such as sensors (such as speed sensors, angular position sensors, temperature sensors, etc.), communication devices (CAN transceivers, LIN transceivers, etc.), etc.
[0058] In addition, a (functional) safety control device 123 is provided, that is, a functional safety (English: safety) control device. In particular, the task of this safety control device is to monitor the rectifier device, determine the state of the rectifier device, and, if necessary, summarize the signals S1 to S4 for the safe state, so that the rectifier circuit can operate under normal drive control or can be converted to a safe state such as ASC or the like. In order to achieve this, it is beneficial that the safety control device 123 communicates with as many components or structural modules of the rectifier device as possible, and also communicates with the upper-level controller 124 (such as the so-called MCU), in particular, in order to achieve the desired "Automotive Safety Integrity Level" (ASIL) (depending on the functional safety goal). The communication and signal transmission between the safety control device 123 and the upper-level controller 124 are shown with double arrows with dashed lines.
[0059] To increase safety, an energy management circuit 125 for the power supply is provided for the controller 124, for example in the form of a so-called PMIC (English: power management IC, integrated circuit) or a safety PMIC or a safety system basis chip (safety SBC). A safety PMIC integrates a plurality of DC voltage converters in a housing. Most of these devices have built-in protection functions such as soft start, pulse current limitation, independent voltage monitoring, temperature measurement and cut-off in the event of excessive power loss. Most PMICs have a watchdog timer to ensure the integrity of the microcontroller used in the system.
[0060] exist Figure 1 In the embodiment, the safety control device 123 is supplied with current or energy by the power supply circuit 126. In order to improve safety, the safety control device 123 is also supplied with current by the energy management circuit 125. Figure 2 , Figure 3 and Figure 6 In the embodiment, the safety controller 123 is supplied with current or energy via the first power supply circuit 126a and via the second power supply circuit 126b.
[0061] In order to achieve the functional safety target (eg, ASIL D), the safety control device 123 may have two independent safety logic circuits 123a, 123b, and the two safety logic circuits have two independent supply devices. Figure 1 In FIG. 1 , the first safety logic circuit 123a is supplied by the power supply circuit 126, and the second safety logic circuit 123b is supplied by the energy management circuit 125. Figure 2 , Figure 3 and Figure 6In the embodiment, the first safety logic circuit 123a is supplied by the first power supply circuit 126a, and the second safety logic circuit 123b is supplied by the second power supply circuit 126b. In the event of a power failure in one of the two safety logic circuits, the other safety logic circuit can ensure a switch to a safe state.
[0062] In order to achieve the desired level of functional safety, different measurement signals can be provided to the safety control device 123 and the upper-level controller 124, such as, for example, voltage, temperature, speed, etc. of different parts of the rectifier circuit or different parts of the vehicle power supply, fault or health status / signals of the power supply, sensors, gate drivers, main switches, etc.
[0063] In a rectifier device that does not have two low-voltage branches 120, 130 according to the present invention, a fault (interruption or short circuit) may cause a current supply interruption or a latent fault for the only low-voltage branch and hinder the current supply of the safety control device 123 or the gate driver, making it impossible for the rectifier circuit 115 to switch to a safe state. In order to advantageously deal with this situation, additional precautions described below are taken in the rectifier device.
[0064] As shown in the figure, the first low-voltage branch 120 is not electrically connected to the second low-voltage branch 130. Figure 1 and Figure 2 In the embodiment, the second low-voltage branch 130 establishes its own connection with the LS power supply circuit 300 and with the safety logic circuit 123a. Alternatively, the second low-voltage branch 130 can also establish a connection with the HS-power supply circuit 200 ( Figure 3 ) and the safety logic circuit 123b (not shown).
[0065] exist Figure 1 and Figure 2 , an embodiment is shown in which at least one gate driver circuit 310 for a low-side semiconductor switch 116 b is or can be supplied with energy by the second low-voltage branch 130 . Figure 3 , an embodiment is shown in which at least one gate driver circuit 210 for a high-side semiconductor switch 116a is or can be supplied with energy by the second low-voltage branch 130. Figure 6 and Figure 7 , an embodiment is shown in which at least one gate driver circuit 310 for the low-voltage side semiconductor switch 116 b is or can be supplied with energy by the first low-voltage branch 120, for which purpose a terminal 120 a is provided. In order to ensure galvanic isolation between the second low-voltage branch 130 and the first low-voltage branch 120 or the high-voltage branch 110, a current blocking circuit, such as a diode 122, is provided for this purpose. As shown in Figure 6As shown in FIG. 1 , the diode 122 may be arranged downstream of the DC-DC converter 10 , and if present, downstream of the safety isolation circuit 31 , or in series with the terminal 120 a .
[0066] exist Figure 1 In the embodiment, the safety control device 123 is connected to the second low-voltage branch 130 through the power supply circuit 126, and is connected to the first low-voltage branch 120 through the energy management circuit 125. Figure 2 and Figure 3 In the embodiment, the safety control device 123 is connected to the second low-voltage branch 130 through the first power supply circuit 126a, and is connected to the first low-voltage branch 120 through the second power supply circuit 126b. Figure 6 In the embodiment, the safety control device 123 is connected to the second low-voltage branch 130 through the first power supply circuit 126a, and is connected to the first low-voltage branch 120 through the second power supply circuit 126b.
[0067] As long as at least one of the two low-voltage branches 120, 130 is supplied, the safety control device 123 is powered by one or both low-voltage branches. If the supply by one of the two low-voltage branches fails, the safety control device 123 or its first safety logic circuit or second safety logic circuit 123a, 123b is powered by the other low-voltage branch. The remaining safety logic circuit can start the safety state for the gate driver.
[0068] In the design solution, one or more (optional) safety isolation circuits 31 to 33 are added to the rectifier device to protect the power supply as a whole and isolate the faulty area from the rest of the power grid. The safety isolation circuits 31 to 33 can prevent the spread of faults and potential faults in the rectifier device. The safety isolation circuits 31 to 33 can communicate with the safety control device 123 and the upper controller 124 (the communication link is not shown).
[0069] Safety control device 123 is configured to bring rectifier circuit 115 into a safe state when a disconnection situation exists, wherein the presence of a disconnection situation is determined in particular when at least one of safety isolation circuits 31 to 33 is in an open state.
[0070] A first safety isolation circuit 31 can be added in series with the DC-DC converter 10. If a fault occurs in the DC-DC converter 10, the first safety isolation circuit 31 can be disconnected, thereby protecting the first low-voltage branch 120 and interrupting the fault current, and (if necessary) reporting the fault to the safety control device 123 and / or the superior controller 124. Subsequently, the LS-supply circuit 300 and the safety control device 123 can be supplied by the second low-voltage branch 130.
[0071] As the first power supply circuit supplied by the first low-voltage branch 120, it can be connected to the HS-power supply circuit 200 (see Figure 1 , Figure 2 ) or LS-supply circuit 300 (see Figure 3 ) is connected in series with the second safety isolation circuit 32. If a fault occurs in the first power supply circuit 200, the second safety isolation circuit 32 can be disconnected, thereby protecting the first low-voltage branch 120 from the spread of the fault, interrupting the fault current, and (if necessary) reporting the fault to the safety control device 123 and / or the superior controller 124.
[0072] A third safety isolation circuit 33 may be added in series with the second low-voltage branch 130. If a fault occurs in the low-voltage grid B+, the third safety isolation circuit 33 may be disconnected, thereby protecting the second low-voltage branch 130 and interrupting the fault current, and (if necessary) reporting the fault to the safety control device 123 and / or the superior controller 124. Subsequently, supply may be achieved from the high-voltage branch 110 via the first low-voltage branch 120.
[0073] All of these safety isolation circuits 31 to 33 can be implemented as diagnostic modules and monitoring modules with integrated control circuits and are protected against short circuits, short circuits to ground, reverse current blocking, overvoltages and undervoltages. Figure 8 An example of a simplified safety isolation circuit 400 is shown in FIG. 4 . In general, the safety isolation circuit 400 can be implemented by means of electronic switches 401, 402 (such as MOSFETs) and a control circuit 403, which receives input 404 and output 405 signals, especially signals about current and / or voltage, and controls the gate of the MOSFET. Alternatively or additionally, the control circuit 403 is configured to open or close the electronic switches 401, 402 according to a control signal, especially a control signal of the safety control device 123 or the superior controller 124.
[0074] In order to protect the primary and secondary sides of the DC-DC converter 10, a fuse F1 is provided as a high-voltage isolation circuit so that in the event of a fault on the primary side, such as a short circuit in the transformer winding or a short circuit in the galvanically isolated DC voltage converter, the fuse can isolate the faulty part.
[0075] In accordance with Figure 3 In the rectifier device of FIG. 1 , the HS supply circuit 200 is supplied by the second low-voltage branch 130. The first safety logic circuit 123a is also supplied by the second low-voltage branch 130 as before.
[0076] In all the variants shown, faults in the first low-pressure branch 120 and in the second low-pressure branch 130 are isolated from one another. Therefore, faults cannot be transferred from the first low-pressure branch 120 to the second low-pressure branch 130 and vice versa.
[0077] If a fault occurs in the first low-voltage branch 120 or in the high-voltage branch 110 , the second low-voltage branch 130 can ensure the supply of the first safety logic circuit 12a and the respective LS supply circuit or HS supply circuit 200 , 300 (only one of them). The achievement of the safe state is thus ensured.
[0078] By means of the invention, functional safety and reliability can be improved without having to prove that the rectifier device of the inverter has full redundancy, which would otherwise increase the cost by a factor of 2. Advantageously, the second low-voltage branch also does not have to be powerful enough to supply the entire rectifier device, which reduces the cost of implementing the concept.
[0079] List of Reference Numerals
[0080] 10DC-DC Converter
[0081] 31-33 Safety isolation circuit
[0082] 100 rectifier equipment
[0083] 110 high voltage branch
[0084] 500 motor
[0085] 115 Rectifier Circuit
[0086] 116a, 116b semiconductor switch
[0087] 117 control terminal
[0088] 118 Logic Circuit
[0089] 120 First low voltage branch
[0090] 120a Terminal for the first low voltage branch
[0091] 122 diode
[0092] 123 Safety Control Device
[0093] 123a, 123b safety logic circuit
[0094] 124 Upper controller
[0095] 125 Energy Management Circuit
[0096] 126, 126a, 126b power supply circuit
[0097] 130 Second low-voltage branch
[0098] 200, 300HS-power supply circuit
[0099] 210, 310 gate driver circuit
[0100] 220, 320 low dropout regulator (LDO)
[0101] 230, 330 bias voltage supply circuit
[0102] 240, 340 pre-regulator power supply
[0103] 400 safety isolation circuit
[0104] 401, 402 MOSFET
[0105] 403 control circuit
[0106] 404 Input
[0107] 405 Output
[0108] 540, 640 Flyback Converter
[0109] F1 high voltage isolation circuit
[0110] S1-S4 Signal
[0111] HV+ forward DC voltage terminal
[0112] HV-Negative DC voltage terminal
[0113] B+ forward DC voltage terminal
[0114] U, V, W AC voltage terminals
Claims
1. A rectifier device (100) for controlling an electric motor (500), The rectifier device (100) comprises a rectifier circuit (115), a safety controller (123) and an energy supply circuit for supplying the rectifier circuit (115) and the safety controller (123). in, The safety control device (123) is configured to switch the rectifier circuit (115) to a safe state when a cut-off condition occurs. The energy supply circuit comprises a high-voltage branch (110), a first low-voltage branch (120) and a second low-voltage branch (130). The high-voltage branch (110) is connected to the first low-voltage branch (120) via a DC-DC converter (10). wherein the high-voltage branch (110) and the first low-voltage branch (120) are not electrically connected to the second low-voltage branch (130), The rectifier circuit (115) and the safety control device (123) are supplied with energy by the first low-voltage branch (120) and the second low-voltage branch (130).
2. The rectifier device (100) according to claim 1, wherein: The safety control device (123) has at least two power supply circuits (125, 126; 126a, 126b), wherein the first of the at least two power supply circuits is supplied with energy by the first low-voltage branch (120), and the second of the at least two power supply circuits is supplied with energy by the second low-voltage branch (130).
3. The rectifier device (100) according to claim 1, wherein: The rectifier circuit (115) has at least two power supply circuits (200, 300), wherein a first power supply circuit of the at least two power supply circuits is supplied with energy by the first low-voltage branch (120), and a second power supply circuit of the at least two power supply circuits is supplied with energy by the second low-voltage branch (130).
4. The rectifier device (100) according to claim 3, wherein: By means of a second safety isolation circuit (32), a first power supply circuit of the at least two power supply circuits can be disconnected from the first low-voltage branch (120).
5. The rectifier device (100) according to claim 3, wherein: At least two power supply circuits (200, 300) of the rectifier circuit (115) respectively have gate driver circuits (210, 310), wherein the first gate driver circuit (210) is supplied with energy by the first low-voltage branch (120), and the second gate driver circuit (310) is supplied with energy by the second low-voltage branch (130).
6. The rectifier device (100) according to claim 5, wherein: At least two power supply circuits (200, 300) of the rectifier circuit (115) respectively have bias voltage supply circuits (230, 330; 540, 640) for the gate driver circuits (210, 310), wherein a first bias voltage supply circuit (230) is supplied with energy by the first low-voltage branch (120), and a second bias voltage supply circuit (330) is supplied with energy by the second low-voltage branch (130).
7. The rectifier device (100) according to claim 1, wherein: The DC-DC converter (10) and the first low-voltage branch (120) are disconnectable by means of a first safety isolation circuit (31), and / or the DC-DC converter (10) and the high-voltage branch (110) are disconnectable by means of a high-voltage isolation circuit (F1).
8. The rectifier device (100) according to claim 1, wherein: By means of a third safety isolating circuit (33), the second low-voltage branch (130) can be disconnected from an external energy supply (B+).
9. The rectifier device (100) according to claim 4, 7 or 8, wherein: The safety control device (123) is configured to determine that a cutoff condition exists when at least one of the first safety isolation circuit, the second safety isolation circuit and the third safety isolation circuit (31-33) is in a non-conducting state.
10. The rectifier device (100) according to claim 4, 7 or 8, wherein: At least one of the first safety isolation circuit, the second safety isolation circuit and the third safety isolation circuit (31-33) has at least one electronic switch (401, 402) and a control circuit (403) between an input (404) and an output (405), wherein the control circuit (403) is configured to open or close the at least one electronic switch (401, 402) according to a control signal.
11. The rectifier device (100) according to claim 1, wherein: The safety control device (123) has at least two safety logic circuits (123a, 123b), wherein a first safety logic circuit (123a) of the at least two safety logic circuits is or can be supplied with energy by the first low-voltage branch (120), and a second safety logic circuit (123b) of the at least two safety logic circuits is or can be supplied with energy by the second low-voltage branch (130).
12. A method for operating a rectifier device (100) according to claim 1, comprising: When a cut-off condition exists, the rectifier circuit (115) is brought into a safe state.
13. The method according to claim 12, in, The DC-DC converter (10) and the first low-voltage branch (120) are disconnectable by means of a first safety isolation circuit (13). The method comprises: The presence of a shutdown situation is detected when the first safety isolating circuit (31) detects a fault and / or the first safety isolating circuit (31) is in an open state.
14. The method according to claim 12, in, The rectifier circuit (115) has at least two power supply circuits (200, 300), wherein a first power supply circuit of the at least two power supply circuits is supplied with energy by the first low-voltage branch (120), and a second power supply circuit of the at least two power supply circuits is supplied with energy by the second low-voltage branch (130), wherein, by means of a second safety isolation circuit (32), a first power supply circuit of the at least two power supply circuits and the first low-voltage branch (120) can be disconnected, The method comprises: The presence of a shutdown situation is detected when the second safety isolating circuit (32) detects a fault and / or the second safety isolating circuit (32) is in an open state.
15. The method according to claim 12, in, By means of a third safety isolation circuit (33), the second low-voltage branch (130) can be disconnected from an external energy supply (B+). The method comprises: The presence of a shutdown situation is detected when the third safety isolating circuit (33) detects a fault and / or the third safety isolating circuit (33) is in an open state.
16. The method according to claim 12, comprising: If the DC-DC converter (10) is faulty, a shutdown situation is detected.
17. The method according to claim 12 and claim 5, comprising: The presence of a shutdown situation is detected when the gate driver circuit (210; 310) detects a fault, in particular a fault in the energy supply from the first low-voltage branch (120) and / or the second low-voltage branch (130).