Power supply control method and system of motor controller

Abstract

The invention relates to the technical field of vehicle power supplies, in particular to a power supply control method and system of a motor controller. The system comprises an upper bridge auxiliary power supply, a lower bridge auxiliary power supply, an upper bridge driving chip, a micro-control unit, a power supply chip and a three-level safety module realized based on hardware, wherein the upper bridge auxiliary power supply and the upper bridge driving chip are powered by a battery, and the lower bridge auxiliary power supply and the lower bridge driving chip are powered by a high-voltage bus; the input end of the three-stage safety module is connected with the power supply chip, and the output end of the three-stage safety module is connected with the lower bridge driving chip; and the power supply chip is connected with the micro-control unit and is used for carrying out fault detection on the micro-control unit and sending a lower bridge active short circuit control signal to the third-stage safety module under the condition that the fault of the micro-control unit is detected.

Description

Technical Field

[0001] The present application relates to the technical field of vehicle power supply, and in particular to a power supply control method and system for a motor controller. Background Art

[0002] With the development of new automobile intelligence and electrification, the functional safety development of automobiles has become increasingly critical in the field of automotive engineering, especially the safety of motor controllers, which is particularly important as it is directly related to the life and property safety of drivers, passengers and other road users.

[0003] The safety requirements of the motor controller include: torque safety, high voltage safety and thermal safety. Among them, the premise of torque safety is a safe and reliable power supply architecture. In the prior art, the power supply architecture of the motor controller can only play a basic power supply function. When a power supply failure occurs, the safe operation of the motor controller cannot be guaranteed.

[0004] In view of this, this application is filed. Summary of the invention

[0005] To solve the problems in the background technology, the present application provides a power control method and system for a motor controller.

[0006] In a first aspect, the present application provides a power control system for a motor controller, comprising: an upper bridge auxiliary power supply, a lower bridge auxiliary power supply, an upper bridge driver chip, a lower bridge driver chip, a microcontroller unit, a power chip, and a three-level safety module based on hardware implementation; The upper bridge auxiliary power supply and the upper bridge drive chip are powered by a battery, and the lower bridge auxiliary power supply and the lower bridge drive chip are powered by a high-voltage bus; The input end of the three-level safety module is connected to the power chip, and the output end is connected to the lower bridge driver chip; The power chip is connected to the micro control unit and is used for performing fault detection on the micro control unit, and sending a lower bridge active short circuit control signal to the third-level safety module when a fault of the micro control unit is detected.

[0007] Optionally, the system further comprises: a secondary safety module implemented based on software control; The input end of the secondary safety module is connected to the micro control unit, and the output end is respectively connected to the upper bridge driving chip and the lower bridge driving chip.

[0008] Optionally, the system further comprises: a KL30 input anti-reverse module, a first insurance module and a buck-boost power supply; The KL30 power supply of the battery is connected in sequence to the KL30 input anti-reverse module, the first insurance module and the buck-boost power supply; The buck-boost power supply is connected to the upper bridge auxiliary power supply and the upper bridge driving chip respectively.

[0009] Optionally, the system further comprises: a second insurance module; The KL30 power supply of the battery is connected to the KL30 input anti-reverse module, the second insurance module and the power chip in sequence; The power chip is used to supply power to the micro control unit and the secondary safety module.

[0010] Optionally, the system further comprises a power conversion module; The power conversion module is connected to the lower bridge auxiliary power supply and the third-level safety module respectively, and is used for converting the output voltage of the lower bridge auxiliary power supply and inputting it into the third-level safety module.

[0011] Optionally, the system further comprises a watchdog circuit; The power chip is connected to the micro control unit through the watchdog circuit; The power chip is used to detect whether the micro control unit fails through the watchdog circuit.

[0012] In a second aspect, the present application further provides a power control method of a motor controller, which is applicable to any power control system, and the method comprises: The power chip performs fault detection on the microcontroller unit; In the case of detecting a fault in the micro control unit, the power chip sends a lower bridge active short circuit control signal to the third-level safety module; The third-level safety module performs active short-circuit control on the lower bridge driving chip in response to the lower bridge active short-circuit control signal, so as to enter an active short-circuit state from the lower bridge.

[0013] Optionally, the method further includes: When the power chip detects a fault in itself, it sends a lower bridge active short circuit control signal to the third-level safety module.

[0014] Optionally, the method further includes: The micro control unit performs fault detection on the motor controller, the upper bridge circuit and the lower bridge circuit, and sends an upper bridge active short circuit control signal or a lower bridge active short circuit control signal to the secondary safety module when a fault is detected; The secondary safety module performs active short-circuit control on the upper bridge driver chip in response to the upper bridge active short-circuit control signal, so as to enter an active short-circuit state from the upper bridge; or, The secondary safety module performs active short-circuit control on the lower bridge driving chip in response to the lower bridge active short-circuit control signal, so as to enter an active short-circuit state from the lower bridge.

[0015] Optionally, the microcontroller unit performs fault detection on the motor controller, the upper bridge circuit and the lower bridge circuit, and sends an upper bridge active short circuit control signal or a lower bridge active short circuit control signal to the secondary safety module when a fault is detected, including at least one of the following: When the microcontroller detects a motor controller failure, it sends an upper bridge active short-circuit control signal to the secondary safety module; When the microcontroller detects a fault in the lower bridge driver chip or the lower bridge auxiliary power supply, it sends an upper bridge active short circuit control signal to the secondary safety module; When the microcontroller detects a fault in the upper bridge driver chip, the upper bridge auxiliary power supply or the buck-boost power supply, it sends a lower bridge active short-circuit control signal to the secondary safety module.

[0016] Compared with the prior art, the beneficial effects of this application are: The upper bridge auxiliary power supply and the upper bridge driver chip in this application are powered by batteries, and the lower bridge auxiliary power supply and the lower bridge driver chip are powered by high-voltage busbars, so that the upper bridge and the lower bridge are powered by different and independent power supplies, which are redundant. On the basis of this redundant power supply architecture, a hardware-based level 3 safety module is also installed. The level 3 safety module can work when the microcontroller unit fails. When the microcontroller unit fails, the level 3 safety module controls the lower bridge to enter an active short-circuit state, which meets high safety requirements and has low hardware costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 It is a structural schematic diagram of a power supply control system of a motor controller provided in an embodiment of the present application; Figure 2 It is a schematic diagram of a PWM signal controlling the state of an IGBT provided in an embodiment of the present application; Figure 3 It is a structural schematic diagram of another power supply control system of a motor controller provided in an embodiment of the present application; Figure 4 It is a flow chart of a power expansion control method of a motor controller provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0020] An embodiment of the present application provides a power control system of a motor controller, which is suitable for powering the motor controller and performing active short circuit (ASC) control.

[0021] The motor controller of new energy vehicles is a key component in electric vehicles. It is responsible for receiving instructions from the on-board computer or other control systems, and then adjusting the power supply and drive strategy of the motor according to these instructions to achieve precise control of the vehicle's speed, torque and other performance.

[0022] See also Figure 1 , the red line is the power line, the black line is the signal line, and the green line is the watchdog circuit. The power control system provided in this embodiment includes an upper bridge auxiliary power supply, a lower bridge auxiliary power supply, an upper bridge driver chip, a lower bridge driver chip, a micro control unit, a power chip, and a three-level safety module based on hardware implementation. The connection relationship and function of each component are described in detail below.

[0023] The upper bridge auxiliary power supply can be an upper bridge IGBT (Insulated Gate Bipolar Transistor) isolated drive auxiliary power supply, which is responsible for providing a stable and reliable drive power supply for the upper bridge IGBT and ensuring that the IGBT can be reliably turned on and off. The workflow of the upper bridge IGBT isolated drive auxiliary power supply includes: 1) Input voltage processing: The power supply first receives the input voltage (such as DC bus voltage or rectified AC voltage) and obtains a stable DC voltage through filtering, voltage stabilization and other processing; 2) Electrical isolation: In order to ensure the electrical isolation between the drive circuit and the main circuit, the power supply is usually implemented by isolation devices such as transformers and optocouplers. This can prevent the high voltage and high current in the main circuit from interfering with or damaging the drive circuit; 3) Output voltage regulation: According to the driving requirements of the IGBT, the power supply needs to output a suitable voltage and current. This is usually achieved through PWM (pulse width modulation) control, linear voltage stabilization and other methods; 4) Protection function: In order to protect the IGBT and the drive circuit, the power supply usually also has protection functions such as overcurrent, overvoltage, and short circuit. When an abnormal situation is detected, the power supply will quickly cut off the output to avoid damage to the equipment.

[0024] The upper bridge driver chip can be an upper bridge IGBT isolation driver chip. The upper bridge IGBT isolation driver chip is an integrated circuit specially designed to drive the upper bridge arm IGBT. It provides electrical isolation, signal amplification, protection and other functions. Electrical isolation ensures the safe isolation between the drive circuit and the main circuit to prevent high voltage and high current from interfering with or damaging the drive circuit. The signal amplification function is used to enhance the driving capability of the control signal to ensure that the IGBT can be turned on and off reliably. The protection function is used to monitor the working status of the IGBT and take timely measures when an abnormality occurs, such as cutting off the output, reducing the power, etc., to protect the IGBT from damage.

[0025] In this embodiment, the upper bridge driver chip is used to receive a PWM (Pulse Width Modulation) control signal and an active short-circuit control signal sent by an MCU (Microcontroller Unit) to control the IGBT upper bridge switch.

[0026] Among them, the PWM signal can control the on and off of the inverter (the principle of the inverter is to convert DC power into three-phase AC power to power the drive motor by controlling the on and off of the IGBT), such as Figure 2 As shown, ON means on, OFF means off, 1 means high level, and 0 means low level. The frequency and amplitude of the output AC power are adjusted by adjusting the duty cycle and output frequency of PWM. Since the output capacity of MCU is very low, the upper / lower IGBT isolation driver chip is generally required to enhance the PWM signal. The upper / lower IGBT isolation driver chip provides higher power and current output capabilities and stronger PWM drive signals, that is, the upper bridge driver chip outputs an enhanced upper bridge IGBT drive signal, and the lower bridge driver chip outputs an enhanced lower bridge IGBT drive signal to control the on and off of the lower bridge IGBT and realize motor control.

[0027] In addition, when the upper bridge / lower bridge driver chip fails, it will output a low level (0), and the IGBT cannot be turned on, and the IGBT is in the off state.

[0028] The upper bridge auxiliary power supply is connected to a battery (such as a small vehicle-mounted battery) through a charging circuit and is powered by the battery. The upper bridge auxiliary power supply is connected to the upper bridge driver chip, converting the 15v power supply into 3-way drive power supply (U / V / W) to power the high-voltage side of the upper bridge driver chip. It can be seen that both the upper bridge auxiliary power supply and the upper bridge driver chip are powered by batteries. Among them, the motor controller mainly converts DC power into three-phase AC power by controlling the inverter to drive the three-phase motor. U / V / W represent the three drive input terminals of the motor, which also correspond to the three phase lines of the three-phase AC power.

[0029] The lower bridge auxiliary power supply may be a lower bridge IGBT isolation driver auxiliary power supply. The lower bridge driver chip may be a lower bridge IGBT isolation driver chip, which is used to receive a PWM (Pulse Width Modulation) control signal and an active short circuit control signal sent by the MCU to control the IGBT lower bridge switch.

[0030] The lower bridge auxiliary power supply is connected to the high-voltage bus in the car and is powered by the high-voltage bus. The lower bridge auxiliary power supply is connected to the lower bridge driver chip, converting the high-voltage bus voltage into a 15V power supply to power the low-voltage side of the lower driver chip, and converting the high-voltage bus voltage into 3 drive power supplies (U / V / W) to power the high-voltage side of the lower bridge driver chip. It can be seen that both the lower bridge auxiliary power supply and the lower bridge driver chip are powered by the high-voltage bus.

[0031] The level 3 safety module is based on hardware time, including high-performance power controller, monitoring circuit, protection circuit and communication interface, etc. The level 3 safety module is located at a higher level of the power architecture, as a controller monitoring level, with the functions of electronic and electrical system hardware diagnosis, independent monitoring and application flow inspection.

[0032] The power chip can be an SBC (System Basic Chip) power chip, which is a SBC chip specifically used for power management. It usually integrates functions such as power conversion, power monitoring, and power protection to provide a stable and reliable power supply for the system. The power chip is also powered by a battery and supplies power to the MCU. Optionally, the power chip can provide 5V, 3V, or 1.25V power to the MCU according to the power demand of the MCU.

[0033] The input end of the level 3 safety module is connected to the power chip, and the output end is connected to the lower bridge driver chip.

[0034] The power chip is connected to the MCU to detect faults of the MCU. Optionally, the power chip is connected to the MCU via a watchdog circuit, and the watchdog circuit is used to detect whether the MCU is faulty.

[0035] The watchdog circuit has an input terminal (dog feeding terminal) and an output terminal. The input terminal is connected to the MCU, and the output terminal is connected to the power chip. The MCU will periodically send a signal (dog feeding signal) to the input terminal, and this signal will reset the timer inside the watchdog circuit. If the MCU fails and fails to send the dog feeding signal within the specified time, the timer inside the watchdog circuit will time out and output a reset signal to the power chip, so that the power chip detects that the MCU has failed. When the MCU fails, the MCU cannot send an active short-circuit control signal to the upper bridge driver chip and the lower bridge driver chip. Therefore, the power chip directly sends a lower bridge active short-circuit control signal to the level 3 safety module and enters the ASC state from the lower bridge.

[0036] The level3 safety module responds to the lower bridge active short-circuit control signal to actively short-circuit the connected lower bridge driver chip. The lower bridge driver chip receives the control signal sent by the level3 safety module and then controls the lower bridge of the IGBT to turn on, so that the motor controller enters the active short-circuit state. The ASC state of the motor controller of new energy vehicles is one of its important safety protection mechanisms. The ASC state is a safe working state achieved by the motor controller under certain conditions by selectively turning on or off the upper and lower bridge arms of the IGBT. When the motor controller enters the ASC state, the motor stator winding and the IGBT of the lower bridge arm (or upper bridge arm, depending on the specific implementation method) form a closed loop, the back electromotive force energy generated by the motor is released through the stator winding, and the motor output end generates a corresponding braking torque. The ASC state of the motor controller can be applied to the following scenarios: 1) Vehicle out-of-control protection: When the vehicle is out of control, ASC will intervene quickly, generate reverse torque to brake the vehicle slowly, and ensure safe parking. 2) Power battery fault protection: When the power battery fails, ASC can quickly isolate the motor, motor controller and power battery to ensure the high voltage safety of the whole vehicle. 3) Motor speed abnormality protection: During driving, if the motor speed is abnormal or too high, ASC will intervene in time to prevent excessive back electromotive force from damaging the power battery, bus capacitor and other high-voltage components. 4) Motor controller fault protection: When a switch failure occurs in the inverter circuit of the motor controller, ASC can effectively prevent uncontrollable rectifier current from damaging other components or the power battery.

[0037] The upper bridge auxiliary power supply and the upper bridge driver chip in this application are powered by batteries, and the lower bridge auxiliary power supply and the lower bridge driver chip are powered by high-voltage busbars, so that the upper bridge and the lower bridge are powered by different and independent power supplies, which are redundant. On the basis of this redundant power supply architecture, a hardware-based level 3 safety module is also installed. The level 3 safety module can work when the microcontroller unit fails. When the microcontroller unit fails, the motor controller is controlled to enter an active short-circuit state through the level 3 safety module, which meets high safety requirements and has low hardware costs.

[0038] In some embodiments, see Figure 3 The system also includes a level 2 (levev2) safety module based on software implementation. The input end of the levev2 safety module is connected to the MCU, and the output end is connected to the upper bridge driver chip and the lower bridge driver chip respectively.

[0039] The level 2 safety module is based on software control and is mainly responsible for monitoring and ensuring the normal operation of the power system, as well as taking appropriate safety measures when anomalies occur. The level 2 safety module integrates embedded software and algorithms for fault diagnosis, early warning and safety protection to meet the high safety requirements of the power system. The MCU can send a lower bridge active short circuit control signal or an upper bridge active short circuit control signal to the level 2 safety module; then, the level 2 safety module controls the lower bridge driver chip or the lower bridge driver chip to enter the ASC state.

[0040] Optional, see Figure 3 The system also includes a KL30 input anti-reverse module, a first insurance module and a buck-boost power supply. The KL30 power supply of the battery is sequentially connected to the KL30 input anti-reverse module, the first insurance module and the buck-boost power supply; the buck-boost power supply is respectively connected to the upper bridge auxiliary power supply and the upper bridge drive chip.

[0041] KL30 represents the positive pole of the battery, that is, the power supply (Vbat) in the automotive electrical system, and it always remains charged. KL30 provides permanent power to important equipment, such as the vehicle alarm system, vehicle computer, and vehicle locking system. Even after the vehicle is turned off, these systems still need power to maintain working status or data storage. The main function of the KL30 input reverse protection module is to prevent reverse connection of the power supply to protect the BMS main control board and other related electronic equipment from damage. The KL30 input reverse protection module also has a clamping protection function to deal with abnormal conditions such as surge voltage, which is usually achieved by selecting protective devices such as transient voltage suppressors.

[0042] Among them, the KL30 input anti-reverse module filters the KL30 power supply of the small battery of the whole vehicle to prevent reverse, and outputs 12v power supply to the first insurance module. The first insurance module can be an electronic fuse (efuse), which is also a non-volatile storage device for storing information and protecting chips. The first insurance module outputs 12v power to the buck-boost power supply. The buck-boost power supply can be a SEPIC buck-boost power supply module. SEPIC, that is, Single-Ended Primary Inductor Converter, is a circuit topology that can simultaneously realize boost and buck functions. Its working principle is based on inductive energy storage and capacitive coupling. By controlling the on and off of the switch tube, the input voltage is converted into the required output voltage. The buck-boost power supply boosts the input 12v power supply to 15v and provides it to the upper bridge auxiliary power supply and the upper bridge driver chip.

[0043] Optional, see Figure 3 The system also includes a second insurance module, such as efuse. The KL30 power supply of the battery is connected to the KL30 input anti-reverse module, the second insurance module and the power chip in sequence. The KL30 input anti-reverse module outputs 12v power to the second insurance module, the second insurance module outputs 12v power to the power chip, the power chip supplies power to the level 2 safety module, and provides 5v power to the level 2 safety module.

[0044] Optional, see Figure 3 The system also includes a power conversion module. The power conversion module can be an LDO (Low Dropout) module, which is a low voltage difference linear regulator that can stabilize the output voltage when there is only a small voltage difference between the input voltage and the output voltage. The power conversion module is connected to the lower bridge auxiliary power supply and the level 3 safety module respectively, and is used to convert the output voltage of the lower bridge auxiliary power supply and input it into the level 3 safety module. Figure 3 In the process, the power conversion module converts the 15V power output of the lower bridge auxiliary power supply into a 5V power input to the level 3 safety module.

[0045] The power control system of the motor controller provided in the embodiment of the present application is that the upper and lower bridges are completely independently powered in the power architecture, saving the power cost of one circuit. The level 2 safety module is implemented based on software, and the level 3 safety module is implemented based on hardware. This architecture can meet the three-layer architecture requirements of E-gas (Standardized E-Gas Monitoring Concept for Gasoline and Diesel Engine Control Units).

[0046] The present application also provides a power control method for a motor controller, which is applicable to the power control system of the motor controller provided in the above embodiment. Figure 4 , the method provided in this embodiment includes the following operations: S110, the power chip performs fault detection on the MCU.

[0047] S120: When an MCU failure is detected, the power chip sends a lower bridge active short circuit control signal to the level 3 safety module.

[0048] The power chip detects whether the MCU is faulty through the watchdog circuit. When the timer of the watchdog circuit times out, it sends a lower bridge active short-circuit control signal to the level 3 safety module.

[0049] S130 , the level 3 safety module performs active short circuit control on the lower bridge driver chip in response to the lower bridge active short circuit control signal, so as to enter an active short circuit state from the lower bridge.

[0050] Optionally, when the power chip detects a fault, it sends a lower bridge active short circuit control signal to the level 3 safety module. For example, the power chip will detect its own operating status in real time, and when it detects a fault, it will output a control signal (such as a low level) to the level 3 safety module through the monitoring output pin. The level 3 safety module recognizes the control signal as a lower bridge active short circuit control signal and performs active short circuit control on the lower bridge driver chip.

[0051] In this embodiment, when the power chip fails, the vehicle can still enter the ASC state from the lower bridge through the level 3 safety module to ensure driving safety.

[0052] Optionally, the method further includes: the MCU performs fault detection on the motor controller, the upper bridge circuit and the lower bridge circuit, and sends an upper bridge active short circuit control signal or a lower bridge active short circuit control signal to the level 2 safety module when a fault is detected. The level 2 safety module performs active short circuit control on the upper bridge driver chip in response to the upper bridge active short circuit control signal to enter an active short circuit state from the upper bridge; or, performs active short circuit control on the lower bridge driver chip in response to the lower bridge active short circuit control signal to enter an active short circuit state from the lower bridge.

[0053] In this embodiment, the MCU is used to perform the basic tasks of motor control. It can detect overcurrent fault, overvoltage fault, upper bridge drive fault, lower bridge drive fault, SBC power supply fault, upper bridge circuit fault, lower bridge circuit fault, and output different ASC control signals according to different fault types to control the system to enter the upper bridge or lower bridge ASC state.

[0054] The following describes in detail the process of the MCU control system entering the ASC state through several specific implementations. The MCU performs fault detection on the motor controller, the upper bridge circuit, and the lower bridge circuit, and sends an upper bridge active short circuit control signal or a lower bridge active short circuit control signal to the level 2 safety module when a fault is detected, including at least one of the following: (1) When the MCU detects a motor controller failure, it sends an active short-circuit control signal to the level 2 safety module.

[0055] For example, when the MCU detects an overcurrent fault or overvoltage fault in the motor controller, since the power supply of the lower bridge driver chip comes from the high-voltage bus, when an overcurrent fault or overvoltage fault occurs, the power supply or power supply circuit of the lower bridge may be abnormal. At this time, the MCU sends an upper bridge active short-circuit control signal to the level 2 safety module. The level 2 safety module responds to the upper bridge active short-circuit control signal and actively short-circuits the upper bridge driver chip to enter the active short-circuit state from the upper bridge.

[0056] (2) When the MCU detects a fault in the lower bridge driver chip or the lower bridge auxiliary power supply, it sends an upper bridge active short-circuit control signal to the level 2 safety module.

[0057] The lower bridge driver chip itself has a fault diagnosis function, and will output a fault signal to the MCU when a fault occurs; for the fault detection of the lower bridge auxiliary power supply, it is necessary to collect the voltage signal output by the lower bridge auxiliary power supply through a resistor voltage divider acquisition circuit, and give the voltage signal to the MCU. The MCU performs fault detection based on whether the voltage signal meets the working voltage. When the MCU detects a fault in the lower bridge driver chip or the lower bridge auxiliary power supply, it means that it is impossible to enter the ASC state from the lower bridge, and then sends an upper bridge active short circuit control signal to the level 2 safety module. In response to the upper bridge active short circuit control signal, the level 2 safety module sends a control signal to the upper bridge driver chip to enter the active short circuit state from the upper bridge.

[0058] (3) When the MCU detects a fault in the upper bridge driver chip, upper bridge auxiliary power supply, or buck-boost power supply, it sends a lower bridge active short-circuit control signal to the level 2 safety module.

[0059] The upper bridge driver chip itself has a fault diagnosis function, and will output a fault signal to the MCU when a fault occurs; for the fault detection of the upper bridge auxiliary power supply, it is necessary to collect the voltage signal output by the upper bridge auxiliary power supply through a resistor voltage divider acquisition circuit, and give the voltage signal to the MCU. The MCU performs fault detection based on whether the voltage signal meets the working voltage; for the fault detection of the buck-boost power supply, it is necessary to collect the voltage signal output by the buck-boost power supply through another resistor voltage divider acquisition circuit, and give the voltage signal to the MCU. The MCU performs fault detection based on whether the voltage signal meets the working voltage. When the MCU detects that the upper bridge driver chip, the upper bridge auxiliary power supply, or the buck-boost power supply fails, it means that the ASC state cannot be entered from the upper bridge, and then the lower bridge active short circuit control signal is sent to the level 2 safety module. In response to the lower bridge active short circuit control signal, the level 2 safety module sends a control signal to the lower bridge driver chip to enter the active short circuit state from the lower bridge.

[0060] Optionally, the power control system of the motor controller will perform a logic self-check on the ASC logic control path when powered on to detect potential faults of the level 2 safety module and the level 3 safety module, ensuring that the ASC logic control path is normal every time the vehicle is driven, thereby improving the safety of the system.

[0061] For example, the self-test process of the level 2 safety module includes: the MCU sends an ASC control signal to the level 2 safety module, and then the MCU monitors the output of the level 2 safety module. If the output is within the expected range, the self-test passes. If the output deviates from expectations, a fault is reported. The self-test process of the level 3 safety module includes: the MCU controls the power chip to output a control signal (such as a high level) to the level 3 safety module by monitoring the output pin. Then the MCU monitors the output of the level 3 safety module. If the output is within the expected range, the self-test passes. If the output deviates from expectations, a fault is reported.

[0062] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0063] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A power control system for a motor controller, characterized in that: include: Upper bridge auxiliary power supply, lower bridge auxiliary power supply, upper bridge driver chip, lower bridge driver chip, micro control unit, power chip and three-level safety module based on hardware implementation; The upper bridge auxiliary power supply and the upper bridge drive chip are powered by a battery, and the lower bridge auxiliary power supply and the lower bridge drive chip are powered by a high-voltage bus; The input end of the three-level safety module is connected to the power chip, and the output end is connected to the lower bridge driver chip; The power chip is connected to the micro control unit and is used for performing fault detection on the micro control unit, and sending a lower bridge active short circuit control signal to the third-level safety module when a fault of the micro control unit is detected.

2. The system according to claim 1, characterized in that Also includes: Secondary safety module based on software control; The input end of the secondary safety module is connected to the micro control unit, and the output end is respectively connected to the upper bridge driving chip and the lower bridge driving chip.

3. The system according to claim 1, characterized in that Also includes: KL30 input anti-reverse module, first insurance module and buck-boost power supply; The KL30 power supply of the battery is connected in sequence to the KL30 input anti-reverse module, the first insurance module and the buck-boost power supply; The buck-boost power supply is connected to the upper bridge auxiliary power supply and the upper bridge driving chip respectively.

4. The system according to claim 3, characterized in that Also includes: Second insurance module; The KL30 power supply of the battery is connected to the KL30 input anti-reverse module, the second insurance module and the power chip in sequence; The power chip is used to supply power to the micro control unit and the secondary safety module.

5. The system according to claim 1, characterized in that Also included is a power conversion module; The power conversion module is connected to the lower bridge auxiliary power supply and the third-level safety module respectively, and is used for converting the output voltage of the lower bridge auxiliary power supply and inputting it into the third-level safety module.

6. The system according to claim 1, characterized in that Also includes a watchdog circuit; The power chip is connected to the micro control unit through the watchdog circuit; The power chip is used to detect whether the micro control unit fails through the watchdog circuit.

7. A power control method for a motor controller, characterized in that: Applicable to the power supply control system according to any one of claims 1 to 6; the method comprises: The power chip performs fault detection on the microcontroller unit; In the case of detecting a fault in the micro control unit, the power chip sends a lower bridge active short circuit control signal to the third-level safety module; The third-level safety module performs active short-circuit control on the lower bridge driving chip in response to the lower bridge active short-circuit control signal, so as to enter an active short-circuit state from the lower bridge.

8. The method according to claim 7, characterized in that Also includes: When the power chip detects a fault in itself, it sends a lower bridge active short circuit control signal to the third-level safety module.

9. The method according to claim 7, characterized in that: Also includes: The micro control unit performs fault detection on the motor controller, the upper bridge circuit and the lower bridge circuit, and sends an upper bridge active short circuit control signal or a lower bridge active short circuit control signal to the secondary safety module when a fault is detected; The secondary safety module performs active short-circuit control on the upper bridge driver chip in response to the upper bridge active short-circuit control signal, so as to enter an active short-circuit state from the upper bridge; or, The secondary safety module performs active short-circuit control on the lower bridge driving chip in response to the lower bridge active short-circuit control signal, so as to enter an active short-circuit state from the lower bridge.

10. The method according to claim 9, characterized in that The microcontroller unit performs fault detection on the motor controller, the upper bridge circuit and the lower bridge circuit, and sends an upper bridge active short circuit control signal or a lower bridge active short circuit control signal to the secondary safety module when a fault is detected, including at least one of the following: When the microcontroller detects a motor controller failure, it sends an upper bridge active short-circuit control signal to the secondary safety module; When the microcontroller detects a fault in the lower bridge driver chip or the lower bridge auxiliary power supply, it sends an upper bridge active short circuit control signal to the secondary safety module; When the microcontroller detects a fault in the upper bridge driver chip, the upper bridge auxiliary power supply or the buck-boost power supply, it sends a lower bridge active short-circuit control signal to the secondary safety module.

Images