Electric drive system based on two-way redundant sampling and control method thereof

Abstract

The invention discloses an electric drive system based on two-way redundancy sampling and a control method thereof, and solves the problems that in the prior art, an electric drive system is low in torque estimation precision and poor in vehicle operability, the system comprises a two-way redundancy sampling module, the two-way redundancy sampling module is connected with a torque estimation module, and the two-way redundancy sampling module is connected with a control module; the torque estimation module is connected with a fault management module, the fault management module is connected with a double-channel redundancy sampling module, and the double-channel redundancy sampling module performs double-channel redundancy sampling on input signals, compares and verifies the input signals and sends fault alarm signals according to verification results. The torque estimation module carries out high-precision torque estimation or low-precision torque estimation according to the fault alarm signal, and the fault management module sends a torque reduction signal according to the fault alarm signal to control torque reduction of the motor. On the basis of a double-channel sampling redundancy comparison mode, the safety of the electric drive system is guaranteed, and the precision of functional safety torque estimation is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of functional safety of electric drive systems, and particularly relates to an electric drive system based on dual-channel redundant sampling and a control method therefor. Background Art

[0002] With the continuous development of electronic control systems, the safety of electronic control has become increasingly important. The requirements for the functional safety of electric drive systems are getting higher and higher, and it is particularly important to meet the functional safety requirements of electric drive systems. Currently, the functional safety architecture design for electric drive systems is based on a three-layer monitoring architecture. Among them, the most important torque monitoring is the key to achieving the functional safety of the system. However, the estimated torque required for torque monitoring has very low accuracy. At the same time, due to the introduction of functional safety torque monitoring, the system will enter a safe state when a fault occurs, resulting in the loss of power of the vehicle and poor vehicle operability.

[0003] For example, on August 5, 2022, the China National Patent Office published an invention named "An Electric Drive System Output Torque Safety Monitoring System and Method", with the publication number CN114851859A. According to the comparison between the calculated actual output torque of the motor and the torque request instruction from the CAN bus, when the deviation between the actual output torque and the torque request instruction exceeds the unexpected torque threshold, the electric drive system is controlled to enter the active short circuit or shutdown state, avoiding harm events such as unexpected acceleration and deceleration, unexpected driving, or unexpected reverse driving of the vehicle due to the inconsistency between the actual output torque of the motor and the torque request instruction, and achieving the development of safety goals at ASIL C level and higher levels. The electric drive system is also based on a three-layer monitoring architecture and enters a safe state when a fault occurs, without solving the problems of low accuracy of estimated torque and poor vehicle operability. Summary of the Invention

[0004] The object of the present invention is to solve the problems in the prior art that the torque estimation accuracy of the electric drive system is low, and the electric drive system directly enters the safe state when a fault occurs, resulting in poor vehicle operability. The present invention provides an electric drive system based on dual-channel redundant sampling and a control method therefor. Through the method of dual-channel sampling redundancy, early warning is carried out during redundant comparison in case of a fault, the torque of the electric drive system is reduced, and the operability of the electric drive system is improved; when there is no fault in the redundant comparison, the torque estimation accuracy is improved.

[0005] To achieve the above object, the present invention adopts the following technical solutions: An electric drive system based on dual-channel redundant sampling, characterized in that it includes: a dual-channel redundant sampling module, the dual-channel redundant sampling module is connected to a torque estimation module, the torque estimation module is connected to a fault management module, the fault management module is connected to the dual-channel redundant sampling module, the dual-channel redundant sampling module performs dual-channel redundant sampling on the input signal, and performs comparison verification on the input signal, and sends a fault alarm signal according to the verification result, the torque estimation module performs high-precision torque estimation or low-precision torque estimation according to the fault alarm signal, and the fault management module sends a torque reduction signal according to the fault alarm signal to control the motor to reduce torque.

[0006] The electric drive system architecture provided by the present invention performs comparison verification on the signals used for torque estimation in advance before torque monitoring. When a signal comparison fault alarm occurs, torque reduction processing is performed, and the customer can still drive the vehicle, improving the operability of the vehicle. Based on the dual-channel sampling redundancy comparison method, it not only ensures the safety of the system but also improves the accuracy of functional safety torque estimation.

[0007] Preferably, the dual-channel redundant sampling module includes a decoding and processing module connected to the motor. The decoding and processing module performs dual-channel sampling on the sin signal and cos signal, and respectively compares the two sampled signals. If the difference between the two sampled signals exceeds the threshold, a fault alarm signal is sent to control the torque estimation module to perform low-precision torque estimation and control the fault management module to send a torque reduction signal. Otherwise, the torque estimation module is controlled to perform high-precision torque estimation.

[0008] Preferably, a torque monitoring module is provided between the torque estimation module and the fault management module. The fault management module is connected to a safety state execution module. The torque monitoring module compares and monitors the torque estimation value and the requested torque value of the VCU. If the difference between the torque estimation value and the requested torque value reaches the fault setting condition, the fault management module is controlled to send a torque output interruption signal to the safety state execution module to control the motor to enter the safety state.

[0009] Preferably, the input signal includes the sin signal and cos signal of the decoding and processing module, the three-phase current signals of the phase current processing module, the bus voltage signal of the DC voltage processing module, and the bus current signal of the DC current module.

[0010] Preferably, it further includes an output control module. The output control module is connected to the dual-channel redundant sampling module and outputs a three-phase duty cycle to control the motor according to the torque request value of the VCU or outputs a three-phase duty cycle to control the motor according to the torque reduction signal.

[0011] Preferably, the torque estimation module performs torque estimation according to the input signals sent at different times.

[0012] A control method for an electric drive system based on dual-channel redundant sampling, comprising: Perform dual-channel redundant sampling on the input signal, and perform comparison and verification on it, and set the threshold value of the comparison error; If the comparison error is less than or equal to the threshold value, use the signal of the sampling channel with high precision for functional safety torque estimation; If the comparison error is greater than the threshold value, use the signal of the sampling channel with high safety for functional safety torque estimation, and at the same time the electric drive system enters the torque reduction state to limit the torque output.

[0013] Preferably, it is judged whether the difference between the estimated functional safety torque and the requested torque value of the VCU meets the fault setting condition. If so, the electric drive system enters the safe state and the vehicle interrupts the torque output.

[0014] Preferably, if the comparison error is greater than the threshold value and the difference of the torque meets the fault setting condition, the electric drive system preferentially enters the safe state.

[0015] Preferably, the comparison error is the absolute value of the difference between the sampling of the high-precision channel and the sampling of the safety channel; when the electric drive system enters the torque reduction state, a custom torque coefficient is defined and the PWM duty cycle is output.

[0016] Therefore, the present invention has the following beneficial effects: By means of dual-channel sampling redundancy, the input of the signal is verified to meet the requirements of the functional safety of the electric drive system. For the verified dual-channel signals, the time-sharing access method is adopted. When there is a redundant comparison fault, safety is mainly considered and torque reduction is performed, so that the vehicle will not lose power and the operability of the vehicle is improved; when there is no redundant comparison fault, the accuracy of torque estimation is mainly considered, and at the same time the requirements of the functional safety torque monitoring of the electric drive system are met. Brief Description of the Drawings

[0017] Figure 1 It is a schematic diagram of the architecture of the electric drive system based on dual-channel redundant sampling in Embodiment 1.

[0018] Figure 2 It is a schematic diagram of the architecture of the electric drive system in the prior art.

[0019] Figure 3 It is a schematic diagram of the dual-channel sampling redundancy processing of the decoding processing module.

[0020] Figure 4 It is a flowchart of the steps of the control method of the electric drive system based on dual-channel redundant sampling in Embodiment 2.

[0021] In the figure: 1. Decoding processing module; 2. Phase current processing module; 3. DC voltage processing module; 4. DC current processing module; 5. Torque estimation module; 6. Torque monitoring module; 7. Fault management module; 8. Safety status execution module; 9. Torque reduction control module; 10. Output module; 11. Driver chip control module; 12. IGBT module; 13. CAN processing module; 14. Vehicle-integrated CAN communication module; 15. High-voltage power supply; 16. Motor; 17. Monitoring processor. Detailed implementation mode

[0022] The present invention will be further described in detail below in conjunction with the accompanying drawings and the detailed implementation mode: Embodiment 1: This embodiment provides an electric drive system based on dual-channel redundant sampling. As Figure 1 shown, it adopts a three-layer architecture, including a first layer, a second layer, and a third layer. The first layer is connected to the second layer, and the second layer is connected to the third layer. The first layer is used to perform torque control according to the torque request of the VCU and output a three-phase duty ratio to control the motor. The second layer is used to perform dual-channel sampling redundancy comparison verification on the input signal. When a signal comparison fault occurs, the electric drive system is made to perform torque reduction output, and the estimated torque is compared and monitored with the VCU request torque. When the difference between the two is too large, the torque is interrupted. The third layer is used to monitor the controller.

[0023] The functional safety electric drive system architecture design based on dual-channel sampling redundancy adopted in this embodiment verifies the input of the signal in the way of dual-channel sampling redundancy, meets the requirements of the functional safety of the electric drive system, adopts a time-sharing access method for the verified dual-channel signals, mainly considers safety during redundant comparison faults, performs torque reduction processing, and will not cause the vehicle to lose power, improving the operability of the vehicle. When there is no redundant comparison fault, mainly consider the accuracy of torque estimation, and at the same time meet the requirements of the functional safety torque monitoring of the electric drive system.

[0024] Next, the technical solution and technical effect of the present invention will be further described through a specific system architecture. The following examples are explanations of the present invention, and the present invention is not limited to the following examples.

[0025] For the traditional electric drive system architecture, as Figure 2 shown, although it also includes a three-layer architecture, as Figure 1The first - layer architecture can achieve torque control according to the torque request of the VCU, output three - phase duty cycles to control the power module, and thus control the torque output of the motor. Although it can achieve the control of the motor, it cannot meet the requirements of functional safety. Therefore, for the realization of the functional safety of the electric drive system, generally, the torque output of the motor is estimated, and the estimated torque is compared and monitored with the VCU - requested torque. When the difference between the two is too large, the torque is interrupted, and at the same time, the controller is monitored, such as Figure 2 the second and third layers.

[0026] For the electric drive system architecture adopted in this embodiment, for the second - layer function monitoring layer, a dual - path sampling redundancy comparison check of the input signal is added before torque estimation. When a signal comparison fault occurs in the input signal of a certain module, the electric drive system will notify the fault management module to issue a fault alarm, and the electric drive system will execute torque reduction or interrupt torque output, that is, enter the safe state.

[0027] Specifically: In this embodiment, the first layer includes an output control module. The output control module includes an output module 10, a drive chip control module 11, and an IGBT module 12. The output module is respectively connected to the CAN processing module and the drive chip control module, and outputs a control PWM to the drive chip control module according to the torque request. The drive chip control module is connected to the safety state execution module, receives the control signal of the safety state execution module, and at the same time, the drive chip control module is connected to the IGBT module. The IGBT module is respectively connected to the high - voltage power supply 15 and the motor 16.

[0028] During operation, the output module receives the control signal from the torque reduction control module and outputs a PWM signal to the drive chip control module, or the output module receives the torque request from the VCU for torque control and outputs a PWM signal to the drive chip control module. The drive chip control module outputs corresponding signals to the motor through the IGBT according to the PWM signal or the control signal of the safety state execution module, so as to control the torque output of the motor.

[0029] IGBT (Insulated Gate Bipolar Transistor), that is, insulated gate bipolar transistor, is a semiconductor device that can withstand large currents and large voltages, and at the same time has gain and amplification functions; when the IGBT is under abnormal conditions such as overload or short - circuit, it can also cut off the power supply autonomously through the internal protection function to protect the safety of the entire electric drive system. The output signal of the IGBT can convert direct current into alternating current through an inverter circuit. Through the function of the inverter circuit, the IGBT can convert high - voltage (or low - voltage) direct current into the required low - voltage (or high - voltage) alternating current.

[0030] The VCU is the core electronic control unit that realizes the vehicle control decision-making.

[0031] The second layer includes a dual-channel redundant sampling module, a torque estimation module 5, a torque monitoring module 6, a CAN processing module 13, a fault management module 7, a torque reduction control module 9, and an execution safety status module 8. The dual-channel redundant sampling module includes a decoding processing module 1, a phase current processing module 2, a DC voltage processing module 3, and a DC current processing module 4. The decoding processing module, the phase current processing module, the DC voltage processing module, and the DC current processing module are all connected to the motor, the torque estimation module, and the fault management module. The torque estimation module is connected to the torque monitoring module. The torque monitoring module is connected to the CAN processing module. The CAN processing module is connected to the vehicle CAN communication module 14. The torque monitoring module is connected to the fault management module. The fault management module is respectively connected to the torque reduction control module and the execution safety status module. The torque reduction control module is connected to the output module.

[0032] During operation, the decoding processing module performs dual-channel redundant sampling on the sin signal and the cos signal, and respectively compares the two sampled sin signals and cos signals. According to the comparison result, a fault signal is sent. The phase current processing module performs dual-channel redundant sampling on the U, V, and W three-phase current signals, and respectively compares the two sampled three-phase current signals. According to the comparison result, a fault signal is sent. The DC voltage processing module performs dual-channel redundant sampling on the DC voltage signal, and respectively compares the two sampled DC voltage signals. According to the comparison result, a fault signal is sent. The DC current processing module performs dual-channel redundant sampling on the DC current signal, and respectively compares the two sampled DC current signals. According to the comparison result, a fault signal is sent.

[0033] As Figure 3 shown, for the decoding processing module, DSADC and VADC dual-channel sampling are adopted. The sin signal and cos signal sampled by DSADC have higher accuracy and higher real-time performance, and are used for torque control in the first layer. The sampling accuracy of VADC is lower, but the safety is high, and it is used for torque estimation in the second layer. The sin and cos signals sampled by the two channels are respectively compared. When the error between the two is too large, a signal comparison fault alarm is issued. At this time, the safety of the electric drive system should be ensured first. Therefore, the rotation speed and angle calculated by the low-precision VADC channel are used for torque estimation, and the signal comparison fault alarm is sent to the fault management module for torque reduction processing. When the comparison error of the sin and cos signals sampled by the two channels is within the controllable range, no signal comparison fault alarm is issued. At this time, the high-precision DSADC channel can be used to estimate the rotation speed and angle extremely, improving the accuracy of torque estimation.

[0034] DSADC (Delta-Sigma Analog-to-Digital Converter) sampling is a special ADC (Analog-to-Digital Converter) sampling technology, which is mainly used in high-precision and low-power application scenarios. DSADC converts analog signals into digital signals through oversampling and noise shaping technology, with high signal-to-noise ratio and dynamic range.

[0035] ‌VADC sampling is the process of discretizing analog signals according to a certain sampling frequency and then converting them into digital signals. It mainly includes four steps: sampling, holding, quantization and encoding.

[0036] Similarly, the input signals of the phase current processing module, the DC voltage processing module, and the DC current processing module are all sampled redundantly by DSADC and VADC and compared. When the comparison error between the two is within the controllable range, no signal comparison fault alarm will be issued. At this time, a high-precision channel signal can be used for torque estimation. When the comparison error between the two is too large, a signal comparison fault alarm will be issued. At this time, a high-security channel signal can be used for torque estimation, and a fault alarm will be sent to the fault management module, so that the electric drive system can perform torque reduction processing and the vehicle will not lose power. Only when the torque monitoring fault is reported, the electric drive system will be controlled to enter a safe state and the vehicle will lose power.

[0037] In order to improve the accuracy of torque estimation, it is necessary to ensure the accuracy of the speed and angle output by the decoding processing module, the accuracy of the d and q axis currents output by the phase current processing module, the accuracy of the bus voltage output by the DC voltage processing module, and the accuracy of the bus current output by the DC current processing module.

[0038] The torque estimation module estimates the torque based on the input signal sent in time.

[0039] The torque monitoring module is used to compare the torque value estimated by the torque estimation module with the requested torque value of the VCU. If the comparison result does not meet the preset fault setting condition, a control signal is sent to the fault management module.

[0040] According to the control signal of the torque monitoring module, the fault management module sends the corresponding control signal to the safe state execution module, so that the electric drive system enters the safe state and the vehicle interrupts the torque output. According to the control signal sent by the four processing modules, the fault management module sends the corresponding control signal to the torque reduction control module, and cooperates with the first layer to make the electric drive system enter the torque reduction state and limit the torque output.

[0041] The third layer includes a monitoring processor 17, which is connected to the safety state execution module.

[0042] In this embodiment, the implementation logic of the functional safety electric drive system based on dual-path redundant sampling is as follows: Step (1): Perform dual-channel redundant sampling on the input signals used for functional safety torque estimation, including the sin and cos signals of the decoding processing module, the three-phase current signals of U, V, and W of the phase current processing module, the bus voltage signal of the DC voltage processing module, and the bus current signal of the DC current module. If other torque estimation methods are used and different input signals are involved, this step is also applicable.

[0043] Step (2): Compare and verify the dual-channel redundant input signals, set the threshold of the comparison error. When it is greater than the threshold, send a signal comparison fault alarm as 1, indicating a fault; when it is less than or equal to the threshold, send a signal comparison fault alarm as 0, indicating no fault.

[0044] Step (3): When the signal comparison fault alarm is 1, the electric drive system gives priority to safety and uses the signal of the sampling channel with high safety for functional safety torque estimation. At the same time, since a fault state has occurred at this time, torque reduction processing is required, and the torque becomes smaller. This not only prevents the vehicle from losing power, improves the vehicle's maneuverability, but also reduces the vehicle's danger. Torque monitoring is carried out synchronously to ensure the vehicle's safety.

[0045] Step (4): When the signal comparison fault alarm is 0, the electric drive system mainly ensures the accuracy of functional safety torque estimation and uses the signal of the sampling channel with high accuracy for functional safety torque estimation. The higher the accuracy of torque estimation, the less likely the electric drive system is to mis-trigger torque monitoring due to accuracy issues, further ensuring the vehicle's maneuverability.

[0046] Step (5): The torque estimation module estimates the torque based on the input signals sent in a time-sharing manner.

[0047] Step (6): The torque monitoring module compares and monitors the torque estimation value and the requested torque value of the VCU. When it is found that the fault setting conditions for comparison monitoring are met, the electric drive system enters the safe state and the vehicle interrupts torque output.

[0048] Step (7): When the signal comparison fault alarm is 1, the system enters the torque reduction state, limits the torque output, and the torque limit ratio can be defined according to different needs.

[0049] Traditional electric drive functional safety only monitors torque. When a torque monitoring failure is reported, the vehicle can only enter a safe state, losing power. The customer can no longer drive the vehicle and can only drive normally after powering on and off again. The electric drive system based on dual-channel redundant sampling provided in this application performs dual-channel redundant verification and fault handling at the front end of torque estimation, compares and verifies the signals used for torque estimation in advance. When a signal comparison fault alarm occurs, torque reduction processing is performed, and the customer can still drive the vehicle. Only when a torque monitoring failure is reported will the electric drive system control the vehicle to enter a safe state and lose power, improving the operability of the vehicle.

[0050] Embodiment 2: This embodiment provides a control method for an electric drive system based on dual-channel redundant sampling, as Figure 4 shown. Its operation process is as follows: Step 1, perform dual-channel redundant sampling on the input signal and perform a comparison check on it, and set the threshold of the comparison error; Step 2, if the comparison error is less than or equal to the threshold, use the signal of the sampling channel with higher precision for functional safety torque estimation; Step 3, if the comparison error is greater than the threshold, use the signal of the sampling channel with higher safety for functional safety torque estimation, and at the same time, the electric drive system enters a torque reduction state to limit torque output.

[0051] The control method for the electric drive system based on dual-channel redundant sampling provided in this embodiment verifies the input signal through the dual-channel sampling redundancy method, meets the requirements of the functional safety of the electric drive system, and uses the time-sharing access method for the verified dual-channel signals. When there is a redundant comparison fault, mainly consider safety and perform torque reduction processing, so that the vehicle will not lose power and improve the operability of the vehicle. When there is no redundant comparison fault, mainly consider the accuracy of torque estimation, and at the same time meet the requirements of the functional safety torque monitoring of the electric drive system.

[0052] Next, continue to further illustrate the technical solutions and technical effects of the present invention through specific examples and specific application scenarios. The following examples are explanations of the present invention, and the present invention is not limited to the following examples.

[0053] The first step: Perform dual-channel redundant sampling on the input signal and perform a comparison check on it, and set the threshold of the comparison error.

[0054] Sample the input signal from channel A (high-precision channel) and channel B (safety channel) respectively, and set the threshold of the comparison error. Calculate the difference between the signal sampled by channel A and the signal sampled by channel B, and determine whether the difference between the two is greater than the set threshold of the comparison error.

[0055] The input signals include the sin signal and cos signal of the decoding processing module, the three-phase current signals of U, V, and W of the phase current processing module, the bus voltage signal of the DC voltage processing module, and the bus current signal of the DC current module. Dual-channel redundant sampling and comparison verification are performed on each input signal, and the comparison verification result of each input signal can enable the subsequent steps.

[0056] Step 2: If the comparison error is less than or equal to the threshold, the signal of the sampling channel with higher precision is used for functional safety torque estimation.

[0057] If the comparison error is less than or equal to the threshold, it indicates no fault. At this time, the electric drive system focuses on ensuring the accuracy of functional safety torque estimation, outputs the processing result of the sampling signal of Channel A, performs high-precision functional safety torque estimation, improves the torque estimation accuracy, so that the electric drive system will not misjudge the difference between the functional safety torque and the requested torque value of the VCU to meet the fault setting conditions due to torque estimation accuracy problems, thereby enabling the electric drive system to enter a safe state and further ensuring the operability of the vehicle.

[0058] Step 3: If the comparison error is greater than the threshold, the signal of the sampling channel with higher safety is used for functional safety torque estimation, and at the same time, the electric drive system enters a torque reduction state to limit torque output.

[0059] If the comparison error is greater than the threshold, it indicates a fault. A signal comparison fault alarm signal is sent, the processing result of the sampling signal of Channel B is output, and low-precision functional safety torque estimation is performed to ensure the safety of the electric drive system. At the same time, a torque reduction instruction is sent, the torque coefficient is customized, and the PWB duty ratio is output according to the torque reduction cooling, controlling the electric drive system to enter a torque reduction state to limit torque output.

[0060] Step 4: Determine whether the difference between the estimated functional safety torque and the requested torque value of the VCU meets the fault setting conditions. If so, the electric drive system enters a safe state and the vehicle interrupts torque output.

[0061] If the difference between the estimated functional safety torque and the requested torque value of the VCU meets the fault setting conditions, it indicates that unexpected torque has occurred, and a fault alarm is required. At the same time, the electric drive system is controlled to enter a safe state to ensure the safety of the electric drive system.

[0062] This embodiment further includes recording the time and location of each fault occurrence. If the number of faults is greater than the preset fault warning threshold within the set time range, the electric drive system is inspected to determine whether its internal modules are faulty.

[0063] In this embodiment, if the comparison error is greater than the threshold value, and at the same time the difference between the estimated functional safety torque and the requested torque value of the VCU meets the fault setting condition, the electric drive system preferentially enters the safe state and the vehicle interrupts torque output.

[0064] The above-described embodiments are only a preferred solution of the present invention, and do not impose any form of limitation on the present invention. There are other variations and modifications without exceeding the technical solutions described in the claims.

Claims

1. An electric drive system based on dual-path redundant sampling, characterized in that: It includes a dual-channel redundant sampling module, the dual-channel redundant sampling module is connected to a torque estimation module, the torque estimation module is connected to a fault management module, the fault management module is connected to the dual-channel redundant sampling module, the dual-channel redundant sampling module performs dual-channel redundant sampling on the input signal, and compares and verifies the input signal, sends a fault alarm signal according to the verification result, the torque estimation module performs high-precision torque estimation or low-precision torque estimation according to the fault alarm signal, and the fault management module sends a torque reduction signal according to the fault alarm signal to control the motor to reduce torque.

2. The electric drive system based on dual-path redundant sampling according to claim 1, characterized in that: The dual-channel redundant sampling module includes a decoding processing module connected to the motor. The decoding processing module performs dual-channel sampling on the sin signal and the cos signal, and compares the two sampled signals respectively. If the difference between the two sampled signals exceeds a threshold, a fault alarm signal is sent to control the torque estimation module to perform low-precision torque estimation and control the fault management module to send a torque reduction signal. Otherwise, the torque estimation module is controlled to perform high-precision torque estimation.

3. The electric drive system based on dual-path redundant sampling according to claim 1, characterized in that: A torque monitoring module is provided between the torque estimation module and the fault management module. The fault management module is connected to a safe state execution module. The torque monitoring module compares and monitors the torque estimation value and the requested torque value of the VCU. If the difference between the torque estimation value and the requested torque value reaches the fault setting condition, the fault management module is controlled to send a torque output interrupt signal to the safe state execution module to control the motor to enter a safe state.

4. An electric drive system based on dual-path redundant sampling according to claim 1 or 2, characterized in that: The input signals include the sin signal and cos signal of the decoding processing module, the three-phase current signal of the phase current processing module, the bus voltage signal of the DC voltage processing module, and the bus current signal of the DC current module.

5. An electric drive system based on dual-path redundant sampling according to claim 1, 2 or 3, characterized in that: It also includes an output control module, which is connected to the dual-channel redundant sampling module and outputs a three-phase duty ratio to control the motor according to the torque request value of the VCU or outputs a three-phase duty ratio to control the motor according to the torque reduction signal.

6. An electric drive system based on dual-path redundant sampling according to claim 1, 2 or 3, characterized in that: The torque estimation module estimates the torque according to the input signal sent in time division.

7. A control method for an electric drive system based on dual-path redundant sampling, applied to an electric drive system based on dual-path redundant sampling according to any one of claims 1 to 6, characterized in that: include: Perform dual-channel redundant sampling on the input signal, perform comparison verification on it, and set the comparison error threshold; If the comparison error is less than or equal to the threshold, the high-precision sampling channel signal is used to estimate the functional safety torque; If the comparison error is greater than the threshold, the functional safety torque estimation is performed using the sampling channel signal with high safety, and the electric drive system enters the torque reduction state to limit the torque output.

8. The electric drive system control method based on dual-path redundant sampling according to claim 7, characterized in that: Determine whether the difference between the estimated functional safety torque and the VCU's requested torque value meets the fault setting condition. If so, the electric drive system enters a safe state and the vehicle interrupts torque output.

9. The electric drive system control method based on dual-path redundant sampling according to claim 8 or 9, characterized in that: If the comparison error is greater than the threshold and the torque difference meets the fault setting conditions, the electric drive system will enter the safe state first.

10. The electric drive system control method based on dual-path redundant sampling according to claim 8 or 9, characterized in that: The comparison error is the absolute value of the difference between the high-precision channel sampling and the safety channel sampling; when the electric drive system enters the torque reduction state, the torque coefficient is customized and the PWM duty cycle is output.

Images