Control method and system of electric drive controller state machine based on double-level verification

Abstract

The invention discloses an electric drive controller state machine control method and system based on double-level verification, and the method comprises the steps that a vehicle control unit sends a mode instruction to an electric drive controller through a CAN bus, and the mode instruction comprises a target mode type and a switching condition; the electric drive controller receives the mode instruction and transmits the mode instruction to a functional layer and a monitoring layer, the functional layer receives the mode instruction and then executes a state machine mode switching action, and a first mode state feedback signal is generated and transmitted to the monitoring layer; and the monitoring layer receives the mode instruction and the first mode state feedback signal, and performs logic consistency verification on mode types and switching conditions of the mode instruction and the first mode state feedback signal. Through double-level verification, namely independent operation and cross verification of the functional layer and the monitoring layer, the problems of misjudgment risk, skipping failure and the like caused by monitoring of only the functional layer are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of new energy vehicle drive control, and particularly to a control method and system for an electric drive controller state machine based on double - level verification of a function layer and a monitoring layer. Background Art

[0002] Please refer to Figure 1 , in the electric drive control system of a new energy vehicle, a vehicle control unit (VCU) sends instructions (such as power on / off, torque control, discharge mode, etc.) to an electric drive controller (MCU) through a CAN bus. The function layer (QM) of the MCU is responsible for executing the instructions and driving the state machine to complete mode jumps (such as Standby, Ready, Tq Ctrl, Discharge, etc.), and then feeds back the current state to the vehicle control unit through the CAN bus.

[0003] However, when using such a single software function layer for instruction execution and electric drive state monitoring, the following limitations exist: On the one hand, relying solely on the function layer to execute instructions and feedback states lacks an independent monitoring mechanism. Due to the single - point failure risk of the software function layer (such as code logic errors, signal transmission delays, hardware anomalies, etc.), problems such as false state reporting or jump failures may occur.

[0004] On the other hand, there is a lack of a real - time verification mechanism for the state machine jump process. When the function layer executes an instruction, if key hardware signals are not verified again, hardware - level anomalies may not be detected. In addition, the vehicle control unit judges the system state only through the one - way feedback of the function layer and cannot cross - verify the authenticity of instruction execution. Summary of the Invention

[0005] The technical problem to be solved by the present invention is how to solve the problems of false state reporting, jump failures, and insufficient fault tolerance caused by single - function - layer monitoring.

[0006] In the first aspect of the present invention, to solve the above - mentioned technical problem, the present invention provides a control method for an electric drive controller state machine based on double - level verification, and the method includes: The vehicle control unit sends a mode instruction to the electric drive controller through the CAN bus, and the mode instruction includes a target mode type and a switching condition; The electric drive controller receives the mode instruction and transmits the mode instruction to the function layer and the monitoring layer, where: After receiving the mode instruction, the function layer performs a state machine mode switching action and generates a first mode state feedback signal to transmit to the monitoring layer; The monitoring layer receives the mode instruction and the first mode state feedback signal, and performs a logical consistency verification on the mode type and switching condition of both.

[0007] Further, the monitoring layer receives the mode instruction and the first mode status feedback signal, and performs a logical consistency check on the mode types and switching conditions of both, including: If the verification result is consistent, the monitoring layer generates a final mode confirmation signal and feeds it back to the vehicle controller via the CAN bus to complete the instruction closed-loop; If the verification result is inconsistent, the monitoring layer triggers the electric drive controller to enter the safe state and sends a fault alarm signal to the vehicle controller via the CAN bus.

[0008] Further, the logical consistency check includes: Verify whether the target mode type matches; Verify whether the switching condition meets the preset threshold.

[0009] Further, the target mode type includes any one of Initial, Standby, Ready, Spd Ctrl, TqCtrl, Discharge, Fault, Power Down.

[0010] Further, the preset threshold includes a voltage difference ≤ 5%, a rotational speed deviation ≤ 50 rpm, and the relay state is consistent with the instruction.

[0011] Further, if the verification result is inconsistent, the monitoring layer triggers the electric drive controller to enter the safe state, where the safe state is achieved by at least one of the following methods: Reduce power operation; And / or, active safety control.

[0012] Further, after receiving the mode instruction, the function layer performs a state machine mode switching action and generates a first mode status feedback signal for transmission to the monitoring layer, and further includes: The function layer synchronously collects hardware signals, and the hardware signals include the actual rotational speed of the motor, the bus voltage, and the pre-charge relay state; Compare the hardware signals with the logical conditions of the target mode type to generate the first mode status feedback signal.

[0013] In the second aspect of the present invention, a control system for the state machine of an electric drive controller based on double-level verification is provided, including: A CAN communication module configured to perform instruction transmission and status feedback with the vehicle controller; A function layer module configured to perform a state machine mode switching action and generate a first mode status feedback signal; The monitoring layer module is configured to receive the instructions from the vehicle controller and the feedback signals from the functional layer module, and perform logical consistency verification. The safety control module is configured to trigger power reduction operation or safety mode when the verification by the monitoring layer module is inconsistent.

[0014] Furthermore, the monitoring layer module includes: A signal synchronization unit for aligning the timestamps of the instructions from the vehicle controller and the feedback signals from the functional layer module; A multi-condition verification unit with a built-in mode type matching library and a dynamic threshold adjustment algorithm; A fault log unit for recording the type, duration, and hardware signals at the time of triggering of the events where the verification by the monitoring layer module is inconsistent.

[0015] Furthermore, the functional layer module is also configured to: During the process of performing the state machine mode switching action, monitor the temperature and current harmonic rate of the motor controller in real time; wherein, if the temperature of the motor controller exceeds the safety threshold or the current harmonic rate is abnormal, interrupt the execution of the state machine mode switching action and notify the monitoring layer module.

[0016] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: Through double-level verification, that is, through the independent operation and cross-verification of the functional layer and the monitoring layer, the present invention avoids problems such as misjudgment risk and jump failure in single-layer (functional layer) monitoring, realizes high-precision and high-reliability control of the electric drive controller state machine, and improves the safety and driving experience of new energy vehicles. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0018] Figure 1 It is a schematic diagram of the verification strategy for the existing electric drive controller state machine; Figure 2 It is a schematic diagram of the verification strategy for the electric drive controller state machine provided by the present invention; Figure 3 It is a schematic diagram of the mode jump of the electric drive controller state machine provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] To enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0020] The present invention aims to provide a control method for the state machine of an electric drive controller based on double-level verification, which is used to avoid problems such as misjudgment risks and jump failures existing in the existing single-layer (function layer) monitoring.

[0021] Please refer to Figure 2-3 , which mainly includes the following steps: Step 1: The vehicle controller sends a mode instruction to the electric drive controller through the CAN bus; wherein, the mode instruction includes a target mode type and a switching condition.

[0022] Step 2: The electric drive controller receives the mode instruction and transmits the mode instruction to the function layer and the monitoring layer, where: After receiving the mode instruction, the function layer performs a state machine mode switching action and generates a first mode status feedback signal to be transmitted to the monitoring layer.

[0023] The monitoring layer receives the mode instruction and the first mode status feedback signal, and performs a logical consistency verification on the mode types and switching conditions of both.

[0024] Step 3: Process the logical consistency verification result as follows: If the verification result is consistent, the monitoring layer generates a final mode confirmation signal and feeds it back to the vehicle controller through the CAN bus to complete the instruction closed-loop.

[0025] If the verification result is inconsistent, the monitoring layer triggers the electric drive controller to enter a safe state and sends a fault alarm signal to the vehicle controller through the CAN bus.

[0026] In a further solution of this embodiment, the logical consistency verification includes: verifying whether the target mode type matches; verifying whether the switching condition meets a preset threshold.

[0027] Among them, the target mode type includes any one of Initial, Standby, Ready, Spd Ctrl, Tq Ctrl, Discharge, Fault, and Power Down.

[0028] Those skilled in the art further explain: Initial: Initialization. In new energy vehicles, the Initial state of the controller state machine refers to the initialization state or starting state of the vehicle. Usually, the state machine jumps to this state after the vehicle's KL15 is powered on.

[0029] Standby: Standby mode, which refers to a low-power operating state of the vehicle's electronic control system. Usually, it jumps to Standby after initialization is completed (Initial finish).

[0030] Ready: Startup completed, which means the vehicle has made all preparations, has started successfully, and can depart at any time. At this time, the new energy vehicle has completed high-voltage power-on. Usually, when high-voltage power is applied in the Standby state and the vehicle receives the vehicle Ready command, it jumps to this state.

[0031] Spd Ctrl: Speed control mode, which means the motor has entered the speed control mode and can control the motor speed according to the given speed command or accelerator pedal command. Usually, when it receives the speed command on the CAN in the Ready state, it jumps to this state.

[0032] Tq Ctrl: Torque control mode, which means the motor has entered the torque control mode and can output the motor torque according to the given torque command or accelerator pedal command. Usually, when it receives the torque command on the CAN in the Spd Ctrl state, it jumps to this state.

[0033] Discharge: Discharge mode. When the new energy vehicle is in the startup-completed state or during driving, when it receives the active discharge command sent by the vehicle, it will jump to the discharge mode.

[0034] Fault: Fault mode. When the electric drive controller receives a fault command sent on the Can or from other controllers, the state machine will jump to Fault and enter the safety mode to protect the safety of the vehicle and passengers.

[0035] Power Down: Controls the shutdown or energy-saving mode of the vehicle's electrical system. At this time, the high-voltage power of the new energy vehicle has been discharged and the KL15 has been powered off successfully.

[0036] Among them, the preset thresholds include voltage difference ≤ 5%, speed deviation ≤ 50 rpm, and the relay state is consistent with the command.

[0037] When the verification result is inconsistent, the safety state that the monitoring layer triggers the electric drive controller to enter is mainly achieved through at least one of the following methods: reducing power operation or active safety control, which is used to protect the stability of the vehicle and the safety of the occupants.

[0038] In a further embodiment of the present invention, the functional layer further includes a synchronous acquisition of hardware signals; wherein the hardware signals include the actual motor speed, the bus voltage, and the pre-charge relay status; and the hardware signals are compared with the logical conditions of the target mode type to generate a first mode status feedback signal.

[0039] Based on the monitoring layer, by verifying the mode results executed by the functional layer and the instructions issued by the vehicle controller, the accuracy of the state machine mode switching can be greatly improved and mode misjudgment can be prevented, thereby ensuring that the vehicle operates normally in a reliable state.

[0040] The present invention also provides a control system for an electric drive controller state machine based on a two-level verification, mainly including a CAN communication module, a functional layer module, a monitoring layer module, and a safety control module.

[0041] The CAN communication module is configured to transmit instructions and feedback status with the vehicle controller.

[0042] The functional layer module is configured to execute the state machine mode switching action and generate a first mode status feedback signal.

[0043] The monitoring layer module is configured to receive the vehicle controller instructions and the feedback signals of the functional layer module and perform a logical consistency verification.

[0044] The safety control module is configured to trigger a power reduction operation or a safety mode when the verification of the monitoring layer module is inconsistent.

[0045] In a further embodiment of the present invention, the functional layer module is further configured to monitor the temperature and current harmonic rate of the motor controller in real time during the execution of the state machine mode switching action; wherein, if the temperature of the motor controller exceeds the safety threshold or the current harmonic rate is abnormal, the execution of the state machine mode switching action is interrupted and the monitoring layer module is notified.

[0046] The monitoring layer module includes a signal synchronization unit, a multi-condition verification unit, and a fault log unit. Among them: The signal synchronization unit is used to align the timestamps of the vehicle controller instructions and the feedback signals of the functional layer module.

[0047] The multi-condition verification unit has a built-in mode type matching library and a dynamic threshold adjustment algorithm.

[0048] The fault log unit can record the type, duration, and hardware signals at the time of triggering of the monitoring layer module verification inconsistent events.

[0049] Through the two-level (functional layer + monitoring layer) collaborative monitoring and verification mechanism, the present invention can simultaneously monitor the electric drive controller mode and use the monitoring layer to verify the state machine mode, and feedback to the vehicle to reduce the probability of state machine jump failure or false alarm, thereby improving the safety and stability during the vehicle driving process.

[0050] Although embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A control method for an electric drive controller state machine based on a double-level check, characterized in that: The method comprises: The vehicle controller sends a mode instruction to the electric drive controller via the CAN bus, wherein the mode instruction includes a target mode type and a switching condition; The electric drive controller receives the mode instruction and transmits the mode instruction to the functional layer and the monitoring layer, wherein: After receiving the mode instruction, the functional layer executes the state machine mode switching action and generates a first mode state feedback signal to be transmitted to the monitoring layer; The monitoring layer receives the mode instruction and the first mode state feedback signal, and performs a logic consistency check on the mode types and switching conditions of the two.

2. The control method of the electric drive controller state machine based on double-level verification according to claim 1 is characterized in that: The monitoring layer receives the mode instruction and the first mode state feedback signal, and performs a logic consistency check on the mode types and switching conditions of the two, including: If the verification result is consistent, the monitoring layer generates a final mode confirmation signal and feeds it back to the vehicle controller via the CAN bus to complete the command closed loop; If the verification result is inconsistent, the monitoring layer triggers the electric drive controller to enter a safe state and sends a fault alarm signal to the vehicle controller via the CAN bus.

3. The control method of the electric drive controller state machine based on double-level verification according to claim 1 is characterized in that: The logic consistency check includes: Check whether the target mode type matches; Check whether the switching condition meets a preset threshold.

4. The control method of the electric drive controller state machine based on double-level verification according to claim 3 is characterized in that: The target mode type includes any one of Initial, Standby, Ready, Spd Ctrl, Tq Ctrl, Discharge, Fault, and Power Down.

5. The control method of the electric drive controller state machine based on double-level verification according to claim 3 is characterized in that: The preset thresholds include voltage difference ≤5%, speed deviation ≤50rpm, and relay state is consistent with the instruction.

6. The control method of the electric drive controller state machine based on double-level verification according to claim 2 is characterized in that: If the verification result is inconsistent, the monitoring layer triggers the electric drive controller to enter a safe state, wherein the safe state is achieved in at least one of the following ways: Reduced power operation; and / or, active safety controls.

7. The control method of the electric drive controller state machine based on double-level verification according to claim 1, characterized in that: After receiving the mode instruction, the functional layer executes the state machine mode switching action and generates a first mode state feedback signal to transmit to the monitoring layer, and further includes: The functional layer synchronously collects hardware signals, including actual motor speed, bus voltage, and pre-charge relay status; The hardware signal is compared with the logic condition of the target mode type to generate the first mode state feedback signal.

8. A control system of an electric drive controller state machine based on a double-level verification, characterized in that: include: CAN communication module, configured to transmit commands and provide status feedback to the vehicle controller; A functional layer module, configured to execute a state machine mode switching action and generate a first mode state feedback signal; A monitoring layer module is configured to receive vehicle controller instructions and feedback signals from the functional layer module and perform a logic consistency check; The safety control module is configured to trigger power reduction operation or safety mode when the monitoring layer module verification is inconsistent.

9. The control system of the electric drive controller state machine based on double-level verification according to claim 8, characterized in that: The monitoring layer module includes: A signal synchronization unit, used to align the timestamps of the vehicle controller command and the feedback signal of the functional layer module; Multi-condition verification unit, built-in pattern type matching library and dynamic threshold adjustment algorithm; The fault log unit records the type, duration and hardware signal of the monitoring layer module verification inconsistency event when it is triggered.

10. The control system of the electric drive controller state machine based on double-level verification according to claim 8, characterized in that: The functional layer module is also configured as: During the execution of the state machine mode switching action, the temperature and current harmonic rate of the motor controller are monitored in real time; wherein, if the temperature of the motor controller exceeds the safety threshold or the current harmonic rate is abnormal, the execution of the state machine mode switching action is interrupted and the monitoring layer module is notified.

Images