Straight-through prevention redundant power supply safety architecture for motor controller

Abstract

The invention discloses an anti-straight-through redundant power supply safety architecture for a motor controller, and the architecture comprises a main power supply module which is used for taking power from a system power supply, and outputting independent positive and negative voltages to a driving module of an IGBT / SIC power module after the power is processed by a filtering anti-reverse circuit, an overcurrent protection unit and a driving power module, the driving module comprises an upper bridge driving module and a lower bridge driving module; the backup power supply module is used for maintaining the driving voltage of the IGBT / SIC power module through a backup power supply path when the main power supply module triggers overcurrent protection due to short circuit of the bridge arm of the IGBT / SIC power module; and the control module is used for receiving the fault signal sent by the driving module, and triggering the safety logic module to execute a fault bridge arm three-phase active short circuit strategy after confirming the fault state according to the fault signal. According to the safety architecture, the direct connection risk and the unexpected braking torque of the IGBT / SIC power module are avoided through the main and standby power supply seamless switching and fault bridge arm directional short circuit strategy.

Description

Technical Field

[0001] This invention relates to the field of new energy vehicle motor control technology, and in particular to a safety architecture for a power supply with anti-shoo-through redundancy for motor controllers. Background Technology

[0002] With the rapid development of modern electric vehicle technology and continuous cost optimization, the safety requirements for electric vehicles are becoming increasingly stringent. Power semiconductor modules (such as IGBTs / SiCs) are core power switching devices in new energy motor controllers. They are one of the heart components of the electric vehicle's power system and also one of the most vulnerable critical components, their reliability directly affecting the safety of the entire vehicle. Failure of a single bridge arm of the module can cause drastic fluctuations in the vehicle's output torque, resulting in vehicle shaking and jerking. If a shoot-through failure occurs between the upper and lower bridge arms, it can cause a metallic short circuit through the two IGBTs on the DC bus high voltage (e.g., 400V / 800V), posing a systemic threat to the electric vehicle's module, fuses, battery pack, and the overall vehicle safety. Therefore, the motor controller system should avoid generating unexpected braking torque and the risk of shoot-through in the power battery pack.

[0003] During normal operation of an electric vehicle, a short circuit in any of the six arms of the power module in the motor controller can cause the system to suddenly shut down, resulting in uncontrolled motor torque and speed, posing a serious safety hazard. If the system power supply fails, it may also cause cascading failures, leading to short circuits in the arms connected to the short-circuited arm, resulting in module shoot-through risk, i.e., the risk of the battery pack fuse blowing, thus incurring additional maintenance costs for the user. If the fuse fails to blow in time or has insufficient breaking capacity, in a single-drive system, it can also cause the busbars, connectors, and copper busbars to melt or catch fire, resulting in catastrophic battery damage or thermal runaway fire. In a dual-drive system, if a rear-drive failure causes the entire vehicle's fuses to blow, the front drive will also lose power, causing the limp-walk function to fail, which in turn causes the front motor torque and speed to become uncontrolled, resulting in a sudden loss of vehicle power and a major safety hazard.

[0004] Currently, most automotive motors use permanent magnet synchronous motors. Considering scenarios where a short circuit occurs in the power module but the motor speed still exists, the controller needs to implement a three-phase active short circuit (ASC) safety strategy at high speeds to avoid generating unexpected braking torque, specifically targeting the short-circuited bridge arm. This prevents the risk of direct connection between the upper and lower bridges, thus avoiding the risk of the entire vehicle's fuses blowing. At low speeds, it should be able to execute a safety strategy that shuts off all power transistors (FWL).

[0005] Publication number CN222785800U (hereinafter referred to as D1) discloses a drive power supply architecture for a motor controller. D1 relies on a high-voltage backup power supply to cope with power failure of KL30, but it cannot prevent cascading failures caused by short circuits in the power module. When a base-collector / base-collector-emitter composite short circuit occurs in any bridge arm, the undervoltage of the drive power supply causes the ASC strategy to fail.

[0006] Announcement No. CN222423479U (hereinafter referred to as D2) discloses a power supply architecture for a motor controller and a new energy vehicle. D2 sets up multiple redundant power supply modules and separates the upper and lower bridges of the drive circuit used to drive the power module. Independent power supply is achieved for the upper and lower bridge drive circuits through the upper bridge power supply circuit and the lower bridge power supply circuit. At least one of the lower bridge output terminal and the upper bridge output terminal of the protection module can output a low-voltage power supply voltage, so that at least one of the upper bridge drive circuit and the lower bridge drive circuit can work normally with the support of the power supply circuit and respond to the control signal output by the motor control module. This allows the motor control module to still control the drive circuit to enter a safe state when there is a single point of failure in the power supply architecture, thereby avoiding the problem of overvoltage damage to the power module and bus capacitor due to system power failure and improving operational safety. Although D2 supports single-bridge arm base-emitter short circuit protection, when the system power supply is short-circuited, or the base-collector is short-circuited, or the base-collector-emitter composite short circuit occurs, the multi-level protection circuit will shut down the drive power supply in conjunction, forcing the system to enter the FWL state and generating unexpected braking torque.

[0007] The common shortcomings of the above solutions are:

[0008] The fault propagation path of a short circuit in the unisolated power module to the drive power supply;

[0009] Unable to maintain drive voltage under combined short-circuit scenarios;

[0010] Executing the bridge ASC strategy may cause shoot-through risk (e.g., when the upper bridge fails, the lower bridge IGBT is turned on, causing the battery positive and negative terminals to be directly connected).

[0011] Therefore, there is an urgent need for a redundant power supply architecture that can cover all failure scenarios and simultaneously avoid shoot-through risks and unexpected torque. Summary of the Invention

[0012] To address the technical problems existing in the background art, this invention proposes a safety architecture for a shoot-through redundant power supply for motor controllers.

[0013] This invention proposes a safety architecture for a shoot-through redundant power supply for a motor controller, comprising:

[0014] The main power supply module is used to draw power from the system power supply. After being processed by the filter anti-reverse circuit, overcurrent protection unit and drive power supply module, it outputs independent positive and negative voltages to the drive module of IGBT / SiC power module. The drive module includes the upper bridge drive module and the lower bridge drive module.

[0015] The backup power supply module is used to maintain the drive voltage of the IGBT / SIC power module through the backup power supply path when the main power supply module triggers overcurrent protection due to a short circuit in the bridge arm of the IGBT / SIC power module.

[0016] The control module is used to receive fault signals from the drive module, and after confirming the fault status based on the fault signals, it simultaneously triggers the safety logic module to execute the three-phase active short-circuit strategy of the faulty bridge arm. The fault signals include the upper bridge arm fault signal and the lower bridge arm fault signal.

[0017] Preferably, the security logic module includes an upper bridge security logic unit and a lower bridge security logic unit; the control unit is communicatively connected to the upper bridge security logic unit and the lower bridge security logic unit respectively; the upper bridge security logic unit is communicatively connected to the upper bridge drive module; the lower bridge security logic unit is communicatively connected to the lower bridge drive module; and the control unit is communicatively connected to the upper bridge drive module and the lower bridge drive module respectively.

[0018] Preferably, the fault signal is specifically an upper bridge arm fault signal; after the control module receives the upper bridge arm fault signal from the lower bridge drive module and confirms the upper bridge arm fault status, the control module controls the upper bridge drive module to turn on the upper bridge arm of the IGBT / SIC power module through the upper bridge safety logic unit, and at the same time controls the lower bridge drive module to turn off the lower bridge arm of the IGBT / SIC power module through the lower bridge safety logic unit, so that the upper bridge arm enters the three-phase active short circuit safety strategy.

[0019] Preferably, the fault signal is a lower bridge arm fault signal. After receiving the lower bridge arm fault signal from the upper bridge drive module and confirming the lower bridge arm fault status, the control module controls the lower bridge drive module to turn on the lower bridge arm of the IGBT / SIC power module through the lower bridge safety logic unit, and at the same time controls the upper bridge drive module to turn off the upper bridge arm of the IGBT / SIC power module through the upper bridge safety logic unit, so that the lower bridge arm enters the three-phase active short circuit safety strategy.

[0020] Preferably, the backup power supply path specifically draws power from the backup power battery, outputs five independent power supplies through the current limiting protection unit, of which three are output to the upper bridge drive module, one is output to the lower bridge drive module, and one is a redundant backup power supply.

[0021] Preferably, the power supply terminals of both the upper bridge drive module and the lower bridge drive module have dual enable control terminals, wherein the dual enable control terminals include a first enable terminal and a second enable terminal. The first enable terminal is connected to the enable signal of the main power supply module, and the second enable terminal is connected to the enable signal of the backup power supply module. When the power supply path of the main power supply module is turned off, the enable signal of the backup power supply module is immediately activated to maintain the power supply to the upper bridge drive module and the lower bridge drive module.

[0022] Preferably, the IGBT power module is composed of 6 transistors; the bridge arm short circuit is specifically a base-collector short circuit or a base-collector-emitter short circuit of any transistor.

[0023] Preferably, the SIC power module is composed of 6 MOS transistors; the bridge arm short circuit is specifically a gate-drain short circuit or a gate-drain-source short circuit of any MOS transistor.

[0024] The proposed reverse-through redundant power supply safety architecture for motor controllers, through a main power supply module, overcurrent protection unit, backup power supply module, and current limiting protection unit, ensures uninterrupted power supply to the drive module under any short-circuit failure mode in any of the six bridge arms of the power module. This completely avoids the safety hazards to users caused by unexpected braking torque generated by the vehicle, and effectively prevents the risk of fire caused by battery pack reverse-through. By designing redundant power supplies and overcurrent protection units to supply power to the system power chip, the drive power supply remains normal even in the event of a short circuit failure inside the system power chip or in the output load, ensuring the basic conditions required for the active safety state of the subsequent three-phase power supply. It also allows the backup power supply module on the high-voltage side to automatically switch over when the main power supply module loses power, ensuring that the driving function is not affected during normal vehicle operation. Through the novel power architecture design and the addition of overcurrent and current limiting protection units, the risk of battery pack fuse burnout and unexpected braking torque generated by the vehicle are avoided at a lower component cost, and additional after-sales maintenance costs are also avoided for users. It also supports the execution of safety policies in scenarios such as short circuit of any bridge arm of the power module, short circuit of the system power supply, and power failure of KL30, and is compatible with IGBT / SiC modules. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the circuit architecture of a safety architecture for a motor controller with anti-shoo-through redundant power supply proposed in this invention.

[0026] Figure 2 This is a schematic diagram of the IGBT / SiC power module of the anti-shoo-through redundant power supply safety architecture for motor controllers proposed in this invention.

[0027] Figure 3This is a schematic diagram of the fault signal transmission structure of a safety architecture for a motor controller with anti-shoo-through redundant power supply proposed in this invention. Detailed Implementation

[0028] Reference Figure 1-3 The present invention proposes a safety architecture for a motor controller with anti-shoo-through redundancy power supply, comprising:

[0029] The main power supply module is used to draw power from the system power supply. After being processed by the filter anti-reverse circuit, overcurrent protection unit and drive power supply module, it outputs independent positive and negative voltages to the drive module of IGBT / SiC power module. The drive module includes upper bridge drive module and lower bridge drive module.

[0030] Specifically, the drive power module includes an upper bridge drive power module and a lower bridge drive power module. The system power supply is a 12V battery. The signals output from the positive terminal KL30 and the negative terminal KL31 of the battery are processed by a filtering and anti-reverse circuit to filter out interference signals from the power harness. After passing through the current protection unit, they supply power to the upper bridge drive power module, the lower bridge drive power module, and the system power supply, respectively. The motor controller supports wake-up via a KL15 hard-wired signal or via a specific frame of the CAN bus.

[0031] The backup power supply module is used to maintain the drive voltage of the IGBT / SIC power module through the backup power supply path when the main power supply module triggers overcurrent protection due to a short circuit in the bridge arm of the IGBT / SIC power module.

[0032] Specifically, the backup power supply path draws power from the backup power battery, outputs five independent power supplies through the current limiting protection unit, of which three are output to the upper bridge drive module, one is output to the lower bridge drive module, and one is a redundant backup power supply.

[0033] In this embodiment, when the motor controller is operating normally, the overcurrent protection unit is not triggered, and the drive chip is powered normally by the main power supply module. When a short circuit occurs in the power module or the drive chip output, the overcurrent protection unit will trigger, and the main power supply module will shut down its output. At this time, the high-voltage side backup power supply module will immediately take over and continue to supply positive voltage to the drive module, thereby ensuring that the positive voltage supply to the drive module is not interrupted. There is a current limiting protection unit between the high-voltage side backup power supply and the drive module power supply, preventing the backup power supply from entering a hiccup protection state due to a module short circuit, thus ensuring the stability of the backup power supply's output voltage.

[0034] In this embodiment, when the motor controller is operating normally, the overcurrent protection unit of the power supply is not triggered, and the main power supply module can normally supply power to the control module MCU, safety logic module, current sampling and other modules. When a failure occurs such as a short circuit in the output of the main power supply module or a short circuit in the power supply of the control module MCU, the overcurrent protection will be triggered immediately, shutting down the system power supply, MCU power supply and the power supply of each module on the low voltage side. At this time, the power supply of the drive module is still normal, so it can enter the three-phase active safety state of the lower three bridge through the safety logic module to avoid the generation of unexpected braking torque.

[0035] In this embodiment, both the upper bridge drive module and the lower bridge drive module have dual enable control terminals at their power supply ends. The dual enable control terminals include a first enable terminal and a second enable terminal. The first enable terminal is connected to the enable signal of the main power supply module, and the second enable terminal is connected to the enable signal of the backup power supply module. When the power supply path of the main power supply module is turned off, the enable signal of the backup power supply module is immediately activated to maintain the power supply to the upper bridge drive module and the lower bridge drive module.

[0036] The control module is used to receive fault signals from the drive module, and after confirming the fault status based on the fault signals, it triggers the safety logic module to execute the three-phase active short-circuit strategy of the faulty bridge arm. The fault signals include the upper bridge arm fault signal and the lower bridge arm fault signal.

[0037] In this embodiment, the security logic module includes an upper bridge security logic unit and a lower bridge security logic unit; the control unit is communicatively connected to the upper bridge security logic unit and the lower bridge security logic unit respectively; the upper bridge security logic unit is communicatively connected to the upper bridge drive module; the lower bridge security logic unit is communicatively connected to the lower bridge drive module; and the control unit is communicatively connected to the upper bridge drive module and the lower bridge drive module respectively.

[0038] In this embodiment, the fault signal is specifically the upper bridge arm fault signal. After the control module receives the upper bridge arm fault signal from the lower bridge drive module and confirms the upper bridge arm fault status, the control module controls the upper bridge drive module to turn on the upper bridge arm of the IGBT / SIC power module through the upper bridge safety logic unit, and at the same time controls the lower bridge drive module to turn off the lower bridge arm of the IGBT / SIC power module through the lower bridge safety logic unit, so that the upper bridge arm enters the three-phase active short circuit safety strategy.

[0039] In this embodiment, the fault signal is specifically a lower bridge arm fault signal. After receiving the lower bridge arm fault signal from the upper bridge drive module and confirming the lower bridge arm fault status, the control module controls the lower bridge drive module to turn on the lower bridge arm of the IGBT / SIC power module through the lower bridge safety logic unit, and at the same time controls the upper bridge drive module to turn off the upper bridge arm of the IGBT / SIC power module through the upper bridge safety logic unit, so that the lower bridge arm enters the three-phase active short circuit safety strategy.

[0040] In this embodiment, the IGBT power module is specifically composed of 6 transistors; the bridge arm short circuit is specifically a base-collector short circuit or a base-collector-emitter short circuit of any transistor.

[0041] In this embodiment, the SiC power module is specifically composed of 6 MOS transistors; the bridge arm short circuit is specifically a gate-drain short circuit or a gate-drain-source short circuit of any MOS transistor.

[0042] In this embodiment, by optimizing the backup power supply architecture, the high-voltage side backup power supply module outputs three independent power supplies to power the upper bridge driver module, one power supply to simultaneously power the lower bridge driver chip, and one low-voltage backup power supply for redundant backup with the KL30 power supply. All five output power supplies are positive. The main power supply module outputs three independent positive and negative voltage power supplies to power the upper three bridge driver chips, and three independent positive and negative voltage power supplies to power the lower three bridge driver chips. This achieves redundant power supply for both the driver modules and the system power supply.

[0043] like Figure 3As shown, when any one of the transistors (or MOSFETs) Q1, Q2, and Q3 in the upper arm of the IGBT / SiC power module experiences a base-collector (or gate-drain) short circuit or a simultaneous base-collector-emitter (or gate-drain-source) short circuit, such as when Q2 short-circuits and remains continuously conducting uncontrolled by the system, meaning one of the outputs of the upper bridge drive module is short-circuited, this causes a short circuit in the upper bridge drive module, triggering the upper bridge overcurrent protection and shutting off the power supply to the upper bridge drive module. At this time, the emergency backup power supply output is unaffected by the current limiting protection module and continues to supply power to the upper bridge drive module through the current limiting protection module, ensuring the normal power supply to the upper bridge drive module and creating the basic conditions for the system to execute the three-phase active short-circuit safety strategy of the short-circuit bridge arm. At this moment, the lower bridge drive module will also detect the upper bridge arm short-circuit fault simultaneously and issue a fault signal Fault_L. The Fault_L signal reflects the upper bridge arm short-circuit fault. After the system processing unit detects the Fault_L signal and confirms the fault status, it controls the upper bridge drive module to turn on Q1 and Q3 through the upper bridge safety logic unit, thus ensuring that Q1, Q2, and Q3 are simultaneously turned on; and controls the lower bridge drive module to turn off Q4, Q5, and Q6 through the lower bridge safety logic unit. In other words, the system completes the upper three-bridge active short circuit (ASC) safety strategy, avoiding the generation of unexpected braking torque and the risk of direct connection between the upper and lower bridges. When any one of the lower bridge arms Q4, Q5, and Q6 of the power module experiences a base-collector (or gate-drain) short circuit or a simultaneous base-collector-emitter (or gate-drain-source) short circuit, the situation is similar. For example, if Q5 is short-circuited, Q5 will remain on uncontrolled by the system. The upper bridge driver module will also detect the lower bridge arm short circuit fault and issue a fault signal Fault_H. The fault signal Fault_H is used to reflect the lower bridge arm short circuit fault. After the system processing unit detects the fault signal Fault_H and confirms the fault status, it controls the lower bridge driver module to turn on Q4 and Q6 through the lower bridge safety logic unit, thus ensuring that Q4, Q5, and Q6 are on simultaneously. It controls the upper bridge driver module to turn off Q1, Q2, and Q3 through the upper bridge safety logic unit.

[0044] In this embodiment, by designing a reasonable power architecture and topology, overcurrent protection unit, and current limiting protection unit, the design defects of the existing power architecture are solved at a lower cost. The new power architecture can handle and avoid the risk of unexpected braking torque and axle shoot-through when the vehicle experiences module failure at high speed, meeting the functional safety requirements of the vehicle and avoiding the risk of fuse blowout. Furthermore, it is compatible with existing technologies where the backup power supply can automatically take over in the event of a power failure or undervoltage in the KL30, ensuring stable power supply and unaffected basic functions of the motor controller. This design scheme features high reliability, low cost, high adaptability, and compatibility with short-circuit failure scenarios of IGBT power modules and SiC power modules.

[0045] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A safety architecture for a non-shoo-through redundant power supply in a motor controller, characterized in that, include: The main power supply module is used to draw power from the system power supply. After being processed by the filter anti-reverse circuit, overcurrent protection unit and drive power supply module, it outputs independent positive and negative voltages to the drive module of IGBT / SiC power module. The drive module includes the upper bridge drive module and the lower bridge drive module. The backup power supply module is used to maintain the drive voltage of the IGBT / SIC power module through the backup power supply path when the main power supply module triggers overcurrent protection due to a short circuit in the bridge arm of the IGBT / SIC power module. The control module is used to receive fault signals from the drive module, and after confirming the fault status based on the fault signals, it simultaneously triggers the safety logic module to execute the three-phase active short-circuit strategy of the faulty bridge arm. The fault signals include the upper bridge arm fault signal and the lower bridge arm fault signal.

2. The anti-shoo-through redundant power supply safety architecture for a motor controller according to claim 1, characterized in that, The safety logic module includes an upper bridge safety logic unit and a lower bridge safety logic unit; the control unit is communicatively connected to the upper bridge safety logic unit and the lower bridge safety logic unit respectively; the upper bridge safety logic unit is communicatively connected to the upper bridge drive module; the lower bridge safety logic unit is communicatively connected to the lower bridge drive module; the control unit is communicatively connected to the upper bridge drive module and the lower bridge drive module respectively.

3. The anti-shoo-through redundant power supply safety architecture for a motor controller according to claim 2, characterized in that, The fault signal is specifically an upper bridge arm fault signal. After receiving the upper bridge arm fault signal from the lower bridge drive module and confirming the upper bridge arm fault status, the control module controls the upper bridge drive module to turn on the upper bridge arm of the IGBT / SIC power module through the upper bridge safety logic unit, and at the same time controls the lower bridge drive module to turn off the lower bridge arm of the IGBT / SIC power module through the lower bridge safety logic unit, so that the upper bridge arm enters the three-phase active short circuit safety strategy.

4. The anti-shoo-through redundant power supply safety architecture for a motor controller according to claim 2, characterized in that, The fault signal is specifically a lower bridge arm fault signal. After receiving the lower bridge arm fault signal from the upper bridge drive module and confirming the lower bridge arm fault status, the control module controls the lower bridge drive module to turn on the lower bridge arm of the IGBT / SIC power module through the lower bridge safety logic unit, and at the same time controls the upper bridge drive module to turn off the upper bridge arm of the IGBT / SIC power module through the upper bridge safety logic unit, so that the lower bridge arm enters the three-phase active short circuit safety strategy.

5. The anti-shoo-through redundant power supply safety architecture for a motor controller according to claim 1, characterized in that, The backup power supply path specifically draws power from the backup power battery, outputs five independent power supplies through the current limiting protection unit, of which three are output to the upper bridge drive module, one is output to the lower bridge drive module, and one is a redundant backup power supply.

6. The anti-shoo-through redundant power supply safety architecture for a motor controller according to claim 1, characterized in that, Both the upper bridge drive module and the lower bridge drive module have dual enable control terminals at their power supply ends. The dual enable control terminals include a first enable terminal and a second enable terminal. The first enable terminal is connected to the enable signal of the main power supply module, and the second enable terminal is connected to the enable signal of the backup power supply module. When the power supply path of the main power supply module is turned off, the enable signal of the backup power supply module is immediately activated to maintain the power supply to the upper bridge drive module and the lower bridge drive module.

7. The anti-shoo-through redundant power supply safety architecture for a motor controller according to claim 1, characterized in that, The IGBT power module is specifically composed of 6 transistors; the bridge arm short circuit is specifically a base-collector short circuit or a base-collector-emitter short circuit of any transistor.

8. The anti-shoo-through redundant power supply safety architecture for a motor controller according to claim 1, characterized in that, The SiC power module is specifically composed of 6 MOS transistors; the bridge arm short circuit is specifically a gate-drain short circuit or a gate-drain-source short circuit of any MOS transistor.

Images