Motor controller anti-pass-through protection system and method based on multi-level fault diagnosis

Abstract

This invention discloses a motor controller anti-shot-through protection system and method based on multi-level fault diagnosis, belonging to the technical field of electric drive systems for new energy vehicles. It aims to solve the problems of existing technologies, such as single protection mode, lack of dynamic switching capability, missing two-point failure handling, and poor speed adaptability. The system includes an MCU module, a dynamic protection decision module, an anti-shot-through interlock logic module, and a two-point failure handling module. The MCU module collects upper / lower bridge drive faults and system-level functional safety L2 faults, identifying the source and type of the fault. The dynamic protection decision module combines fault information with motor speed to output freewheel or active short-circuit protection commands. The anti-shot-through interlock logic module prohibits dangerous protection actions based on desaturation faults. The two-point failure handling module coordinates multiple concurrent fault scenarios. This invention achieves multi-level fault response, avoids bridge arm shot-through, improves the safety of the motor controller and electric drive system, and eliminates the need for dedicated chips, thus controlling costs.

Description

Technical Field

[0001] This invention relates to the field of electric drive system technology for new energy vehicles, and in particular to a motor controller anti-surge protection system and method based on multi-level fault diagnosis. Background Technology

[0002] The electric drive system of new energy vehicles converts the DC power from the power battery into three-phase AC power through a motor controller and power module, driving a permanent magnet synchronous motor to provide power to the vehicle. As the core actuator of the electric drive system, the motor controller's failure (especially a short circuit in the power module) can cause a large amount of heat to accumulate, potentially burning out the power module or even leading to a vehicle safety accident. Therefore, efficient active protection measures are necessary to ensure the safe operation of the system.

[0003] Commonly used active protection technologies for existing motor controllers include Freewheel (FW) and Active Short Circuit (ASC). FW physically disconnects the motor from the controller by disconnecting the upper and lower IGBTs of the UVW three-phase bridge. ASC dissipates motor energy through a short circuit in the upper bridge arm (upper ASC) or the lower bridge arm (lower ASC). The IGBT on / off states of these two protection methods must be strictly distinguished to avoid bridge arm shoot-through. However, existing motor controller shoot-through protection technologies have significant drawbacks:

[0004] The protection mode is singular and lacks dynamic switching capability: For example, the Chinese patent with publication number CN116316435A only implements the lower bridge ASC protection through hardware and cannot dynamically switch between upper and lower ASC according to the fault type (upper bridge / lower bridge fault); if the upper ASC is accidentally triggered when the lower bridge is short-circuited, it will cause the bridge arm to shoot through and burn out the IGBT.

[0005] Lack of anti-shot-through interlock mechanism: For example, the Chinese patent with publication number CN214544110U only limits the level of the upper and lower bridge drive signals through hardware circuits, without combining the judgment of core fault types such as desaturation fault, and cannot avoid the risk of shot-through caused by erroneous protection action.

[0006] Dual-point failure handling is lacking: Existing technologies do not cover dual-point failure scenarios such as "concurrent L2 functional safety failure and desaturation failure". When multiple failures are superimposed, protection logic conflicts are likely to occur, leading to protection failure.

[0007] Poor speed adaptability: The motor speed signal is not integrated. At high speeds, the FW protection will generate a back electromotive force far exceeding the bus voltage, which may damage the power module. At low speeds, the ASC protection has the problem of insufficient energy dissipation.

[0008] In summary, existing technologies cannot meet the comprehensive requirements of new energy vehicle electric drive systems for "multi-level diagnosis, dynamic protection, functional safety, and two-point failure protection," and there is an urgent need for a shoot-through protection solution that can cover all fault scenarios and dynamically adapt to operating conditions. Summary of the Invention

[0009] To address the technical problems existing in the background art, this invention proposes a motor controller anti-straight-through protection system and method based on multi-level fault diagnosis.

[0010] The present invention proposes a motor controller shoot-through protection system based on multi-level fault diagnosis. This system includes an upper bridge arm and a lower bridge arm connected between the DC bus and the three-phase windings of the motor, and an upper bridge drive module and a lower bridge drive module, each containing a drive chip, for driving the upper and lower bridge arms.

[0011] The MCU module is electrically connected to the upper bridge driver module, the lower bridge driver module, and the system-level functional safety monitoring unit. It is used to receive interrupt fault signals from the upper bridge driver module and the lower bridge driver module, read back the data of the internal registers of the driver chip through SPI communication, and receive system-level functional safety L2 fault signals from the system-level functional safety monitoring unit. In this way, it can determine the source bridge arm of the fault and the fault type. The fault types include interrupt fault, desaturation fault, driver chip fault obtained through SPI communication, and system-level functional safety L2 fault.

[0012] The dynamic protection decision module is connected to the MCU module and the speed detection unit. It is used to receive the source arm of the fault, the fault type and the motor speed signal output by the speed detection unit, and dynamically decide to output the instruction of free wheel protection mode, upper bridge active short circuit protection mode or lower bridge active short circuit protection mode.

[0013] The anti-straight-through interlock logic module is connected to the MCU module and the dynamic protection decision module. It is used to prevent the dynamic protection decision module from outputting an active short-circuit protection mode command that would cause a straight-through loop with the faulty bridge arm when the desaturation fault is detected, based on the desaturation fault state determined by the MCU module.

[0014] Preferably, the MCU module includes:

[0015] The hardware emergency stop unit is used to immediately block the drive pulses of all bridge arms through hardware circuitry when an interrupt fault signal is detected to be valid.

[0016] The software fault diagnosis unit is used to read the fault registers of the upper and lower bridge driver chips through interrupt service routines and SPI communication after the hardware emergency stop unit is activated, so as to accurately determine the fault type and locate the fault source bridge arm.

[0017] Preferably, the execution process of the dynamic protection decision module includes:

[0018] When a fault is detected in both the upper and lower bridge driver chips via SPI communication and the desaturation fault state cannot be confirmed, the decision is made to enter the freewheel protection mode.

[0019] When only the upper bridge driver chip is identified as faulty and the lower bridge does not have a desaturation fault, the decision is made to enter the lower bridge active short circuit protection mode.

[0020] When only the lower bridge driver chip is identified as faulty and the upper bridge does not have a desaturation fault, the decision is made to enter the upper bridge active short circuit protection mode.

[0021] When it is identified that only the upper bridge arm has a desaturation fault, the decision is made to enter the lower bridge active short circuit protection mode;

[0022] When a desaturation fault is detected only in the lower bridge arm, the decision is made to enter the active short-circuit protection mode of the upper bridge.

[0023] Preferably, the dynamic protection decision module is further used for:

[0024] When only an upper bridge arm interruption fault is received and the motor speed is higher than or equal to the set threshold m, the decision is made to enter the lower bridge active short circuit protection mode.

[0025] When only an upper arm interruption fault is received and the motor speed is lower than the set threshold m, the decision is made to enter the freewheel protection mode.

[0026] When only a lower bridge arm interruption fault is received and the motor speed is higher than or equal to the set threshold m, the decision is made to enter the upper bridge active short circuit protection mode.

[0027] When only a lower bridge arm interruption fault is received and the motor speed is lower than the set threshold m, the decision is made to enter the freewheel protection mode.

[0028] Wherein, the set threshold m is the critical speed value corresponding to when the motor back electromotive force exceeds the bus voltage by 50V.

[0029] Preferably, it further includes:

[0030] The dual-point failure handling module, connected to the MCU module and the dynamic protection decision module, is used to generate control instructions for functional safety enable signals according to the order of occurrence of system-level functional safety L2 faults and any other faults in the fault type when they are detected concurrently, so as to coordinate the protection strategy.

[0031] Preferably, the two-point failure handling module is specifically used for:

[0032] When a system-level functional safety L2 fault occurs before a desaturation fault, if the motor speed is greater than or equal to m, the lower bridge active short-circuit protection mode is first entered according to the system-level functional safety L2 fault, and then switched to free wheel protection mode after a desaturation fault is subsequently detected.

[0033] When a desaturation fault occurs before a system-level functional safety L2 fault, the level of the interrupt fault signal pin is immediately checked. If the pin is low, the functional safety enable signal is pulled low to disable the hardware protection function. If the pin is high, the functional safety enable signal is pulled high to enable the hardware protection function.

[0034] Preferably, the two-point failure handling module further includes:

[0035] The timing determination unit is used to monitor the level transition timestamps of system-level functional safety L2 fault signals and INTB interrupt fault signals; compare the order of occurrence of the two types of fault signals and determine the fault timing with microsecond-level precision; and execute the corresponding coordination strategy based on the determined timing.

[0036] Preferably, the interlocking process of the anti-straight-through interlocking logic module specifically includes:

[0037] If the desaturation fault occurs in the upper bridge arm, the upper bridge active short circuit protection mode command is prohibited from being output, and only the lower bridge active short circuit protection mode or free wheel protection mode command is allowed to be output.

[0038] If the desaturation fault occurs in the lower bridge arm, the output of the lower bridge active short circuit protection mode command is prohibited, and only the output of the upper bridge active short circuit protection mode or free wheel protection mode command is allowed.

[0039] Preferably, it also includes an L2 hardware protection circuit module, connected between the MCU module and the upper bridge driver module and the lower bridge driver module, wherein the enable terminal of the L2 hardware protection circuit module receives the functional safety enable signal sent by the two-point failure handling module;

[0040] The L2 hardware protection circuit module is used to: when the functional safety enable signal is valid and a system-level functional safety L2 fault signal is received, implement freewheel protection or lower bridge active short-circuit protection in hardware according to the received motor speed signal.

[0041] The present invention proposes a motor controller anti-shot-through protection method based on multi-level fault diagnosis, which is applied to the motor controller anti-shot-through protection system based on multi-level fault diagnosis as described in any of the above claims. The method includes the following steps:

[0042] The MCU module obtains interrupt fault signals from the upper and lower bridge driver modules, reads back the internal register data of the driver chip through serial peripheral interface communication, and obtains system-level functional safety L2 fault signals from the system-level functional safety monitoring unit. The system then processes these signals to obtain the source bridge arm of the fault and the fault type, including interrupt faults, desaturation faults, driver chip faults obtained through SPI communication, and system-level functional safety L2 faults.

[0043] The dynamic protection decision module receives the source arm of the fault, the fault type, and the motor speed signal output by the speed detection unit. After processing, it decides and outputs instructions for free wheel protection mode, upper bridge active short circuit protection mode, or lower bridge active short circuit protection mode.

[0044] Based on the desaturation fault status, the anti-straight-through interlocking logic module prohibits the output of active short-circuit protection mode commands that would cause a straight-through loop with the faulty bridge arm when a desaturation fault is detected in any bridge arm.

[0045] When a system-level functional safety L2 fault is detected concurrently with any other fault by the dual-point failure handling module, the sequence of fault occurrence is obtained, processed, and a control command for generating a functional safety enable signal is generated to coordinate the execution of the protection strategy.

[0046] The proposed motor controller anti-shot-through protection system and method based on multi-level fault diagnosis in this invention constructs a multi-level protection mechanism of "fast hardware response, precise software diagnosis, functional safety coordination, and dynamic speed adaptation." This mechanism can comprehensively cover all fault scenarios from single-point faults to double-point failures. By using anti-shot-through interlock logic, it avoids the risk of bridge arm shot-through caused by erroneous protection actions. At the same time, it dynamically adjusts the protection mode according to the motor operating conditions to ensure the safety of the power module. Its hardware and software co-design can meet the functional safety requirements of high reliability scenarios and does not rely on dedicated driver chips. While simplifying the hardware structure and reducing control costs, it significantly improves the overall safety, reliability, and adaptability of the motor controller and electric drive system. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the system architecture of the motor controller anti-straight-through protection system based on multi-level fault diagnosis proposed in this invention;

[0048] Figure 2 This is a schematic diagram of the implementation of the motor controller shoot-through protection system based on multi-level fault diagnosis proposed in this invention. Figure 1 ;

[0049] Figure 3 This is a schematic diagram of the implementation of the motor controller shoot-through protection system based on multi-level fault diagnosis proposed in this invention. Figure 2 ;

[0050] Figure 4 This invention presents the processing flow of the dual-point failure handling module in a motor controller shoot-through protection system based on multi-level fault diagnosis. Figure 1 ;

[0051] Figure 5 This invention presents the processing flow of the dual-point failure handling module in a motor controller shoot-through protection system based on multi-level fault diagnosis. Figure 2 ;

[0052] Figure 6 This invention presents the processing flow of the dual-point failure handling module in a motor controller shoot-through protection system based on multi-level fault diagnosis. Figure 3 ;

[0053] Figure 7 This invention presents the processing flow of the dual-point failure handling module in a motor controller shoot-through protection system based on multi-level fault diagnosis. Figure 4 ;

[0054] Figure 8 This invention presents the processing flow of the dual-point failure handling module in a motor controller shoot-through protection system based on multi-level fault diagnosis. Figure 5 ;

[0055] Figure 9 This invention presents the processing flow of the dual-point failure handling module in a motor controller shoot-through protection system based on multi-level fault diagnosis. Figure 6 ;

[0056] Figure 10 This is a schematic diagram of the MCU module electrically connecting the upper bridge drive module and the lower bridge drive module in the motor controller anti-straight-through protection system based on multi-level fault diagnosis proposed in this invention.

[0057] Figure 11 This is a schematic diagram of one embodiment of the L2 hardware protection circuit module of the motor controller anti-straight-through protection system based on multi-level fault diagnosis proposed in this invention. Detailed Implementation

[0058] Reference Figure 1-11 The present invention proposes a motor controller anti-shoo-through protection system based on multi-level fault diagnosis, comprising an upper bridge arm and a lower bridge arm connected between the DC bus and the three-phase windings of the motor, and an upper bridge drive module and a lower bridge drive module containing drive chips for driving the upper bridge arm and the lower bridge arm, comprising:

[0059] The MCU module is electrically connected to the upper bridge driver module, the lower bridge driver module, and the system-level functional safety monitoring unit. It is used to receive interrupt fault signals from the upper bridge driver module and the lower bridge driver module, read back the data of the internal registers of the driver chip through SPI communication, and receive system-level functional safety L2 fault signals from the system-level functional safety monitoring unit. In this way, it can determine the source bridge arm and fault type of the fault. The fault types include interrupt fault, desaturation fault, driver chip fault obtained through SPI communication, and system-level functional safety L2 fault.

[0060] In this embodiment, the MCU module includes:

[0061] The hardware emergency stop unit is used to immediately block the drive pulses of all bridge arms through hardware circuitry when an interrupt fault signal is detected to be valid.

[0062] The software fault diagnosis unit is used to read the fault registers of the upper and lower bridge driver chips through interrupt service routines and SPI communication after the hardware emergency stop unit is activated, so as to accurately determine the fault type and locate the fault source bridge arm.

[0063] The dynamic protection decision module is connected to the MCU module and the speed detection unit. It is used to receive the source arm of the fault, the fault type, and the motor speed signal output by the speed detection unit, and dynamically decide to output instructions for free wheel protection mode, upper bridge active short circuit protection mode, or lower bridge active short circuit protection mode.

[0064] In this embodiment, the MCU module uses an Infineon TC3xx series MCU with Emergency Stop (ES) function, which can trigger hardware blocking via the falling edge of PortB to achieve nanosecond-level fast protection. The GD3160 driver chip supports fault detection and SPI communication, and can provide feedback on power supply faults, desaturation (DESAT) faults, etc., by pulling the INTB pin low. The MCU can identify the specific fault type by reading back the fault register via SPI. Among them, the DESAT fault is the core fault type of power module short circuit, which requires a fast response to avoid module burnout. Its protection timeliness directly determines the safe life of the electric drive system.

[0065] In this embodiment, the execution process of the dynamic protection decision module includes:

[0066] When a fault is detected in both the upper and lower bridge driver chips via SPI communication and the desaturation fault state cannot be confirmed, the decision is made to enter the freewheel protection mode.

[0067] When only the upper bridge driver chip is identified as faulty and the lower bridge does not have a desaturation fault, the decision is made to enter the lower bridge active short circuit protection mode.

[0068] When only the lower bridge driver chip is identified as faulty and the upper bridge does not have a desaturation fault, the decision is made to enter the upper bridge active short circuit protection mode.

[0069] When it is identified that only the upper bridge arm has a desaturation fault, the decision is made to enter the lower bridge active short circuit protection mode;

[0070] When a desaturation fault is detected only in the lower bridge arm, the decision is made to enter the active short-circuit protection mode of the upper bridge.

[0071] In this embodiment, the dynamic protection decision module is also used for:

[0072] When only an upper bridge arm interruption fault is received and the motor speed is higher than or equal to the set threshold m, the decision is made to enter the lower bridge active short circuit protection mode.

[0073] When only an upper arm interruption fault is received and the motor speed is lower than the set threshold m, the decision is made to enter the freewheel protection mode.

[0074] When only a lower bridge arm interruption fault is received and the motor speed is higher than or equal to the set threshold m, the decision is made to enter the upper bridge active short circuit protection mode.

[0075] When only a lower bridge arm interruption fault is received and the motor speed is lower than the set threshold m, the decision is made to enter the freewheel protection mode.

[0076] The threshold m is set as the critical speed value corresponding to when the motor back electromotive force exceeds the bus voltage by 50V.

[0077] The anti-straight-through interlocking logic module is connected to the MCU module and the dynamic protection decision module. Based on the desaturation fault state determined by the MCU module, when a desaturation fault is detected in any bridge arm, it prohibits the dynamic protection decision module from outputting an active short-circuit protection mode command that would cause a straight-through loop with the faulty bridge arm.

[0078] In this embodiment, the interlocking process of the anti-straight-through interlocking logic module specifically includes:

[0079] If the desaturation fault occurs in the upper bridge arm, the upper bridge active short circuit protection mode command is prohibited from being output, and only the lower bridge active short circuit protection mode or free wheel protection mode command is allowed to be output.

[0080] If the desaturation fault occurs in the lower bridge arm, the output of the lower bridge active short circuit protection mode command is prohibited, and only the output of the upper bridge active short circuit protection mode or free wheel protection mode command is allowed.

[0081] In this embodiment, it also includes:

[0082] The dual-point failure handling module, connected to the MCU module and the dynamic protection decision module, is used to generate control commands for functional safety enable signals according to the order of occurrence of system-level functional safety L2 faults and any other faults in the fault type when they are detected concurrently, so as to coordinate the protection strategy.

[0083] Specifically, the two-point failure handling module is used for:

[0084] When a system-level functional safety L2 fault occurs before a desaturation fault, if the motor speed is greater than or equal to m, the lower bridge active short-circuit protection mode is first entered according to the system-level functional safety L2 fault, and then switched to free wheel protection mode after a desaturation fault is subsequently detected.

[0085] When a desaturation fault occurs before a system-level functional safety L2 fault, the level of the interrupt fault signal pin is immediately checked. If the pin is low, the functional safety enable signal is pulled low to disable the hardware protection function. If the pin is high, the functional safety enable signal is pulled high to enable the hardware protection function.

[0086] Specifically, the two-point failure handling module also includes:

[0087] The timing determination unit is used to monitor the level transition timestamps of system-level functional safety L2 fault signals and INTB interrupt fault signals; compare the order of occurrence of the two types of fault signals and determine the fault timing with microsecond-level precision; and execute the corresponding coordination strategy based on the determined timing.

[0088] In this embodiment, an L2 hardware protection circuit module is also included, which is connected between the MCU module and the upper bridge driver module and the lower bridge driver module. The enable terminal of the L2 hardware protection circuit module receives the functional safety enable signal sent by the dual-point failure handling module.

[0089] The L2 hardware protection circuit module is used to: when the functional safety enable signal is valid and a system-level functional safety L2 fault signal is received, implement freewheel protection or lower bridge active short-circuit protection in hardware based on the received motor speed signal.

[0090] Example 1:

[0091] In this embodiment, the freewheel protection mode is abbreviated as FW, the upper bridge active short circuit protection mode is abbreviated as upper ASC, and the lower bridge active short circuit protection mode is abbreviated as lower ASC.

[0092] like Figure 2As shown, the interrupt faults include upper bridge INTB faults and lower bridge INTB faults. When an upper bridge INTB fault or a lower bridge INTB fault occurs, the INTB pin is pulled low. This interrupt fault signal is input to the MCU module through PortB. The falling edge of PortB triggers the ES function, which drives the PWM blocking of the 6 IGBTs, implementing a nanosecond-level freewheel protection mode (FW) in hardware. At the same time, the GTM and TIM modules in the MCU module capture the falling edge of PortB and trigger the interrupt ISR. In this interrupt, the high and low level states of Port1 and Port2 can be read to identify whether the interrupt fault signal comes from the upper bridge or the lower bridge. If the MCU module reads that Port1 is low, an upper bridge INTB fault has occurred; if the MCU reads that Port2 is low, a lower bridge INTB fault has occurred. Then, based on the fault type and rotational speed, a microsecond-level active short-circuit protection mode and a freewheel protection mode (FW) are implemented.

[0093] However, entering active short-circuit protection mode may cause shoot-through. For example, if the lower bridge is already short-circuited, but the protection action is to enter active short-circuit protection mode for the upper bridge, this will lead to shoot-through due to the incorrect protection action. Entering freewheel protection mode will not cause shoot-through, but at high speeds, the permanent magnet synchronous motor will generate a large back EMF, which may damage the power module. Therefore, at high speeds, active short-circuit protection mode should be used as much as possible. When the back EMF generated by the permanent magnet synchronous motor is greater than 50V of the bus voltage, the motor speed is considered high; otherwise, it is considered low. After triggering ES, the PortB pin is pulled low and an interrupt is triggered. In the PortB interrupt handler, the INTB faults of both the upper and lower bridges are read back. At this time, it is necessary to read back the driver chips of the upper and lower bridges via SPI to check for DESAT faults, and combine the SPI fault and DESAT fault to implement the shoot-through protection strategy shown in the table below:

[0094] Protective actions SPI failure on bridge Lower bridge SPI failure DESAT failure on upper bridge DESAT failure in lower bridge FW Y Y Unable to confirm Unable to confirm FW Y N Unable to confirm Y FW N Y Y Unable to confirm FW N N Y Y Download ASC Y N Unable to confirm N Up ASC N Y N Unable to confirm Download ASC N N Y N Up ASC N N N Y

[0095] After ES is triggered, the PortB pin is pulled low and an interrupt is triggered. In the PortB interrupt handler, only the upper bridge INTB or lower bridge INTB fault is read back. Based on the speed and fault type, the anti-shot-through strategy in the table below is implemented:

[0096] Protective actions rotational speed upper bridge INTB failure Lower bridge INTB fault FW low speed Y N FW low speed N Y Download ASC high speed Y N Up ASC high speed N Y

[0097] In this embodiment, the motor speed and L2 functional safety fault can be combined to determine, through hardware circuitry, whether to activate FW protection or the lower bridge active short-circuit protection mode. Figure 3As shown in the diagram. Here, MCU pulling DO_SPEED_EN high indicates high speed, and MCU pulling DO_SPEED_EN low indicates low speed. L2_2N pulling high enables L2 protection, and pulling low disables L2 protection. When DO_SPEED_EN is pulled low and L2 protection is enabled, the hardware circuit implements fault-tolerant (FW) protection. When DO_SPEED_EN is pulled high and L2 protection is enabled, the hardware circuit implements the lower bridge active short-circuit protection mode.

[0098] In this embodiment, the working scenarios of the two-point failure handling module include:

[0099] Scenario 1: A system-level functional safety L2 fault occurs first, followed by a desaturation fault (DESAT fault). When a system-level functional safety L2 fault occurs at high speeds, Figure 11 When DO_SPEED_EN is pulled high, L2 protection is enabled, and the system enters the lower ASC protection state. If a short circuit occurs in the upper bridge, a DESAT fault occurs in the lower bridge. The lower bridge INTB pin is pulled low, the TIM module captures the falling edge and triggers an interrupt. In the lower bridge INTB interrupt handler, it checks if a system-level functional safety L2 fault has occurred. If so, it enters the FW state; otherwise, it maintains the lower ASC state. Figure 4 As shown.

[0100] Scenario 2: A desaturation fault (DESAT fault) occurs first, followed by a system-level functional safety L2 fault. When a short circuit occurs on the upper bridge at high speed, a DESAT fault occurs on the lower bridge. The lower bridge INTB pin is pulled low, triggering ES. TIM captures the falling edge of the PortB pin and triggers an interrupt. In the PortB interrupt handler, the upper ASC protection is entered. If a system-level functional safety L2 fault occurs at this time, the hardware circuit will enter the lower bridge active short-circuit protection mode, which poses a risk of leakage. Therefore, after a system-level functional safety L2 fault occurs, it is necessary to first determine whether the lower bridge INTB pin is pulled low. If the INTB pin is pulled low, the MCU module disables L2 by pulling the L2_EN pin low; if the INTB pin is not pulled low, the MCU enables L2 by pulling the L2_EN pin high, entering the lower bridge active short-circuit protection mode. Figure 5 As shown.

[0101] Scenario 3: An upper bridge desaturation fault (upper bridge DESAT fault) occurs first, followed by a lower bridge INTB fault. When a lower bridge short circuit occurs at high speed, a DESAT fault occurs on the upper bridge, the upper bridge INTB pin is pulled low, triggering ES. TIM captures the falling edge of the PortB pin and triggers an interrupt. In the PortB interrupt handler, the lower bridge active short circuit protection mode is entered. If a lower bridge INTB fault occurs at this time, the TIM module captures the falling edge of the lower bridge INTB and triggers an interrupt. In the INTB interrupt handler, if both the upper and lower bridge INTB are low, DO_SPEED_EN is pulled low and L2 is enabled, entering FW protection. Figure 6 As shown.

[0102] Scenario 4: A lower bridge INTB fault occurs first, followed by an upper bridge DESAT fault (upper bridge DESAT fault). When a lower bridge INTB fault occurs at high speed, the lower bridge INTB pin is pulled low, triggering ES. The TIM module captures the falling edge of the PortB pin and triggers an interrupt. In the PortB interrupt handler, it enters the upper ASC protection. If a lower bridge short circuit occurs at this time, the upper bridge DESAT fault occurs. The TIM module captures the falling edge of the upper bridge INTB and triggers an interrupt. In the INTB interrupt handler, it is determined that both the upper and lower bridge INTB are low. If so, DO_SPEED_EN is pulled low and L2 is enabled, entering FW protection. Figure 7 As shown.

[0103] Scenario 5: A lower bridge DESAT fault occurs first, followed by an upper bridge INTB fault. When an upper bridge short circuit occurs at high speed, a lower bridge DESAT fault occurs, the lower bridge INTB pin is pulled low, triggering ES. The TIM module captures the falling edge of the PortB pin and triggers an interrupt. In the PortB interrupt handler, it enters upper ASC protection. If an upper bridge INTB fault occurs at this time, TIM captures the falling edge of the upper bridge INTB and triggers an interrupt. In the INTB interrupt handler, it checks if both upper and lower bridge INTB are low, then pulls DO_SPEED_EN low and enables L2, entering FW protection. Figure 8 As shown.

[0104] Scenario 6: An upper bridge INTB fault occurs first, followed by a lower bridge DESAT fault. When an upper bridge INTB fault occurs at high speed, the upper bridge INTB pin is pulled low, triggering ES. The TIM module captures the falling edge of the PortB pin and triggers an interrupt. In the PortB interrupt handler, the lower bridge active short-circuit protection mode is entered. If an upper bridge short circuit occurs at this time, a lower bridge DESAT fault occurs. The TIM module captures the falling edge of the lower bridge INTB and triggers an interrupt. In the INTB interrupt handler, if both the upper and lower bridge INTB pins are low, DO_SPEED_EN is pulled low and L2 is enabled, entering FW protection. Figure 9 As shown.

[0105] In this embodiment, the upper and lower bridge INTB pins of the driver chip are at a high level, and the upper and lower bridge INTB signals are input to Port1 and Port2 of the MCU module, respectively. When no fault occurs, the MCU module's PortB pin is pulled up to 5V. When the upper bridge fails, its INTB pin is pulled low, causing the MCU module's PortB and Port1 pins to also be pulled low. The low-level PortB pin triggers the ES function, and the TIM module captures the falling edges of PortB and Port1 respectively and triggers an interrupt. When the lower bridge fails, its INTB pin is pulled low, causing the MCU's PortB and Port2 pins to also be pulled low. The low-level PortB pin triggers the ES function, and the TIM module captures the falling edges of PortB and Port2 respectively and triggers an interrupt. Figure 10 As shown.

[0106] like Figure 11 As shown, through Figure 11 The circuit implements an L2 hardware protection module, which includes one AND gate, three OR gates, and six tri-state output line drivers. When a system-level functional safety L2 fault occurs at low speed, the MCU module pulls DO_SPEED_EN low and simultaneously pulls L2_EN high. This causes the NOE signal of the six tri-state output line drivers to go high, shutting down output Y and cutting off the six PWM outputs from the MCU. When a system-level functional safety L2 fault occurs at high speed, the MCU pulls DO_SPEED_EN high and simultaneously pulls L2_EN high. Although the six PWM outputs from the MCU are cut off, the high-level DO_SPEED_EN signal, after passing through an OR gate, is input to the UVW three-phase lower bridge driver chip, implementing active short-circuit protection mode for the lower bridge. System-level functional safety L2 faults are user-defined, such as resolver signal out-of-range faults and three-phase current non-zero faults.

[0107] Reference Figure 1-11The proposed method for shoot-through protection of motor controllers based on multi-level fault diagnosis is applied to any of the above-mentioned shoot-through protection systems for motor controllers based on multi-level fault diagnosis. The method includes the following steps:

[0108] The MCU module obtains interrupt fault signals from the upper and lower bridge driver modules, reads back the internal register data of the driver chip through serial peripheral interface communication, and obtains system-level functional safety L2 fault signals from the system-level functional safety monitoring unit. The system then processes these signals to obtain the source bridge arm of the fault and the fault type, including interrupt faults, desaturation faults, driver chip faults obtained through SPI communication, and system-level functional safety L2 faults.

[0109] The dynamic protection decision module receives the source arm of the fault, the fault type, and the motor speed signal output by the speed detection unit. After processing, it decides and outputs instructions for free wheel protection mode, upper bridge active short circuit protection mode, or lower bridge active short circuit protection mode.

[0110] Based on the desaturation fault status, the anti-straight-through interlocking logic module prohibits the output of active short-circuit protection mode commands that would cause a straight-through loop with the faulty bridge arm when a desaturation fault is detected in any bridge arm.

[0111] When a system-level functional safety L2 fault is detected concurrently with any other fault by the dual-point failure handling module, the sequence of fault occurrence is obtained, processed, and a control command for generating a functional safety enable signal is generated to coordinate the execution of the protection strategy.

[0112] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A motor controller anti-shoot-through protection system based on multi-stage fault diagnosis, comprising upper and lower bridge arms connected between a DC bus and a three-phase winding of a motor, and upper and lower bridge drive modules containing drive chips for driving the upper and lower bridge arms, characterized in that, include: The MCU module is electrically connected to the upper bridge driver module, the lower bridge driver module, and the system-level functional safety monitoring unit. It is used to receive interrupt fault signals from the upper bridge driver module and the lower bridge driver module, read back the data of the internal registers of the driver chip through SPI communication, and receive system-level functional safety L2 fault signals from the system-level functional safety monitoring unit. In this way, it can determine the source bridge arm of the fault and the fault type. The fault types include interrupt fault, desaturation fault, driver chip fault obtained through SPI communication, and system-level functional safety L2 fault. The dynamic protection decision module is connected to the MCU module and the speed detection unit. It is used to receive the source arm of the fault, the fault type and the motor speed signal output by the speed detection unit, and dynamically decide to output the instruction of free wheel protection mode, upper bridge active short circuit protection mode or lower bridge active short circuit protection mode. The anti-straight-through interlock logic module is connected to the MCU module and the dynamic protection decision module. It is used to prevent the dynamic protection decision module from outputting an active short-circuit protection mode command that would cause a straight-through loop with the faulty bridge arm when the desaturation fault is detected, based on the desaturation fault state determined by the MCU module.

2. The multi-stage fault diagnosis based motor controller anti-shoot-through protection system of claim 1, wherein, The MCU module includes: The hardware emergency stop unit is used to immediately block the drive pulses of all bridge arms through hardware circuitry when an interrupt fault signal is detected to be valid. The software fault diagnosis unit is used to read the fault registers of the upper and lower bridge driver chips through interrupt service routines and SPI communication after the hardware emergency stop unit is activated, so as to accurately determine the fault type and locate the fault source bridge arm.

3. The multi-stage fault diagnosis based motor controller anti-shoot-through protection system of claim 1, wherein, The execution process of the dynamic protection decision module includes: When a fault is detected in both the upper and lower bridge driver chips via SPI communication and the desaturation fault state cannot be confirmed, the decision is made to enter the freewheel protection mode. When only the upper bridge driver chip is identified as faulty and the lower bridge does not have a desaturation fault, the decision is made to enter the lower bridge active short circuit protection mode. When only the lower bridge driver chip is identified as faulty and the upper bridge does not have a desaturation fault, the decision is made to enter the upper bridge active short circuit protection mode. When it is identified that only the upper bridge arm has a desaturation fault, the decision is made to enter the lower bridge active short circuit protection mode; When a desaturation fault is detected only in the lower bridge arm, the decision is made to enter the active short-circuit protection mode of the upper bridge.

4. The motor controller anti-straight-through protection system based on multi-level fault diagnosis according to claim 1 or 3, characterized in that, The dynamic protection decision module is also used for: When only an upper bridge arm interruption fault is received and the motor speed is higher than or equal to the set threshold m, the decision is made to enter the lower bridge active short circuit protection mode. When only an upper arm interruption fault is received and the motor speed is lower than the set threshold m, the decision is made to enter the freewheel protection mode. When only a lower bridge arm interruption fault is received and the motor speed is higher than or equal to the set threshold m, the decision is made to enter the upper bridge active short circuit protection mode. When only a lower bridge arm interruption fault is received and the motor speed is lower than the set threshold m, the decision is made to enter the freewheel protection mode. Wherein, the set threshold m is the critical speed value corresponding to when the motor back electromotive force exceeds the bus voltage by 50V.

5. The motor controller anti-short-through protection system based on multi-level fault diagnosis according to claim 1, characterized in that, Also includes: The dual-point failure handling module, connected to the MCU module and the dynamic protection decision module, is used to generate control instructions for functional safety enable signals according to the order of occurrence of system-level functional safety L2 faults and any other faults in the fault type when they are detected concurrently, so as to coordinate the protection strategy.

6. The motor controller anti-straight-through protection system based on multi-level fault diagnosis according to claim 5, characterized in that, The two-point failure handling module is specifically used for: When a system-level functional safety L2 fault occurs before a desaturation fault, if the motor speed is greater than or equal to m, the lower bridge active short-circuit protection mode is first entered according to the system-level functional safety L2 fault, and then switched to free wheel protection mode after a desaturation fault is subsequently detected. When a desaturation fault occurs before a system-level functional safety L2 fault, the level of the interrupt fault signal pin is immediately checked. If the pin is low, the functional safety enable signal is pulled low to disable the hardware protection function. If the pin is high, the functional safety enable signal is pulled high to enable the hardware protection function.

7. The motor controller anti-short-through protection system based on multi-level fault diagnosis according to claim 6, characterized in that, The two-point failure handling module also includes: The timing determination unit is used to monitor the level transition timestamps of system-level functional safety L2 fault signals and INTB interrupt fault signals; compare the order in which the two types of fault signals occur, and determine the fault timing with microsecond-level precision; and execute the corresponding coordination strategy based on the determined timing.

8. The motor controller anti-short-through protection system based on multi-level fault diagnosis according to claim 1, characterized in that, The interlocking process of the anti-straight-through interlocking logic module specifically includes: If the desaturation fault occurs in the upper bridge arm, the upper bridge active short circuit protection mode command is prohibited from being output, and only the lower bridge active short circuit protection mode or free wheel protection mode command is allowed to be output. If the desaturation fault occurs in the lower bridge arm, the output of the lower bridge active short circuit protection mode command is prohibited, and only the output of the upper bridge active short circuit protection mode or free wheel protection mode command is allowed.

9. The motor controller anti-straight-through protection system based on multi-level fault diagnosis according to claim 5, characterized in that, It also includes an L2 hardware protection circuit module, which is connected between the MCU module and the upper bridge driver module and the lower bridge driver module. The enable terminal of the L2 hardware protection circuit module receives the functional safety enable signal sent by the two-point failure handling module. The L2 hardware protection circuit module is used to: when the functional safety enable signal is valid and a system-level functional safety L2 fault signal is received, implement freewheel protection or lower bridge active short-circuit protection in hardware according to the received motor speed signal.

10. A method for shoot-through protection of a motor controller based on multi-level fault diagnosis, characterized in that, The method, applied to the motor controller shoot-through protection system based on multi-level fault diagnosis as described in any one of claims 1-9, comprises the following steps: The MCU module obtains interrupt fault signals from the upper and lower bridge driver modules, reads back the internal register data of the driver chip through serial peripheral interface communication, and obtains system-level functional safety L2 fault signals from the system-level functional safety monitoring unit. The system then processes these signals to obtain the source bridge arm of the fault and the fault type, including interrupt faults, desaturation faults, driver chip faults obtained through SPI communication, and system-level functional safety L2 faults. The dynamic protection decision module receives the source arm of the fault, the fault type, and the motor speed signal output by the speed detection unit. After processing, it decides and outputs instructions for free wheel protection mode, upper bridge active short circuit protection mode, or lower bridge active short circuit protection mode. Based on the desaturation fault status, the anti-straight-through interlocking logic module prohibits the output of active short-circuit protection mode commands that would cause a straight-through loop with the faulty bridge arm when a desaturation fault is detected in any bridge arm. When a system-level functional safety L2 fault is detected concurrently with any other fault by the dual-point failure handling module, the sequence of fault occurrence is obtained, processed, and a control command for generating a functional safety enable signal is generated to coordinate the execution of the protection strategy.

Images