Function safety architecture of three-level motor controller and control method
By combining independently configured drive power supplies and fuse components, along with non-functional safety chips and electronic fuses, the contradiction between functional safety and cost control in the three-level topology is resolved. This achieves low-cost safe state switching and fault isolation, improving the system's safety performance and robustness.
Patent Information
- Application Number
- CN202512045192.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-03-27
AI Technical Summary
Three-level topologies face challenges in achieving functional safety due to their high complexity and cost, making them difficult to widely apply in cost-sensitive and high-safety-requirement scenarios.
By employing an independently configured drive power supply and fuse components working in tandem, and controlling the shutdown command of the transverse tube drive chip via an MCU, combined with a non-functional safety chip and an electronic fuse, rapid fault isolation and safe state switching are achieved, simplifying circuit design and reducing costs.
While meeting functional safety requirements, it achieves low-cost safe state switching, simplifies circuit design, reduces hardware costs and complexity, and improves the system's safety performance and robustness.
Smart Images
Figure CN121749071A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of new energy vehicle electrical architecture, and particularly relates to a functional safety architecture of a three-level motor controller and a control method. BACKGROUND
[0002] In the field of motor control, the controller topology directly affects the system performance. The traditional two-level topology control is simple, but the output voltage waveform has high harmonic content, resulting in relatively large motor operating noise and loss. Therefore, in order to improve the performance, people have gradually begun to widely apply three-level topology. The output waveform of three-level topology is closer to a sine wave, which can effectively reduce harmonic distortion, thereby improving motor efficiency, stability and reducing electromagnetic interference, and has become an important technical development direction.
[0003] However, the three-level topology structure is more complex, which poses significant challenges in implementing functional safety. Compared with two-level, the definition and execution path of its safety state are more complex, resulting in complex fault detection circuit design, high safety logic hardware requirements, and often requiring more high-cost functional safety dedicated chips. This greatly increases the overall cost, design difficulty and circuit board area of the system, restricting the widespread application of this technology in cost-sensitive and high-safety scenarios.
[0004] At present, there is still a lack of solutions that can effectively balance the performance advantages of three-level and the implementation of functional safety. SUMMARY
[0005] In order to overcome the above technical defects, the purpose of the present application is to provide a functional safety architecture and control method of a three-level motor controller.
[0006] The present application discloses a functional safety architecture of a three-level motor controller, comprising: an MCU for issuing instructions to control other components; a safety module including a first fuse component; a three-phase power assembly for controlling a motor, the three-phase power assembly including a three-phase switching module, and each phase of the switching module including an upper switching tube, a lower switching tube, a first horizontal switching tube, and a second horizontal switching tube; a driving chip module including an upper bridge driving chip for driving the upper switching tube, a lower bridge driving chip for driving the lower switching tube, and a horizontal bridge driving chip for driving the first horizontal switching tube and the second horizontal switching tube; a power module including an upper bridge driving power supply, a lower bridge driving power supply, and at least one horizontal bridge driving power supply, which are independently arranged and isolated from each other; the upper bridge driving power supply is electrically connected with the upper bridge driving chip; the lower bridge driving power supply is electrically connected with the lower bridge driving chip; and the at least one horizontal bridge driving power supply is electrically connected with the horizontal bridge driving chip through the first fuse component in a disconnectable manner; When the three-level motor controller generates a fault signal, the MCU sends a pipe-off command to the horizontal pipe driving chip, and the first fuse component is disconnected; the three-level motor controller executes the upper bridge safety state or the lower bridge safety state to make the motor not generate unexpected torque.
[0007] Preferably, the horizontal bridge driving chip is a non-functionally safe driving chip.
[0008] Preferably, the at least one horizontal bridge driving power supply is one horizontal bridge driving power supply.
[0009] Preferably, the safety module further comprises a second fuse component arranged between the upper bridge driving power supply and the upper bridge driving chip, and a third fuse component arranged between the lower bridge driving power supply and the lower bridge driving chip. The first fuse component, the second fuse component, and the third fuse component are all electronic fuses.
[0010] Preferably, the functionally safe architecture further comprises an independent emergency power supply, which is electrically connected with the lower bridge driving chip.
[0011] The second aspect of the present application also provides a functionally safe control method of a three-level motor controller, which is applied to the functionally safe architecture as described in any one of the preceding aspects, and comprises: Fault response: when an unrecoverable short-circuit fault is detected, the horizontal bridge driving power supply is immediately cut off by controlling the first fuse component to be disconnected, and the MCU sends a shutdown command to the horizontal pipe driving chip; Safety state execution: according to the fault position and the rotating speed, the three-phase power assembly is controlled to enter the upper bridge safety state, the lower bridge safety state, or the full pipe-off safety state.
[0012] Preferably, controlling the three-phase power assembly to enter the upper bridge safety state, the lower bridge safety state, or the full pipe-off safety state comprises: When the upper switch tube and / or the first horizontal switch tube fails, the lower bridge safety state is executed; When the lower switch tube and / or the second horizontal switch tube fails, the upper bridge safety state is executed; Wherein, the upper switch tube and the first horizontal switch tube receive complementary PWM signals with the lower switch tube and the second horizontal switch tube.
[0013] Preferably, the control method further comprises: when the first fuse component of the functionally safe architecture of the three-level motor controller is an electronic fuse, fault diagnosis is realized through power-on self-test.
[0014] Preferably, the control method further comprises: When the functionally safe architecture of the three-level motor controller further comprises an emergency power supply, if the power module fails, the emergency power supply is started to execute the lower bridge safety state.
[0015] Compared with the prior art, the above technical scheme has the following beneficial effects: 1. The functional safety architecture of the three-level motor controller provided in the application can quickly cut off the supply of the horizontal pipe and switch to a safe state through the cooperative action of the independently arranged drive power supply and the first fuse component in the event of a fault, thereby ensuring that the motor does not generate unintended torque and returning the three-level architecture to a two-level safe state mode, without the need for additional complex design, so that the upper / lower ASC (Active Short Circuit) safety function consistent with the two-level controller can be realized at a lower cost on the premise of meeting the functional safety requirement, effectively balancing the demand for functional safety and cost control; 2. On the basis of the architecture, the non-functional safety chip is used to drive the horizontal pipe, which can help to simplify the circuit design, reduce the layout space and reduce the cost. In addition, a common horizontal bridge drive power supply and an electronic fuse network are provided, and the scheme realizes significant cost savings and design simplification. The unified design of the horizontal pipe power supply can isolate all horizontal pipes through a single control action, and the operation is reliable and the logic is simple. The independent fuse added in the upper and lower bridge power supply paths realizes complete decoupling and fault isolation of the drive power supply, and improves the fault tolerance. In addition, the independent emergency power supply provides ultimate power guarantee for the lower bridge drive, ensuring that the system can still execute the key safety state even in the extreme condition of main power failure, further improving the safety performance; 3. The functional safety method of the three-level motor controller provided in the application guarantees that the horizontal pipe does not participate in the safety state of the circuit through the double protection of cutting off the horizontal bridge drive power supply and issuing a shutdown instruction to the horizontal pipe drive chip by the MCU. According to this point, the mapping rule between the fault position and the safety state is determined, and the complex diagnosis is converted into simple and reliable hardware logic. In addition, the power-on self-test of the key execution component (such as the electronic fuse) can improve the preventive safety capability and simplify the fault confirmation process. Finally, by activating the emergency power supply and executing the safety state when the main power supply fails, a complete control logic from normal monitoring, fault response to extreme situation disposal is constructed, and the functional safety goal is closed loop realized from the software level, so that the entire system has high safety performance and high robustness. BRIEF DESCRIPTION OF DRAWINGS
[0016] Figure 1 The architecture diagram of the functional safety architecture of the three-level motor controller provided in the application; Figure 2 The circuit structure schematic diagram of the three-phase power component in the functional safety architecture of the three-level motor controller provided in the application; Figure 3 The flowchart of the functional safety control method of the three-level motor controller provided in the application. Detailed Implementation
[0017] The advantages of the present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments.
[0018] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.
[0019] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.
[0020] It should be understood that although the terms first, second, third, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."
[0021] In the description of this invention, it should be understood that the terms "longitudinal", "lateral", "up", "down", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.
[0022] In the description of this invention, unless otherwise specified and limited, it should be noted that the terms "installation", "connection" and "linking" should be interpreted broadly. For example, they can refer to mechanical or electrical connections, or internal connections between two components. They can be direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms according to the specific circumstances.
[0023] In the following description, suffixes such as "module," "part," or "unit" used to denote elements are used only for the convenience of the description of the invention and have no specific meaning in themselves. Therefore, "module" and "part" can be used interchangeably.
[0024] Please see Figures 1-2 , Figure 1 An architecture diagram of the functional safety architecture of the three-level motor controller provided in this application; Figure 2 A schematic diagram of the circuit structure of the three-phase power component in the functional safety architecture of the three-level motor controller provided in this application.
[0025] like Figures 1-2 As shown, this invention discloses a functional safety architecture for a three-level motor controller, comprising: MCU is used to issue commands to control other components; The safety module includes a first safety component; A three-phase power assembly is used to control a motor. The three-phase power assembly includes a three-phase switching module. Each phase switching module includes an upper switching transistor, a lower switching transistor, a first horizontal switching transistor, and a second horizontal switching transistor. The driver chip module includes an upper bridge driver chip for driving the upper switch transistor, a lower bridge driver chip for driving the lower switch transistor, and a cross bridge driver chip for driving the first cross switch transistor and the second cross switch transistor. The power module includes an independently configured and isolated upper bridge drive power supply, a lower bridge drive power supply, and at least one cross bridge drive power supply; the upper bridge drive power supply is electrically connected to the upper bridge drive chip; the lower bridge drive power supply is electrically connected to the lower bridge drive chip; and at least one cross bridge drive power supply is detachably electrically connected to the cross bridge drive chip via a first fuse component. When the three-level motor controller generates a fault signal, the MCU sends a shutdown command to the transverse transistor driver chip and disconnects the first safety component; the three-level motor controller executes the upper bridge safety state or the lower bridge safety state to prevent the motor from generating unexpected torque.
[0026] The principle needs to be explained here: The core safety objective of the motor controller is to prevent the generation of unexpected torque to avoid vehicle hazards. When a serious fault such as an irreversible short circuit occurs in the power switch, the controller must immediately enter a preset safe state and quickly take over control of the motor torque, thereby ensuring that the system is in a deterministic and controllable failure mode. For motor drives, the most typical safe states are ASC (Active Short Circuit) or SPO (Safe Power Off).
[0027] However, unlike traditional two-level topologies which only need to consider the upper and lower bridge ASC states, three-level T-type topologies theoretically have three ASC states: upper, middle, and lower. This makes their fault diagnosis and safety state mapping logic exceptionally complex. If all three states are used to achieve full coverage, it means that the driver chips for all power transistors must meet functional safety requirements and be equipped with extremely complex and expensive monitoring and arbitration logic, leading to a surge in costs and design difficulties.
[0028] Therefore, the functional safety architecture of the three-level motor controller provided in this application, through the coordinated action of the independently set drive power supply and the first safety component, can quickly cut off the power supply to the horizontal tube and switch to a safe state in case of failure. This not only ensures that the motor does not generate unexpected torque, but also allows the three-level architecture to revert to the two-level safe state mode. Without additional complex design, it can achieve the same up / down ASC safety function as the two-level controller at a lower cost while meeting functional safety requirements, effectively balancing the needs of functional safety and cost control.
[0029] The above is a brief description of the functional safety architecture of the three-level motor controller provided in this application. The following will describe the possible specific implementations of each component in conjunction with the accompanying drawings.
[0030] First, based on the aforementioned functional safety architecture, the driver chip and power supply for the crossbridge can be selected.
[0031] like Figures 1-2 As shown, in one possible implementation, the crossbridge driver chip is a non-functional safety driver chip.
[0032] This solution uses a non-functional safety type for the crossbridge driver chip. In case of failure, safety can be ensured by cutting off the power supply to the crossbridge, thus avoiding the use of high-cost functional safety type driver chips. This effectively reduces hardware procurement costs and simplifies the selection and layout of driver chips. Without affecting functional safety, the overall cost of the architecture is further reduced.
[0033] Correspondingly, at least one cross-bridge drive power supply is used. This reduces the number of power supply modules, simplifying the circuit layout and lowering the hardware cost and space occupied by the power supply modules. On the other hand, it enables centralized management of the cross-bridge drive power supply. In case of failure, the power supply control of the cross-bridge can be completed by cutting off a single power supply loop, improving the convenience of power control and the simplicity of the circuit.
[0034] Secondly, the specific structure of the security module is also not limited.
[0035] In one possible implementation, the safety module further includes a second safety component disposed between the upper bridge drive power supply and the upper bridge drive chip, and a third safety component disposed between the lower bridge drive power supply and the lower bridge drive chip. The first, second, and third fuse components are all electronic fuses.
[0036] This solution adds a second and third safety component to the safety module, both using electronic fuses. This gives the upper and lower bridge drive power supply circuits independent overcurrent / short-circuit protection capabilities. The fast response characteristics of the electronic fuses prevent faults from propagating in the power supply circuits, further enhancing the safety redundancy of each drive circuit and improving the overall fault tolerance of the architecture. Furthermore, the resettable electronic fuses facilitate rapid reset after fault resolution, allowing for reuse and reducing maintenance costs.
[0037] Those skilled in the art will understand that certain special requirements can be achieved or costs can be further reduced by including more or fewer components in the functional safety architecture, and this application makes no limitation herein.
[0038] For example, the functional safety architecture also includes a separate emergency power supply, which is electrically connected to the lower bridge driver chip.
[0039] By adding an independent emergency power supply connected to the lower bridge driver chip, the lower bridge driver chip can be continuously powered in extreme scenarios where the main power module fails, ensuring the smooth execution of the lower bridge safety state. This avoids the risk of the safety state being unable to switch due to power failure and enhances the functional safety and reliability of the architecture in power abnormality scenarios.
[0040] The above is a complete description of the functional safety architecture of the three-level motor controller provided in this application. The corresponding control method will be described below.
[0041] Please see Figure 3 , Figure 3 A flowchart illustrating the functional safety control method for the three-level motor controller provided in this application.
[0042] like Figure 3 As shown, and in combination Figures 1-2 It is understood that a second aspect of this application also provides a functional safety control method for a three-level motor controller, applied to the functional safety architecture described in any of the foregoing embodiments, comprising: Fault Response: When an unrecoverable short-circuit fault is detected, the first fuse component is immediately disconnected to cut off the power supply to the cross bridge drive, and a shutdown command is sent to the cross tube drive chip via the MCU. Safety status execution: Based on the fault location and speed, control the three-phase power components to enter the upper bridge safety status, lower bridge safety status, or fully shut-off safety status.
[0043] Corresponding to the aforementioned functional safety architecture, the functional safety method for the three-level motor controller provided in this application ensures that the horizontal transistor will not participate in the safe state of the circuit through the dual protection of cutting off the power supply to the horizontal bridge and issuing a shutdown command to the horizontal transistor driver chip by the MCU.
[0044] Furthermore, controlling the three-phase power components to enter the upper bridge safety state, lower bridge safety state, or fully shut-off safety state includes: When the upper switch and / or the first horizontal switch fails, the lower bridge safety state is executed; When the current switching transistor and / or the second horizontal switching transistor fails, the upper bridge safety state is executed. The upper switch and the first horizontal switch receive complementary PWM signals to the lower switch and the second horizontal switch.
[0045] The principle needs to be explained here. As shown in Table 1, for any unrecoverable short-circuit fault in a single power transistor, there is at least one upper ASC or lower ASC that is a permissible safe state. This means that, from an electrical safety perspective, theoretically, all single fault conditions can be covered by relying solely on the upper and lower ASC states, without the need to activate the middle ASC.
[0046] Table 1 Based on this principle and the functional safety architecture provided in this application, the present invention merges the fault reporting locations to obtain the control logic shown in Table 2: faults of U1 and U2 are mapped to the execution of the down-side ASC; faults of U3 and U4 are mapped to the execution of the up-side ASC. This simplifies the decision-making logic and meets functional safety requirements.
[0047] Table 2 This transforms complex fault diagnosis into concise hardware logic. By treating vertical and horizontal pipe faults on the same side (upper or lower) as equivalent and uniformly triggering the safety state on the opposite side (e.g., triggering ASC under a fault on the upper side), this rule fully utilizes the electrical characteristics of the three-level topology. It simplifies fault judgment logic, reduces software complexity, further improves the speed and determinism of fault response, and ensures that the system can automatically and error-free execute the correct safety state under any single-point or multi-point fault condition on the same side.
[0048] Correspondingly, the control method also includes: when the first safety component of the functional safety architecture of the three-level motor controller is an electronic fuse, fault diagnosis is achieved through power-on self-test.
[0049] Introducing a power-on self-test function for the electronic fuse in the transverse tube drive power supply circuit significantly improves the system's preventative safety capabilities and diagnostic coverage. During controller initialization, actively testing the fuse's switching function allows for the early detection of potential faults, preventing hazards caused by the failure of safe execution paths when actual faults occur. This self-test mechanism enhances monitoring of safety-critical components, enabling the system to meet higher functional safety integrity requirements. Furthermore, this self-test can be performed on the low-voltage side, independent of the transverse tube drive chip itself, making it simple and reliable. In the event of a fault, the self-test also simplifies the fault location confirmation process, ensuring maintainability.
[0050] Correspondingly, the control methods also include: When the functional safety architecture of the three-level motor controller also includes an emergency power supply, if the power supply module fails, the emergency power supply will be activated to execute the downbridge safety state.
[0051] By activating an independent emergency power supply and executing the downbridge ASC state, this control method ensures that the system maintains basic safety control capabilities even in extreme situations where the main power supply is lost. This prevents the complete loss of torque control due to a total controller power failure, which could lead to an uncontrollable and dangerous skidding state. It improves the system's fault response coverage, ensuring that the safety strategy encompasses the entire process from power transistor short circuits to power failure, maximizing safety performance.
[0052] It should be noted that the embodiments of the present invention have better implementability and are not intended to limit the present invention in any way. Any person skilled in the art may use the above-disclosed technical content to change or modify it into equivalent effective embodiments. However, any modifications or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of the technical solution of the present invention.
Claims
1. A functional safety architecture for a three-level motor controller, characterized in that, include: MCU is used to issue commands to control other components; The safety module includes a first safety component; A three-phase power assembly for controlling a motor, the three-phase power assembly including a three-phase switching module, each phase of the switching module including an upper switching transistor, a lower switching transistor, a first horizontal switching transistor and a second horizontal switching transistor; The driver chip module includes an upper bridge driver chip for driving the upper switch transistor, a lower bridge driver chip for driving the lower switch transistor, and a cross bridge driver chip for driving the first cross switch transistor and the second cross switch transistor. The power module includes an independently configured and isolated upper bridge drive power supply, a lower bridge drive power supply, and at least one cross bridge drive power supply; the upper bridge drive power supply is electrically connected to the upper bridge drive chip; the lower bridge drive power supply is electrically connected to the lower bridge drive chip; and the at least one cross bridge drive power supply is detachably electrically connected to the cross bridge drive chip via a first fuse component. When the three-level motor controller generates a fault signal, the MCU issues a shutdown command to the transverse tube driver chip and disconnects the first safety component; the three-level motor controller executes the upper bridge safety state or the lower bridge safety state to prevent the motor from generating unexpected torque.
2. The functional safety architecture of the three-level motor controller as described in claim 1, characterized in that, The crossbridge driver chip is a non-functional safety type driver chip.
3. The functional safety architecture of the three-level motor controller as described in claim 1, characterized in that, The at least one cross-bridge drive power supply is a cross-bridge drive power supply.
4. The functional safety architecture of the three-level motor controller as described in claim 1, characterized in that, The safety module further includes a second safety component disposed between the upper bridge drive power supply and the upper bridge drive chip, and a third safety component disposed between the lower bridge drive power supply and the lower bridge drive chip; The first, second, and third fuse components are all electronic fuses.
5. The functional safety architecture of the three-level motor controller as described in claim 1, characterized in that, The functional safety architecture also includes an independent emergency power supply, which is electrically connected to the lower bridge driver chip.
6. A functional safety control method for a three-level motor controller, characterized in that, Applied to the functional safety architecture as described in any one of claims 1-5, comprising: Fault Response: When an unrecoverable short-circuit fault is detected, the first fuse component is immediately disconnected to cut off the power supply to the cross bridge drive, and a shutdown command is sent to the cross tube drive chip via the MCU. Safety state execution: Based on the fault location and rotational speed, control the three-phase power components to enter the upper bridge safety state, lower bridge safety state, or fully shut-off safety state.
7. The functional safety control method for a three-level motor controller as described in claim 6, characterized in that, The control of the three-phase power components to enter the upper bridge safety state, lower bridge safety state, or fully shut-off safety state includes: When the upper switch and / or the first horizontal switch fails, the lower bridge safety state is executed; When the current switching transistor and / or the second horizontal switching transistor fails, the upper bridge safety state is executed. The upper switch and the first horizontal switch receive complementary PWM signals to the lower switch and the second horizontal switch.
8. The functional safety control method for a three-level motor controller as described in claim 6, characterized in that, The control method further includes: when the first safety component of the functional safety architecture of the three-level motor controller is an electronic fuse, fault diagnosis is achieved through power-on self-test.
9. The functional safety control method for a three-level motor controller as described in claim 6, characterized in that, The control method further includes: When the functional safety architecture of the three-level motor controller also includes an emergency power supply, if the power supply module fails, the emergency power supply will be activated to execute the downbridge safety state.