Redundancy control system and method for electronic control system of new energy commercial vehicle

Abstract

The invention belongs to the technical field of vehicle control, and particularly relates to a redundancy control system and method for an electric control system of a new energy commercial vehicle, and the system comprises a multi-source sensing detection module, a fault decision and management module, a dual-core control module, a power redundancy switching module, and a safety execution module. Through distributed layout and multi-parameter synchronous acquisition of the multi-source sensing detection module and in combination with a multi-feature fusion technology of the fault decision and management module, comprehensive perception of the working state of the motor controller is realized. And particularly, a hardware comparator is adopted to carry out parallel threshold judgment, the response time of key faults is shortened from millisecond level of a traditional software scheme to microsecond level, and the response capability of the system to sudden faults is greatly improved. According to the multi-factor weighted aggregation judgment mechanism, the fault recognition accuracy is improved through dynamic weight adjustment, and the phenomena of false alarm and missing alarm are effectively reduced.

Description

Technical Field

[0001] This invention belongs to the field of vehicle control technology, specifically relating to a redundant control system and method for an electronic control system of a new energy commercial vehicle. Background Technology

[0002] With the rapid development of the new energy vehicle industry, the electronic control system of new energy commercial vehicles, as the core control unit of the whole vehicle, is directly related to the safety and operational efficiency of the vehicle.

[0003] However, in current technological practices, fault diagnosis and redundancy design of electronic control systems (especially motor controllers) still face severe challenges. Existing technical solutions generally suffer from the following prominent problems: First, fault diagnosis capabilities are insufficient. Most systems rely on single parameter thresholds for judgment (such as current or voltage over-limits), resulting in slow response speeds and a tendency to misdiagnose or miss progressive faults (such as component aging) or multi-factor coupled faults (such as concurrent overcurrent and overtemperature), leading to low diagnostic accuracy. Second, redundancy designs are mostly complete dual-system backups, i.e., replicating the entire control module. While this achieves basic functional redundancy, the system is complex, costly, and has a cumbersome switching mechanism, making it difficult to meet the cost and space constraints required by commercial vehicles. Furthermore, fault handling strategies are simplistic, often employing a "one-size-fits-all" approach (such as immediately cutting off power upon detecting a fault), which may cause secondary accidents while the vehicle is in motion, lacking adaptive adjustments to the operating state. Summary of the Invention

[0004] To address the aforementioned shortcomings of the prior art, this invention provides a redundant control system and method for the electronic control system of new energy commercial vehicles.

[0005] In a first aspect, the present invention provides a redundant control system for an electronic control system of a new energy commercial vehicle, comprising: The multi-source sensing and detection module is used to perform distributed multi-parameter real-time monitoring of the motor controller, synchronously acquiring current, voltage, and temperature signals from the power transistor unit, DC bus, and AC output terminal, and performing threshold judgment through a built-in hardware comparator. The fault decision and management module, connected to the multi-source sensor detection module, receives data collected by the multi-source sensor detection module, extracts time-domain features, frequency-domain features, and rate of change features of current, voltage, and temperature signals, normalizes the extracted features to construct a fault feature vector, performs multi-factor weighted aggregation calculation on the fault feature vector according to pre-stored weight coefficients to obtain a fault fusion feature vector value, compares this value with a preset fault threshold to identify the fault type, classifies the fault level according to the fault fusion feature vector value, and queries a preset two-dimensional decision matrix based on the classified fault level and the current vehicle operating status to determine the corresponding adaptive processing strategy. The dual-core control module includes a main control core and a safety monitoring core. The safety monitoring core is connected to the fault decision and management module and is used to generate control commands according to the adaptive processing strategy. The main control core is used to adjust the PWM control signal according to the adaptive processing strategy to reconstruct the system output. The power redundancy switching module is connected to the safety monitoring core of the dual-core control module. It includes an intelligent contactor array, which is used to receive control commands and perform a switching operation that first connects the backup path and then disconnects the faulty path. The safety execution module, connected to the main control core, is used to send appropriate levels of feedback information to the driver.

[0006] Secondly, this invention provides a redundancy control method for a new energy commercial vehicle electronic control system, applicable to the redundancy control system of the aforementioned new energy commercial vehicle electronic control system, the method comprising: S1. The motor controller is monitored in real time with distributed multi-parameter detection through the multi-source sensor detection module. The current signal, voltage signal and temperature signal of the power tube unit, DC bus and AC output terminal are collected synchronously, and the threshold is judged by the built-in hardware comparator. S2. The fault decision and management module receives data collected by the multi-source sensing detection module, extracts the time-domain features, frequency-domain features, and rate of change features of the current signal, voltage signal, and temperature signal, and normalizes the extracted features to construct a fault feature vector. S3. The fault decision and management module performs multi-factor weighted aggregation calculation on the fault feature vector according to the pre-stored weight coefficients to obtain the fault fusion feature vector value; compares the fault fusion feature vector value with the preset fault threshold to realize the fault level classification and identify the fault type. S4. Based on the classified fault levels and the current vehicle operating status, query the preset two-dimensional decision matrix to determine the corresponding adaptive processing strategy. S5, the safety monitoring core in the dual-core control module sends control commands to the power redundancy switching module according to the adaptive processing strategy, and controls the intelligent contactor array to perform a switching operation of first connecting the backup path and then disconnecting the fault path. S6, the main control core in the dual-core control module adjusts the PWM control signal according to the adaptive processing strategy, reconstructs the system output, and sends corresponding level of feedback information to the driver through the safety execution module.

[0007] Further improvements to this technical solution include step S1, which specifically includes: An open-loop Hall current sensor is configured as the main detection channel in the power transistor unit; a high-impedance voltage divider network and an isolated operational amplifier are configured at the DC bus and AC output terminals to realize voltage detection; a negative temperature coefficient thermistor and a digital temperature sensor are configured together to realize temperature monitoring; different sampling frequencies are set for different parameter characteristics, with the current signal using a high sampling frequency and the temperature signal using a low sampling frequency; the detected parameters are judged in parallel using an LM339 four-channel comparator chip, and a fault trigger signal is output when any parameter exceeds the corresponding preset threshold.

[0008] Further improvements to this technical solution include step S2, which specifically includes: S21. Extract the effective value, instantaneous peak value, and DC bias time-domain characteristics from the three-phase current signal, extract the frequency domain characteristics of the 5th and 7th harmonic components through fast Fourier transform, and calculate the current change rate di / dt. S22. Extract the ripple coefficient and voltage drop amplitude from the DC bus voltage signal, and extract the fundamental RMS value and three-phase unbalance from the AC output voltage signal. S23. Extract the absolute temperature value and the temperature rise rate dT / dt from the temperature signal; S24. All extracted feature parameters are normalized using the minimum-maximum normalization formula, mapping all feature values ​​to a unified dimensionless interval, and generating a fault feature vector composed of normalized feature values.

[0009] Further improvements to this technical solution include step S3, which specifically includes: S31, The fault decision-making and management module follows the formula Calculate the fault fusion feature vector value, where w i f is the dynamic weight of the i-th feature parameter. i Let be the normalized eigenvalue of the i-th feature parameter; S32. Compare the calculated fault fusion feature vector value with the preset fault threshold, and identify the fault type according to the degree to which the threshold is exceeded.

[0010] Further improvements to this technical solution include step S32, which specifically includes: The lower limits of the first-level fault threshold, the lower limits of the second-level fault threshold, and the upper limits of the third-level fault threshold are pre-stored in the lookup table of the fault decision and management module. When the fault fusion feature vector value exceeds the lower limit of the first-level fault threshold, it is determined to be a first-level fault. First-level faults include power tube shoot-through faults and DC bus short-circuit faults. When the fault fusion feature vector value is between the lower limits of the first-level fault threshold and the lower limits of the second-level fault threshold, it is determined to be a second-level fault. Second-level faults include overcurrent, overtemperature, and sensor failure faults. When the fault fusion feature vector value is between the lower limit of the second-level fault threshold and the upper limit of the third-level fault threshold, it is determined to be a third-level fault. Third-level faults include communication anomalies and parameter drift faults.

[0011] Further improvements to this technical solution include step S4, which specifically includes: S41. The fault decision and management module constructs a two-dimensional decision matrix inside the FPGA with fault level as the first dimension and vehicle operating state as the second dimension. Each cell of the matrix stores the strategy mode word, vehicle state coefficient K_state, PWM lockout enable bit and mechanical braking request bit. Among them, the vehicle operating state includes high-speed driving, low-speed driving, brake energy recovery, parking charging and idling. S42. When the fault fusion feature vector value exceeds the lower limit of the first-level fault threshold, the fault decision and management module outputs the strategy mode word 0x01. After reading the strategy mode word, the safety monitoring core sets the PWM blocking enable bit to 1 and the mechanical braking request bit to 1, and sends an emergency braking request frame to the vehicle CAN bus. S43. When the fault fusion feature vector value is between the lower limits of the first and second level fault thresholds and the vehicle is operating at high or low speed, the fault decision and management module outputs the strategy mode word 0x02, calculates the maximum allowable output power after derating P_derated = P_max × K_state × (1 - Severity_factor), and calculates the torque limit value T_limit = min(T_driver_req, (P_derated × 9550) / N_motor), and writes P_derated and T_limit into the strategy parameter register; where P_max is the maximum rated power of the motor controller under normal fault-free conditions; Severity_factor is the fault severity factor obtained by mapping the fault fusion feature vector value; T_driver_req is the torque requested by the driver; and N_motor is the current motor speed. S44. When the fault fusion feature vector value is between the lower limit of the first-level and second-level fault thresholds and the vehicle operating state is brake energy recovery, the fault decision and management module outputs strategy mode word 0x03, sets the mechanical brake request bit to 1, and forces the vehicle state coefficient K_state to 0 to limit the subsequent drive power. S45. When the fault fusion feature vector value is between the lower limits of the first-level and second-level fault thresholds and the vehicle is in a parking charging or idling state, the fault decision and management module outputs the strategy mode word 0x03 and sets the PWM blocking enable bit to 1. S46. When the fault fusion feature vector value is between the upper limit of the level 2 and level 3 fault thresholds, the fault decision and management module outputs strategy mode word 0x04, sets the PWM blocking enable bit to 0, the mechanical braking request bit to 0, and maintains the current power output.

[0012] A further improvement to this technical solution is that the formula for calculating the severity factor (Severity_factor) is as follows: The formula for calculating the severity factor (Severity_factor) is as follows: ; in, These are the fault fusion feature vector values; This is the lower limit of the level 2 fault threshold; This is the lower limit of the first-level fault threshold.

[0013] Further improvements to this technical solution include step S5, which specifically includes: S51. The safety monitoring core receives the strategy mode word output in step S4. If it is 0x01 or 0x02, it sends a contactor pre-charging command to the power redundancy switching module. The pre-charging resistor charges the capacitive load of the backup path. After charging is completed, the bridging contactor K3 is closed within a preset time. After confirming that the feedback status bit of K3 is 1, the contactor K1 or K2 corresponding to the faulty power module is disconnected, completing the redundancy switching of closing first and then disconnecting. After the redundancy switching is completed, the contactor switching completion flag bit is stored in the execution status word of the safety monitoring core. S52. The safety monitoring core receives the PWM blocking enable bit output in step S4. If the bit is 1, it blocks all PWM drive signals of the faulty power module, forces its output to a high impedance state, and stores the corresponding PWM hard blocking valid flag bit in the execution status word. S53. The safety monitoring core receives the mechanical braking request bit output in step S4. If the bit is 1, it sends a message with the braking deceleration request value of the maximum deceleration to the electromechanical braking system EMB via the CAN bus to activate the mechanical braking.

[0014] Further improvements to this technical solution include the following method in step S6: the main control core adjusts the PWM control signal according to the adaptive processing strategy and sends feedback information. S61. The main control core reads the strategy mode word, the maximum allowed output power P_derated after derating, and the torque limit value T_limit from the strategy parameter register written in step S4 through the dual-port RAM inside the dual-core control module, and reads the contactor switching completion flag and the PWM hard block effective flag from the execution status word written after step S5. S62. The main control core parses the strategy mode word. If the strategy mode word is 0x02 and the PWM hard block effective flag is 0, then the duty cycle value of the PWM waveform comparison register is recalculated according to the current motor speed and torque limit value T_limit. The calculated duty cycle value is limited within the voltage vector amplitude range corresponding to T_limit. The register configuration of the PWM generation module is updated to reconstruct the system output. S63. The main control core generates a driver feedback information frame based on the strategy mode word. If the strategy mode word is 0x01, it sends an emergency warning frame containing an emergency stop icon and a maximum volume buzzer command to the safety execution module. If the strategy mode word is 0x02, it sends a general warning frame containing a depreciation percentage and a maintenance reminder icon. If the strategy mode word is 0x03 or 0x04, it sends a low-priority information frame containing only text prompts. After receiving the information frame, the safety execution module drives the instrument panel display and triggers the corresponding audible and visual alarms.

[0015] The beneficial effects of this invention are as follows: By employing a distributed layout and synchronous acquisition of multiple parameters from multi-source sensing modules, combined with multi-feature fusion technology in the fault decision-making and management module, comprehensive awareness of the motor controller's operating status is achieved. In particular, the use of hardware comparators for parallel threshold judgment reduces the response time for critical faults from milliseconds in traditional software solutions to microseconds, significantly improving the system's responsiveness to sudden faults (such as power transistor shoot-through). The multi-factor weighted aggregation judgment mechanism, through dynamic weight adjustment, enhances fault identification accuracy and effectively reduces false alarms and missed alarms.

[0016] Employing a heterogeneous dual-core architecture with partial redundancy, the system significantly reduces costs while ensuring reliability. The division of labor between the main control core and the safety monitoring core ensures both normal control performance and dedicated safety monitoring. Power redundancy switching via an intelligent contactor array saves hardware costs compared to traditional full system backup solutions, while also increasing the system's mean time between failures (MTBF). This partial redundancy architecture is particularly suitable for cost-sensitive commercial vehicle applications.

[0017] The two-dimensional decision matrix in this invention achieves adaptive matching between fault levels and vehicle operating states, completely changing the traditional "one-size-fits-all" protection strategy. For level two faults, through precise power derating calculation (P_derated=P_max×K_state×(1-Severity_factor)) and torque limiting (T_limit=min(T_driver_req,(P_derated×9550) / N_motor)), the continuity of vehicle operation is maintained to the maximum extent while ensuring safety. This intelligent derating strategy avoids the safety hazards caused by sudden power interruption during driving and significantly improves vehicle availability.

[0018] The power redundancy switching module employs a "make-before-break" mechanism, ensuring seamless power output transitions through precise timing control (2-5ms intervals). The pre-charging circuit design effectively avoids capacitive load surges, while the intelligent contactor array bridging scheme enables resource sharing between different power modules. When a fault is detected in power module A, the system closes contactor K3 to enable the healthy module B to provide coordinated power to both motors. The entire process is smooth, completely eliminating power interruptions or surges during switching. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a block diagram of the overall hardware architecture of a system according to an embodiment of the present invention.

[0021] Figure 2 This is a diagram of the heterogeneous architecture of the dual-core control module.

[0022] Figure 3 This is the circuit diagram for the power redundancy switching module.

[0023] Figure 4 This is a schematic flowchart illustrating a method according to an embodiment of the present invention.

[0024] Figure 5 This is the complete process of the present invention from fault detection to execution of protection actions. Detailed Implementation

[0025] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the specific embodiments. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0027] like Figure 1 As shown, the present invention provides a redundant control system for the electronic control system of a new energy commercial vehicle, comprising: The multi-source sensing and detection module is used to perform distributed multi-parameter real-time monitoring of the motor controller, synchronously acquiring current, voltage, and temperature signals from the power transistor unit, DC bus, and AC output terminal, and performing threshold judgment through a built-in hardware comparator. The fault decision and management module, connected to the multi-source sensor detection module, receives data collected by the multi-source sensor detection module, extracts time-domain features, frequency-domain features, and rate of change features of current, voltage, and temperature signals, normalizes the extracted features to construct a fault feature vector, performs multi-factor weighted aggregation calculation on the fault feature vector according to pre-stored weight coefficients to obtain a fault fusion feature vector value, compares this value with a preset fault threshold to identify the fault type, classifies the fault level according to the fault fusion feature vector value, and queries a preset two-dimensional decision matrix based on the classified fault level and the current vehicle operating status to determine the corresponding adaptive processing strategy. The dual-core control module includes a main control core and a safety monitoring core. The safety monitoring core is connected to the fault decision and management module and is used to generate control commands according to the adaptive processing strategy. The main control core is used to adjust the PWM control signal according to the adaptive processing strategy to reconstruct the system output. The power redundancy switching module is connected to the safety monitoring core of the dual-core control module. It includes an intelligent contactor array, which is used to receive control commands and perform a switching operation that first connects the backup path and then disconnects the faulty path. The safety execution module, connected to the main control core, is used to send appropriate levels of feedback information to the driver.

[0028] Multi-source sensing detection module: Current detection: A Hall current sensor is connected to the emitter of the upper arm of the IGBT in the motor controller's IGBT bridge arm output. This Hall current sensor is a Honeywell CSNV500N-351Z Hall current sensor (measurement range ±500A). Simultaneously, a 0.001Ω / 5W high-precision sampling resistor and an AD8421 differential amplifier circuit (redundant detection channel, 1000x amplification, input offset voltage ≤25μV) are connected in parallel at the power transistor output to achieve dual-backup current monitoring.

[0029] Voltage detection: For DC bus voltage acquisition, a precision resistor divider network is constructed using a 4191KΩ resistor and a 10KΩ resistor. An NSI1311 isolation operational amplifier (with a fixed gain of 1 and a maximum isolation voltage of 5000V) is used to output a differential signal to an operational amplifier TP2302. After being amplified 2.5 times by the operational amplifier to increase the resolution, the signal is sent to the FPGA. Finally, the FPGA calculates the DC bus voltage. For the AC output, a Hall effect current sensor is used to directly acquire the current.

[0030] Temperature Detection: The IGBT module has a built-in NTC thermistor, and a digital temperature sensor is placed around the IGBT to detect its temperature. An MTS4 chip is used, with an accuracy of ±0.1℃. The detected temperature is sent to the FPGA in digital form via the I2C protocol, forming a dual temperature detection system. An NTC104 thermistor is attached to the motor stator winding, with a resistance of 100KΩ, a B value of 3950, and a resistance accuracy of ±1%.

[0031] Sampling frequency settings: 100kHz for current signal (high sampling), 50kHz for voltage signal (medium sampling), and 10Hz for temperature signal (low sampling). Differentiated acquisition is achieved by configuring the sampling clock through the FPGA.

[0032] Hardware comparator: Employs an LM339 quad comparator chip. The non-inverting input connects to the sensor output, while the inverting input connects to an adjustable reference threshold. The adjustable reference threshold is determined based on different voltage platforms and vehicle models. After setting primary, secondary, and tertiary reference thresholds, the acquired temperature, current, and voltage signals are compared with these thresholds to trigger different levels of alarms.

[0033] Fault Decision and Management Module: Hardware foundation: The core processing unit is built on an Intel Agilex AGIB014R24A2E2V FPGA, integrating DSP arithmetic blocks, coefficient memory, threshold memory, and fault model library storage unit.

[0034] Time-domain features: Extract the effective value of current, instantaneous peak value, and DC bias; voltage ripple coefficient, drop amplitude, fundamental wave effective value, and three-phase unbalance degree; absolute temperature value of temperature and temperature rise rate dT / dt.

[0035] Frequency-domain features: Perform fast Fourier transform on the current signal through the built-in FFT IP core of the FPGA to extract the amplitudes of the 5th and 7th harmonic components.

[0036] Rate-of-change features: Calculate the rate of change of current di / dt and the rate of change of voltage du / dt.

[0037] Normalization processing: Use the min-max normalization formula , and map all features to the interval [0, 1] (F is the original feature value, and Fmax / Fmin are the maximum and minimum values of the normal range of this feature).

[0038] Construction of the fault fusion feature vector: Pre-store the dynamic weight table obtained through high-accelerated life test and simulation verification (such as the weight of current / temperature increases when heavy-load uphill) in the FPGA coefficient memory, and execute in parallel through the DSP operation block (w is the dynamic weight, and f is the normalized feature value) to generate the fault fusion feature vector value.

[0039] Fault identification and classification: The threshold memory pre-stores the fault thresholds of level 1 (Threshold_1), level 2 (Threshold_2), and level 3 (Threshold_3). V fault ≥Threshold_1 is a level 1 fault (power transistor short-circuit, bus short-circuit), Threshold_3 ≤ V fault <Threshold_1 is a level 2 fault (overcurrent, over-temperature, sensor failure), Threshold_3 ≤ V fault <Threshold_2 is a level 3 fault (communication anomaly, parameter drift); identify the specific fault type by comparing with the fault model library (including various fault feature maps).

[0040] After a fault is detected, the system starts the corresponding redundancy switching mechanism according to the fault level, as shown in Table 1: Level 1 fault response: Immediately start full redundancy switching and block the PWM of the faulty module; Level 2 fault response: According to the system load condition, select derating operation or partial redundancy switching; Level 3 fault response: Record the fault information and issue a warning, but do not switch immediately.

[0041] Table 1: Processing strategies for different fault levels

[0042] Dual-core control module, such as Figure 2 As shown: Hardware architecture: The main control core uses a TI TMS570LS3137 ARM Cortex-R MCU (300MHz clock speed, supports floating-point operations, responsible for motor control algorithms); the safety monitoring core is implemented in the FPGA as a Nios V RISC-V soft core (150MHz clock speed, focused on fault monitoring and redundancy switching); the two cores share data through dual-port RAM (1MB capacity, 100MHz read / write speed), hardware semaphores (model 74HC74) achieve resource synchronization, and hardware watchdog timers (model MAX706) monitor each other with heartbeat signals.

[0043] Working mechanism: During normal operation, the main control core executes the vector control algorithm and sends a heartbeat signal to the safety monitoring core every 1ms. The safety monitoring core receives the strategy instructions from the fault decision and management module, generates redundancy switching control instructions, and monitors the status of the main control core. If no heartbeat signal is received within 3ms, the main core is triggered to reset and takes over the core control itself.

[0044] Power redundancy switching module, such as Figure 3 As shown: Hardware configuration: The intelligent contactor array includes main contactor K1 (powered by power module A), K2 (powered by power module B), and backup contactor K3 (for bridging lines). The initial design of this invention aimed to use a single three-phase contactor to simultaneously control the three-phase power switch. However, due to the difficulty in procuring suitable three-phase contactors, three single-phase contactors are used instead. The single-phase contactor selected is the Hongfa 600A / 750V HFE82V600 / 100024HL6. All three single-phase contactors are controlled by the same control signal, simultaneously opening or closing.

[0045] Switching process: After receiving the safety monitoring core command, the standby path capacitive load is pre-charged through the pre-charging resistor (charging time 2~5ms, the voltage reaches 90% of the bus voltage to determine completion); K3 is closed to connect the jumper line. After the FPGA confirms the standby path is conducting through the voltage sensor, K1 or K2 corresponding to the fault module is disconnected to achieve seamless "close first, then disconnect" switching; during the switching process, the IGBT drive signal of the fault module is blocked to keep it in a high impedance state.

[0046] Secure Execution Module: Hardware configuration: The STM32F103C8T6 MCU is used as the core, which communicates with the main control core through the CAN bus and connects to the instrument panel LCD display, buzzer and LED indicator (red, yellow and green correspond to the first, second and third level faults respectively).

[0047] Feedback mechanism: After receiving the main control core command, in the case of a level 1 fault, the display screen will show "Emergency fault! Stop immediately", the buzzer will sound continuously (frequency 2kHz), and the red LED will be constantly lit; in the case of a level 2 fault, the display screen will show "Repair recommended, power limit", the buzzer will sound intermittently (1Hz), and the yellow LED will be constantly lit; in the case of a level 3 fault, the display screen will show "Please check in time", the green LED will flash (2Hz), and the buzzer will not be triggered.

[0048] The distributed layout and multi-parameter acquisition of the multi-source sensing detection module, combined with time-domain, frequency-domain, and rate-of-change feature extraction and multi-factor weighted fusion, breaks through the limitations of traditional single-parameter diagnosis. It can accurately capture progressive faults and multi-factor coupled faults, avoiding false or missed judgments. The hardware comparator and FPGA parallel operation enable fast response, ensuring that sudden faults are identified in a timely manner.

[0049] The system adopts a "partial redundancy" architecture and enables power module sharing through an intelligent contactor array, eliminating the need to replicate the entire control system. Compared to a complete dual-system backup, this significantly reduces hardware costs, size, and power consumption. The "connect first, disconnect later" switching mechanism and pre-charging design achieve seamless power connection and eliminate power interruption or impact during the switching process.

[0050] A two-dimensional decision matrix enables precise matching of fault levels and vehicle status, replacing the "one-size-fits-all" approach. Level 1 faults trigger emergency braking to ensure safety, Level 2 faults reduce operating load to balance safety and continuity, and Level 3 faults provide early warning without stopping to ensure operational efficiency, effectively preventing secondary accidents caused by sudden power interruptions during driving.

[0051] Figure 4 This is a schematic flowchart illustrating a redundancy control method for an electronic control system of a new energy commercial vehicle provided by the present invention. Figure 4 The executing entity can be a redundant control system of a new energy commercial vehicle's electronic control system. Depending on different requirements, the order of steps in this flowchart can be changed, and some steps can be omitted.

[0052] like Figure 4 As shown, the method includes: S1. The motor controller is monitored in real time with distributed multi-parameter detection through the multi-source sensor detection module. The current signal, voltage signal and temperature signal of the power tube unit, DC bus and AC output terminal are collected synchronously, and the threshold is judged by the built-in hardware comparator. S2. The fault decision and management module receives data collected by the multi-source sensing detection module, extracts the time-domain features, frequency-domain features, and rate of change features of the current signal, voltage signal, and temperature signal, and normalizes the extracted features to construct a fault feature vector. S3. The fault decision and management module performs multi-factor weighted aggregation calculation on the fault feature vector according to the pre-stored weight coefficients to obtain the fault fusion feature vector value; compares the fault fusion feature vector value with the preset fault threshold to realize the fault level classification and identify the fault type. S4. Based on the classified fault levels and the current vehicle operating status, query the preset two-dimensional decision matrix to determine the corresponding adaptive processing strategy. S5, the safety monitoring core in the dual-core control module sends control commands to the power redundancy switching module according to the adaptive processing strategy, and controls the intelligent contactor array to perform a switching operation of first connecting the backup path and then disconnecting the fault path. S6, the main control core in the dual-core control module adjusts the PWM control signal according to the adaptive processing strategy, reconstructs the system output, and sends corresponding level of feedback information to the driver through the safety execution module.

[0053] To facilitate understanding of the present invention, the following describes the principle of the redundancy control method for the electronic control system of a new energy commercial vehicle, combined with the process of performing redundancy control on the electronic control system of a new energy commercial vehicle in the embodiments, such as... Figure 5 As shown, the redundancy control method for the electronic control system of new energy commercial vehicles provided by the present invention will be further described.

[0054] First, step S1 specifically includes: An open-loop Hall current sensor is configured as the main detection channel in the power transistor unit, and a sampling resistor and differential amplifier circuit are configured in parallel as redundant detection channels. A high-impedance voltage divider network and an isolation operational amplifier are configured at the DC bus terminal to realize voltage detection. Temperature monitoring is achieved by configuring a negative temperature coefficient thermistor and a digital temperature sensor together at key nodes. Different sampling frequencies are set for different parameter characteristics, with a high sampling frequency for current signals and a low sampling frequency for temperature signals. A hardware comparator circuit is built using an LM339 four-channel comparator chip to perform parallel threshold judgment on the detected parameters. When any parameter exceeds the corresponding preset threshold, a fault trigger signal is output.

[0055] Secondly, step S2 specifically includes: S21. Extract the effective value, instantaneous peak value, and DC bias time-domain characteristics from the three-phase current signal, extract the frequency domain characteristics of the 5th and 7th harmonic components through fast Fourier transform, and calculate the current change rate di / dt. S22. Extract the ripple coefficient and voltage drop amplitude from the DC bus voltage signal, and extract the fundamental RMS value and three-phase unbalance from the AC output voltage signal. S23. Extract the absolute temperature value and the temperature rise rate dT / dt from the temperature signal; S24. All extracted feature parameters are normalized using the minimum-maximum normalization formula, mapping all feature values ​​to a unified dimensionless interval, and generating a fault feature vector composed of normalized feature values.

[0056] Temporal feature extraction: Effective value calculation: The three-phase current signal (sampling frequency 100kHz) acquired by the multi-source sensing module is calculated according to the formula... The calculation is performed, where N is the number of sampling points in a single power frequency cycle (2000 points, corresponding to a 50Hz power frequency), and I_i is the current value of the i-th sampling point. The synchronous calculation of the effective values ​​of the three-phase currents A, B, and C is completed in parallel through the FPGA's built-in accumulator and square root IP core, with a calculation accuracy of ≤±0.1%.

[0057] Instantaneous peak extraction: An FPGA parallel comparator array is used to compare the three-phase current sampling values ​​in real time within each sampling period, lock and store the maximum value in each period as the instantaneous peak, and the comparison response time is ≤1ns to ensure that no peak is missed.

[0058] DC bias extraction: The three-phase current signal is filtered by a moving average filtering algorithm (with a window length of 100 sampling points) to remove AC component interference. The mean of the filtered signal is the DC bias, and the filtering delay is ≤1μs.

[0059] Frequency domain feature extraction: Fast Fourier Transform (FFT) Configuration: The FPGA's built-in radix-2 FFT IP core is called, the number of transform points is set to 1024, the sampling frequency is 100kHz, and the frequency resolution is approximately 97.66Hz; a real-sequence FFT transform is performed on the filtered three-phase current signal, and the spectrum data in the frequency range of 0~50kHz is output.

[0060] Harmonic component extraction: The frequency index is used to locate the spectral amplitudes corresponding to the 5th harmonic (250Hz) and the 7th harmonic (350Hz). An amplitude correction algorithm is used to eliminate the influence of FFT spectral leakage (the correction coefficient is experimentally calibrated to 1.02) to ensure that the accuracy of harmonic component amplitude extraction is ≤ ±0.5%.

[0061] Calculation of the rate of change of current di / dt: Using the adjacent sampling point difference algorithm, according to the formula Calculate, where I i+1 with I i T represents the current values ​​at two consecutive sampling points. s The sampling period is 10μs; the FPGA subtractor and divider IP cores are used for parallel operation, and the rate of change data is output once per sampling period, with a calculation accuracy of ≤±1A / μs.

[0062] DC bus voltage feature extraction: Ripple coefficient calculation: For the DC bus voltage sampling signal (sampling frequency 50kHz), first extract the DC component U by passing it through a first-order RC low-pass filter (cutoff frequency 100Hz). dc_avg Then calculate the maximum voltage U within a single power frequency cycle. dc_max With minimum value U dc_min According to the formula The ripple coefficient calculation, filtering, and calculation process are implemented through FPGA hardware logic.

[0063] Voltage sag extraction: Set voltage reference value U ref (Equal to the average DC bus voltage when the system is operating normally, for example, 350V), compare the current voltage sampling value U in real time. dc_current Compared with the benchmark value, according to the formula Calculate the voltage drop amplitude. When ΔU is negative, take 0, that is, only record the amplitude of the voltage drop.

[0064] AC output voltage feature extraction: Fundamental RMS value calculation: For the AC output voltage sampling signal (sampling frequency 50kHz), the fundamental component is extracted using a synchronous detection algorithm. First, the fundamental frequency (50Hz) is locked through a phase-locked loop (PLL) to generate a reference signal with the same frequency and phase as the fundamental. Then, the fundamental component is separated by a multiplier and a low-pass filter (cutoff frequency 100Hz). Finally, the fundamental RMS value is calculated according to the RMS formula, with an extraction accuracy of ≤±0.2%.

[0065] Three-phase unbalance calculation: according to the formula Calculate, where U max U min These represent the maximum and minimum effective values ​​of the fundamental voltages of phases A, B, and C, respectively. avg The average value of the fundamental effective value of the three-phase voltage is calculated in parallel using FPGA adder, comparator and divider IP cores.

[0066] Temperature signal feature extraction: Absolute temperature value extraction: Temperature data (sampling frequency 10Hz) collected by the NTC thermistor and the MTS4 digital temperature sensor are fused and processed using a weighted average algorithm. T NTC T represents the thermistor detection value. MTS4 The values ​​are detected by a digital temperature sensor, and the weighting coefficients are determined experimentally (digital sensors have higher accuracy and are therefore assigned higher weights). The accuracy of the fused absolute temperature value is ≤ ±0.1℃.

[0067] Calculation of temperature rise rate dT / dt: according to the formula Calculate, where Tk T represents the absolute temperature value for the current sampling period. k-1 The absolute temperature value of the previous sampling period is given by Δt, which is the sampling period (0.1s). The calculation is performed by FPGA subtractors and dividers, and the temperature rise rate is output in real time with a calculation accuracy of <±0.1℃ / s.

[0068] Fault feature vector generation: The 12 normalized feature values ​​are arranged in a fixed order (current RMS value → instantaneous peak value → DC bias → 5th harmonic amplitude → 7th harmonic amplitude → di / dt → ripple coefficient → voltage drop amplitude → fundamental RMS value → three-phase unbalance → absolute temperature value → dT / dt) to form a 1×12-dimensional fault feature vector, which is stored in the FPGA's built-in FIFO cache (depth 1024, width 12×32bit) for subsequent multi-factor weighted aggregation calculations.

[0069] Further improvements to this technical solution include step S3, which specifically includes: S31, The fault decision-making and management module follows the formula Calculate the fault fusion feature vector value, where w i f is the dynamic weight of the i-th feature parameter. i Let be the normalized eigenvalue of the i-th feature parameter; S32. Compare the calculated fault fusion feature vector value with the preset fault threshold, and identify the fault type according to the degree to which the threshold is exceeded.

[0070] A coefficient memory is built inside the FPGA in the fault decision and management module to store a set of weighted coefficients obtained in advance through high-acceleration life testing, stress testing, and simulated fault injection. The set of weighted coefficients is dynamically adjusted according to the current vehicle operating state, with the weighted coefficients for current and temperature characteristics increasing accordingly when the vehicle is under heavy load and going uphill. The DSP computing block of the FPGA in the fault decision and management module is used to perform multi-channel multiplication and accumulation operations in parallel, according to the formula... Calculate the fault fusion feature vector value.

[0071] Furthermore, step S32 specifically includes: The lower limit of the primary fault threshold, the lower limit of the secondary fault threshold, and the upper limit of the tertiary fault threshold are pre-stored in the lookup table of the fault decision and management module; when the value of the fault fusion feature vector exceeds the lower limit of the primary fault threshold, it is determined as a primary fault, and the primary faults include the through-fault of the power transistor and the short-circuit fault of the DC bus; when the value of the fault fusion feature vector is between the lower limit of the primary fault threshold and the lower limit of the secondary fault threshold, it is determined as a secondary fault, and the secondary faults include overcurrent, over-temperature, and sensor failure faults; when the value of the fault fusion feature vector is between the lower limit of the secondary fault threshold and the upper limit of the tertiary fault threshold, it is determined as a tertiary fault, and the tertiary faults include communication anomalies and parameter drift faults.

[0072] The fault decision and management module constructs a threshold memory inside the FPGA and pre-stores three key threshold parameters determined through laboratory high-accelerated life tests, stress tests, and simulation modeling: the lower limit of the primary fault threshold (Threshold_1), the lower limit of the secondary fault threshold (Threshold_2), and the upper limit of the tertiary fault threshold (Threshold_3). During the real-time diagnosis process, the calculated value of the fault fusion feature vector V_fault is compared level by level with the said thresholds: The first-level comparison - fault level determination: When V_fault ≥ Threshold_1, it is determined as a primary fault (emergency fault); when Threshold_2 ≤ V_fault < Threshold_1, it is determined as a secondary fault (important fault); when Threshold_3 ≤ V_fault < Threshold_2, it is determined as a tertiary fault (general fault).

[0073] The second-level comparison - specific fault type identification: After determining the fault level, the fault decision and management module performs similarity matching between the real-time V_fault and each fault sub-pattern within this level in the pre-stored fault model library. The fault model library contains fusion feature maps of different fault types, and each typical fault corresponds to a standard fault fusion feature vector template. The system identifies the specific fault type by calculating the Euclidean distance or cosine similarity between the real-time feature vector and each template. For example: Primary fault type identification: When V_fault exceeds Threshold_1 and the Vce_sat (IGBT saturation voltage drop) in the feature components of V_fault is close to 1, the temperature change rate dT / dt increases abnormally, and the current change rate di / dt exceeds the limit, it is determined as a through-fault of the power transistor; when V_fault exceeds Threshold_1 and the DC bus voltage drop amplitude is close to 1 and the ripple coefficient changes suddenly, it is determined as a short-circuit fault of the DC bus.

[0074] Secondary fault type identification: When V_fault is between Threshold_2 and Threshold_1 and the effective current RMS value is consistently higher than 0.8 and the absolute temperature value exceeds 0.7, it is determined to be an overcurrent or overtemperature fault; when V_fault is in this range and the waveform of a certain phase current is distorted and the harmonic components are abnormal but the temperature is normal, it is determined to be a sensor failure fault.

[0075] Level 3 fault type identification: When V_fault is between Threshold_3 and Threshold_2 and the communication status characteristic value is close to 1 and the parameter drift characteristic value increases slowly, it is determined to be a communication abnormality or parameter drift fault.

[0076] Third-level comparison—Quantification of fault severity: For level 2 faults, the severity factor Severity_factor is obtained by quantifying the "degree exceeding the threshold" using the following formula: ; in, These are the fault fusion feature vector values; This is the lower limit of the level 2 fault threshold; This represents the lower limit of the Level 1 fault threshold. The value of Severity_factor ranges from [0, 0.5]. A larger value indicates that V_fault is closer to the Level 1 fault threshold, and the severity of the fault is higher, thus determining the depreciation rate. For example, when Severity_factor = 0.1, the depreciation rate is relatively small; when Severity_factor = 0.4, the depreciation rate is relatively large, approaching the Level 1 fault handling strategy.

[0077] Adaptive processing strategy determination: Construct a two-dimensional decision matrix of "fault level - vehicle state" (vehicle state includes high-speed driving, low-speed driving, brake energy recovery, parking and charging, and idling), output the corresponding processing strategy based on the matrix query results, and calculate the derating power and torque limit values ​​when the vehicle is in a level 2 fault driving state.

[0078] The core of the adaptive strategy is to no longer adopt a "one-size-fits-all" approach for the same fault level, but instead introduce "vehicle operating status" as a second decision dimension to form a two-dimensional decision matrix, thereby outputting the safest and most reasonable control command. The adaptive processing strategy module is shown in Table 2.

[0079] Table 2: Adaptive Processing Strategies

[0080] Fault model library construction and dynamic updates: The fault model library is built and continuously updated in the following three ways: Laboratory modeling: High-acceleration life test and stress test were performed on the motor controller prototype to induce known faults such as rotor bar breakage, IGBT aging, and capacitor failure. The corresponding multi-source sensor data sequences were recorded to build an initial fault feature library.

[0081] Simulation modeling: Establish a high-precision physical simulation model of the motor controller, inject fault parameters (such as increased IGBT on-resistance and sensor gain drift) into the simulation environment, simulate and obtain standard fault fusion feature vectors under various faults, and expand the fault model library.

[0082] Machine learning modeling: A large amount of normal operating status data of motor controllers is collected, and a normal operating baseline model is established through unsupervised learning algorithms (such as Isolation Forest); simultaneously, based on known fault data, a fault classifier is trained through supervised learning algorithms (such as Support Vector Machine). The fault decision and management module achieves accurate identification and classification of fault types by calculating the deviation between real-time feature vectors and the baseline model, or by using the classifier for pattern recognition.

[0083] Through the above three-level comparison mechanism, the system not only achieves rapid classification of fault levels, but also accurately identifies specific fault types such as power tube shoot-through, DC bus short circuit, overcurrent, overtemperature, sensor failure, communication anomaly, and parameter drift based on the specific degree and characteristic distribution pattern of V_fault exceeding the threshold, providing accurate decision-making basis for subsequent adaptive processing strategies.

[0084] Next, step S4 specifically includes: S41. The fault decision and management module constructs a two-dimensional decision matrix inside the FPGA with fault level as the first dimension and vehicle operating state as the second dimension. Each cell of the matrix stores the strategy mode word, vehicle state coefficient K_state, PWM lockout enable bit and mechanical braking request bit. Among them, the vehicle operating state includes high-speed driving, low-speed driving, brake energy recovery, parking charging and idling. S42. When the fault fusion feature vector value exceeds the lower limit of the first-level fault threshold, the fault decision and management module outputs the strategy mode word 0x01. After reading the strategy mode word, the safety monitoring core sets the PWM blocking enable bit to 1 and the mechanical braking request bit to 1, and sends an emergency braking request frame to the vehicle CAN bus. S43. When the fault fusion feature vector value is between the lower limits of the first and second level fault thresholds and the vehicle is operating at high or low speed, the fault decision and management module outputs the strategy mode word 0x02 and calculates the maximum allowable output power after derating. ), and calculate the torque limit value. The P_derated and T_limit parameters are written to the strategy parameter register; where P_max is the maximum rated power of the motor controller under normal fault-free conditions; Severity_factor is the fault severity factor obtained by mapping the fault fusion feature vector value, ranging from 0 to 0.5; K_state is the vehicle state coefficient, with a value of 0.6 for high-speed driving and 0.8 for low-speed driving; T_driver_req is the driver-requested torque; and N_motor is the current motor speed. S44. When the fault fusion feature vector value is between the lower limit of the first-level and second-level fault thresholds and the vehicle operating state is brake energy recovery, the fault decision and management module outputs strategy mode word 0x03, sets the mechanical brake request bit to 1, and forces the vehicle state coefficient K_state to 0 to limit the subsequent drive power. S45. When the fault fusion feature vector value is between the lower limits of the first-level and second-level fault thresholds and the vehicle is in a parking charging or idling state, the fault decision and management module outputs the strategy mode word 0x03 and sets the PWM blocking enable bit to 1. S46. When the fault fusion feature vector value is between the upper limit of the level 2 and level 3 fault thresholds, the fault decision and management module outputs strategy mode word 0x04, sets the PWM blocking enable bit to 0, the mechanical braking request bit to 0, and maintains the current power output.

[0085] In addition, step S5 specifically includes: S51. The safety monitoring core receives the strategy mode word output in step S4. If it is 0x01 or 0x02, it sends a contactor pre-charging command to the power redundancy switching module. The pre-charging resistor charges the capacitive load of the backup path. After charging is completed, the bridging contactor K3 is closed within a preset time. After confirming that the feedback status bit of K3 is 1, the contactor K1 or K2 corresponding to the faulty power module is disconnected, completing the redundancy switching of closing first and then disconnecting. After the redundancy switching is completed, the contactor switching completion flag bit is stored in the execution status word of the safety monitoring core. S52. The safety monitoring core receives the PWM blocking enable bit output in step S4. If the bit is 1, it sends a continuous low level directly to the enable terminal of the IGBT drive optocoupler through the FPGA internal hard-wired logic to block all PWM drive signals of the faulty power module, forcing its output terminal to a high impedance state, and storing the corresponding PWM hard blocking valid flag bit in the execution status word. S53. The safety monitoring core receives the mechanical braking request bit output in step S4. If the bit is 1, it sends a message with a braking deceleration request value of 0.8g to the electromechanical braking system EMB via the CAN bus to activate the mechanical braking.

[0086] Finally, the method by which the main control core adjusts the PWM control signal and sends feedback information according to the adaptive processing strategy in step S6 includes: S61. The main control core reads the strategy mode word, the maximum allowed output power P_derated after derating, and the torque limit value T_limit from the strategy parameter register written in step S4 through the dual-port RAM inside the dual-core control module, and reads the contactor switching completion flag and the PWM hard block effective flag from the execution status word written after step S5. S62. The main control core parses the strategy mode word. If the strategy mode word is 0x02 and the PWM hard block effective flag is 0, then the duty cycle value of the PWM waveform comparison register is recalculated according to the current motor speed and torque limit value T_limit. The calculated duty cycle value is limited within the voltage vector amplitude range corresponding to T_limit. The register configuration of the PWM generation module is updated to reconstruct the system output. S63. The main control core generates a driver feedback information frame based on the strategy mode word. If the strategy mode word is 0x01, it sends an emergency warning frame containing an emergency stop icon and a maximum volume buzzer command to the safety execution module. If the strategy mode word is 0x02, it sends a general warning frame containing a depreciation percentage and a maintenance reminder icon. If the strategy mode word is 0x03 or 0x04, it sends a low-priority information frame containing only text prompts. After receiving the information frame, the safety execution module drives the instrument panel display and triggers the corresponding audible and visual alarms.

[0087] In this embodiment, the fault decision-making and management module constructs a two-dimensional decision matrix within the FPGA using programmable logic resources. Its physical implementation utilizes a dual-port RAM block (M20K) for storage. This RAM has a depth of 15 address units (3 fault levels × 5 vehicle states), with each address unit having a width of 64 bits. The mapping relationship is as follows: Address [3:0]: The addressing signal is composed of the fault level code (2 bits) and the vehicle status code (3 bits); Fault level codes: 00b = Level 3 fault, 01b = Level 2 fault, 10b = Level 1 fault; Vehicle status codes: 000b = high speed driving, 001b = low speed driving, 010b = regenerative braking, 011b = parking and charging, 100b = idling. Data bits [63:48]: 16-bit policy mode word (0x01-0x04); Data bits [47:32]: 16-bit vehicle state coefficient K_state (Q8 fixed-point format); Data bits [31:16]: 1 bit PWM lockout enable bit (bit31) + 15 bits reserved; Data bits [15:0]: 1 mechanical brake request bit (bit15) + 15 reserved bits; The coded signals of fault level and vehicle status are generated by the fault decision logic state machine after receiving sensor data. This state machine adopts a three-stage Mealy state machine design, and the state transition conditions are determined by the comparison result of the fault fusion feature vector value V_fault and the preset threshold Threshold_1 / Threshold_2.

[0088] The computational units for P_derated and T_limit are implemented as follows: Under the S43 branch, the FPGA calls the DSP hard core module (such as the 18×18 multiplier of an Intel FPGA) for parallel computation. The computation process is divided into a three-stage pipeline: Level 1: Input V_fault, Threshold_1, and Threshold_2 into the Severity_factor calculation unit, use a fixed-point divider (Radix-2 algorithm) to perform formula calculations, and cache the results in the Severity_factor register; Second stage: Input P_max (loaded from external EEPROM), K_state, and Severity_factor into the multiplication and accumulation unit, calculate P_derated, and write the result to the policy parameter register address 0x2004-0x2007; Level 3: Input P_derated, motor speed N_motor (captured via QEP interface), and T_driver_req (received via CAN bus) to the T_limit calculation unit, call the square root and division IP core to perform formula calculation, and write the result to the strategy parameter register address 0x2008-0x200B; Dual-port RAM address isolation mechanism: The policy parameter register and the execution status word are mapped to different RAM blocks respectively. Policy Parameter Register: Base address 0x2000, only allowed to be written by the Fault Decision and Management Module, and read by the Security Monitoring Core and the Main Control Core. Execution status word: base address 0x3000, only security monitoring core (write) and main control core (read) are allowed; This isolation design ensures unidirectional data flow between the decision-making and execution layers, preventing execution status feedback from being mistakenly overwritten as strategy parameters.

[0089] The security monitoring core is implemented based on the Nios V RISC-V soft core, and its firmware adopts a bare-metal architecture without an operating system, with a main loop cycle of 100μs.

[0090] Hardware implementation of S51 contactor switching timing: The safety monitoring core sends an SPI command sequence to the contactor driver chip (e.g., TIDRV8353), which contains three key control words: Precharge control word: 0x80 + precharge time value (in ms), activates the precharge MOSFET; K3 closing control word: 0x40 + contactor pull-in holding current value (unit: 0.1A), driving K3 coil; K1 / K2 disconnect control word: 0x20 + delay disconnect time value (unit μs), configures the close-then-disconnect delay; Timing monitoring: After the safety monitoring core sends the K3 closing command, it starts the hardware watchdog timer (period 5ms). If the "closing confirmation" signal (high level) fed back by the K3 auxiliary contact is not read within 5ms, the switching is determined to be a failure, the safety state machine is immediately triggered, all contactor drive signals are pulled low and a serious fault is reported.

[0091] In the S52 PWM hard-blocking circuit: When the PWM block enable bit is 1, the safety monitoring core does not control via software GPIO, but instead configures the FPGA's internal hardware logic gates (AND gate array). One end of this AND gate array is connected to the PWM waveform output by the main control core, and the other end is connected to the block enable signal. When the enable signal is 0, the AND gate output is always 0, directly blocking the input of the IGBT driving optocoupler. This hard-wired logic response time is ≤50ns and is unaffected by software interrupt delays.

[0092] In S53, CAN message transmission: The safety monitoring core sends a braking request message through the CAN-FD controller IP core integrated in the FPGA. The message ID is 0x18F00503 (SAE J1939 format). The 0th byte of the data field is filled with the braking deceleration value (0xC8=0.8g). After the transmission is completed, the transmission completion flag bit of the CAN controller status register is queried. After the flag bit is set, the mechanical braking request transmission confirmation bit is written into the execution status word.

[0093] The main control core uses the TI TMS570LS3137 MCU, whose ePWM module supports independent compare registers (CMPA / CMPB) and dead time control.

[0094] S61 data read mechanism: After the main control core detects the policy update interrupt signal of the dual-port RAM (triggered by the security monitoring core via GPIO), it immediately reads the policy parameters at addresses 0x2000-0x200B and the execution status words at addresses 0x3000-0x3003 in batches via the SPI bus (speed 10MHz). The read process uses DMA transfer to avoid CPU intervention delay.

[0095] S62 PWM Reconfiguration Logic: After the SVPWM voltage vector calculation is completed, the motor control algorithm (FOC) inside the main control core compares the calculated duty cycle value with the T_limit value for limiting. If the output torque corresponding to the duty cycle exceeds T_limit, the dq axis current command is scaled proportionally, and the duty cycle is recalculated to ensure that the output torque is precisely limited to below 850 N·m (example value). This limiting operation is performed once per PWM carrier cycle (50 μs).

[0096] S63 Information Frame Format Definition: The main control core generates a UDS diagnostic service frame based on the policy mode word. Mode word 0x01: Service ID=0x54 (critical warning), data field contains DTC fault code (4 bytes), emergency stop icon ID (0xFF01), buzzer frequency (4000Hz); Mode word 0x02: Service ID=0x55 (general warning), data field contains derating percentage (e.g., 60%), maintenance reminder icon ID (0xFF02); Mode word 0x03 / 0x04: Service ID=0x56 (prompt message), data field contains only the text string "Please check the motor system"; After receiving the above frame, the safety execution module (dashboard) drives the TFT screen to display icons through the LVDS interface and drives the speaker through the Class-D audio amplifier.

[0097] Specifically, the connection method of the intelligent contactor array and the bidirectional diode isolation circuit. Normal state: K1 and K2 are closed, K3 is open. Power module A drives motor A, and power module B drives motor B.

[0098] Fault status (e.g., power module A fault): Isolation: The safety monitoring core first blocks all IGBT drive signals of power module A, making its output present a high impedance state, thus achieving hardware isolation.

[0099] First, close: Then, close K3.

[0100] Finally, disconnect K1 to completely isolate the faulty part from the physical circuit.

[0101] Result: The healthy power module B supplies power to both motor A and motor B simultaneously through K3, and the system enters derating operation mode.

[0102] Although the present invention has been described in detail with reference to the accompanying drawings and preferred embodiments, the present invention is not limited thereto. Various equivalent modifications or substitutions can be made to the embodiments of the present invention by those skilled in the art without departing from the spirit and essence of the invention, and such modifications or substitutions should all be within the scope of the present invention. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should also be covered within the protection scope of the present invention.

Claims

1. A redundant control system for a new energy commercial vehicle electric control system, characterized in that, The method comprises the following steps: A multi-source sensing detection module is used for distributed multi-parameter real-time monitoring of the motor controller, synchronous acquisition of current signals, voltage signals and temperature signals of power tube units, DC bus and AC output terminals, and threshold judgment by a built-in hardware comparator; A fault decision and management module is connected with the multi-source sensing detection module, used for receiving data collected by the multi-source sensing detection module, extracting time domain features, frequency domain features and change rate features of the current signals, voltage signals and temperature signals, normalizing the extracted features to construct a fault feature vector, performing multi-factor weighted aggregation calculation on the fault feature vector according to a pre-stored weight coefficient to obtain a fault fusion feature vector value, comparing the value with a pre-set fault threshold to identify a fault type, and performing fault level division according to the fault fusion feature vector value; According to the divided fault level and the current vehicle operating state, a pre-set two-dimensional decision matrix is queried to determine a corresponding adaptive processing strategy; A dual-core control module includes a main control core and a safety monitoring core, the safety monitoring core is connected with the fault decision and management module, used for generating a control instruction according to the adaptive processing strategy, and the main control core is used for adjusting a PWM control signal according to the adaptive processing strategy to reconstruct system output; A power redundancy switching module is connected with the safety monitoring core of the dual-core control module, including an intelligent contactor array, used for receiving the control instruction and performing a switching operation of first connecting a backup path and then disconnecting a fault path; A safety execution module is connected with the main control core, used for sending feedback information of a corresponding level to a driver.

2. A redundancy control method of a new energy commercial vehicle electric control system, characterized in that, The method comprises the following steps: S1, a multi-source sensing detection module is used for distributed multi-parameter real-time monitoring of the motor controller, synchronous acquisition of current signals, voltage signals and temperature signals of power tube units, DC bus and AC output terminals, and threshold judgment by a built-in hardware comparator; S2, a fault decision and management module receives data collected by the multi-source sensing detection module, extracts time domain features, frequency domain features and change rate features of the current signals, voltage signals and temperature signals, and normalizes the extracted features to construct a fault feature vector; S3, the fault decision and management module performs multi-factor weighted aggregation calculation on the fault feature vector according to a pre-stored weight coefficient to obtain a fault fusion feature vector value; compares the fault fusion feature vector value with a pre-set fault threshold to realize fault level division and identify a fault type; S4, according to the divided fault level and the current vehicle operating state, a pre-set two-dimensional decision matrix is queried to determine a corresponding adaptive processing strategy; S5, a safety monitoring core in a dual-core control module sends a control instruction to a power redundancy switching module according to the adaptive processing strategy, controls an intelligent contactor array to perform a switching operation of first connecting a backup path and then disconnecting a fault path; S6, a main control core in the dual-core control module adjusts a PWM control signal according to the adaptive processing strategy to reconstruct system output, and simultaneously sends feedback information of a corresponding level to a driver through a safety execution module.

3. The redundancy control method of the new energy commercial vehicle electric control system according to claim 2, characterized in that, Step S1 specifically comprises: The open-loop Hall current sensor is configured as a main detection channel in the power tube unit; a high-resistance voltage dividing network and an isolation operational amplifier are configured at the DC bus and the AC output end to realize voltage detection; a negative temperature coefficient thermistor and a digital temperature sensor are configured to realize temperature monitoring; different sampling frequencies are set for different parameter characteristics, in which a high sampling frequency is used for the current signal and a low sampling frequency is used for the temperature signal; and the detected parameters are subjected to parallel threshold value judgment through an LM339 four-channel comparator chip, and a fault triggering signal is output when any parameter exceeds the corresponding preset threshold value.

4. The redundancy control method of the new energy commercial vehicle electric control system according to claim 2, characterized in that, Step S2 specifically comprises: S21, extracting the time domain features of the effective value, instantaneous peak value and DC bias from the three-phase current signal, extracting the frequency domain features of the 5th and 7th harmonic components through fast Fourier transform, and calculating the current change rate di / dt; S22, extracting the ripple coefficient and voltage drop amplitude from the DC bus voltage signal, and extracting the fundamental effective value and three-phase unbalance degree from the AC output voltage signal; S23, extracting the absolute temperature value and temperature rise rate dT / dt from the temperature signal; S24, normalizing all the extracted characteristic parameters by using the minimum-maximum normalization formula to map all the characteristic values to a unified dimensionless interval, and generating a fault feature vector composed of normalized characteristic values.

5. The redundancy control method of the new energy commercial vehicle electric control system according to claim 2, characterized in that, Step S3 specifically comprises: S31, the fault decision and management module calculates the fault fusion feature vector value according to the formula , wherein W i is the dynamic weight of the i th feature parameter, f i is the normalized feature value of the i th feature parameter; S32, comparing the calculated fault fusion feature vector value with the preset fault threshold value, and identifying the fault type according to the degree of exceeding the threshold value.

6. The redundancy control method of the new energy commercial vehicle electric control system according to claim 5, characterized in that, Step S32 specifically comprises: The lower limit of the first-level fault threshold value, the lower limit of the second-level fault threshold value and the upper limit of the third-level fault threshold value are stored in the lookup table of the fault decision and management module in advance; when the fault fusion feature vector value exceeds the lower limit of the first-level fault threshold value, it is determined as a first-level fault, and the first-level fault includes a power tube straight-through fault and a DC bus short circuit fault; when the fault fusion feature vector value is between the lower limit of the first-level fault threshold value and the lower limit of the second-level fault threshold value, it is determined as a second-level fault, and the second-level fault includes an overcurrent, overtemperature and sensor failure fault; when the fault fusion feature vector value is between the lower limit of the second-level fault threshold value and the upper limit of the third-level fault threshold value, it is determined as a third-level fault, and the third-level fault includes a communication abnormality and a parameter drift fault.

7. The redundancy control method of the new energy commercial vehicle electric control system according to claim 6, characterized in that, Step S4 specifically comprises: S41, the fault decision and management module constructs a two-dimensional decision matrix with the fault level as the first dimension and the vehicle running state as the second dimension in the FPGA, and each unit of the matrix stores a strategy mode word, a vehicle state coefficient K_state, a PWM lockout enable bit and a mechanical braking request bit; wherein the vehicle running state includes high-speed driving, low-speed driving, braking energy recovery, parking charging and idling; S42, when the fault fusion feature vector value exceeds the lower limit of the first-level fault threshold value, the fault decision and management module outputs the strategy mode word 0x01, the safety monitoring core reads the strategy mode word and sets the PWM lockout enable bit to 1 and the mechanical braking request bit to 1, and sends an emergency braking request frame to the vehicle CAN bus. S43, when the fault fusion feature vector value is between the first and second fault threshold lower limit and the vehicle operating state is high-speed or low-speed driving, the fault decision and management module outputs the strategy mode word 0x02, calculates the maximum output power allowed after derating P_derated=P_max×K_state×(1-Severity_factor), and calculates the torque limit value T_limit=min(T_driver_req, (P_derated×9550) / N_motor), and writes P_derated and T_limit into the strategy parameter register; wherein P_max is the maximum power rating of the motor controller in the normal fault-free state; Severity_factor is the fault severity factor obtained by mapping according to the fault fusion feature vector value; T_driver_req is the driver request torque; N_motor is the current speed of the motor; S44, when the fault fusion feature vector value is between the first and second fault threshold lower limit and the vehicle operating state is brake energy recovery, the fault decision and management module outputs the strategy mode word 0x03, sets the mechanical brake request bit to 1, and forcibly sets the vehicle state coefficient K_state to 0 to limit the subsequent drive power; S45, when the fault fusion feature vector value is between the first and second fault threshold lower limit and the vehicle operating state is parking charging or idling, the fault decision and management module outputs the strategy mode word 0x03, and sets the PWM lockout enable bit to 1; S46, when the fault fusion feature vector value is between the second and third fault threshold upper limit, the fault decision and management module outputs the strategy mode word 0x04, sets the PWM lockout enable bit to 0, the mechanical brake request bit to 0, and maintains the current power output.

8. The redundancy control method of the new energy commercial vehicle electric control system according to claim 7, characterized in that, The calculation formula of the fault severity factor Severity_factor is: ； wherein, is a fault fusion feature vector value; is a secondary fault threshold lower limit; is a primary fault threshold lower limit.

9. The redundancy control method of the new energy commercial vehicle electric control system according to claim 7, characterized in that, Step S5 specifically includes: S51, the safety monitoring core receives the strategy mode word output by step S4, if it is 0x01 or 0x02, sends a contactor pre-charge instruction to the power redundancy switching module, charges the capacitive load of the standby path through the pre-charge resistor, closes the cross contactor K3 within a preset time after charging is completed, opens the contactor K1 or K2 corresponding to the fault power module after confirming that the K3 feedback state bit is 1, completes the redundancy switching of closing first and then breaking; and stores the contactor switching completion flag bit to the execution state word of the safety monitoring core after the redundancy switching is completed; S52, the safety monitoring core receives the PWM lockout enable bit output by step S4, if the bit is 1, locks all PWM drive signals of the fault power module, forces the output end to be in a high resistance state, and stores the corresponding PWM hard lock effective flag bit to the execution state word; S53, the safety monitoring core receives the mechanical brake request bit output by step S4, if the bit is 1, sends a message with the maximum deceleration value of the brake deceleration request value to the electronic mechanical brake system EMB through the CAN bus, and activates the mechanical brake.

10. The redundancy control method of the new energy commercial vehicle electric control system according to claim 9, characterized in that, The method for adjusting the PWM control signal and sending feedback information by the main control core in step S6 comprises: S61, the main control core reads the strategy mode word, the maximum output power allowed after derating P_derated and the torque limit value T_limit in the strategy parameter register written in step S4 through the dual-port RAM inside the dual-core control module, and reads the contactor switching completion flag and the PWM hard lock effective flag in the execution state word written after the execution in step S5; S62, the main control core analyzes the strategy mode word, and if the strategy mode word is 0x02 and the PWM hard lock effective flag is 0, the duty cycle value of the PWM waveform comparison register is recalculated according to the current motor speed and the torque limit value T_limit, the amplitude of the calculated duty cycle value is limited in the voltage vector amplitude range corresponding to T_limit, and the register configuration of the PWM generation module is updated to reconstruct the system output; S63, the main control core generates a driver feedback information frame according to the strategy mode word, if the strategy mode word is 0x01, an emergency warning frame containing an emergency stop icon and a maximum volume buzzer instruction is sent to the safety execution module, if the strategy mode word is 0x02, a general warning frame containing a derating percentage and a maintenance reminder icon is sent, if the strategy mode word is 0x03 or 0x04, a low-priority information frame containing only a text prompt is sent, and the safety execution module drives the instrument panel to display and trigger the corresponding sound and light alarm after receiving the information frame.

Images