Vehicle electric drive system protection control method and device, electronic equipment and storage medium

Abstract

This invention relates to the field of vehicle technology and discloses a protection and control method, device, electronic device, and storage medium for a vehicle electric drive system. The method includes: monitoring the motor speed and power module chip temperature of the vehicle electric drive system in real time; based on the motor speed and power module chip temperature, determining and executing protection and control actions for the vehicle electric drive system according to preset protection and control logic (the protection and control actions include at least executing a short-term fully open circuit, thereby controlling the bridge arm to perform an active short circuit, executing a short-term fully open circuit, thereby using a fault-free bridge arm to perform an active short circuit, and stopping power output and executing a fully open circuit); and executing vehicle speed limiting operations, at least after the vehicle drops to a preset speed threshold, controlling the inverter to perform a discharge function to a preset safe high voltage level. This invention, through at least a multi-layered protection and control mechanism, can effectively protect personal and system safety even if a system failure occurs.

Description

Technical Field

[0001] This invention relates to the field of vehicle technology, and in particular to a protection and control method, device, electronic device, and storage medium for a vehicle electric drive system. Background Technology

[0002] As the core power source of the entire vehicle, the stable and reliable operation of the electric drive system in new energy vehicles is directly related to the vehicle's power output and driving safety.

[0003] The existing technology has at least the following problems:

[0004] 1. Risk of Software Control Failure under Extreme Faults: In the event of a severe hardware failure (such as IGBT shoot-through / short circuit) while the motor is rotating at high speed, the motor can become a back electromotive force source, generating uncontrolled high voltage. In this situation, the damaged IGBT cannot be turned off, leading to a near-complete failure of the software control logic, and the system cannot interrupt the fault using normal software algorithms. The risk is the potential formation of a "semi-controlled rectifier bridge" circuit, generating enormous braking torque, causing wheel lock-up and vehicle loss of control; simultaneously, the massive fault current will rapidly accumulate heat, burning out power devices and even motor windings, leading to serious safety accidents.

[0005] 2. Control blind spot after low-voltage power supply failure: When the vehicle's low-voltage (12V / 24V) power supply fails, the motor controller's control software and the low-voltage power supply system will not work properly, resulting in the protection mechanism not being activated and the system entering an "out-of-control" state. Summary of the Invention

[0006] The purpose of this invention is to provide a protection and control method, device, electronic device and storage medium for a vehicle electric drive system, which can effectively protect personal and system safety even if the system fails, through at least a multi-layer protection and control mechanism.

[0007] To address the aforementioned technical problems, in a first aspect, the present invention provides a protection and control method for a vehicle electric drive system, comprising at least:

[0008] At least monitor the motor speed and power module chip temperature of the vehicle's electric drive system in real time;

[0009] Based on the motor speed and power module chip temperature, the protection control action of the vehicle electric drive system is determined and executed according to the preset protection control logic; the protection control action includes at least executing a short-term fully open circuit, thereby controlling the bridge arm to perform an active short circuit, executing the short-term fully open circuit, thereby using the fault-free bridge arm to perform an active short circuit, and stopping power output and executing a fully open circuit;

[0010] The vehicle speed limit operation is executed, and at least after the vehicle speed drops to the preset speed threshold, the inverter is controlled to perform the discharge function to the preset safe high voltage level.

[0011] In the above vehicle electric drive system protection and control process, at least the three-phase current and DC current of the system are monitored, and then the three-phase excitation fuse is opened at least when the three-phase current is greater than the first current threshold, so as to at least disconnect the inverter from the motor at the physical level, and the DC excitation fuse is opened at least when the DC current is greater than the second current threshold, so as to at least disconnect the inverter from the power battery at the physical level.

[0012] Optionally, the step of determining and executing the protection control action of the vehicle electric drive system based on the motor speed and power module chip temperature according to preset protection logic specifically includes:

[0013] In response to a system fault report, the fault state of the system is determined based on the motor speed;

[0014] When the system is in the first fault state, it performs a short-term fully open circuit, thereby controlling the active short circuit of the bridge arm.

[0015] Optionally, after determining the system fault state based on the motor speed in response to a system fault report, the method further includes:

[0016] When the system is in the second fault state, it is determined whether the system fault report is a short circuit fault;

[0017] When the system fault is reported as a short circuit fault, power output is stopped and the system is fully open.

[0018] Optionally, after determining whether the system fault report is a short-circuit fault when the system is in a second fault state, the method further includes:

[0019] When the system fault report is not the short-circuit fault, the short-time fully open circuit is executed, and then the fault-free bridge arm is used to perform an active short circuit.

[0020] Optionally, the step of determining and executing the protection control action of the vehicle electric drive system based on the motor speed and power module chip temperature according to preset protection logic further includes:

[0021] The junction temperature of the power device is determined based on the temperature of the power module chip.

[0022] When the junction temperature of the power device meets the preset temperature condition, an over-temperature fault is reported, and power output is stopped and the device is fully open.

[0023] Based on the same concept, in a second aspect, the present invention also provides a vehicle electric drive system protection control device for performing the vehicle electric drive system protection control method described in any one of the first aspects;

[0024] The vehicle electric drive system protection and control device includes at least:

[0025] A real-time monitoring module is used to monitor, at least in real time, the motor speed and power module chip temperature of the vehicle's electric drive system.

[0026] The protection control module is used to determine and execute the protection control actions of the vehicle electric drive system based on the motor speed and power module chip temperature according to the preset protection control logic. The protection control actions include at least executing a short-term fully open circuit and then controlling the bridge arm to perform an active short circuit, executing the short-term fully open circuit and then using the fault-free bridge arm to perform an active short circuit, and stopping power output and executing a fully open circuit.

[0027] The speed-limiting discharge module is used to perform vehicle speed-limiting operations. At least after the vehicle speed drops to a preset threshold, it controls the inverter to perform the discharge function to a preset safe high voltage level.

[0028] In the above vehicle electric drive system protection and control process, at least the three-phase current and DC current of the system are monitored, and then the three-phase excitation fuse is opened at least when the three-phase current is greater than the first current threshold, so as to at least disconnect the inverter from the motor at the physical level, and the DC excitation fuse is opened at least when the DC current is greater than the second current threshold, so as to at least disconnect the inverter from the power battery at the physical level.

[0029] Optionally, the protection control module is specifically used for:

[0030] In response to a system fault report, the fault state of the system is determined based on the motor speed;

[0031] When the system is in the first fault state, it performs a short-term fully open circuit, thereby controlling the active short circuit of the bridge arm.

[0032] Optionally, the protection control module is further configured to:

[0033] When the system is in the second fault state, it is determined whether the system fault report is a short circuit fault;

[0034] When the system fault is reported as a short circuit fault, power output is stopped and the system is fully open.

[0035] Based on the same concept, in a third aspect, the present invention also provides an electronic device, including a memory and a processor, the memory storing a computer program executable on the processor, wherein the processor, when executing the program, implements the steps of the vehicle electric drive system protection control method according to any one of the first aspects.

[0036] Based on the same concept, in a fourth aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the vehicle electric drive system protection control method according to any one of the first aspects.

[0037] The technical solution provided by this invention firstly monitors the motor speed and power module chip temperature of the vehicle electric drive system in real time. Further, based on the motor speed and power module chip temperature, it determines and executes protection control actions for the vehicle electric drive system according to preset protection logic (the protection control actions include at least executing a short-term fully open circuit, thereby controlling the bridge arm to perform an active short circuit; executing a short-term fully open circuit, thereby using a fault-free bridge arm to perform an active short circuit; and stopping power output and executing a fully open circuit). Finally, it performs vehicle speed limiting, controlling the inverter to perform a discharge function to a preset safe high voltage level at least after the vehicle speed drops to a preset threshold. In the above vehicle electric drive system protection control process, it at least monitors the three-phase current and DC current of the system, and then opens the three-phase excitation fuse at least when the three-phase current is greater than a first current threshold to physically disconnect the inverter from the motor, and opens the DC excitation fuse at least when the DC current is greater than a second current threshold to physically disconnect the inverter from the power battery. Therefore, it can be seen that the embodiments of the present invention can effectively protect personal and system safety even if the system fails, through at least a multi-layered protection and control mechanism. Attached Figure Description

[0038] Figure 1 This is a flowchart of a vehicle electric drive system protection and control method provided in an embodiment of the present invention;

[0039] Figure 2 This is a partial structural block diagram of a vehicle electric drive system provided in an embodiment of the present invention;

[0040] Figure 3 This is a structural block diagram of a backup power supply and discharge unit provided in an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of the structure of a vehicle electric drive system protection and control device provided in an embodiment of the present invention;

[0042] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0044] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “said,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0045] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0046] It should be understood that although the terms first, second, third, etc., may be used in the embodiments of this application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, first may also be referred to as second without departing from the scope of the embodiments of this application, and similarly, second may also be referred to as first.

[0047] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0048] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0049] It should be noted that any symbols and / or numbers present in the specification that are not marked in the accompanying drawings are not reference numerals.

[0050] Figure 1 This is a flowchart of a vehicle electric drive system protection and control method provided by an embodiment of the present invention. This embodiment is applicable to at least any protection and control scenario of the electric drive system in a new energy vehicle. The vehicle electric drive system protection and control method can be, but is not limited to, executed by the vehicle electric drive system protection and control device in this embodiment as the execution subject. This execution subject can be implemented in software and / or hardware. Figure 1 As shown, the protection and control method for the vehicle's electric drive system includes at least the following steps:

[0051] S1. Monitor the motor speed and power module chip temperature of the vehicle's electric drive system in real time.

[0052] The motor speed and the temperature of the power module chip can be measured by sensors.

[0053] S2. Based on the motor speed and power module chip temperature, determine and execute the protection control actions of the vehicle electric drive system according to the preset protection control logic; the protection control actions include at least executing a short-term fully open circuit, thereby controlling the bridge arm to perform an active short circuit, executing a short-term fully open circuit, thereby using the fault-free bridge arm to perform an active short circuit, and stopping power output and executing a fully open circuit.

[0054] The preset protection and control logic can be configured according to the actual needs of the vehicle, and this invention does not limit it.

[0055] In one specific implementation, step S2 may optionally include:

[0056] (2-1) In response to system fault reporting, determine the fault state of the system based on the motor speed;

[0057] (2-2) When the system is in the first fault state (for example, the system may report a fault when it is running at high speed, and the fault occurs in the upper or lower bridge arm. The fault can be further analyzed by registers and other means into the following types: abnormal drive voltage fault, system self-test failure fault, low voltage power supply fault, internal communication error fault, short circuit fault), a short-term full open circuit is executed, thereby controlling the active short circuit of the bridge arm.

[0058] In another specific implementation, step S2 may optionally further include:

[0059] (2-3) When the system is in the second fault state (for example, the system may report a fault at high speed, and the fault occurs at the same time in the upper arm and the lower arm), determine whether the system fault report is a short circuit fault.

[0060] (2-4) When the system fault is reported as a short circuit fault, stop the power output and execute full open circuit.

[0061] In yet another specific implementation, step S2 may optionally further include:

[0062] (2-5) When the system fault report is not a short circuit fault, a short-term full open circuit is executed, and then the fault-free bridge arm is used to perform an active short circuit.

[0063] In yet another specific implementation, step S2 may optionally further include:

[0064] (2-6) Determine the junction temperature of the power device based on the temperature of the power module chip;

[0065] (2-7) When the junction temperature of the power device meets the preset temperature condition (for example, the junction temperature of the power device is not lower than the preset over-temperature threshold T) jmax When the temperature exceeds the limit, report an over-temperature fault, stop power output, and execute a fully open circuit.

[0066] Furthermore, when the junction temperature of the power device is not lower than (T jmax When the temperature reaches -25℃, the control system linearly reduces the frequency output; when the junction temperature of the power device is not lower than (T jmax When the temperature is below -15℃, the control system linearly reduces the torque output; when the junction temperature of the power device is not lower than (T jmax When the temperature drops to -5℃, the torque output of the control system decreases to 0; when the junction temperature of the power device decreases to no higher than (T jmax When the temperature reaches -45℃, the control system automatically resumes operation.

[0067] S3. Perform vehicle speed limiting operation. At least after the vehicle speed drops to the preset speed threshold, control the inverter to perform the discharge function to the preset safe high voltage level.

[0068] In the above vehicle electric drive system protection and control process, at least the three-phase current and DC current of the system are monitored. The three-phase excitation fuse is activated at least when the three-phase current exceeds a first current threshold, to physically disconnect the inverter from the motor. Similarly, the DC excitation fuse is activated at least when the DC current exceeds a second current threshold, to physically disconnect the inverter from the power battery. It is understood that the preset vehicle speed threshold and preset safe high voltage level can be configured according to the actual vehicle requirements, and this invention does not impose any limitations on them.

[0069] More specifically, the electric motor system of a new energy vehicle, as the core power source of the entire vehicle, directly affects the vehicle's power output and driving safety through its stable and reliable operation. The motor controller, as the brain of this system, is responsible for adjusting the motor's operating state in real time to ensure the vehicle operates safely and efficiently under various conditions. However, under extreme conditions—especially when the vehicle faces the risk of loss of control or power device failure—it is often difficult to ensure system safety. Therefore, it is necessary to construct a fault response mechanism that can still ensure driving safety and minimize harm under extreme conditions such as high speeds.

[0070] To achieve this goal, multiple types of sensors can be deployed in the system to perform comprehensive, multi-state real-time monitoring of the motor inverter and core critical components, covering, but not limited to, the following fault types:

[0071] 1. Abnormal drive voltage: Overvoltage or undervoltage fault. Overvoltage fault: The drive circuit supply voltage exceeds the design limit, which may cause power devices to break down or be falsely triggered. Undervoltage fault: The drive circuit supply voltage is lower than the operating requirements, which may cause insufficient IGBT drive, resulting in a sharp increase in conduction losses or shoot-through short circuit.

[0072] 2. Low-voltage power supply abnormality: Overvoltage or undervoltage fault. Overvoltage fault: The low-voltage power supply of the control unit (such as MCU, sensor) exceeds the standard, which may damage the logic chip or cause malfunction. Undervoltage fault: Insufficient low-voltage power supply may cause controller reset, data loss, or logic errors.

[0073] 3. Internal communication error: failure of critical signal transmission; failure of signal transmission or verification error between critical functional modules (such as driver board and main control board) within the controller, which may lead to loss of control commands or misjudgment of status.

[0074] 4. System self-test failure: The self-test fails during startup or operation; if the controller fails the self-test of key hardware such as memory, ADC, and drive circuit during startup or operation, it indicates a potential hardware defect or software anomaly.

[0075] 5. IGBT short circuit faults: including gate-source short circuit (GS short circuit), drain-source short circuit (DS short circuit), phase-to-phase short circuit, etc.; such faults can easily lead to a sharp increase in current, overheating of the device, or even explosion. Real-time monitoring and fast shutdown protection must be implemented.

[0076] 6. IGBT open circuit fault: The power device cannot conduct normally. Specifically, this means that the power device cannot conduct normally due to damage, drive failure, or abnormal connection. This can lead to phase loss, torque pulsation, or loss of control in the motor. It is necessary to combine current and speed signals for diagnosis and enable fault-tolerant control strategies.

[0077] 7. Overcurrent fault: The system current exceeds the safety threshold, which may be caused by sudden load changes, short circuits, or control abnormalities. Protection mechanisms should include graded current limiting, pulse blocking, and fault lockout to prevent thermal damage to devices and system failure.

[0078] 8. IGBT over-temperature fault: IGBT over-temperature fault usually means that the junction temperature of the IGBT exceeds the safe threshold.

[0079] 9. High-voltage overvoltage fault: The DC bus voltage exceeds the allowable range, commonly seen in scenarios such as regenerative braking energy recovery or excessive back EMF due to motor runaway. Protection is required through a bleed circuit or adjustment of the energy recovery strategy to prevent overvoltage damage to capacitors and power devices.

[0080] Based on the real-time fault information fed back by the aforementioned sensors, the system should have the ability to handle faults in a graded and classified manner. Depending on the fault type, severity, and driving status, it should dynamically execute corresponding control strategies—such as reducing torque output, entering limp mode, or performing active safety power cut-off, so as to maximize vehicle safety in multiple fault scenarios and achieve minimal damage control to occupants and vehicle systems.

[0081] The above faults are typical faults in motor control systems. In actual systems, recoverable and unrecoverable faults can be further distinguished according to the depth of diagnosis and safety level requirements, and corresponding graded response mechanisms can be designed, as follows:

[0082] Level 1 Fault: Minor abnormality, alarm sounds and power is limited, does not affect safe driving, only performance is limited. Examples include DC bus voltage high / low warning, inverter IGBT temperature high warning, etc. Level 1 faults require the instrument fault light to illuminate (yellow warning), output power / torque to be limited, fault code to be recorded, and continued driving is allowed. It is recommended to have it repaired as soon as possible.

[0083] Level 2 Fault: Moderate risk. Enters limp mode, indicating a risk of failure. High power output is prohibited. Examples include IGBT overheating reaching the Level 2 threshold, bus overvoltage / undervoltage reaching the Level 2 threshold, etc. A Level 2 fault enters limp mode, significantly limiting power / torque, prohibiting rapid acceleration and high speeds, maintaining the vehicle at low speed to a safe area, storing fault codes, and prompting immediate stop and repair.

[0084] Level 3 Fault: Serious danger. Immediately enters safety mode to perform safe power-off and mechanical locking. Examples include severe IGBT overheating, severe bus overvoltage / short circuit, severe phase-to-phase short circuit, short circuit to ground, IGBT shoot-through, severe overcurrent, etc. Level 3 faults immediately execute the safety shutdown mode, performing actions including shutting down the IGBT drive signal (fully open circuit OC), active short circuit (Active Short Circuit, ASC), disconnecting the main relay, and performing mechanical locking / anti-rollover (in coordination with the vehicle). After high-voltage power-off is completed, automatic power-on is prohibited. The instrument panel displays a red fault light, indicating that driving is prohibited. The fault is forcibly recorded and the fault state is locked, requiring maintenance and reset.

[0085] Explanation: The core function of the Active Short Circuit (ASC) mentioned above is to quickly establish a safe and controllable state by actively short-circuiting the three phases of the permanent magnet synchronous motor when it is rotating at high speed and a system fault occurs, thereby protecting the entire electric drive system. It mainly has the following three key functions:

[0086] 1. Preventing uncontrolled braking and ensuring driving safety: When the motor is rotating at high speed, if the inverter is simply "off" (OC, i.e., all switches are disconnected), the back electromotive force generated by the motor will be rectified by the inverter's diodes and uncontrollably charge the battery. This will instantly generate a huge braking torque, causing the vehicle to suddenly decelerate at high speed, which can easily lead to serious accidents such as rear-end collisions. Active short-circuiting, by short-circuiting the three-phase windings, can control the output torque to near zero at high speeds, avoiding this dangerous and unpredictable braking and ensuring driving safety.

[0087] 2. Preventing overvoltage damage and protecting core components: In states such as coasting due to inertia, a rotating motor acts like a generator. If the battery is disconnected at this time, the back electromotive force generated by the motor has nowhere to go, resulting in extremely high voltage spikes on the DC bus, which can easily damage the DC bus capacitors and power modules in the inverter. Active short-circuiting provides a safe internal circulation path for the current generated by the motor, dissipating electrical energy as heat within the motor and power transistors, thereby limiting the rapid rise in voltage and protecting the battery, capacitors, and power devices from damage.

[0088] 3. Ensuring Torque Safety and Meeting Functional Safety Requirements: Torque safety is a core objective in the functional safety design of electric vehicles, meaning the system must avoid generating unexpected acceleration or deceleration forces. Active short-circuiting is a key technical means to achieve this goal. It ensures that in the event of a system failure, regardless of the motor speed, its output torque can be limited to a safe and predictable range, thus providing a fundamental guarantee for the vehicle to achieve the highest safety level (such as ASIL D).

[0089] Figure 2 This is a partial structural block diagram of a vehicle electric drive system provided in an embodiment of the present invention. See also... Figure 2 An electric drive inverter system consists of at least a control unit, a judgment unit, an execution unit, a fault monitoring unit, a drive unit, a backup power supply and discharge unit, and an excitation fuse. The control unit receives torque requests from the vehicle controller (VCU), sends six PWM signals, and controls the switching of high-speed power switching devices through the drive unit to convert high-voltage DC power into AC power to drive the motor. The fault monitoring unit monitors the system status in real time for fault diagnosis and protection. The judgment unit determines the fault type and severity, and the execution unit executes corresponding protective actions to ensure vehicle speed and high voltage remain within safe ranges, thereby ensuring vehicle and personal safety. The six IGBTs are the core power devices; by monitoring the status and drive status of each IGBT, different safety modes are entered, ultimately bringing the vehicle to a safe stop. This is understandable. Figure 1 The control flow shown can rely on Figure 2 The system architecture shown was thus realized.

[0090] The aforementioned short-circuit fault can refer to an IGBT reporting a desaturation (DESAT) fault, which can characterize either an open-circuit fault in the IGBT itself or a short-circuit fault in the IGBT pair. An IGBT short-circuit fault indicates that the IGBT itself is damaged, resulting in a low impedance between its collector (C) and emitter (E) terminals, preventing it from turning off. This means the IGBT is damaged and continuously conducting. If the IGBT itself is not faulty, but a sudden surge in current (short-circuit current) occurs due to load issues or a shoot-through in the bridge arm, an overcurrent fault will be reported.

[0091] The aforementioned short-time fully open circuit execution is at the microsecond level, which can avoid software-generated waveforms and unstable states that could lead to shoot-through.

[0092] During execution, the three-phase current and DC bus current are monitored in real time. If the threshold is exceeded, the electromagnetic exciter is disconnected and the connection is broken.

[0093] When an active short circuit is triggered, the current generated by the motor no longer flows outwards. Instead, it forms a short-circuit circulating current within the three-phase windings through the inverter's power transistors. This traps energy inside the motor, converting it into heat, thus preventing excess energy from flowing to the battery side and raising the voltage. While an active short circuit does not lower the battery voltage, it prevents voltage spikes, acting as a voltage regulator. Rapid discharge can then be achieved through the discharge unit.

[0094] When the system malfunctions, the motor acts as a back electromotive force source during high-speed rotation. If one of the IGBTs in the upper arm (e.g., the upper diode of phase U) is short-circuited (continuously conducting), the three-phase AC power generated by the motor's rotation will form a circuit through the damaged IGBT (continuously conducting) and the diodes of the other two normal phases (because the upper diodes of the other two phases are not damaged, the current can only flow through the lower diodes). This is equivalent to forming an uncontrolled "semi-controlled rectifier bridge" between the positive and negative terminals of the DC bus through the motor coils. This will result in huge braking torque, causing the vehicle to decelerate suddenly and violently, and the rear wheels may lock up. The huge current will continuously flow into the damaged IGBT and the lower diodes of the other two phases, causing a rapid accumulation of heat, which may lead to serious consequences.

[0095] In this catastrophic failure of "high speed + short circuit," the software is essentially rendered useless (because the faulty transistor cannot be shut off). At this point, only hardware protection can be relied upon, in three steps:

[0096] Step 1: Briefly shut down all normal transistors (on the order of microseconds), immediately cutting off the drive signals of all other 5 normal IGBTs, keeping them off. This can prevent system ripples from causing more serious bridge arm shoot-through (burning out the rest as well). However, this alone is not enough, because current will still flow through the faulty transistor and the normal diodes.

[0097] Step 2: Identify and trigger "active short circuit" (if the topology allows).

[0098] At this critical moment, it is absolutely crucial not to conduct the other power transistor in the same phase (if it does, the battery positive terminal will be directly short-circuited through the faulty upper transistor and the artificially connected lower transistor, which will instantly rupture the copper busbar). Short-circuit faults are reported via desaturation (DESAT), which can indicate an open-circuit fault in the IGBT itself or a short-circuit fault in the paired IGBTs. Active short-circuiting of all three bridge arms of the paired transistors is necessary to ensure that the energy generated by the motor is evenly dissipated within the three-phase windings, rather than being concentrated on the faulty transistor in one phase, thus delaying temperature rise and buying time.

[0099] Step 3: The Vehicle Control Unit (VCU) implements speed limiting, and the Battery Management System (BMS) executes "emergency power-off," discharging the high-voltage electricity through the discharge unit. If the three-phase current or DC current is still high enough to exceed the threshold, the main circuit or three-phase copper busbar circuit is directly detonated by activating the fuse. If the current is not high enough to cause the relay to stick, the high-voltage positive and negative relays are immediately disconnected. The purpose is to isolate the battery, a huge energy source, from the faulty system. As long as the battery is disconnected, although the motor is still running, the energy it generates can only be consumed by its own windings and the faulty tube, and it can no longer obtain energy from the battery, thus controlling the risk within the motor. Disconnecting the three-phase AC copper busbar means that although the motor is still running, the back EMF generated will not affect the power devices connected in parallel with the busbar, such as capacitors and semiconductor modules.

[0100] In applications with a fully open circuit, under specific scenarios where the system operates at extremely low speeds and safety is paramount (e.g., during power-on initialization or certain fault diagnosis procedures), all switches may briefly turn off. However, this is usually controlled, temporary, and protected by hardware circuitry (such as an active discharge circuit) to ensure the bus voltage does not exceed limits. At high speeds, the motor rotates and carries its own energy. Even if the battery is disconnected, the high-speed rotating permanent magnet continues to generate high voltage. This voltage will continuously form a loop through the faulty IGBT (equivalent to a conducting diode / wire). Attempts should be made to turn on the switches of a specific phase (the non-faulty phase) to establish a controlled motor short-circuit mode and disperse energy as much as possible. The ultimate protection is to detonate the excitation fuse or disconnect the high-voltage relay to completely isolate the battery from the faulty terminal.

[0101] Once such a "high speed + short circuit" fault occurs, the power module containing the damaged IGBT usually needs to be replaced entirely during repair, and the motor windings need to be checked for damage due to prolonged high current.

[0102] Furthermore, through careful research, the inventors discovered that the traditional passive discharge method used in existing technologies has limitations: conventional solutions rely on passive discharge resistors (slow discharge) as backup. This method is bulky, costly, and generates significant heat during operation, continuously consuming system power and affecting overall vehicle energy efficiency. The backup logic also has flaws; conventional fast discharge units (using motor windings for discharge) depend on the integrity of the control unit and three-phase power devices. When a serious fault occurs (such as a three-phase fuse tripping or power device damage) causing the fast discharge path to fail, the system can only rely on the passive resistor, which suffers from the aforementioned drawbacks.

[0103] Conventional new energy vehicle electric drives require dual backups for both fast and slow discharge modes. If one discharge mode fails, the other can ensure successful discharge of high-voltage electricity. Under normal circumstances, fast discharge takes less than 2 seconds to release the high-voltage electricity from the bus capacitor, using the motor windings. Slow discharge takes less than 5 minutes to reduce the DC bus capacitor of the drive motor controller to 60V, using passive discharge resistors. The fast discharge unit relies on the control unit, three-phase power switching devices, and motor windings; none of these components can fail. A serious fault will prevent fast discharge. Normally, a fault would trigger a functional safety path, i.e., active short circuit or over-the-air (OC) mode. Whether active short circuit or OC mode is entered depends on the high voltage and high speed. If the speed is low, direct discharge is sufficient. If the speed is high, active short circuit and discharge are performed. If fast discharge is not possible in this case, passive resistors must be used, which are bulky, costly, generate significant heat, and discharge continuously, impacting system power consumption.

[0104] In view of this, Figure 3 This is a structural block diagram of a backup power supply and discharge unit provided in an embodiment of the present invention. See also... Figure 3 The specific functions and control logic of the backup power supply and discharge unit are as follows: When the low-voltage power supply of the system fails, the control software and the low-voltage power supply system will not be able to work normally, and the backup power supply function will be automatically started at this time; when it is necessary to discharge the high-voltage circuit, the active discharge system will be started.

[0105] In case of a fault, the system draws power from the high-voltage power supply. After processing by the power management unit and isolation transformer T1, it generates an isolated low-voltage power supply VCC (a 15V low-voltage power supply is generated when the bus voltage exceeds 60V; if the low-voltage is lost, the 15V low-voltage power supply powers the entire system). This power supply powers the entire low-voltage system, ensuring the continuous and stable execution of the protection mode. Simultaneously, after logical judgment by the discharge control unit, the discharge switch Q2 is triggered to conduct, achieving high-voltage discharge through resistor R1. The filter units C1, R2, C2, and C3 further stabilize the output voltage of the high-voltage power supply. The power management unit is a power management chip; the discharge control unit is a logic processing circuit that performs AND operations on multiple signals. One signal comes from the control software processing logic signal (used when the software can be operated normally); one signal comes from the low-voltage interlock signal (which can accurately identify whether the low-voltage power supply connector is properly connected; if it is disconnected, the software cannot control it normally); one signal comes from the bus voltage monitoring; if the high voltage is detected to be higher than the set threshold, the discharge is started; and one signal comes from the high-voltage interlock; if the high-voltage relay is disconnected or the excitation fuse is blown, the discharge is started.

[0106] The system monitors the high voltage on the bus capacitor in real time and will activate the discharge function when any of the following conditions are met: 1) the control software processes the logic signal; 2) the low voltage power supply and signal are disconnected; 3) the high voltage is detected to be higher than the set threshold; 4) the high voltage relay is disconnected or the fuse is activated and blown.

[0107] The advantage of the above solution is that it achieves dual backup of the active discharge unit without adding extra circuitry. One path still uses the rapid discharge of the motor windings, while the other path uses the above solution. The two are independent of each other. When the three-phase fuse disconnects the motor from the inverter, rapid discharge can still be achieved through the internal components of the inverter. At the same time, the original passive discharge resistor can be eliminated, effectively solving the problems of severe heat generation, high cost, and limited space for traditional passive discharge resistors.

[0108] The technical solution provided in this embodiment firstly monitors the motor speed and power module chip temperature of the vehicle electric drive system in real time. Further, based on the motor speed and power module chip temperature, it determines and executes protection control actions for the vehicle electric drive system according to preset protection control logic (protection control actions include at least executing a short-term fully open circuit, thereby controlling the bridge arm to perform an active short circuit; executing a short-term fully open circuit, thereby using a fault-free bridge arm to perform an active short circuit; and stopping power output and executing a fully open circuit). Finally, it executes vehicle speed limiting operations, controlling the inverter to perform a discharge function to a preset safe high voltage level at least after the vehicle speed drops to a preset threshold. In the above vehicle electric drive system protection control process, it at least monitors the three-phase current and DC current of the system, and at least opens the three-phase excitation fuse when the three-phase current is greater than a first current threshold to physically disconnect the inverter from the motor, and opens the DC excitation fuse when the DC current is greater than a second current threshold to physically disconnect the inverter from the power battery. Therefore, this embodiment can effectively protect personal and system safety even if the system fails, through at least a multi-layered protection and control mechanism.

[0109] It should be noted that, in order to address the technical problems existing in the prior art, this invention provides a motor controller protection logic that ensures safety under extreme conditions through hardware redundancy and an autonomous power supply scheme:

[0110] 1. Construct a hardware-level catastrophic failure response mechanism: For catastrophic failures involving "high speed + short circuit," instead of relying solely on faulty software, a hardware protection path is established. Once an uncontrollable short circuit fault is detected, the system will attempt to activate the switching transistors of a specific phase (the non-faulty phase) to establish a controllable motor short circuit mode to disperse energy. In the event of overcurrent, the final protection measure is to disconnect the high-voltage relay or detonate the excitation fuse, physically isolating the battery from the faulty terminal or the motor from the inverter, cutting off the energy source and preventing the accident from escalating.

[0111] 2. Provides backup power and discharge system to ensure continuous protection execution and safe, rapid discharge: When the system's low-voltage power supply fails, the system automatically activates the backup power function, drawing power from the high-voltage power supply. Through the power management unit and isolation transformer, an isolated low-voltage power supply (VCC) is generated to power the entire low-voltage system (including control chips, drive circuits, etc.). This ensures that even in the event of a low-voltage power supply loss, the protection mode can still execute stably and continuously. Simultaneously, the active discharge system is optimized to achieve dual backup and eliminate the need for passive resistors. This is a hardware discharge unit independent of the motor windings, forming a true dual-backup discharge mechanism. One path uses the original motor windings for rapid discharge, while the other (newly added in this invention) forms an independent hardware discharge circuit through the discharge control unit, discharge switch (Q2), and discharge resistor (R1). This ensures that the two discharge paths are independent of each other; even if the three-phase fuses blow (the connection between the motor and inverter is cut off), the newly added hardware discharge circuit can still achieve rapid discharge through the internal components of the inverter. By adding a hardware discharge circuit as an effective backup, the traditional passive discharge resistor, which is bulky, expensive, and generates a lot of heat, can be eliminated, thus solving the problems of limited layout space and high system power consumption.

[0112] Figure 4 This is a schematic diagram of the structure of a vehicle electric drive system protection and control device provided in an embodiment of the present invention. This embodiment is applicable to at least any protection and control scenario of the electric drive system in a new energy vehicle. The vehicle electric drive system protection and control device can be implemented using software and / or hardware. Figure 4 As shown, the vehicle electric drive system protection control device includes at least:

[0113] Real-time monitoring module 110 is used to monitor the motor speed and power module chip temperature of the vehicle electric drive system in real time at least.

[0114] The protection control module 120 is used to determine and execute the protection control actions of the vehicle electric drive system based on the motor speed and the power module chip temperature according to the preset protection control logic. The protection control actions include at least executing a short-term fully open circuit and then controlling the bridge arm to perform an active short circuit, executing a short-term fully open circuit and then using the fault-free bridge arm to perform an active short circuit, and stopping power output and executing a fully open circuit.

[0115] The speed limiting discharge module 130 is used to perform vehicle speed limiting operation, at least after the vehicle speed drops to a preset vehicle speed threshold, it controls the inverter to perform the discharge function to a preset safe high voltage level.

[0116] In the above vehicle electric drive system protection and control process, at least the three-phase current and DC current of the system are monitored, and the three-phase excitation fuse is opened at least when the three-phase current is greater than the first current threshold, so as to at least disconnect the inverter from the motor at the physical level, and the DC excitation fuse is opened at least when the DC current is greater than the second current threshold, so as to at least disconnect the inverter from the power battery at the physical level.

[0117] Optionally, the protection control module 120 is specifically used for:

[0118] In response to system fault reports, the fault state of the system is determined based on the motor speed;

[0119] When the system is in the first fault state, it performs a short-term fully open circuit, thereby controlling the active short circuit of the bridge arm.

[0120] Optionally, the protection control module 120 is also specifically used for:

[0121] When the system is in the second fault state, determine whether the system fault report is a short circuit fault;

[0122] When the system fault is reported as a short circuit fault, power output is stopped and the circuit is fully open.

[0123] Optionally, the protection control module 120 is also specifically used for:

[0124] When the system fault report is not a short circuit fault, a short-term fully open circuit is executed, and then the fault-free bridge arm is used to perform an active short circuit.

[0125] Optionally, the protection control module 120 is also specifically used for:

[0126] Determine the junction temperature of the power device based on the temperature of the power module chip;

[0127] When the junction temperature of the power device meets the preset temperature condition, an over-temperature fault is reported, and power output is stopped and the device is fully open.

[0128] The technical solution provided in this embodiment firstly monitors the motor speed and power module chip temperature of the vehicle electric drive system in real time through a real-time monitoring module. Further, based on the motor speed and power module chip temperature, a protection control module determines and executes protection control actions for the vehicle electric drive system according to preset protection control logic (protection control actions include at least executing a short-term fully open circuit, thereby controlling the bridge arm to perform an active short circuit; executing a short-term fully open circuit, thereby using a fault-free bridge arm to perform an active short circuit; and stopping power output and executing a fully open circuit). Finally, a speed-limiting discharge module performs vehicle speed-limiting operations, controlling the inverter to perform a discharge function to a preset safe high-voltage level at least after the vehicle speed drops to a preset threshold. In the above vehicle electric drive system protection control process, at least the three-phase current and DC current of the system are monitored, and at least when the three-phase current is greater than a first current threshold, the three-phase excitation fuse is opened to physically disconnect the inverter from the motor, and at least when the DC current is greater than a second current threshold, the DC excitation fuse is opened to physically disconnect the inverter from the power battery. Therefore, this embodiment can effectively protect personal and system safety even if the system fails, through at least a multi-layered protection and control mechanism.

[0129] Based on the technical solutions of the foregoing embodiments or implementation methods, this application provides a protection mechanism for the motor controller in a vehicle electric drive system, integrating monitoring, decision-making, and execution. In the event of a fault, the system first briefly blocks all normally functioning power transistors to prevent control malfunctions from causing secondary faults such as bridge arm shoot-through; simultaneously, it identifies the fault state and triggers an "active short-circuit" mode to delay temperature rise and suppress sudden changes in vehicle speed, buying time for subsequent safety measures. Subsequently, the battery management system (BMS) performs an "emergency power-down" operation, actively detonating the excitation fuse when necessary to disconnect the main circuit or three-phase copper busbar connection, while the discharge unit releases high-voltage electricity to ensure safe vehicle stopping and rapidly reduce the high-voltage electricity to a safe range. Through the above multi-layered protection mechanism, even if the motor controller fails, personal and system safety can still be effectively guaranteed.

[0130] Furthermore, this application also provides an integrated backup power supply and discharge control logic. When the system's low-voltage power supply fails or the control software malfunctions, the backup power supply will automatically start and take over the power supply, ensuring the continuous execution of the protection logic. Simultaneously, the system has an active discharge function, achieving dual backup of the discharge unit without adding additional circuitry: one path uses the traditional motor winding for rapid discharge, while the other path utilizes an independent hardware discharge channel provided in this application. The two discharge paths are independent of each other; even if the three-phase fuses blow and the motor and inverter are electrically isolated, rapid discharge can still be achieved through internal inverter components. This design eliminates the need for the original passive discharge resistor, effectively avoiding its problems of severe heat generation, high cost, and large space occupation, thus improving system integration and reliability.

[0131] This embodiment provides an electronic device. Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. See also: Figure 5 The electronic device 1000 includes a processor 1001 and a memory 1002. The memory 1002 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 1001, the steps in any of the above-described vehicle electric drive system protection and control methods are performed. Through the above technical solution, the processor 1001 and the memory 1002 are interconnected and communicate with each other via a communication bus and / or other forms of connection mechanisms (not shown). The memory 1002 stores a processor-executable computer program. When the electronic device 1000 is running, the processor 1001 executes the computer program to perform the vehicle electric drive system protection and control method in any optional implementation of the above embodiments, to at least achieve the following functions: at least real-time monitoring of the motor speed and power module chip temperature of the vehicle electric drive system; based on the motor speed and power module chip temperature, determining and executing the protection and control actions of the vehicle electric drive system according to preset protection and control logic; performing vehicle speed limiting operations, at least after the vehicle drops to a preset speed threshold, controlling the inverter to perform a discharge function to a preset safe high voltage level.

[0132] This embodiment provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it implements the vehicle electric drive system protection and control method provided in all embodiments of this application: at least real-time monitoring of the motor speed and power module chip temperature of the vehicle electric drive system; based on the motor speed and power module chip temperature, determining and executing protection and control actions of the vehicle electric drive system according to preset protection and control logic; executing vehicle speed limiting operation, and at least after the vehicle drops to a preset vehicle speed threshold, controlling the inverter to perform a discharge function to a preset safe high voltage level.

[0133] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0134] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0135] The program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0136] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A protection and control method for a vehicle electric drive system, characterized in that, At least including: At least monitor the motor speed and power module chip temperature of the vehicle's electric drive system in real time; Based on the motor speed and power module chip temperature, the protection control action of the vehicle electric drive system is determined and executed according to the preset protection control logic; the protection control action includes at least executing a short-term fully open circuit, thereby controlling the bridge arm to perform an active short circuit, executing the short-term fully open circuit, thereby using the fault-free bridge arm to perform an active short circuit, and stopping power output and executing a fully open circuit; The vehicle speed limit operation is executed, and at least after the vehicle speed drops to the preset speed threshold, the inverter is controlled to perform the discharge function to the preset safe high voltage level. In the above vehicle electric drive system protection and control process, at least the three-phase current and DC current of the system are monitored, and then the three-phase excitation fuse is opened at least when the three-phase current is greater than the first current threshold, so as to at least disconnect the inverter from the motor at the physical level, and the DC excitation fuse is opened at least when the DC current is greater than the second current threshold, so as to at least disconnect the inverter from the power battery at the physical level.

2. The vehicle electric drive system protection and control method according to claim 1, characterized in that, Based on the motor speed and power module chip temperature, the protection control actions of the vehicle electric drive system are determined and executed according to preset protection logic, specifically including: In response to a system fault report, the fault state of the system is determined based on the motor speed; When the system is in the first fault state, it performs a short-term fully open circuit, thereby controlling the active short circuit of the bridge arm.

3. The vehicle electric drive system protection and control method according to claim 2, characterized in that, After responding to a system fault report and determining the system fault state based on the motor speed, the process further includes: When the system is in the second fault state, it is determined whether the system fault report is a short circuit fault; When the system fault is reported as a short circuit fault, power output is stopped and the system is fully open.

4. The vehicle electric drive system protection and control method according to claim 3, characterized in that, After determining whether the system fault report is a short-circuit fault when the system is in a second fault state, the method further includes: When the system fault report is not the short-circuit fault, the short-time fully open circuit is executed, and then the fault-free bridge arm is used to perform an active short circuit.

5. The vehicle electric drive system protection and control method according to claim 2, characterized in that, Based on the motor speed and power module chip temperature, the step of determining and executing the protection control action of the vehicle electric drive system according to preset protection logic further includes: The junction temperature of the power device is determined based on the temperature of the power module chip. When the junction temperature of the power device meets the preset temperature condition, an over-temperature fault is reported, and power output is stopped and the device is fully open.

6. A protection and control device for a vehicle electric drive system, characterized in that, Used to perform the vehicle electric drive system protection and control method according to any one of claims 1-5; The vehicle electric drive system protection and control device includes at least: A real-time monitoring module is used to monitor, at least in real time, the motor speed and power module chip temperature of the vehicle's electric drive system. The protection control module is used to determine and execute the protection control actions of the vehicle electric drive system based on the motor speed and power module chip temperature according to the preset protection control logic. The protection control actions include at least executing a short-term fully open circuit and then controlling the bridge arm to perform an active short circuit, executing the short-term fully open circuit and then using the fault-free bridge arm to perform an active short circuit, and stopping power output and executing a fully open circuit. The speed-limiting discharge module is used to perform vehicle speed-limiting operations. At least after the vehicle speed drops to a preset vehicle speed threshold, it controls the inverter to perform the discharge function to a preset safe high voltage level. In the above vehicle electric drive system protection and control process, at least the three-phase current and DC current of the system are monitored, and then the three-phase excitation fuse is opened at least when the three-phase current is greater than the first current threshold, so as to at least disconnect the inverter from the motor at the physical level, and the DC excitation fuse is opened at least when the DC current is greater than the second current threshold, so as to at least disconnect the inverter from the power battery at the physical level.

7. The vehicle electric drive system protection and control device according to claim 6, characterized in that, The protection control module is specifically used for: In response to a system fault report, the fault state of the system is determined based on the motor speed; When the system is in the first fault state, it performs a short-term fully open circuit, thereby controlling the active short circuit of the bridge arm.

8. The vehicle electric drive system protection and control device according to claim 7, characterized in that, The protection control module is also specifically used for: When the system is in the second fault state, it is determined whether the system fault report is a short circuit fault; When the system fault is reported as a short circuit fault, power output is stopped and the system is fully open.

9. An electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the vehicle electric drive system protection and control method according to any one of claims 1-5.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the vehicle electric drive system protection and control method according to any one of claims 1-5.

Images