Safety protection device for motor controller, motor controller comprising the device

Abstract

The application relates to a safety protection device for a motor controller and a motor controller comprising the same. The safety protection device comprises: first signal generation means configured to generate an intermediate safety signal based on a safety protection enable signal and a safety request signal, and configured to perform first delay processing on the safety request signal to generate the intermediate safety signal delayed for a first time length in the case that the safety protection enable signal is valid; second signal generation means configured to generate an intermediate operation signal based on the safety protection enable signal and an operation request signal; and third signal generation means configured to generate a safety control signal based on the intermediate operation signal and the intermediate safety signal, the second signal generation means being further configured to generate an inverter control signal based on the safety control signal and an operation control signal, so as to set the switching state of each switching tube in an inverter, thereby enabling the inverter to enter a corresponding safety protection mode or a normal working mode.

Description

Technical Field

[0001] This application relates to the field of vehicle motor control, and more specifically, to a safety protection device for a motor controller, and a motor controller including the device. Background Technology

[0002] The development of new energy vehicles, especially electric vehicles, is becoming increasingly rapid. Electric vehicles use a motor controller to convert the direct current (DC) from the vehicle's high-voltage battery into alternating current (AC) that drives the motor, thus propelling the vehicle.

[0003] The core component for power conversion in the motor controller is the inverter. To ensure the quality of electric vehicles and user experience, the inverter, as an important part of the vehicle's power system, must operate reliably and stably throughout the entire life cycle of the electric vehicle. This not only places high demands on important inverter components such as capacitors and IGBTs, but also poses a high challenge to the safety and stability of the entire inverter's drive device. Summary of the Invention

[0004] This application proposes an improved safety protection device for a motor controller. Specifically, the motor controller includes a control chip and an inverter configured to convert direct current from a vehicle battery pack into alternating current for driving the motor. The control chip is configured to control the switching states of various switching transistors in the inverter. The safety protection device is configured to receive operation request signals, safety protection enable signals, and safety request signals from the control chip, and control the inverter to enter corresponding operating modes based on these signals. The safety protection device includes:

[0005] The first signal generating device is configured to generate an intermediate security signal based on a security protection enable signal and a security request signal. The first signal generating device is configured to perform a first delay processing on the security request signal when the security protection enable signal is active, so as to generate an intermediate security signal that is delayed for a first duration.

[0006] The second signal generation device is configured to generate an intermediate operation signal based on a safety protection enable signal and an operation request signal, and to perform a second delay processing on the operation request signal in the event that the safety protection enable signal fails, so as to generate an operation control signal that is delayed for a second duration; and

[0007] The third signal generation device is configured to generate a safety control signal based on the intermediate operation signal and the intermediate safety signal.

[0008] The second signal generating device is further configured to generate an inverter control signal based on a safety control signal and an operation control signal, in order to set the switching state of each switching transistor in the inverter, thereby enabling the inverter to enter the corresponding safety protection mode or normal operation mode.

[0009] According to an optional embodiment, the inverter is configured as a bridge inverter circuit consisting of switching transistors on a first side and a second side. The safety request signal includes a first safety request signal for controlling the switching transistors on the first side of the inverter and a second safety request signal for controlling the switching transistors on the second side of the inverter. The operation request signal includes a first operation request signal for controlling the switching transistors on the first side of the inverter and a second operation request signal for controlling the switching transistors on the second side of the inverter. The inverter control signal includes a first inverter control signal and a second inverter control signal for controlling the states of the switching transistors on the first side and the second side of the inverter, respectively.

[0010] According to an optional embodiment, the security protection device is further configured as follows:

[0011] When the safety protection enable signal is valid, if the first and second safety request signal states are different, the inverter is controlled to enter the ASC mode of the corresponding side switch; if the first and second safety request signal states are the same, the inverter is controlled to enter the FreeWheeling mode; and / or

[0012] When the safety protection enable signal is invalid, if the states of the first and second operation request signals are different, the inverter is controlled to enter the normal operation mode; if the states of the first and second safety request signals are the same, the inverter is controlled to enter the FreeWheeling mode.

[0013] According to an optional embodiment, the first signal generating device is configured to set the state of an intermediate security signal based on a security protection enable signal, wherein, when the security protection enable signal is valid, the state of the intermediate security signal is set based on the states of the first and second security request signals, and when the security protection enable signal is invalid, the intermediate security signal is set to an invalid state.

[0014] According to an optional embodiment, the first signal generating device is further configured as follows:

[0015] When the safety protection enable signal is valid and the first and second safety request signals are in different states, the intermediate safety signal for each side of the inverter is set to follow the safety request signal used to control the switching transistor on the same side of the inverter and is delayed relative to that safety request signal for a first duration; and

[0016] When the security protection enable signal is valid and the first and second security request signals are in the same state, the intermediate security signal is set to invalid.

[0017] According to an optional embodiment, the second signal generating device is configured to set the state of the operation control signal based on the safety protection enable signal, wherein, when the safety protection enable signal is invalid, the state of the operation control signal is set based on the states of the first and second operation request signals, and when the safety protection enable signal is valid, the operation control signal is set to an invalid state.

[0018] According to an optional embodiment, the second signal generating device is further configured as follows:

[0019] When the safety protection enable signal is invalid and the first and second operation request signals have different states, the operation control signal for each side of the inverter is set to follow the operation request signal used to control the switching transistor on the same side of the inverter and delayed by a second duration relative to that operation request signal; and

[0020] If the safety protection enable signal is invalid and the first and second operation request signals are in the same state, the operation control signal will be set to an invalid state.

[0021] According to an optional embodiment, the first signal generating device further includes:

[0022] The first logic circuit is configured to perform NAND operations on the first and second security request signals and to invert the security protection enable signal, and to perform AND operations on the NAND result and the inverted result of the security protection enable signal with the first security request signal and the second security request signal, respectively, to generate a first intermediate request signal for controlling the first-side switch of the inverter and a second intermediate request signal for controlling the second-side switch of the inverter, respectively.

[0023] The first delay circuit is configured to delay the first and second intermediate request signals by a first duration, respectively.

[0024] The second delay circuit is configured to delay the first and second intermediate request signals, which have been delayed by a first duration, by a third duration, respectively; and

[0025] The second logic circuit is configured to perform NAND operations on the first and second intermediate request signals that have been delayed for a first duration, and to perform AND operations on the NAND results with the first and second intermediate request signals that have been delayed for a third duration, respectively, to generate a first intermediate safety signal for controlling the first-side switching transistor of the inverter and a second intermediate safety signal for controlling the second-side switching transistor of the inverter.

[0026] According to an optional embodiment, the second signal generating device includes:

[0027] The third logic circuit is configured to perform NAND operations on the first operation request signal and the second operation request signal, and to perform AND operations on the NAND result and the safety protection enable signal with the first operation request signal and the second operation request signal, respectively, to generate a first intermediate operation signal for controlling the first-side switch of the inverter and a second intermediate operation signal for controlling the second-side switch of the inverter.

[0028] According to an optional embodiment, the third signal generating device includes:

[0029] The fourth logic circuit is configured to perform a NAND operation on the second intermediate security signal and the first intermediate operation signal to obtain a first NAND result, and to perform a NAND operation on the first intermediate security signal and the second intermediate operation signal to obtain a second NAND result.

[0030] The third delay circuit is configured to delay the first and second intermediate safety signals by a third time duration, respectively.

[0031] The fifth logic circuit is configured to perform an AND operation on the first NAND result and the second intermediate safety signal delayed by a third time, and to perform an AND operation on the second NAND result and the first intermediate safety signal delayed by a third time, so as to generate a first safety control signal for controlling the first-side switching transistor of the inverter and a second safety control signal for controlling the second-side switching transistor of the inverter.

[0032] According to an optional embodiment, the second signal generating device further includes:

[0033] The fourth delay circuit is configured to delay the first and second intermediate operation signals by a second duration, respectively.

[0034] The fifth delay circuit is configured to delay the first and second intermediate operation signals, which have been delayed for a second duration, for a third duration, respectively.

[0035] The sixth logic circuit is configured to perform a NAND operation on the first and second intermediate operation signals that have been delayed for a second duration, and to perform an AND operation on the NAND result with the first and second intermediate operation signals that have been delayed for a third duration, to generate a first operation control signal for controlling the first-side switch of the inverter and a second operation control signal for controlling the second-side switch of the inverter; and

[0036] The seventh logic circuit is configured to perform an OR operation on the first safety control signal and the first operation control signal, and to perform an OR operation on the second safety control signal and the second operation control signal, to generate a first inverter control signal and a second inverter control signal.

[0037] This application also proposes a motor controller including a control chip and an inverter, the inverter being configured to convert DC power from a vehicle battery pack into AC power for driving a motor, the control chip being configured to control the switching states of various switching transistors in the inverter, and the motor controller also including the safety protection devices described above.

[0038] The safety protection device for the motor controller according to this application effectively avoids the shoot-through problem of the upper and lower transistors of the inverter bridge arm through a specific logic circuit design. This design significantly improves the robustness of the inverter hardware, ensuring the safety and reliability of the equipment under various potential fault conditions. Furthermore, this safety protection device can flexibly implement ASC (Active Short Circuit) functions on both the high-side and low-side of the motor inverter. Under the control of the safety enable signal, the inverter can quickly respond and switch to the corresponding safety state, which includes either high-side or low-side ASC. This design not only improves the system's response speed but also ensures that the controller can quickly enter a safety protection mode in emergency situations, protecting the motor and controller from damage. Attached Figure Description

[0039] By incorporating the figures in this article and subsequently the appendix Figure 1 The specific embodiments used to illustrate certain principles of this application will make other features and advantages of the methods of this application clearer or more specifically apparent. Throughout the drawings, the same reference numerals denote the same elements.

[0040] Figure 1 An exemplary safety protection mode for a motor controller is shown.

[0041] Figure 2 A logic block diagram of a typical safety protection device for a motor controller is shown.

[0042] Figure 3 A block diagram of a safety protection device for a motor controller according to an embodiment of the present disclosure is shown.

[0043] Figures 4A-4C An exemplary logic block diagram of a signal generation apparatus in a security protection device according to an embodiment of the present disclosure is shown.

[0044] Figures 5A-5C A timing diagram of various control signals in a safety protection device according to an embodiment of the present disclosure is shown.

[0045] Figure 6 An operation flowchart of a security protection device according to an embodiment of the present disclosure is shown.

[0046] Figure 7 A signal simulation waveform diagram of a first example of a security protection device according to an embodiment of the present disclosure is shown.

[0047] Figure 8 A signal simulation waveform diagram of a second example of an inverter control system according to an embodiment of the present disclosure is shown. Detailed Implementation

[0048] Exemplary implementations according to this disclosure will now be described with reference to the accompanying drawings and embodiments. In the following description, numerous specific details are set forth to enable those skilled in the art to gain a more complete understanding of the present application. However, it will be apparent to those skilled in the art that implementations of the present application may not include some of these specific details. Instead, the present application may be practiced with any combination of the following features and elements, regardless of whether they relate to different embodiments. Therefore, the following aspects, features, embodiments, and advantages are illustrative only and should not be construed as elements or limitations of the claims.

[0049] Furthermore, it should be understood that although the terms "first," "second," etc., may be used herein to describe different elements, components, regions, parts, and / or signals, these elements, components, regions, parts, and / or signals should not be limited by these terms. These terms are only used to distinguish one element, component, region, part, or signal from another. Therefore, without departing from the teachings of the exemplary embodiments according to this application, the first element, component, region, part, or signal discussed below may also be referred to as the second element, component, region, part, or signal. Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It will also be understood that, unless expressly defined herein, terms such as those defined in a general dictionary should be interpreted as having a meaning consistent with their meaning in the relevant field context, and not as having an ideal or overly formal meaning.

[0050] In vehicle control, comprehensive and timely protection is needed for potential overvoltage, undervoltage, overcurrent, and short circuit conditions that may occur in the vehicle inverter to ensure its safety. Currently, two main safety protection modes are considered: FW (Free Wheeling, also known as "Free Wheeling" or "SPO" mode) and ASC (Active Short Control, also known as "Active Short Circuit Control"). Figure 1As shown.

[0051] The FW (Freewheeling) method disconnects the motor and motor controller by disconnecting all the switching transistors in the inverter. This safety mode is often used to protect the inverter when the vehicle is traveling at low speeds or during charging. However, this isolation is not complete because the body diode has a freewheeling function, which may lead to leakage and affect the device.

[0052] ASC (Automatic Safety Control) is implemented by short-circuiting either the upper or lower bridge of the inverter to separate the motor and controller. Typically, considering three-phase (U, V, W) power supply, ASC often requires short-circuiting either the upper or lower bridge to create a short circuit with the motor's U, V, and W phases. This safety mode is often used to protect the inverter when the vehicle is traveling at high speeds.

[0053] Current common safety protection technologies mainly implement low-side ASC (Active Safety Control) functionality. Specifically, when a safety protection enable signal is active (e.g., low level, indicating safety protection is enabled), ASC can be implemented through circuits, such as safety logic circuits. Safety protection enable signals can include: / SFY_EN, / FOC_U, / FOC_V, / FOC_W, / EM_STOP_D, TLF_SS1, / FOV_FAULT, etc. If the safety protection enable signal goes low (indicating activation), all pulse width modulation (PWM) signals to the inverter power supply are disabled, and a safe state including inverter low-side ASC (active short circuit) and active discharge is established.

[0054] However, some current safety protection logic circuits only implement low-side ASC when a safety protection enable signal is present. Especially when the motor speed is very low, low-side ASC may damage DC bus components such as MOSFETs.

[0055] Furthermore, some current safety protection logic circuits primarily implement a short-duration (approximately 4μs) freewheeling (FW) upon the presence of a safety protection enable signal. However, especially at very high motor speeds, freewheeling can damage DC bus components such as MOSFETs. Another critical drawback of freewheeling is that it cannot function if a phase IGBT / MOSFET experiences a short circuit.

[0056] Another key drawback of some current safety logic circuits is the inability to immediately resume normal PWM control after the safety protection enable signal is released (e.g., goes high). Specifically, normal software (SW) PWM control typically waits at least 4–5 μs before resuming to avoid the risk of a temporary high-voltage DC short circuit to ground, thus preventing a rapid recovery of normal PWM control. Furthermore, the safety logic hardware circuitry lacks a design to prevent shoot-through (i.e., direct conduction of the upper and lower transistors to ground), which could potentially damage the circuit components.

[0057] Figure 2 A logic block diagram of a conventional safety protection device for a motor controller is shown. When any functional safety signal (e.g., SFY_EN (active low)) is triggered, and the PWM control signals (e.g., PWM_xH and / PWM_xL) stop controlling, after passing through the logic circuit, the PWR_xH_FB received by the high-side drive control chip will become a low-level signal, and the high-side drive control chip is configured to have the input signal PWR_xH_FB active high. On the other hand, after a delay of time t2, the PWR_xL_FB received by the low-side drive control chip will become a low-level signal, and the low-side drive control chip is configured to have the input signal PWR_xL_FB active low. Thus, the inverter can only enter the low-side ASC state. ASC short-circuits the three-phase lower bridge / low-side switching transistors of the inverter bridge to ground. On the other hand, after all functional safety signals are released, / PWM_xH and / PWM_xL start control at the same time. If the / PWM_xH control signal is high, the three-phase high-side switch of the inverter is turned on to HV+. At the same time, because of the delay t2, ASC has not yet exited, which may lead to the risk of HV+ being directly short-circuited to ground.

[0058] Therefore, an improved control scheme for automotive inverters is needed. In particular, it should be able to effectively isolate the upper and / or lower bridges of the inverter in case of abnormal conditions to smoothly enter a safety protection mode, such as FW or ASC mode, and / or quickly restore to normal operation after leaving the safety state, and / or effectively avoid potential serial conduction risks when switching between the safety protection state and the normal operation state.

[0059] Specifically, in the scheme disclosed herein, by appropriately setting the safety control-related signals for each side of the inverter, more comprehensive safety protection for the inverter can be achieved. In particular, by setting the safety control-related signals for the first side (also known as the "high side" or "upper bridge") and the second side (also known as the "low side" or "lower bridge") of the inverter respectively, the upper bridge ASC / FW protection mode and the lower bridge ASC / FW protection mode can be implemented respectively.

[0060] Furthermore, in the scheme disclosed herein, different delays are applied to the inverter safety control-related signals and the inverter operation control-related signals, which enables asynchronous execution of mode switching on one side of the inverter and mode switching on the other side of the inverter, effectively avoiding the serial conduction problem caused by simultaneous mode switching.

[0061] Additionally or alternatively, in the scheme disclosed herein, the control-related signals applied to each side of the inverter can be further set based on the control-related signals on the other side of the inverter, thereby enabling the accurate setting of the state of the control signals for various initial input signal states to control the inverter to operate in an appropriate mode.

[0062] Specifically, on the one hand, the signal states related to safety control on the high-side or low-side of the inverter can be set based on the signal states related to safety control on both sides of the inverter, and / or the signal states related to operation control on each side of the inverter can be set based on the signal states related to operation control on both sides of the inverter. This allows the inverter's operating mode to be appropriately set according to the signal states during operation; for example, it can be appropriately in a normal operating mode during safety protection or normal operation, or enter an appropriate safety protection mode. On the other hand, additionally or alternatively, the signals related to safety control on one side of the inverter can be further set based on the signals related to operation control on the other side of the inverter. This allows for optimized setting of the control signals for each side of the inverter when different sides of the inverter may switch to different modes, thereby avoiding potential serial conduction problems.

[0063] Figure 3 A block diagram of a safety protection device for a motor controller according to an embodiment of the present disclosure is shown. The motor controller typically includes a control chip and an inverter. The inverter is configured to convert direct current from a vehicle battery pack into alternating current for driving the motor. The control chip is configured to control the switching states of various switching transistors in the inverter. The safety protection device proposed in this disclosure can receive operation request signals PWM_x_H, PWM_x_L, safety protection enable signals SFY_EN, and safety request signals SFY_H, SFY_L from the control chip, and control the inverter to enter the corresponding operating mode based on these signals.

[0064] like Figure 3 As shown, the safety protection device 300 may include a first signal generating device B1, a second signal generating device B2, and a third signal generating device B3.

[0065] The first signal generating device B1 can be configured to generate intermediate security signals SFY_H_FB_2 and SFY_L_FB_2 based on the security protection enable signal SFY_EN and the security request signals SFY_H and SFY_L. The first signal generating device is configured to perform a first delay processing on the security request signals SFY_H and SFY_L when the security protection enable signal is active, so as to generate intermediate security signals that are delayed for a first duration Td1.

[0066] The second signal generating device B2 can be configured to generate intermediate operation signals PWM_x_H_FB and PWM_x_L_FB based on the safety protection enable signal SFY_EN and operation request signals PWM_x_H and PWM_x_L. In the event that the safety protection enable signal fails, the second signal generating device B2 can delay the operation request signals PWM_x_H and PWM_x_L to generate operation control signals PWM_x_H_FB_3 and PWM_x_L_FB_3 delayed by a second duration Td2 and a third duration Td3 (the second duration Td2 may be shorter than the first duration Td1, for example).

[0067] The third signal generation device B3 can be configured to generate safety control signals SFY_H_FB_3 and SFY_L_FB_3 based on intermediate operation signals PWM_x_H_FB_2 and intermediate safety signals SFY_H_FB_2 and SFY_L_FB_2.

[0068] The second signal generating device B2 is further configured to generate inverter control signals PWM_x_H_out and PWM_x_L_out based on safety control signals SFY_H_FB_3 and SFY_L_FB_3 and operation control signals PWM_x_H_FB_3 and PWM_x_L_FB_3, in order to set the switching state of each switching transistor in the inverter, thereby enabling the motor to enter the corresponding safety protection mode or normal operation mode.

[0069] In embodiments of this disclosure, a safety protection enable signal can indicate whether execution / entry into an inverter safety protection mode is permitted. As an example, the safety protection enable signal can be represented as SFY_EN, typically active low (level), meaning a low level activates safety protection, while a high level disables it. Specifically, when the safety protection enable signal is activated, the inverter is set to enter a safety protection mode based on a safety request signal, while the inverter operation request signal is considered equivalent to invalid, and normal inverter operation, such as various conventional inverter switching transistor drive operations like pulse width modulation (PWM) operation, is not performed. Conversely, when the safety protection enable signal is released, the inverter is set to enter an appropriate operating mode based on an operation request signal, while the inverter safety request signal is considered equivalent to invalid.

[0070] In embodiments of this disclosure, the safety request signal may indicate a signal requesting safety protection for the inverter, particularly including signals requesting safety protection for a first side and a second side of the inverter, such safety protection as ASC, FW, etc. Specifically, the first side may correspond to the high side (also called the "upper bridge") of the inverter, and the second side may correspond to the low side (also called the "lower bridge"), and vice versa. For example, the safety request signal may include signals denoted as SFY_H and SFY_L, where SFY_H indicates a high-side safety request signal and SFY_L indicates a low-side safety request signal. These signals are typically active high (level), enabling the ASC function on the corresponding side to be triggered in the event of overvoltage, overcurrent, or MCU or SBC errors. It should be noted that SFY_H and SFY_L here can also be referred to as initial / input safety request signals. The system or devices in the system can process these signals to generate various signals, such as any intermediate signals or result signals generated by processing the signals, such as intermediate request signals, intermediate safety signals, safety control signals, etc., and these information can be collectively referred to as inverter safety control related signals.

[0071] In embodiments of this disclosure, the inverter operation request signal may indicate a signal requesting the inverter to operate, particularly including signals requesting operation control for a first side and a second side of the inverter, respectively. Furthermore, the inverter operation request signal is typically a three-phase signal, for example, including U, V, and W signals respectively, and for example, the signal for each side is a three-phase signal. As an example, the operation request signal may be represented as PWM_x_H and PWM_x_L, where PWM_x_H indicates the inverter high-side operation request signal, and PWM_x_L indicates the inverter low-side operation request signal, and x may refer to the U-phase, V-phase, or W-phase of the inverter. The operation request signal is typically high (level) active and can trigger operation on the corresponding side. It should be noted that PWM_x_H and PWM_x_L here may also be referred to as initial / input operation request signals. The system or devices within the system may process these signals to generate various signals, such as any intermediate signals or result signals generated from signal processing, such as intermediate operation signals, operation control signals, etc., and these information may be collectively referred to as inverter operation control related signals.

[0072] In embodiments of this disclosure, the inverter control signal may indicate a control signal for setting the inverter's operating mode. Specifically, it may include setting control signals PWM_x_H_out and PWM_x_L_out for the first and second sides of the inverter, respectively, to execute the corresponding operating mode. This operating mode may include a normal operating mode, a safety protection mode such as ASC, FreeWheeling (abbreviated as "FW", also known as "SPO" or free-wheeling mode), etc.

[0073] Here, the valid levels of the safety protection enable signal, safety request signal, and operation request signal are merely illustrative and not limiting. For example, the safety protection enable signal can also be active high, and the safety request signal and operation request signal can also be active low, depending on the specific signal settings, which will not be elaborated here.

[0074] According to embodiments of this disclosure, at least one of the inverter safety control-related signals and the inverter operation control-related signals can be delayed to cause signal delay. Specifically, signal delay refers to a delay in the occurrence of signal state changes, the meaning of which is known in the art and will not be described in detail here. In embodiments of this disclosure, the delay processing can be performed on the input signal itself, or the delay processing can be performed on an intermediate signal generated based on the input signal, as will be described in detail below.

[0075] Here, the delay can be implemented using various logic circuits, devices, apparatuses, etc., known in the art. For example, it can be implemented using a latch to latch the state of the input control signal for a specific duration before providing it to subsequent devices. The implementation of the delay will not be described in detail here.

[0076] According to embodiments of this disclosure, delays are applied to both inverter safety control-related signals and inverter operation control-related signals. Specifically, different delays are applied. Preferably, the delay applied to the inverter safety control-related signals can be greater than the delay applied to the inverter operation control-related signals, so that the state changes of the safety control signals and operation control signals can be performed asynchronously. In particular, when the two sides of the inverter are in different operating modes, and mode switching of the switching transistors is performed on and off on both sides of the inverter—for example, one side requests to enter ASC mode while the other side performs PWM shutdown, or one side requests to exit ASC mode while the other side performs PWM turn-on—it is preferable to turn off the switching transistors first, and then turn them on again. This effectively avoids the problem of serial turn-on of the inverter during mode switching.

[0077] In some embodiments of this disclosure, delays may be applied to different signal state changes for each of the inverter safety control-related signals and inverter operation control-related signals. For example, delays may be applied to both the rising and falling edges of the signal. In particular, the delays for the rising and falling edges may be different; preferably, the delay for the rising edge may be less than the delay for the falling edge. Specifically, when both sides of the inverter are in the same operating mode, such as safety protection mode and inverter operation mode, and the switching transistors on and off are switched on and off on both sides of the inverter respectively, the state changes of the switching transistors on both sides of the inverter can be asynchronous, similar to what has been described above. This can effectively avoid the problem of serial conduction when the switching transistors on both sides of the inverter change state.

[0078] The implementation of the vehicle inverter control system according to embodiments of the present disclosure, and in particular the implementation of the various devices included in the system, will be further described below with reference to the accompanying drawings.

[0079] According to embodiments of this disclosure, the first signal generating apparatus is adapted to process a safety request signal to generate appropriate inverter safety control related signals. Specifically, when a safety protection enable signal is active, the safety request signal can be subjected to a first delay processing to generate an intermediate safety signal delayed for a first duration. More specifically, the first signal generating apparatus can perform a first delay processing on the safety request signal to generate the intermediate safety signal, and can determine the state of the intermediate safety signal based on the state of at least one of the safety protection enable signal and the safety request signal.

[0080] In some embodiments of this disclosure, the security request signal may include a first security request signal for a security protection request on the first side of the inverter and a second security request signal for a security protection request on the second side of the inverter. Correspondingly, the generated intermediate security signal may also include intermediate security signals for the first side and the second side of the inverter, respectively.

[0081] In some embodiments of this disclosure, the first signal generating device may be configured to set the state of an intermediate security signal based on a security protection enable signal. When the security protection enable signal is active (e.g., when the security protection enable signal is low), the state of the intermediate security signal is set based on the states of both the first and second security request signals. When the security protection enable signal is inactive, the intermediate security signal is set to an inactive state (e.g., low).

[0082] In some embodiments of this disclosure, the first signal generating device may be further configured to, when a security protection enable signal is active and the states of the first and second security request signals are different, set an intermediate security signal for the same side to change synchronously with the security request signal, wherein the state change of the intermediate security signal for the same side is delayed relative to the state change of the security request signal by a first duration. In some embodiments of this disclosure, the first signal generating device may be further configured to, when a security protection enable signal is active and the states of the first and second security request signals are the same, or when a security protection enable signal is inactive, set the intermediate security signal to remain in an inactive state.

[0083] In this article, "synchronization" should not be understood as "completely synchronized in time" or "simultaneous," but rather as the states of two signals (input and output signals) changing in the same or similar manner. That is, the state of the output signal "follows" the state of the input signal, but there may be a delay between them. For example, when the input signal is high, the output signal remains high after a predetermined delay; when the input signal switches to low, the output signal also switches to low after a predetermined delay. For example, in the case of inverter safety protection (e.g., ASC mode), it is often necessary to apply safety request signals with different states to both sides of the inverter. For example, a valid safety request signal (e.g., high level) is applied to one side of the inverter, while an invalid safety request signal (e.g., low level) is applied to the other side, thereby effectively activating or deactivating the ASC safety protection mode. According to embodiments of this disclosure, when ASC mode is activated (security enable signal is active) and the security request signal is active, the intermediate security signal will change synchronously with respect to the security request signal, with a delay of a specific time. For example, when the security request signal changes from low to high (rising edge), the intermediate security signal will also change from low to high after a specific delay. The signal state will change in a similar manner when exiting ASC mode. In particular, the high-to-low state change (falling edge) will also be delayed by a specific time.

[0084] Furthermore, in some embodiments of this disclosure, the delays of the rising edge and the falling edge may be the same; here, both are delayed by a first duration. In some embodiments of this disclosure, the delays of the rising edge and the falling edge may be different; here, the first duration of the delay corresponding to the security request signal may include a first delay sub-duration corresponding to the rising edge and a second delay sub-duration corresponding to the falling edge.

[0085] In other cases, such as when the safety request signals on both sides of the inverter are in the same state (e.g., both are high or low), it may indicate that the inverter is in an abnormal operating mode. In such cases, it can switch to an appropriate safety protection mode, such as FW mode, to implement safety protection. Furthermore, if the safety protection enable signal is invalid (e.g., high level), this means the inverter is not permitted to enter the safety protection mode. Therefore, the safety request signal will remain invalid, and the safety protection mode will not be triggered regardless of the state of the safety request signal. Intermediate safety signals will remain invalid (e.g., low level).

[0086] According to embodiments of this disclosure, the state relationships between the safety protection enable signal, the safety request signal, and the intermediate safety signal implemented by the first signal generating device are shown in Table 1 below. SFY_EN indicates the safety protection enable signal, SFY_H and SFY_L indicate the safety request signals of the high and low sides of the inverter, respectively, and SFY_H_FB_2 and SFY_L_FB_2 indicate the intermediate safety signals of the high and low sides of the inverter, respectively. H represents a high level and L represents a low level.

[0087] Table 1

[0088]

[0089] According to embodiments of this disclosure, processing of a security request signal may include delaying an intermediate request signal derived from the security request signal, and then obtaining an intermediate security signal based on the delayed intermediate request signal.

[0090] According to embodiments of this disclosure, the generation of at least one of the intermediate request signal and the intermediate safety signal can be performed in an appropriate manner. In particular, for each side of the inverter, at least one of the intermediate request signal and the intermediate safety signal can also be generated based on corresponding signals from both sides of the inverter. As an example, for each side of the inverter, the intermediate request signal can be generated based on the safety request signals from both sides of the inverter, and / or, the intermediate safety signal can be generated based on the delayed intermediate request signals from both sides of the inverter.

[0091] In this way, the signal processing on each side of the inverter takes into account the mutual influence between the signals on both sides of the inverter. This allows for the accurate and appropriate generation of intermediate safety signals for safety request signals, effectively eliminating abnormal input safety control signals. Furthermore, it accurately sets control signals when entering and leaving safety protection modes to instruct corresponding operations. For example, based on the state of the input safety request signal, appropriate safety protection modes can be constructed, such as ASC mode, FW mode, etc.

[0092] According to an embodiment of this disclosure, the first signal generating device B1 is configured to set the state of an intermediate security signal based on a security protection enable signal SFY_EN. When the security protection enable signal SFY_EN is valid, the states of the intermediate security signals SFY_H_FB_2 and SFY_L_FB_2 are set based on the states of the first and second security request signals SFY_H and SFY_L. When the security protection enable signal SFY_EN is invalid, the intermediate security signal is set to an invalid state.

[0093] Specifically, the first signal generating device B1 is further configured to: when the safety protection enable signal SFY_EN is valid and the first and second safety request signals SFY_H and SFY_L are in different states, set the intermediate safety signals SFY_H_FB_2 and SFY_L_FB_2 to follow the safety request signals SFY_H and SFY_L used to control the switching transistors on the same side of the inverter and delay them for a first duration relative to the safety request signals SFY_H and SFY_L; and when the safety protection enable signal SFY_EN is valid and the first and second safety request signals SFY_H and SFY_L are in the same state, set the intermediate safety signals SFY_H_FB_2 and SFY_L_FB_2 to an invalid state.

[0094] In this article, the term "follow" can be understood as the output signal changing state synchronously with the input signal after a predetermined delay. For example, when the input signal is high, the output signal remains high after a predetermined delay; when the input signal switches to low, the output signal also switches to low after a predetermined delay.

[0095] The first signal generating device B1 can be implemented in various suitable ways. In particular, it can be implemented using suitable logic devices, such as various logic gates. In some embodiments, the first signal generating device may further include a first logic circuit configured to perform a NAND operation on the first security request signal and the second security request signal, and to perform an AND operation on the NAND result, the inverted security protection enable signal, and each of the first security request signal and the second security request signal to generate a first intermediate request signal for the first side and a second intermediate request signal for the second side, respectively.

[0096] The first signal generating device B1 may further include first and second delay circuits configured to delay the first and second intermediate request signals for a first duration and a second duration, respectively; and a second logic circuit configured to perform NAND operations on the delayed first and second intermediate request signals, and to perform an AND operation on the NAND result with each of the delayed first and second intermediate request signals to generate a first intermediate security signal SFY_H_FB_2 for the first side and a second intermediate security signal SFY_L_FB_2 for the second side, respectively.

[0097] In this document, NAND stands for NAND gate, AND stands for AND gate, OR stands for OR gate, and INV stands for inverter (i.e., inverter). These logic control functions can be implemented using various appropriate logic gate circuits, which will not be described in detail here. In particular, the first and second logic circuits can be implemented in the same way, for example, using the same logic gate structure. Figure 4A A logic block diagram of an exemplary first signal generation device B1 is shown.

[0098] The implementation of the second signal generation device B2 will be described in detail below. According to embodiments of this disclosure, the second signal generation device B2 is adapted to process an operation request signal to generate an inverter operation control-related signal. Specifically, in the case that the safety protection enable signal is invalid, a second delay processing can be performed on the operation request signal to generate an operation control signal delayed for a second duration. In particular, the operation control signal can be generated by performing the second delay processing on the operation request signal, and the state of the operation control signal can be determined based on the state of at least one of the safety protection enable signal and the operation request signal.

[0099] In some embodiments of this disclosure, the operation request signal may include a first operation request signal for an operation request on the first side of the inverter and a second operation request signal for an operation request on the second side of the inverter. Correspondingly, the generated operation control signal may also include operation control signals for the first side and the second side of the inverter, respectively.

[0100] In some embodiments of this disclosure, the second signal generating device may be configured to set the state of the operation control signal based on a safety protection enable signal. In the case where the safety protection enable signal is invalid (e.g., the safety protection enable signal is high and ineffective), the state of the operation control signal is set based on the states of both the first and second operation request signals. In the case where the safety protection enable signal is active, the operation control signal is set to an invalid state (e.g., low level).

[0101] In some embodiments of this disclosure, the second signal generating device may be further configured to, when the security protection enable signal is invalid and the states of the first and second operation request signals are different, set the operation control signal for the same side to change synchronously with the operation request signal, wherein the state change of the operation control signal for the same side is delayed by a second duration relative to the state change of the operation request signal. In some embodiments of this disclosure, the second signal generating device may be further configured to, when the security protection enable signal is invalid and the states of the first and second security request signals are the same, or when the security protection enable signal is active, set the operation control signal to remain in an invalid state.

[0102] According to embodiments of this disclosure, the state relationships among the safety protection enable signal SFY_EN, operation request signals PWM_x_H and PWM_x_L, and operation control signals PWM_x_H_FB_3 and PWM_x_L_FB_3 implemented by the second signal generation device are shown in Table 2 below. SFY_EN indicates the safety protection enable signal, PWM_x_H and PWM_x_L indicate the operation request signals for the high and low sides of the inverter, respectively, and PWM_x_H_FB_3 and PWM_x_L_FB_3 indicate the operation control signals for the high and low sides of the inverter, respectively.

[0103] Table 2

[0104]

[0105] In some embodiments, the second signal generation circuit may be configured to include: a third logic circuit configured to perform a NAND operation on a first operation request signal and a second operation request signal, and to perform an AND operation on the NAND result, a security protection enable signal, and each of the first operation request signal and the second operation request signal to generate a first intermediate operation signal PWM_x_H_FB for a first side and a second intermediate operation signal PWM_x_L_FB for a second side, respectively; two delay circuits configured to delay each of the first and second intermediate operation signals by a second duration Td2 and a third duration Td3, respectively; and another logic circuit configured to perform a NAND operation on the first and second operation request signals that have been delayed by a fixed duration (e.g., Td2), and to perform an AND operation on the NAND result with the first and second operation request signals that have been delayed by another duration (e.g., Td2+Td3), to generate an operation control signal PWM_x_H_FB_3 for a first side and a second operation control signal PWM_x_L_FB_3 for a second side.

[0106] It should be noted that the signal processing method of the second signal generating device can be similar to that of the first signal generating device. Therefore, similar logic circuits, logic devices, logic gates, etc., can be used for implementation, which will not be described in detail here. As an example, the signal delay of the second signal generating device is less than that of the first signal generating device. Figure 4B An exemplary logic block diagram of a second signal generation apparatus B2 according to an embodiment of the present disclosure is shown.

[0107] The implementation of the third signal generating device B3 will be described in detail below. Specifically, the third signal generating device can be configured to further set safety control signals for the inverter based on operation request signals. In particular, the safety control signal on one side of the inverter can be set based on the intermediate safety signal on that side and the operation request signal on the other side of the inverter. This allows the safety control signal on one side of the inverter to be optimized by comprehensively considering the operating states on both sides of the inverter, thereby improving the execution of the safety protection mode. Specifically, when the inverter enters and leaves the safety protection mode, the on / off control of the conduit on that side can be optimized, avoiding the risk of serial conduction due to operation on the other side.

[0108] In some embodiments of this disclosure, the safety control signal for the inverter side can be set based on an intermediate safety signal on that side and an intermediate operation signal on the other side. The intermediate operation signal can be derived from an operation request signal, as described above with reference to the second signal generation device, and will not be described in detail here.

[0109] In some embodiments of this disclosure, the third signal generating device can perform logical operations on both the operation control signal on one side of the inverter and the intermediate request signal on the other side of the inverter to generate a safety control signal. Specifically, the third signal generating device includes a logic circuit configured to perform a NAND operation on the intermediate safety signal for that side and the intermediate operation signal for the other side of the inverter for each of the first and second sides of the inverter, and then perform an AND operation on the NAND result with the intermediate safety signal delayed by Td3 on that side to generate the safety control signal for that side. Such logical operations can be performed in the same manner as the first logic circuit described above; for example, similar logic circuits, logic devices, logic gates, etc., can be used, and will not be described in detail here.

[0110] It should be noted that in embodiments of this disclosure, both the operation request signal and the operation control signal may include three-phase signals, for example, the signal on each side may be a three-phase signal, such as U, V, and W signals. In one implementation, for example, a logical operation (e.g., OR operation) may be performed on the three-phase signals first, and then a safety control signal may be generated based on the result and an intermediate safety signal. Figure 4C An exemplary logic block diagram of a third signal generation apparatus B3 according to an embodiment of the present disclosure is shown.

[0111] According to embodiments of this disclosure, the state relationships between the intermediate operation signals PWM_x_H_FB\PWM_x_L_FB, the intermediate safety signals SFY_H_FB_2\SFY_L_FB_2, and the safety control signals SFY_H_FB_3\SFY_L_FB_3, implemented by the third signal generation device, are shown in Tables 3a and 3b below. PWM_u_H_FB, PWM_v_H_FB, and PWM_w_H_FB respectively indicate the three-phase PWM intermediate operation signals on the high side of the inverter; PWM_u_L_FB, PWM_v_L_FB, and PWM_w_L_FB respectively indicate the three-phase PWM intermediate operation signals on the low side of the inverter; and SFY_H_FB_3 and SFY_L_FB_3 respectively indicate the safety control signals on the high and low sides of the inverter. Table 3a shows the signal state relationships of the safety control signals on the low side of the inverter, and Table 3b shows the signal state relationships of the safety control signals on the high side of the inverter.

[0112] Table 3a

[0113]

[0114] Table 3b

[0115]

[0116]

[0117] The following continues to describe the implementation of the second signal generation device B2 according to embodiments of the present disclosure. The second signal generation device is further capable of generating inverter control signals based on safety control signals and operation control signals for controlling the inverter to put it into an appropriate operating mode.

[0118] Specifically, the second signal generation device can perform logical operations on the safety control signal and the operation control signal. In particular, it determines the inverter control signal by performing an OR (logical "OR") operation on the safety control signal and the operation control signal. Specifically, it can appropriately set the operating state of the inverter control signal. The OR operation here can be implemented using various suitable logic circuits, devices, and logic gates, which will not be described in detail here.

[0119] The state relationships between the operation control signal PWM_x_H_FB_3, the safety control signal SFY_H_FB_3, and the inverter operation control signal PWM_x_H_out, implemented by the second signal generation device, are shown in Tables 4a and 4b. Here, PWM_x_H_out represents the inverter control signal on the high-side of the inverter, and its state relationship is shown in Table 4a; PWM_x_L_out represents the inverter control signal on the low-side of the inverter, and its state relationship is shown in Table 4b.

[0120] Table 4a

[0121]

[0122]

[0123] Table 4b

[0124]

[0125] Thus, the inverter control system according to embodiments of this disclosure can appropriately set the inverter control signals based on input safety request information and control request information, and according to the activation or deactivation of the safety protection enable signal, thereby achieving appropriate setting of the inverter operating mode. In particular, in some embodiments, when the safety protection enable signal is active to indicate safety protection, if the safety request signal states on the first and second sides of the inverter are different, the inverter is controlled to enter the Active Short Circuit Control (ASC) safety protection mode; if the safety request signal states on the first and second sides of the inverter are the same, the inverter is controlled to enter the Free-Rotation (FW) safety protection mode; and / or when the safety protection enable signal is inactive, if the operation request signal states on the first and second sides of the inverter are different, the inverter is controlled to enter the normal operation mode; if the safety request signal states on the first and second sides of the inverter are the same, the inverter is controlled to enter the FW safety protection mode. Table 6 shows the relationship between the operating states of the input and output signals implemented by the safety protection device according to embodiments of this disclosure.

[0126] Table 6

[0127]

[0128] Figure 5A A timing diagram of various control signals when entering a security control mode according to an embodiment of the present disclosure is shown, wherein the security protection enable signal SFY_EN is active low, and the delay for the falling edge of the security request signal is Td1f, and the delay for the rising edge is Td1r. These two delays are different here as an example, but they can also be the same.

[0129] Figure 5BA timing diagram of the various control signals when exiting the security control mode according to an embodiment of the present disclosure is shown. The security protection enable signal SFY_EN is inactive when high, and the delay for the falling edge of the operation request signal is Td2f, and the delay for the rising edge is Td2r. These two delays are different here as an example, but they can also be the same. It should be noted that the delay for the falling edge of the operation request signal can be the same as or different from the delay for the falling edge of the security request signal, and / or, the delay for the rising edge of the operation request signal can be the same as or different from the delay for the rising edge of the security request signal.

[0130] Therefore, the security control scheme according to the embodiments of this disclosure can achieve at least one of the following advantageous technical effects.

[0131] (1) Based on the motor speed and safety protection enable signal request (high-side request or low-side request), the safety logic circuit can implement not only low-side ASC, but also high-side ASC.

[0132] (2) After the safety control request is not received, i.e., after the safety control is released, this safety logic circuit can quickly switch to normal PWM control without the risk of cross-conduction (short circuit between high voltage power supply (HV+) and ground (GND)). When a safety control request is received, i.e. after the safety control is activated, this safety logic circuit can accurately switch from normal PWM control to safety protection mode without the risk of serial conduction.

[0133] (3) During normal PWM control, this safety logic hardware circuit includes a design to prevent shoot-through (i.e., direct conduction of the high-voltage power supply (HV+) to ground (GND) from the upper bridge / transistor to the lower bridge / transistor of the inverter). In particular, during normal PWM control, such as when switching from high-side PWM control to low-side PWM control, the switching timing of the high-side and low-side switches can be accurately controlled, avoiding the problem of serial conduction caused by simultaneous switching.

[0134] Figure 5C A timing diagram of various control signals in a safety protection device according to another embodiment of the present disclosure is shown. Here, for simplicity, the delays for the rising and falling edges are shown as the same. It should be noted that in actual implementation, the delays for the rising and falling edges may also be different.

[0135] The following describes an implementation example of an inverter control system according to an embodiment of the present disclosure.

[0136] The first example primarily concerns the operations performed by the control system when entering ASC safety mode. It will be illustrated using the normal control of the high-side ASC and the normal U-phase PWM low-side switch as an example. In this example, the safety protection enable signal ( / SFY_EN) is active, there is a request for high-side ASC, and the U-phase low-side PWM is disconnected. The control system can be implemented as follows:

[0137] First, based on the logic block diagram and state table mentioned above, it is found that when the safety protection enable signal is active ( / SFY_EN=L), the operation request signals PWM_x_H and PWM_x_L are invalid. At the same time, there is a request from the high side of ASC, that is, the safety request signal SFY_H is high (the safety request signal SFY_L is low). This request signal passes through the first signal generation device B1, and after a time delay Td1 (about 1μs), the intermediate safety signal SFY_H_FB_2 is also high.

[0138] Then, SFY_H_FB_2 passes through the third signal generation device B3. The function of B3 is to check whether there is a control action on the low-side switching transistors when a high-side ASC request occurs, such as whether PWM_x_L_FB is high. If so, the high-side ASC request signal will be set to low output for SFY_H_FB_3; otherwise, it will be set to high output for SFY_H_FB_3. The high-active ASC signal can then be output through the OR gate of the second signal generation device B2, simultaneously turning on the three high-side switching transistors, thus realizing high-side ASC.

[0139] Here, it needs to be further explained that when the safety signal is active ( / SFY_EN=L), the PWM_x_H and PWM_x_L inputs are invalid. At this time, the high-to-low change of the PWM_u_L_FB of B2 passed to the output of the next stage OR gate has a delay of Td2 (500ns), that is, a turn-off delay of 500ns. This turn-off delay is 1μs different from the turn-on delay of the high-side ASC switch, thus avoiding the serial turn-on of the high and low-side switches.

[0140] The following describes an inverter safety control method according to embodiments of the present disclosure. Figure 6 A flowchart of an inverter safety control method according to an embodiment of the present disclosure is shown. In method 600,

[0141] In step S601, an intermediate security signal is generated based on the security protection enable signal and the security request signal. When the security protection enable signal is active, the security request signal is subjected to a first delay processing to generate an intermediate security signal that is delayed by a first duration Td1.

[0142] Step S602: Generate an operation control signal based on the safety protection enable signal and the operation request signal. In the case of the safety protection enable signal failure, the operation request signal is subjected to a second delay processing to generate an operation control signal that is delayed for a second duration Td2, and the second duration Td2 is shorter than the first duration Td1.

[0143] Step S603: Generate a safety control signal based on the intermediate operation signal and intermediate safety signal obtained from the operation request signal.

[0144] Step S604: Based on the safety control signal and the operation control signal, an inverter control signal is generated to set the inverter's operating mode.

[0145] It should be noted that the sequence of steps shown here is merely illustrative, and the sequence of steps can be adjusted appropriately. For example, steps S601, S602, and S603 can be executed in parallel. In the embodiments of this disclosure, the inverter control method may further include method steps corresponding to the operation of the first to third signal generation devices described above, which will not be described in detail here.

[0146] It should be noted that such inverter safety control methods can be implemented by various suitable entities, particularly through the corresponding devices of the aforementioned safety protection equipment. They can also be implemented by various suitable devices, processors (e.g., CPUs), etc., or through instructions / programs stored on storage devices, computer program products, etc., which will not be described in detail here.

[0147] Figure 7 A schematic diagram of the simulation results for the signal in this example is shown, for example, the simulation results of LTspice. As can be seen from the figure, during the normal control of the high-side ASC and the normal U-phase PWM low-side switch, by applying an appropriate delay to the safety control-related signals, the execution timing of safety control and operation control can be optimized based on the state of the safety request signal before the delay. Preferably, the U-phase PWM low-side switch can be disconnected before the high-side switch is short-circuited to execute the high-side ASC, so that the high-side and low-side of the inverter will not be simultaneously turned on, avoiding damage caused by serial conduction.

[0148] Specifically, for example, at 50μs, when SFY_EN goes low, the high-side SFY_H goes high, and PWM_u_L_IN goes low, the safety control mode takes effect. Through the signal processing implemented by the safety protection device of this disclosure, SFY_H will be delayed by a first delay Td1, so that SFY_H_FB_2 goes high after the first delay Td1, and PWM_u_L_IN will be delayed by a second delay Td2, so that the inverter operation control signal PWM_u_L_FB_2 will go low after the second delay Td2.

[0149] Since Td1 is greater than Td2, at time Td2, SFY_H_FB_2 has not yet changed its state and remains low. Therefore, the control signal PWM_u_L_out for the lower side of the inverter will go low, while the control signal PWM_x_H_out for the upper side will only go high after Td1. This causes the lower-side switch of the inverter to turn off at time Td2, while the upper-side control signal PWM_x_H_out remains low, keeping the upper-side switch off until after Td1 to achieve ASC mode. Clearly, this prevents the high and low sides of the inverter from conducting simultaneously, avoiding damage caused by serial conduction.

[0150] The second example primarily concerns the operations performed by the control system when exiting the ASC safety mode. It will be illustrated using the example of the safety protection enable signal being released ( / SFY_EN being high), the disappearance of the high-side ASC request, and the request for the U-phase low-side PWM switching transistor to turn on. For this example, the implementation of the inverter control system according to this disclosure is as follows:

[0151] First, based on the logic block diagram and state table described above, when the safety signal fails (SFY_EN = H), the PWM_u_H and PWM_u_L inputs are valid, and there is a PWM request from the low / high side U phase (PWM_u_L is high, PWM_u_H is low). This request signal passes through the second signal generation device B2, resulting in PWM_u_L_FB also being high. Simultaneously, the high side ASC request to turn off results in an input where SFY_EN is high (SFY_H is low). After passing through the first signal generation device B1, a delay Td 1 (approximately 1 μs) is obtained before SFY_H_FB_2 becomes low.

[0152] Then, SFY_H_FB_2 passes through the third signal generation device B3. The function of B3 is: when there is a high-side ASC request, it checks whether there is a PWM_x_L_FB high on the low side, that is, it controls the conduction of the low-side switch (or when there is a low-side ASC request, it checks whether there is a PWM_x_H_FB high on the high side, that is, it controls the conduction of the high-side switch). If present, the high-side ASC request signal will set SFY_H_FB_3 to low output; otherwise, the high-side ASC request signal will set SFY_H_FB_3 to high output. When a high-side ASC shutdown request occurs, it will be observed that the high-side ASC shutdown request delay is 1μs. During this shutdown delay (i.e., before the delay expires), SFY_H_F_2 remains high, and PWM_u_L_FB also becomes high. Therefore, SFY_H_FB_3 is low output (based on the state table of B3), directly reaching the high-side OR gate input (PWM_u_H_FB_3 is low, and the high-side output control signal PWM_u_H_out is low output), thus prematurely disabling the high-side switch's ASC function.

[0153] After approximately (Td2)500ns, the U-phase low-side OR gate receives an input where PWM_u_L_FB_3 is also high, meaning PWM_u_L_out is high, which enables the low-side switch to be turned on, thus avoiding the problem of serial conduction of the high and low-side switches.

[0154] Figure 8 A schematic diagram of the simulation results for the signal in this embodiment is shown, for example, the simulation results of LTspice. As can be seen from the figure, when the high-side ASC safety protection is canceled while simultaneously requesting the conduction of the low-side U-phase switch, this situation can be achieved by making the safety protection enable signal high. Furthermore, by applying an appropriate delay to the safety request signal, the execution timing of safety control and operation control can be optimized based on the state of the safety control-related signals before the delay. Therefore, upon receiving the high-side ASC safety protection cancellation signal, the normal operation of the inverter's high side is restored as quickly as possible, i.e., the high-side switch is turned off, and the low-side switch is turned on shortly afterward. This prevents the high and low sides of the inverter from conducting simultaneously, avoiding damage caused by serial conduction.

[0155] Specifically, for example, at 100μs, when SFY_EN goes high, the high-side SFY_H goes low, and PWM_uL_IN goes high, the safety control mode fails. Through the signal processing implemented by the safety protection device of this disclosure, SFY_H will be delayed by a first delay Td1, so that SFY_H_FB_2 goes low after the first delay Td1, and PWM_uL_IN will be delayed by a second delay Td2, so that the inverter operation control signal PWM_uL_FB will go high after the second delay Td2.

[0156] Furthermore, since SFY_H_FB_2 remains high before Td1 or even Td2, while PWM_uL_FB is still high, SFY_uH_FB_3 will go low, causing PWM_H_out to go low earlier, thus enabling the high-side switch's ASC function to be turned off prematurely. However, until time Td2, the inverter operation control signal PWM_uL_FB_2 will go high, turning on the low-side switch. Clearly, this prevents the inverter's high and low sides from conducting simultaneously, avoiding damage caused by serial conduction.

[0157] In this way, after the safety protection enable signal is released ( / SFY_EN=H / becomes high level), the normal PWM control of SW can be quickly and immediately restored. Through the signal generation devices B1-B3 and their internal delay functions Td1, Td2, and Td3, the risk of the high voltage DC being temporarily short-circuited to ground can be avoided, thereby avoiding the 4-5μs wait required for the normal PWM control of SW mentioned above.

[0158] Those skilled in the art will understand that the steps of the method according to this disclosure are not limited to being performed in the order listed above. Furthermore, in this disclosure, terms such as "comprising" and "including" indicate that, in addition to steps that are directly and explicitly stated in the specification and claims, the technical solution of this application does not exclude the presence of other steps not directly or explicitly stated.

[0159] It will be understood by those skilled in the art that the steps of the method according to this application are not limited to being performed in the order listed above. Although this application has been disclosed above with reference to preferred embodiments, it is not limited thereto. Any modifications and alterations made by those skilled in the art without departing from the spirit and scope of this application should be included within the protection scope of this application; therefore, the protection scope of this application should be determined by the scope defined in the claims.

Claims

1. A safety protection device for a motor controller, the motor controller including a control chip and an inverter, the inverter being configured to convert direct current from a vehicle battery pack into alternating current for driving a motor, the control chip being configured to control the switching states of various switching transistors in the inverter, the safety protection device being configured to receive operation request signals (PWM_x_H, PWM_x_L), safety protection enable signals (SFY_EN), and safety request signals (SFY_H, SFY_L) from the control chip, and control the inverter to enter corresponding operating modes based on these signals, wherein... The safety protection device includes: The first signal generating device (B1) is configured to generate an intermediate security signal (SFY_H_FB_2, SFY_L_FB_2) based on a security protection enable signal (SFY_EN) and a security request signal (SFY_H, SFY_L). The first signal generating device is configured to perform a first delay processing on the security request signal (SFY_H, SFY_L) when the security protection enable signal is active, so as to generate an intermediate security signal that is delayed for a first duration (Td1). The second signal generation device (B2) is configured to generate intermediate operation signals (PWM_x_H_FB, PWM_x_L_FB) based on a safety protection enable signal (SFY_EN) and an operation request signal (PWM_x_H, PWM_x_L), and to perform a second delay processing on the operation request signal (PWM_x_H, PWM_x_L) in the event that the safety protection enable signal fails, so as to generate operation control signals (PWM_x_H_FB_3, PWM_x_L_FB_3) that are delayed for a second duration (Td2); and The third signal generation device (B3) is configured to generate safety control signals (SFY_H_FB_3, SFY_L_FB_3) based on intermediate operation signals (PWM_x_H_FB, PWM_x_L_FB) and intermediate safety signals (SFY_H_FB_2, SFY_L_FB_2). The second signal generating device (B2) is further configured to generate inverter control signals (PWM_x_H_out, PWM_x_L_out) based on safety control signals (SFY_H_FB_3, SFY_L_FB_3) and operation control signals (PWM_x_H_FB_3, PWM_x_L_FB_3), which are used to set the switching state of each switching transistor in the inverter, thereby enabling the inverter to enter the corresponding safety protection mode or normal operation mode.

2. The safety protection device according to claim 1, wherein, The inverter is configured as a bridge inverter circuit consisting of switching transistors on a first side and a second side. The safety request signals (SFY_H, SFY_L) include a first safety request signal (SFY_H) for controlling the switching transistors on the first side of the inverter and a second safety request signal (SFY_L) for controlling the switching transistors on the second side of the inverter. The operation request signals (PWM_x_H, PWM_x_L) include a first operation request signal (PWM_x_H) for controlling the switching transistors on the first side of the inverter and a second operation request signal (PWM_x_L) for controlling the switching transistors on the second side of the inverter. The inverter control signals (PWM_x_H_out, PWM_x_L_out) include a first inverter control signal (PWM_x_H_out) and a second inverter control signal (PWM_x_L_out) for controlling the states of the switching transistors on the first side and the second side of the inverter, respectively.

3. The safety protection device according to claim 2, wherein, The safety protection device is further configured as follows: When the safety protection enable signal (SFY_EN) is valid, if the states of the first and second safety request signals (SFY_H, SFY_L) are different, the inverter is controlled to enter the ASC mode of the corresponding side switch; if the states of the first and second safety request signals (SFY_H, SFY_L) are the same, the inverter is controlled to enter the FreeWheeling mode; and / or When the safety protection enable signal (SFY_EN) is invalid, the inverter is controlled to enter the normal operation mode when the states of the first and second operation request signals (PWM_x_H, PWM_x_L) are different; when the states of the first and second safety request signals (PWM_x_H, PWM_x_L) are the same, the inverter is controlled to enter the FreeWheeling mode.

4. The safety protection device according to claim 2 or 3, wherein, The first signal generating device (B1) is configured to set the state of the intermediate security signal based on the security protection enable signal (SFY_EN). When the security protection enable signal (SFY_EN) is valid, the state of the intermediate security signal (SFY_H_FB_2, SFY_L_FB_2) is set based on the states of the first and second security request signals (SFY_H, SFY_L). When the security protection enable signal (SFY_EN) is invalid, the intermediate security signal is set to an invalid state.

5. The safety protection device according to claim 4, wherein, The first signal generating device (B1) is further configured as follows: When the safety protection enable signal (SFY_EN) is valid and the first and second safety request signals (SFY_H, SFY_L) have different states, the intermediate safety signals (SFY_H_FB_2, SFY_L_FB_2) for each side of the inverter are set to follow the safety request signals (SFY_H, SFY_L) used to control the switches on the same side of the inverter and are delayed by a first duration (Td1) relative to these safety request signals (SFY_H, SFY_L); and When the security protection enable signal (SFY_EN) is valid and the first and second security request signals (SFY_H, SFY_L) are in the same state, the intermediate security signal (SFY_H_FB_2, SFY_L_FB_2) is set to invalid.

6. The safety protection device according to claim 2 or 3, wherein, The second signal generating device (B2) is configured to set the state of the operation control signal (PWM_x_H_FB_3, PWM_x_L_FB_3) based on the safety protection enable signal (SFY_EN). When the safety protection enable signal (SFY_EN) is invalid, the state of the operation control signal is set based on the state of the first and second operation request signals (PWM_x_H, PWM_x_L). When the safety protection enable signal (SFY_EN) is valid, the operation control signal is set to an invalid state.

7. The safety protection device according to claim 6, wherein, The second signal generating device (B2) is further configured as follows: When the safety protection enable signal (SFY_EN) is invalid and the first and second operation request signals (PWM_x_H, PWM_x_L) have different states, the operation control signal (PWM_x_H_FB_3, PWM_x_L_FB_3) for each side of the inverter is set to follow the operation request signal (PWM_x_H, PWM_x_L) used to control the switching transistors on the same side of the inverter and delayed by a second duration (Td2) relative to that operation request signal (PWM_x_H, PWM_x_L); and If the safety protection enable signal (SFY_EN) is invalid and the first and second operation request signals (PWM_x_H, PWM_x_L) are in the same state, the operation control signal (PWM_x_H_FB_3, PWM_x_L_FB_3) will be set to invalid.

8. The safety protection device according to claim 2 or 3, wherein, The first signal generating device (B1) further includes: The first logic circuit is configured to perform NAND operations on the first and second security request signals (SFY_H, SFY_L) and to invert the security protection enable signal (SFY_EN), and to perform AND operations on the NAND result and the inverted result of the security protection enable signal (SFY_EN) with the first security request signal and the second security request signal, respectively, to generate a first intermediate request signal for controlling the first-side switching transistor of the inverter and a second intermediate request signal for controlling the second-side switching transistor of the inverter, respectively. The first delay circuit is configured to delay the first and second intermediate request signals by a first duration (Td1), respectively. The second delay circuit is configured to delay the first and second intermediate request signals (SFY_H_FB_1, SFY_L_FB_1) that have been delayed for a first duration by a third duration (Td3); and The second logic circuit is configured to perform NAND operations on the first and second intermediate request signals (SFY_H_FB_1, SFY_L_FB_1) that have been delayed for a first duration, and to perform AND operations on the NAND results with the first and second intermediate request signals that have been delayed for a third duration, respectively, to generate a first intermediate safety signal (SFY_H_FB_2) for controlling the first-side switching transistor of the inverter and a second intermediate safety signal (SFY_L_FB_2) for controlling the second-side switching transistor of the inverter.

9. The safety protection device according to claim 8, wherein, The second signal generating device (B2) includes: The third logic circuit is configured to perform NAND operations on the first operation request signal (PWM_x_H) and the second operation request signal (PWM_x_L), and to perform AND operations on the NAND result and the safety protection enable signal (SFY_EN) with the first operation request signal and the second operation request signal, respectively, to generate a first intermediate operation signal (PWM_x_H_FB) for controlling the first-side switch of the inverter and a second intermediate operation signal (PWM_x_L_FB) for controlling the second-side switch of the inverter.

10. The safety protection device according to claim 8, wherein, The third signal generating device (B3) includes: The fourth logic circuit is configured to perform NAND operation on the second intermediate security signal (SFY_L_FB_2) and the first intermediate operation signal (PWM_x_H_FB) to obtain the first NAND result, and to perform NAND operation on the first intermediate security signal (SFY_H_FB_2) and the second intermediate operation signal (PWM_x_L_FB) to obtain the second NAND result; The third delay circuit is configured to delay the first and second intermediate safety signals by a third duration (Td3) and The fifth logic circuit is configured to perform an AND operation on the first NAND result and the second intermediate safety signal delayed by a third time, and to perform an AND operation on the second NAND result and the first intermediate safety signal delayed by a third time, to generate a first safety control signal (SFY_H_FB_3) for controlling the first-side switching transistor of the inverter and a second safety control signal (SFY_L_FB_3) for controlling the second-side switching transistor of the inverter.

11. The safety protection device according to claim 9 or 10, wherein, The second signal generating device (B2) also includes: The fourth delay circuit is configured to delay the first and second intermediate operation signals (PWM_x_H_FB, PWM_x_L_FB) by a second duration (Td2), respectively. The fifth delay circuit is configured to delay the first and second intermediate operation signals, which have been delayed for a second duration, for a third duration (Td3), respectively. The sixth logic circuit is configured to perform NAND operations on the first and second intermediate operation signals (PWM_x_H_FB_2, PWM_x_L_FB_2) delayed by a second duration, and to perform an AND operation on the NAND result with the first and second intermediate operation signals delayed by a third duration to generate a first operation control signal (PWM_x_H_FB_3) for controlling the first-side switch of the inverter and a second operation control signal (PWM_x_L_FB_3) for controlling the second-side switch of the inverter; and The seventh logic circuit is configured to perform an OR operation on the first safety control signal and the first operation control signal, and to perform an OR operation on the second safety control signal and the second operation control signal, to generate a first inverter control signal (PWM_x_H_out) and a second inverter control signal (PWM_x_L_out).

12. A motor controller comprising a control chip and an inverter, the inverter being configured to convert direct current from a vehicle battery pack into alternating current for driving a motor, the control chip being configured to control the switching states of various switching transistors in the inverter, wherein, The motor controller also includes a safety protection device according to any one of claims 1 to 11.

Images