A system and method for preventing shoot-through in power electronic equipment

Abstract

This invention discloses a power electronic equipment shoot-through prevention system and method, relating to the field of power electronics technology. The system includes: a control unit generating control signals for power branches and bypass branches; a hardware interlock drive unit receiving the control signals and priority configuration signals, dynamically switching interlock priority rules, and executing hardware-level interlock decisions to output drive signals; and an intelligent fault diagnosis unit injecting test signal combinations into the hardware interlock drive unit and diagnosing its effectiveness based on a comparison between the actual output state and the interlock priority rules. This application achieves nanosecond-level hardware interlocking and self-diagnosis through triple heterogeneous redundancy protection, effectively preventing dual-branch shoot-through and improving system reliability.

Description

Technical Field

[0001] This invention belongs to the field of power electronics technology, specifically relating to a power electronic equipment anti-straight-through system and method. Background Technology

[0002] In the operation of power electronic equipment (such as voltage compensation devices and uninterruptible power supplies), there are usually power branches that perform power conversion and bypass branches that maintain power supply during maintenance or faults. To prevent the simultaneous conduction of both branches and the formation of a low-impedance short-circuit loop, existing technologies mostly use software interlocks or simple discrete hardware logic gates for protection. However, software interlocks are prone to program crashes or infinite loops, and cannot fundamentally eliminate shoot-through faults. Existing hardware interlock schemes are usually single-layer fixed logic, which lacks a detection mechanism for the failure of the interlock circuit itself. When the interlock unit fails, the system is in an unprotected state without realizing it. Furthermore, it cannot dynamically adjust the interlock priority according to the system operating conditions, which may affect the continuity of power supply due to the rigidity of the interlock logic in special modes such as emergency bypass. Therefore, there is an urgent need for a shoot-through prevention technology solution with highly reliable interlocks, adaptability to operating conditions, and support for the effective diagnosis of the interlock mechanism itself. Summary of the Invention

[0003] To address the shortcomings of existing technologies, the present invention aims to provide a power electronic equipment anti-surge system and method, which realizes closed-loop monitoring of the reliability of nanosecond-level underlying hardware anti-surge protection and interlocking mechanism itself.

[0004] This invention discloses a power electronic equipment anti-straight-through system, comprising:

[0005] The control unit is configured to generate a first control signal for the power branch and a second control signal for the bypass branch.

[0006] A hardware interlock drive unit is connected between the control unit and the power branch and the bypass branch. It is configured to receive the first control signal, the second control signal and the priority configuration signal, dynamically switch the interlock priority rule based on the priority configuration signal, and perform hardware-level interlock decision on the first control signal and the second control signal according to the currently effective interlock priority rule, and output the corresponding first drive signal and the second drive signal.

[0007] An intelligent fault diagnosis unit, connected to the control unit and the hardware interlock drive unit, is configured to inject a preset combination of test signals into the hardware interlock drive unit, obtain the actual output state of the hardware interlock drive unit in response to the combination of test signals, and diagnose the effectiveness of the hardware interlock drive unit based on the comparison result of the actual output state and the interlock priority rule.

[0008] The interlock priority rules include a first priority mode and a second priority mode; in the first priority mode, when the first control signal is a valid on signal, the hardware interlock drive unit forcibly blocks the second drive signal; in the second priority mode, when the second control signal is a valid on signal, the hardware interlock drive unit forcibly blocks the first drive signal.

[0009] The hardware interlock driving unit includes a priority configuration pin, which receives the priority configuration signal. When the priority configuration pin is in a first level state, the hardware interlock driving unit switches to the first priority mode. When the priority configuration pin is in a second level state, the hardware interlock driving unit switches to the second priority mode. The hardware-level interlock decision follows the following truth table logic: when the first control signal and the second control signal are both valid turn-on signals, both the first driving signal and the second driving signal are forced to output invalid turn-off signals.

[0010] The preset test signal combination is a conflict signal combination that triggers the interlock priority rule to execute a forced block; the intelligent fault diagnosis unit is configured to: if the actual output state does not execute the forced block, determine that the hardware interlock drive unit has failed, and generate interlock failure fault information.

[0011] The intelligent fault diagnosis unit is configured to periodically trigger the injection of the preset test signal combination during system operation intervals; after determining that the hardware interlock drive unit has failed, the intelligent fault diagnosis unit generates the interlock failure fault information and reports the interlock failure fault information to the upper monitoring system through the fault reporting interface, while triggering the local alarm module to execute the corresponding fault prompt.

[0012] The control unit is further configured to perform software strategy interlocking: before generating the first control signal or the second control signal, it acquires the physical state feedback signals of the power branch and the bypass branch; and only when it is confirmed based on the physical state feedback signals that both the power branch and the bypass branch are in the off state, it allows the output of the corresponding first control signal or the second control signal.

[0013] The control unit is also configured to periodically perform cross-validation during system operation: comparing the currently output first control signal and second control signal, the output state of the hardware interlock drive unit, and the physical state feedback signal; when an inconsistency is detected between the first control signal and second control signal, the output state, and the physical state feedback signal, an emergency shutdown action is triggered, and corresponding pass-through fault information or drive failure fault information is generated.

[0014] The power electronic equipment anti-short-through system also includes a data freeze storage module connected to the control unit. The control unit is configured to execute a data freeze service program using the highest priority interrupt when a fault trigger signal is detected, and store snapshots of key variables within a preset control period before and after the fault trigger to the data freeze storage module. The snapshots of key variables include the first control signal and the second control signal, the physical state feedback signal, electrical parameter sampling values, the actual output state of the hardware interlock drive unit, and the value of the priority configuration signal.

[0015] Furthermore, this application also provides a power electronic equipment anti-shoo-through control method, applied to the power electronic equipment anti-shoo-through system as described above, comprising: generating a first control signal for a power branch and a second control signal for a bypass branch; receiving a priority configuration signal, dynamically switching interlock priority rules based on the priority configuration signal, and performing hardware-level interlock adjudication on the first control signal and the second control signal according to the currently effective interlock priority rules, and outputting corresponding first and second drive signals; injecting a preset test signal combination into the hardware interlock drive unit executing the hardware-level interlock adjudication, and obtaining the actual output state of the hardware interlock drive unit in response to the test signal combination; and diagnosing the effectiveness of the hardware interlock drive unit based on the comparison result between the actual output state and the interlock priority rules.

[0016] Before generating the first control signal for the power branch and the second control signal for the bypass branch, the method further includes: acquiring physical state feedback signals for the power branch and the bypass branch; verifying the operating state of the power branch and the bypass branch based on the physical state feedback signals; and allowing the step of generating the first control signal for the power branch and the second control signal for the bypass branch to be executed only when it is confirmed that both the power branch and the bypass branch are in the off state.

[0017] This invention discloses a shoot-through prevention system and method for power electronic equipment. By constructing a triple heterogeneous redundancy protection architecture, the system's safety and adaptability to different operating conditions are significantly improved. First, a hardware interlock drive unit performs nanosecond-level hardware-level interlock adjudication on the drive signal generation path, completely avoiding the shoot-through risk caused by software interlocking program anomalies. It also supports dynamic rule switching based on priority configuration signals, enabling seamless adaptation between normal compensation and emergency bypass modes, resolving the contradiction between fixed interlocking logic and variable operating conditions. Second, an intelligent fault diagnosis unit actively injects conflict test signal combinations into the hardware interlock drive unit, achieving online verification of the interlocking mechanism's effectiveness and filling the safety blind spot of unpredictable interlocking circuit failures in traditional solutions. Finally, by combining software strategy interlocking with a data freeze storage mechanism, a closed-loop protection system is formed, encompassing instruction verification, hardware execution, status feedback, and fault tracing. This not only significantly reduces the probability of power device burnout but also provides complete data for rapid fault location and elimination, effectively ensuring the long-term stable operation of power electronic equipment. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the anti-straight-through system architecture for power electronic equipment according to an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0021] like Figure 1 As shown in the figure, this application provides a power electronic equipment anti-surge system. The system mainly includes a control unit, a hardware interlock drive unit, a power branch, a bypass branch, and an intelligent fault diagnosis unit.

[0022] The control unit is configured to generate a first control signal for the power branch and a second control signal for the bypass branch. Specifically, as the core logic processing component of the system, the control unit can calculate and output pulse-width modulated signals or level signals for controlling the on / off state of power devices based on external commands, power grid conditions, or load requirements. For example, the control unit can be implemented using a microcontroller, digital signal processor, or field-programmable gate array, and the first and second control signals it generates correspond to the on / off commands for the power branch and bypass branch, respectively. It should be understood that although the control unit is drawn as an independent module in the figure, in practical applications, it can also be integrated into a higher-level control system, as long as it can output independent control signals downstream.

[0023] The hardware interlock drive unit is connected between the control unit and the power branch and bypass branch. It is configured to receive a first control signal, a second control signal, and a priority configuration signal. Based on the priority configuration signal, it dynamically switches the interlock priority rules and performs hardware-level interlock decisions on the first and second control signals according to the currently effective interlock priority rules, outputting the corresponding first and second drive signals. Specifically, the hardware interlock drive unit constitutes the first and fastest physical defense against direct pass-through in both branches. Unlike logical judgments that rely on software code execution, hardware-level interlock decisions are implemented through hardware logic within analog circuits, digital logic gates, or dedicated driver integrated circuits. Its response time is typically in the nanosecond range, much faster than the software cycle time. This means that even if the control unit simultaneously outputs a valid conduction signal due to program crashes or electromagnetic interference, the hardware interlock drive unit can forcibly intercept or correct the signal before it reaches the power device gate. Furthermore, this unit does not use fixed interlock logic but can adjust the decision strategy in real time based on the received priority configuration signal. For example, under certain operating conditions, it may be necessary to prioritize the operation of the power branch, while under other emergency conditions, the conduction of the bypass branch must be ensured unconditionally. This dynamic switching mechanism allows the system to flexibly adapt to changing operating requirements, avoiding the risk of power outages that may occur in special modes under traditional fixed interlocking schemes. As one implementation method, the hardware interlocking drive unit can be composed of gate drivers with built-in interlocking functions, combinations of discrete logic gate circuits, or complex programmable logic devices.

[0024] The intelligent fault diagnosis unit connects to the control unit and the hardware interlock drive unit. It is configured to inject a preset combination of test signals into the hardware interlock drive unit, obtain the actual output state of the hardware interlock drive unit in response to the test signal combination, and diagnose the effectiveness of the hardware interlock drive unit based on the comparison result between the actual output state and the interlock priority rules. Specifically, since the hardware interlock drive unit itself is a pure hardware circuit, if it is damaged or its logic fails, the system will be in a dangerous, unprotected state without its knowledge. The role of the intelligent fault diagnosis unit is to fill this safety blind spot and achieve supervision of the "supervisor." Its working principle is to actively construct a specific combination of test signals, which should trigger a certain interlock response (e.g., forced shutdown) under the current interlock priority rules. If the hardware interlock drive unit functions normally, its actual output state should be consistent with the expectation; conversely, if the actual output does not exhibit the expected interlock behavior, the unit can be determined to have failed. For example, the preset test signal combination could be a first control signal and a second control signal that are simultaneously high. Under normal interlock rules, the output should not simultaneously show a valid drive level. Through this closed-loop mechanism of active injection and feedback comparison, the system can continuously verify the integrity of the underlying security protection during operation. Once an interlock failure is detected, degraded operation or shutdown protection measures can be taken in a timely manner to prevent the fault from escalating. It should be understood that the intelligent fault diagnosis unit can exist as an independent hardware module, or it can be integrated into the control unit as firmware or software functional blocks, or it can be implemented by a dedicated monitoring chip, as long as it has the ability to inject signals and read back and compare status.

[0025] Through the above architecture, this embodiment constructs a dual safety guarantee system combining underlying hardware forced interlocking and online self-diagnosis. The hardware interlocking drive unit completely blocks the direct path caused by abnormal control signals at the physical level and supports dynamic priority adaptation, resolving the contradiction between single interlocking logic and changing operating conditions; the intelligent fault diagnosis unit actively verifies the effectiveness of the interlocking mechanism itself through testing, eliminating the hidden danger of unknown interlocking circuit failure in traditional solutions. The two work together to significantly improve the safety and reliability of power electronic equipment operation.

[0026] Furthermore, the dynamic priority configuration mechanism of the hardware interlock drive unit is described in detail. The interlock priority rules include a first priority mode and a second priority mode. In the first priority mode, when the first control signal is a valid conduction signal, the hardware interlock drive unit forcibly blocks the second drive signal; in the second priority mode, when the second control signal is a valid conduction signal, the hardware interlock drive unit forcibly blocks the first drive signal. Specifically, this dual-mode design is to adapt to the differentiated safety strategy requirements of power electronic equipment at different operating stages. For example, when the system is in normal power conversion or voltage compensation operation, it is usually necessary to ensure the dominant regulation of the power branch. At this time, the first priority mode should be activated to ensure that as long as the power branch has a conduction requirement, the bypass branch is forcibly blocked by the hardware level, preventing the bypass from unexpectedly switching in and interrupting the compensation function due to interference or false triggering. Conversely, when the system detects over-temperature or over-current faults in power devices or receives an emergency shutdown maintenance command, it must seamlessly switch to the second priority mode. In this mode, the bypass branch gains the highest control. Once a bypass activation command is issued, the power branch will be unconditionally blocked, thus isolating the faulty power circuit while ensuring the continuity of power supply to the load. Compared to traditional fixed interlocking logic, this dynamic switching mechanism resolves the contradiction between the inability of a single interlocking strategy to simultaneously address normal regulation performance and emergency safety bypass requirements.

[0027] As a specific physical implementation, the hardware interlock driver unit includes a priority configuration pin, which receives a priority configuration signal. When the priority configuration pin is in a first-level state, the hardware interlock driver unit switches to a first-priority mode; when the priority configuration pin is in a second-level state, the hardware interlock driver unit switches to a second-priority mode. For example, the first-level state can be a high level, and the second-level state can be a low level, or vice versa. The control unit can be directly connected to this priority configuration pin through its general-purpose input / output port, and output the corresponding high and low levels in real time according to the operating mode of the internal state machine, thereby achieving nanosecond-level online mode switching. It should be understood that although this embodiment uses an independent physical pin as the carrier of the priority configuration signal, in other embodiments, this signal can also be implemented by writing it into the configuration register inside the hardware interlock driver unit through a serial peripheral interface, I2C bus, or SPI bus, or by providing a fixed level state through external DIP switches, jumpers, or other hardware setting circuits, as long as a clear mode selection indication can be transmitted to the interlock logic core.

[0028] To ensure that no shoot-through failure occurs under any extreme conditions, the hardware-level interlock decision follows the truth table logic: when both the first and second control signals are valid on signals, both the first and second drive signals are forced to output invalid off signals. This logic constitutes a low-level safety fallback mechanism independent of priority modes. Specifically, regardless of whether the current priority mode is the first or second priority mode, and regardless of the level state of the priority configuration pin, as long as two input control signals are detected to be valid simultaneously, the logic gates inside the hardware interlock drive unit will directly override the priority decision result, forcibly pulling both outputs to the off level. The micro-mechanism of this design is that the priority mode switching process may have a brief timing race or metastability risk, or the control unit itself may output an incorrect on command due to a serious fault. In this case, if only the priority logic is relied upon for single selection, it is still possible to output a valid drive, leading to potential risks. By introducing the absolute prohibition rule of "double 1 input equals double 0 output", it is equivalent to setting up an insurmountable last line of defense at the hardware level, ensuring that even if the upper-level control logic is completely chaotic, the driver-level output still maintains a definite safe state, and completely eliminating the possibility of a short circuit caused by logic conflict.

[0029] Furthermore, the active injection self-diagnostic mechanism for the hardware interlock unit is described in detail. The preset test signal combination is a combination of conflicting signals that triggers the execution of the interlock priority rules to enforce a mandatory block. Specifically, in order to verify whether the internal logic circuit of the hardware interlock driver unit is intact, the intelligent fault diagnosis unit does not use conventional functional test signals, but instead deliberately constructs a set of "conflicting signal combinations" that are prohibited from appearing under normal business logic. For example, regardless of whether the current mode is the first priority mode or the second priority mode, the first control signal and the second control signal are simultaneously set to an effective on level (i.e., logic "1,1" state). According to the truth table catch-all logic, when a normal hardware interlock driver unit receives this combination, it must force the output of both the first drive signal and the second drive signal to an invalid off level (i.e., logic "0,0" state). The micro-mechanism of this design is that by using the most stringent constraints of the interlock rules themselves as test vectors, it can maximize the stimulation of potential fault points of the hardware logic gates (such as internal wiring breaks, logic gate breakdown, or metastability caused by timing races), thereby achieving a deep check of the pure hardware security mechanism. It should be understood that although this embodiment uses the simultaneous effectiveness of two paths as a typical example of conflict signal combination, in other implementations, other types of conflict combinations can be designed according to specific interlocking logic. For example, in a specific priority mode, a conduction signal can be sent to a low-priority branch while a conduction signal is also sent to a high-priority branch, as long as the combination can trigger a definite interlocking response.

[0030] The intelligent fault diagnosis unit is configured to determine that the hardware interlock drive unit has failed if the actual output state does not enforce a mandatory blockade, and to generate interlock failure fault information. Specifically, after injecting the aforementioned combination of conflicting signals, the intelligent fault diagnosis unit reads the output state of the hardware interlock drive unit in real time. If the actual output state read is not the expected fully off state (e.g., any one of the drive levels is active, or both are active), it indicates that the interlock logic inside the hardware interlock drive unit is damaged or has failed, and can no longer provide shoot-through protection. At this time, the intelligent fault diagnosis unit immediately generates interlock failure fault information (e.g., defined as F03 fault code) to indicate the loss of function of this specific component. This comparison logic is entirely based on the deterministic expectation of hardware behavior and does not rely on any fuzzy judgment of software algorithms, thus having extremely high diagnostic confidence. In this way, the system achieves supervision of the "supervisor," filling the safety blind spot in traditional solutions where the failure of the interlock circuit itself is unknown, and preventing the system from operating with defects in an unprotected state.

[0031] To ensure that the self-diagnostic process does not interfere with the normal power conversion operations of the power electronic equipment, the intelligent fault diagnosis unit is configured to periodically trigger the injection of preset test signal combinations during system operation gaps. Specifically, "system operation gaps" refer to short time windows during which both power branches and bypass branches are in non-critical operating states. For example, during PWM modulation, the dead time between the switching of upper and lower bridge arms naturally constitutes a safe window for all power devices to be turned off; or, during periods of light load and large control margin, the system can proactively insert a microsecond-level diagnostic time slot. Within these gaps, the intelligent fault diagnosis unit temporarily takes over control, injects conflict test signals, and reads feedback. The entire process is typically completed in nanoseconds to microseconds, far smaller than the thermal time constant of the power devices and the electrical inertia of the load, thus having almost zero impact on the output voltage or current waveform from a macroscopic perspective. This non-intrusive online monitoring mechanism allows the system to continuously verify the integrity of the underlying safety protection without interrupting power supply or degrading power quality. It should be understood that the selection strategy for the operating gap can be flexibly adjusted according to the specific topology and control algorithm. For example, it can be executed during the soft start phase, the shutdown transition phase, or a specific maintenance mode, as long as the test action does not substantially conflict with the normal power transmission.

[0032] After determining that the hardware interlock drive unit has failed, the intelligent fault diagnosis unit generates interlock failure fault information and reports it to the upper-level monitoring system through the fault reporting interface. Simultaneously, it triggers the local alarm module to execute the corresponding fault notification. Specifically, once interlock failure is confirmed, the system not only needs to record the fault but also promptly notify maintenance personnel to take intervention measures. The fault reporting interface can use various industry-standard communication methods such as CAN bus, RS485, Ethernet, or wireless communication modules to send data packets containing the F03 fault code, the fault occurrence timestamp, and the system status parameters at that time to the remote monitoring center or cloud platform for centralized management and trend analysis. Meanwhile, the local alarm module provides intuitive on-site warnings through LED indicators (e.g., solid red indicating interlock failure), LCD displays showing specific fault codes, or buzzer alarms. This multi-dimensional fault notification mechanism ensures that this serious safety hazard of interlock failure can be detected and addressed immediately, regardless of whether the system is manned or unmanned, thereby significantly shortening the system's mean time to repair (MTTR) and improving overall maintenance efficiency and safety.

[0033] Furthermore, the software strategy interlock mechanism is described in detail. As a heterogeneous redundancy protection layer that is completely different from the hardware interlock drive unit mechanism, the control unit is also configured to execute software strategy interlock: before generating the first control signal or the second control signal, it acquires the physical state feedback signals of the power branch and the bypass branch; only when it is confirmed based on the physical state feedback signals that both the power branch and the bypass branch are in the off state, is the corresponding first control signal or the second control signal allowed to be output. Specifically, the physical state feedback signal is an electrical quantity that reflects the actual on / off state of the power device. For example, it can be acquired by a voltage sensor to collect the voltage drop across the branch, or by a current transformer to detect the current flowing through the branch. Before each time the control unit prepares to issue a conduction command, it will force a state read operation. Only when both feedback signals clearly indicate that the state is off (such as zero voltage or below a threshold, zero current) will the software logic gate release the new drive command. The micro-mechanism of this design lies in constructing a pre-emptive safety gate based on physical facts, effectively preventing unexpected conduction caused by abnormal situations such as power device breakdown and adhesion, drive circuit short circuit, or failure to execute the previous shutdown command. Even if the hardware interlock drive unit fails due to extreme interference, or if the instruction generation algorithm inside the control unit malfunctions and attempts to forcibly open another branch before it is fully shut down, this software strategy interlock can block the output of dangerous instructions at the source, thus complementing the purely hardware-level forced interlock and significantly improving the system's safety margin. It should be understood that although this embodiment uses voltage and current as typical examples of physical state feedback, in other embodiments, auxiliary contact signals, temperature feedback, or other physical quantities that can characterize the on / off state of a branch can also be used, as long as they can reliably reflect the actual operating state of the branch.

[0034] To further enhance system safety during dynamic operation, the control unit is configured to periodically perform cross-validation during system operation: comparing the current output first and second control signals, the output state of the hardware interlock drive unit, and the physical state feedback signal; when an inconsistency is detected between the first and second control signals, the output state, and the physical state feedback signal, an emergency shutdown action is triggered, and corresponding pass-through fault information or drive failure fault information is generated. Specifically, this cross-validation is a closed-loop monitoring mechanism covering the entire "command-execution-feedback" chain. The control unit compares three sets of key data in real time at a preset period (e.g., each PWM switching cycle or a fixed microsecond time window): first, the original control command issued by itself, representing the system's "intention"; second, the actual output state of the hardware interlock drive unit, representing the "execution result" of the logic layer; and third, the physical state feedback of the power branch and bypass branch, representing the "real state" of the physical layer. Under normal operating conditions, these three should maintain strict logical consistency. For example, if a control command requires the power branch to be on and the bypass branch to be off, the hardware interlock output should match this, and the physical feedback should show that the power branch is indeed on and the bypass branch is indeed off. If any inconsistency is detected, such as a command requiring shutdown but physical feedback showing on (possibly due to component sticking), a hardware interlock output that does not match the command (possibly due to a drive circuit fault), or physical feedback showing both branches on simultaneously (possibly due to interlock failure), the control unit will immediately determine that the system is in an abnormal state and trigger an emergency shutdown action within microseconds, forcibly blocking all drive outputs to prevent the fault from escalating. Simultaneously, the system will generate differentiated fault information based on the specific type of inconsistency: if a shoot-through risk of both branches being on simultaneously is confirmed, a shoot-through fault message (such as F01 fault code) will be generated; if a device or drive circuit problem is confirmed due to a mismatch between the drive command and the physical state, a drive failure fault message (such as F02 fault code) will be generated. This refined fault classification mechanism enables maintenance personnel to quickly pinpoint the root cause of a fault—whether it's a control logic error, hardware interlock failure, or power device damage—significantly reducing troubleshooting and repair time. Through the aforementioned software strategy interlocking and cross-validation mechanism, this embodiment adds a layer of intelligent monitoring defense based on information flow comparison on top of the nanosecond-level physical defense provided by the hardware interlocking drive unit. The two are completely heterogeneous in their implementation mechanisms—the former relies on the level forcing of analog / digital circuits, while the latter relies on data comparison and logical judgment within the processor. Therefore, they will not fail simultaneously due to the same common defects (such as level flipping caused by electromagnetic interference or logical chaos caused by software malfunctions), truly achieving the design goal of triple redundancy protection and ensuring the ultimate safety of power electronic equipment under various complex operating conditions.

[0035] Furthermore, the fault tracing and data recording mechanisms are explained in detail. For example... Figure 1As shown, the system also includes a data freeze storage module connected to the control unit. The control unit is configured to execute a data freeze service routine using the highest priority interrupt when a fault trigger signal is detected, storing snapshots of key variables within a preset control cycle before and after the fault trigger in the data freeze storage module. Specifically, when serious faults such as shoot-through or interlock failure occur in power electronic equipment, they are often accompanied by drastic changes in system state or even a reset and restart of the control unit. Conventional cyclic overwrite data recording is prone to losing critical information at the moment of the fault, making it impossible to reconstruct the accident scene afterward. This embodiment solves this problem by introducing a highest priority interrupt mechanism. When the intelligent fault diagnosis unit or software strategy interlock logic detects a fault trigger signal that meets preset conditions, the nested vector interrupt controller inside the control unit immediately suspends all currently executing low-priority tasks and jumps to the data freeze service routine with a nanosecond-level response speed. Since this interrupt is configured as the highest priority in the system, its execution process will not be interrupted by any other interrupt or main loop, thus ensuring that critical data in memory can be forcibly written to the data freeze storage module within a very short window before the system completely collapses or loses power. The underlying mechanism of this design lies in leveraging the interrupt preemption features at the processor hardware level to elevate the timing priority of data preservation operations above all normal business logic, fundamentally ensuring the integrity and reliability of fault records. It should be understood that although this embodiment uses a nested vector interrupt controller as the implementation carrier for the highest priority interrupt, in other embodiments, the same effect can be achieved using hardware interrupts of a digital signal processor, internal hardwired triggering logic of a field-programmable gate array, or the emergency latch function of a dedicated monitoring chip, as long as it ensures that data storage operations are unconditionally prioritized at the moment a fault occurs.

[0036] To support rapid root cause analysis after the incident, the key variable snapshots include the first and second control signals, physical state feedback signals, electrical parameter sampling values, the actual output state of the hardware interlock drive unit, and the value of the priority configuration signal. Specifically, these data constitute a complete slice of the system's entire link state at the time of the fault. Among them, the first and second control signals reflect the original intent of the commands issued by the control unit at the moment of the fault; the physical state feedback signal reveals the actual on / off status of the power branch and bypass branch; the electrical parameter sampling values ​​record the voltage and current stress levels at that time; the actual output state of the hardware interlock drive unit demonstrates the execution result of the underlying safety mechanism; and the value of the priority configuration signal indicates the interlock mode in which the system was at that time. By strictly aligning and permanently storing these five types of data on the timeline, maintenance personnel can reconstruct the complete causal chain of the fault afterward. For example, if the snapshot shows that the control command requires the power branch to be turned off but the physical feedback remains on, and the hardware interlock output is also off, then the fault can be accurately identified as a drive failure caused by power device breakdown and adhesion. Conversely, if the snapshot shows that both control signals are valid simultaneously and the hardware interlock output is also abnormally valid simultaneously, then the fault can be directly located as a logical failure of the hardware interlock drive unit itself. This fault location capability based on multi-dimensional data correlation analysis is significantly better than the traditional method that relies solely on a single fault code, greatly shortening the mean time to repair. It should be understood that the content of the key variable snapshot is not limited to the five types mentioned above. Depending on the diagnostic needs of the specific application scenario, it can also be expanded to include temperature sampling values, communication message counters, internal state machine indexes, or other custom debugging variables, as long as they help to reconstruct the fault scene.

[0037] The definition of the preset control cycle encompasses several consecutive control cycles before and after the fault triggering time. Specifically, recording data before the fault is to capture the causes or gradual processes leading to the fault, such as the current rise trend in the several cycles before an overcurrent fault; recording data after the fault is to observe the dynamic response of the system under protection action, such as voltage spikes or oscillations during the shutdown process. As a preferred implementation, the preset control cycle can be configured as one hundred control cycles before the fault triggering and fifty control cycles after the fault triggering. This time window covers the evolution scale of most transient processes while also ensuring efficient utilization of storage space. However, those skilled in the art should understand that the specific number of cycles is not fixed but can be flexibly adjusted according to the system's switching frequency, fault type characteristics, and the capacity of the data freeze storage module. For example, a high-frequency switching system may require more cycles to cover the same time span, while a low-frequency, high-capacity system can appropriately reduce the number of cycles to save resources. Furthermore, the data freeze storage module can be implemented using ferroelectric memory, electrically erasable programmable read-only memory, magnetoresistive random access memory, or other non-volatile storage media with power-loss retention characteristics, as long as it can reliably save fault snapshot data after the system is powered off. Through the aforementioned black box data freeze mechanism, this embodiment provides power electronic equipment with an accident evidence collection system independent of the normal operation process, making each fault a traceable, analyzable, and improveable data asset, thereby continuously improving the safety and maintainability of the equipment.

[0038] This application also provides a method for preventing shoot-through in power electronic equipment, which is applied to the power electronic equipment shoot-through prevention system described in the foregoing embodiments. Unlike the foregoing system embodiments, which focus on module connections and hardware architecture, this embodiment focuses on how to achieve shoot-through protection and self-diagnosis functions through a series of ordered action steps from the perspective of timing execution and logic control. Figure 1 As shown, the control method mainly includes the following steps.

[0039] Step S100 involves acquiring the physical state feedback signals of the power branch and bypass branch, and verifying their operating status based on these signals. Specifically, before generating any drive command, the system first collects electrical quantities reflecting the actual on / off state of the branch in real time using sensors or detection circuits. For example, a voltage sensor can detect the voltage drop across the branch, a current transformer can detect the current flowing through the branch, or the auxiliary contact signal of a mechanical switch can be read. This step constitutes a pre-emptive safety gate in the process flow, its core purpose being to confirm whether the actual physical state meets the safe start-up conditions, preventing the forced issuance of a new turn-on command in an unsafe state due to abnormal situations such as power device breakdown and adhesion, short circuit in the drive circuit, or failure to execute the previous turn-off command. It should be understood that the method of acquiring the physical state feedback signal is not limited to the above example; any physical quantity that can reliably characterize the on / off state of the branch can be used as a verification basis.

[0040] Step S101 allows the generation of a first control signal for the power branch and a second control signal for the bypass branch only when both the power branch and the bypass branch are confirmed to be in the off state. Specifically, this is a strictly condition-triggered action. The control logic will only proceed to the subsequent instruction generation stage if the verification result of step S100 indicates that the current physical state of both branches is definitively off (e.g., voltage is zero, current is zero, or below a safety threshold). If the verification result shows that either branch is in an unexpected conducting state or its state is uncertain, the generation of new drive signals is prohibited, and a corresponding exception handling process can be triggered. This "confirm before action" execution logic establishes the priority of software strategy interlocks at the methodological level, ensuring that the generation of drive signals is always based on safe physical facts, effectively avoiding the shoot-through risk caused by blindly executing the control algorithm.

[0041] Step S200 generates a first control signal for the power branch and a second control signal for the bypass branch. Specifically, after passing the pre-safety check, the control unit calculates and outputs the original control signals for controlling the on / off state of the power devices based on external commands, grid conditions, or load requirements. For example, under normal voltage compensation conditions, a high-frequency PWM modulation signal for the power branch may be generated as the first control signal, while a low-level turn-off signal for the bypass branch may be generated as the second control signal. It should be understood that "generation" here refers to the logical output at the control algorithm level; this signal has not yet been directly applied to the power devices and still needs to undergo subsequent hardware interlocking decisions.

[0042] Step S201: Receive the priority configuration signal, dynamically switch the interlock priority rules based on the priority configuration signal, and perform hardware-level interlock adjudication on the first and second control signals according to the currently effective interlock priority rules, outputting the corresponding first and second drive signals. Specifically, this is the core step that distinguishes this method from traditional software interlock methods. After the control signal is generated and before the drive signal is output, an independent hardware-level adjudication stage is introduced. This stage receives the priority configuration signal (such as high / low level or register configuration value) from the control layer and adjusts the internal interlock logic truth table in real time accordingly. For example, when a configuration signal indicating "power priority" is received, the adjudication logic forcibly blocks the bypass drive output; when a configuration signal indicating "bypass priority" is received, the power drive output is forcibly blocked. More importantly, regardless of the current priority mode, when both input control signals are detected to be valid simultaneously, the hardware-level interlock adjudication will forcibly execute the safety fallback logic of fully shutting down both outputs. The execution of this process is carried out by pure hardware circuits with a response speed in the nanosecond range. It is completely independent of software cycle or processor state, thus building a physical safety barrier in the process flow that is independent of the control logic, completely eliminating the possibility of interlock failure due to program crashes, infinite loops, or electromagnetic interference.

[0043] Step S300: A preset combination of test signals is injected into the hardware interlock drive unit that executes hardware-level interlock decisions, and the actual output state of the hardware interlock drive unit in response to the combination of test signals is obtained. Specifically, to verify the integrity of the hardware interlock mechanism itself as a safety barrier, this method embeds an active self-diagnosis step into the normal operation process. This step is usually executed periodically during system operation gaps (such as PWM dead time, light load periods, or specific maintenance windows) to avoid interfering with normal power conversion services. The injected combination of test signals is specifically constructed to be conflicting signals that can trigger interlock rules, for example, simultaneously setting two control signals to an effective conduction level. Simultaneously with or immediately after injecting the test signals, the system reads the output state of the hardware interlock drive unit in real time as a basis for judging its health status. It should be understood that the timing and construction method of the test signal injection can be flexibly adjusted according to the specific topology and control strategy, as long as the test action does not substantially conflict with normal power transmission and can effectively trigger the interlock logic.

[0044] Step S301 diagnoses the effectiveness of the hardware interlock drive unit based on the comparison result between the actual output state and the interlock priority rules. Specifically, the system rigorously compares the actual output state obtained in step S300 with the expected output under the current interlock priority rules. For example, if dual valid conflict test signals are injected, the expected correct output should be dual-channel complete shutdown; if the actual output read contains any valid level, the hardware interlock drive unit is determined to be faulty. This diagnostic logic is entirely based on the deterministic expectation of hardware behavior and does not rely on fuzzy software algorithm inference, thus possessing extremely high confidence. By integrating this self-diagnostic step into the overall control method flow, closed-loop monitoring of the safety protection mechanism itself is achieved, solving the blind spot of "unknown supervisor failure" in traditional methods and ensuring the continuous effectiveness of the anti-straight-through protection function throughout its entire lifecycle.

[0045] Through the above-described methodological process, this embodiment constructs a complete timing protection chain from physical state confirmation and dynamic hardware interlock adjudication to online self-diagnosis. Each step has both strict sequential logical dependencies (e.g., verification before generation) and includes parallel or periodic independent monitoring mechanisms (e.g., self-diagnosis during runtime), forming a multi-dimensional, heterogeneous security control system. Compared to traditional methods that rely solely on software logic judgment, this embodiment significantly improves the real-time performance, reliability, and maintainability of anti-snap-through control by introducing hardware-level adjudication and proactive testing verification.

[0046] This application also provides a specific application scenario of the above-mentioned power electronic equipment anti-surge system in a series voltage automatic compensation device. The series voltage automatic compensation device is typically connected in series between the power grid and a sensitive load to manage voltage sags, swells, or harmonic pollution in real time. Its main circuit topology includes a power branch responsible for power conversion and a bypass branch used to maintain load power supply during device failure or maintenance. In this application scenario, the system effectively solves the risk of load power loss that may be caused by emergency bypass switching in traditional fixed interlock schemes by dynamically adjusting interlock priority rules, while ensuring anti-surge safety under all operating conditions.

[0047] Specifically, when the series voltage automatic compensation device is in normal voltage compensation mode, the control unit sets the priority configuration pin of the hardware interlock drive unit to a high level, causing the system to enter the first priority mode. In this mode, the power branch has the highest control authority. As long as the control unit issues a valid conduction signal for the power branch, the hardware interlock drive unit will forcibly block the second drive signal of the bypass branch within nanoseconds, regardless of whether the second control signal malfunctions due to electromagnetic interference or software abnormalities. The microscopic mechanism of this design is that under normal compensation conditions, the power devices are in a high-frequency switching state. If the bypass branch is accidentally turned on, it will cause a short circuit on the secondary side of the parallel energy harvesting transformer or a shoot-through burnout of the power devices. Therefore, it is necessary to ensure the absolute blocking of the bypass branch through hardware-level forced interlocking to ensure the continuity of power quality management functions and equipment safety.

[0048] When the series voltage automatic compensation device detects over-temperature or over-current faults in the power device or receives an emergency shutdown maintenance command, the control unit immediately flips the priority configuration pin to a low level, allowing the hardware interlock drive unit to seamlessly switch to the second priority mode. In this mode, the bypass branch gains the highest control. Once a bypass activation command is issued, the hardware interlock drive unit will unconditionally block the first drive signal of the power branch, ensuring that the bypass branch can quickly start operation to take over the power supply to the load. Compared to traditional schemes that use fixed "power priority" or "double 1 equals double 0" interlock logic, the dynamic switching mechanism of this embodiment avoids the serious consequences of the bypass not being able to be activated in time due to the rigidity of the interlock logic when an emergency bypass requirement occurs, resulting in the power failure of sensitive loads. It should be understood that the level flipping of the priority configuration pin is driven by the control unit in real time according to the internal state machine. Its switching process itself is a reconstruction of the truth table of pure hardware logic, without relying on software loop judgment. Therefore, even in extreme cases where part of the control unit malfunctions, as long as the pin level is correct, the underlying interlock can still perform the safety decision as expected.

[0049] During the switching intervals between the two modes or during the PWM dead zone of system operation, the intelligent fault diagnosis unit periodically injects a preset combination of test signals into the hardware interlock drive unit to verify the effectiveness of the currently active interlock priority rules. For example, during the transition window from the first priority mode to the second priority mode, the intelligent fault diagnosis unit can temporarily inject a set of dual-path effective conflict test signals. If the hardware interlock drive unit outputs a forced blocking result that meets the expectation of the current mode (such as blocking only the power branch output in the second priority mode), the interlock function is deemed to be intact; if the output is abnormal, an interlock failure fault information is immediately generated and protection is triggered. This mechanism of embedding self-diagnosis into the actual business flow process enables the series voltage automatic compensation device to continuously confirm the integrity of its own safety protection system without interrupting power supply, truly achieving a unity of high reliability and high availability. Through the implementation of this application scenario, the technical solution of this application not only fundamentally eliminates the risk of direct short circuit between the power branch and the bypass branch, but also endows the equipment with a flexible safety strategy to adapt to complex working conditions, significantly improving the comprehensive performance and operation and maintenance efficiency of power electronic equipment in actual engineering applications.

[0050] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A power electronic equipment anti-straight-through system, characterized in that, include: The control unit is configured to generate a first control signal for the power branch and a second control signal for the bypass branch. A hardware interlock drive unit is connected between the control unit and the power branch and the bypass branch. It is configured to receive the first control signal, the second control signal and the priority configuration signal, dynamically switch the interlock priority rule based on the priority configuration signal, and perform hardware-level interlock decision on the first control signal and the second control signal according to the currently effective interlock priority rule, and output the corresponding first drive signal and the second drive signal. An intelligent fault diagnosis unit, connected to the control unit and the hardware interlock drive unit, is configured to inject a preset combination of test signals into the hardware interlock drive unit, obtain the actual output state of the hardware interlock drive unit in response to the combination of test signals, and diagnose the effectiveness of the hardware interlock drive unit based on the comparison result of the actual output state and the interlock priority rule.

2. The anti-straight-through system for power electronic equipment according to claim 1, characterized in that, The interlock priority rules include a first priority mode and a second priority mode; In the first priority mode, when the first control signal is a valid on signal, the hardware interlock drive unit forcibly blocks the second drive signal; In the second priority mode, when the second control signal is a valid on signal, the hardware interlock drive unit forcibly blocks the first drive signal.

3. The power electronic equipment anti-straight-through system according to claim 2, characterized in that, The hardware interlock drive unit includes a priority configuration pin, which receives the priority configuration signal. When the priority configuration pin is in the first level state, the hardware interlock drive unit switches to the first priority mode; When the priority configuration pin is in the second level state, the hardware interlock drive unit switches to the second priority mode; The hardware-level interlock decision follows the following truth table logic: when the first control signal and the second control signal are both valid turn-on signals, the first drive signal and the second drive signal are both forced to be output as invalid turn-off signals.

4. The anti-straight-through system for power electronic equipment according to claim 1, characterized in that, The preset test signal combination is a combination of conflicting signals that triggers the execution of the interlock priority rule to enforce a mandatory block. The intelligent fault diagnosis unit is configured to: if the actual output state does not execute the forced blocking, determine that the hardware interlock drive unit has failed, and generate interlock failure fault information.

5. The anti-straight-through system for power electronic equipment according to claim 4, characterized in that, The intelligent fault diagnosis unit is configured to periodically trigger the injection of the preset test signal combination during system operation intervals; After determining that the hardware interlock drive unit has failed, the intelligent fault diagnosis unit generates interlock failure fault information and reports the interlock failure fault information to the upper monitoring system through the fault reporting interface, while triggering the local alarm module to execute the corresponding fault prompt.

6. The anti-straight-through system for power electronic equipment according to claim 1, characterized in that, The control unit is also configured to perform software strategy interlocks: Before generating the first control signal or the second control signal, the physical state feedback signals of the power branch and the bypass branch are obtained; The first control signal or the second control signal is allowed to be output only when it is confirmed based on the physical state feedback signal that both the power branch and the bypass branch are in the off state.

7. The anti-straight-through system for power electronic equipment according to claim 6, characterized in that, The control unit is also configured to periodically perform cross-validation during system operation: Compare the currently output first control signal and second control signal, the output state of the hardware interlock drive unit, and the physical state feedback signal; When an inconsistency is detected between the first control signal and the second control signal, or between the output state and the physical state feedback signal, an emergency shutdown action is triggered, and corresponding pass-through fault information or drive failure fault information is generated.

8. The anti-straight-through system for power electronic equipment according to claim 1, characterized in that, It also includes a data freeze storage module, which is connected to the control unit; The control unit is configured to execute a data freeze service program using the highest priority interrupt when a fault trigger signal is detected, and to store snapshots of key variables within a preset control period before and after the fault trigger to the data freeze storage module. The key variable snapshot includes the first control signal and the second control signal, the physical state feedback signal, the electrical parameter sample value, the actual output state of the hardware interlock drive unit, and the value of the priority configuration signal.

9. A method for preventing shoot-through in power electronic equipment, applied to a power electronic equipment shoot-through prevention system as described in any one of claims 1 to 8, characterized in that, include: Generate a first control signal for the power branch and a second control signal for the bypass branch; Receive a priority configuration signal, dynamically switch interlock priority rules based on the priority configuration signal, and perform hardware-level interlock decision on the first control signal and the second control signal according to the currently effective interlock priority rule, and output the corresponding first drive signal and second drive signal; A preset combination of test signals is injected into the hardware interlock driver unit that executes the hardware-level interlock decision, and the actual output state of the hardware interlock driver unit in response to the combination of test signals is obtained. Based on the comparison between the actual output state and the interlock priority rule, the effectiveness of the hardware interlock drive unit is diagnosed.

10. The anti-shoo-through control method for power electronic equipment according to claim 9, characterized in that, Before generating the first control signal for the power branch and the second control signal for the bypass branch, the method further includes: Obtain the physical state feedback signals of the power branch and the bypass branch; The operating status of the power branch and the bypass branch is verified based on the physical state feedback signal. The step of generating the first control signal for the power branch and the second control signal for the bypass branch is permitted only when it is confirmed that both the power branch and the bypass branch are in the off state.

Images