Control system and control method of motor controller, vehicle

Abstract

The embodiment of the application relates to the technical field of motor control, and discloses a control system and a control method of a motor controller and a vehicle, the control system comprising a switching circuit, a low-voltage side power supply module, a high-voltage side power supply module and a first control circuit. The switching circuit is connected in series between main power supply and input ends of the two power supply modules to control the on-off of the main power supply. The output end of the low-voltage side power supply module is coupled to the enable end of the high-voltage side power supply module and the input end of the first control circuit; the output end of the first control circuit is connected to the control end of the switching circuit, and when the output voltage of the low-voltage side exceeds a preset overvoltage threshold, the switching circuit is turned off to realize overvoltage protection. The enable end of the high-voltage side power supply module is controlled by the low-voltage side output, and is started only after the establishment of the low-voltage side output and is turned off when the low-voltage side is lost. The system realizes power supply sequence management through hardware interlocking, avoids the misoperation of the high-voltage side in the case of low-voltage abnormality, and improves safety.

Description

Technical Field

[0001] This invention relates to the field of motor control technology, specifically to a control system and control method for a motor controller, and a vehicle. Background Technology

[0002] The motor controller is a core electronic control component of new energy vehicles, responsible for controlling the motor's start-up, shutdown, speed, and torque to ensure smooth power output. During electric vehicle operation, a sudden power supply failure can easily cause a momentary system shutdown, leading to abnormal and uncontrolled motor speed and torque, resulting in a sudden loss of power and posing a significant safety hazard and driving danger.

[0003] Currently, there are three main solutions for handling power supply anomalies in motor controllers. The first is to use diodes to achieve power competition between primary and backup power supplies. However, diodes have a fixed voltage drop, generate significant heat under high current, and cannot completely isolate reverse leakage current. The second is to add a switching circuit to the power supply line, using a voltage detection circuit in conjunction with the MCU output control signal to control the switch's on / off state. However, this solution relies on the MCU's software response, which is slow, and when a power supply anomaly causes the SBC (System Base Chip) to fail, the MCU loses power and cannot send control signals. The third is a purely hardware response circuit, using comparators and logic gates to achieve rapid shutdown. However, this type of solution only responds to anomalies exceeding the preset voltage range, and is difficult to effectively detect rapid voltage jumps within the normal range, and is prone to malfunctions due to repeated voltage fluctuations.

[0004] Furthermore, in scenarios with abnormal power supply, the timing management of the high-voltage and low-voltage power supplies of the driver chip is also crucial. If the high-voltage power supply continues to output even after the low-voltage power supply is lost, it may cause the PWM input to float, the power transistor to mis-conduct, and lead to shoot-through failure of the upper and lower bridge transistors. Existing solutions for handling such timing issues mostly rely on software control, which carries the risk of failure under extreme power supply anomalies.

[0005] Therefore, how to achieve a fast and reliable power supply response for the motor controller under various abnormal power supply scenarios, while ensuring the safety of the core chip and the correct power-on / off sequence, is a technical problem that urgently needs to be solved. Summary of the Invention

[0006] In view of the shortcomings of the prior art, the purpose of this application is to provide a control system and control method for a motor controller, and a vehicle, which aims to solve the problems of slow response speed, insufficient protection of core chips, and inability to distinguish different levels of power supply abnormalities in the prior art.

[0007] In a first aspect, embodiments of this application provide a control system for a motor controller, comprising: a switching circuit, a low-voltage side power supply module, a high-voltage side power supply module, and a first control circuit. The switching circuit controls the on / off state of the main power supply. The low-voltage side power supply module has a power supply output terminal, and its input terminal is coupled to the main power supply via the switching circuit. The input terminal of the high-voltage side power supply module is coupled to the main power supply via the switching circuit, and the high-voltage side power supply module has an enable terminal, which is coupled to the power supply output terminal of the low-voltage side power supply module. The input terminal of the first control circuit is coupled to the power supply output terminal of the low-voltage side power supply module, and its output terminal is coupled to the control terminal of the switching circuit. The first control circuit controls the switching circuit to turn off when the output voltage of the low-voltage side power supply module exceeds a preset overvoltage threshold. After the output voltage of the low-voltage side power supply module is established, the high-voltage side power supply module establishes an output; when the output voltage of the low-voltage side power supply module is lost, the high-voltage side power supply module turns off its output.

[0008] In this embodiment, the enable terminal of the high-voltage side power supply module is directly controlled by the output voltage of the low-voltage side power supply module, rather than relying on the software control of the MCU. This ensures from a hardware perspective that the low-voltage side power supply of the driver chip is established before the high-voltage side power supply, eliminating the risk of power transistor failure due to power-on timing violations. Simultaneously, the first control circuit, as an independent hardware overvoltage detection path, directly controls the switching circuit to shut down when the output voltage of the low-voltage side power supply module exceeds a preset overvoltage threshold. This requires no MCU intervention, resulting in a fast response time and the ability to cut off abnormal power supply in a very short time after an overvoltage occurs, preventing the core chip from burning out due to overvoltage. This control system, through the combination of a power architecture that controls the high-voltage side power supply enable from the low-voltage side and an independent hardware overvoltage shutdown circuit, achieves reliable timing management of the high and low voltage side power supplies of the driver chip and rapid hardware disconnection of high-risk overvoltages.

[0009] In some embodiments, the first control circuit includes an overvoltage detection circuit. The input terminal of the overvoltage detection circuit is coupled to the power supply output terminal of the low-voltage side power supply module, and the output terminal of the overvoltage detection circuit is coupled to the control terminal of the switching circuit. The overvoltage detection circuit compares the output voltage of the low-voltage side power supply module with a preset overvoltage threshold. When the output voltage exceeds the preset overvoltage threshold, an overvoltage signal is output to control the switching circuit to turn off. The preset overvoltage threshold is set according to the pin withstand voltage of the protected chip in the motor controller.

[0010] In this embodiment, the first control circuit is a purely hardware circuit and does not rely on software operation. When a severe overvoltage is detected, it can cut off the abnormal power supply to prevent the overvoltage from damaging the subsequent chips.

[0011] In some embodiments, the control system of the motor controller further includes: a microcontroller, a first safety monitoring unit, a second safety monitoring unit, a driver chip, and a second control circuit. The first safety monitoring unit is located in the high-voltage side power supply module, and the second safety monitoring unit is located in the low-voltage side power supply module. The first and second safety monitoring units are respectively coupled to the microcontroller and are used to provide fault detection signals to the microcontroller. The microcontroller is coupled to the driver chip to control the driver chip to output drive signals. The input terminal of the second control circuit is coupled to the microcontroller, and the output terminal of the second control circuit is coupled to the control terminal of the switching circuit. The second control circuit is used to control the switching circuit to open and close according to the instructions of the microcontroller.

[0012] In this embodiment, by setting up a first safety monitoring unit and a second safety monitoring unit, the system can acquire fault detection signals from multiple nodes when a power supply anomaly occurs, achieving comprehensive fault monitoring with high fault diagnosis coverage and accurate location. The microcontroller executes fault response logic based on the fault detection signal, distinguishing fault types and severity levels. For non-severe faults, it only stops the PWM output without cutting off the main power supply, allowing the system to maintain operation or attempt recovery in a safe state, avoiding unnecessary power interruptions due to minor power supply fluctuations. The second control circuit enables the microcontroller to actively shut down the switching circuit via software instructions when it confirms the need for power cut-off, achieving software-level power supply control, which complements the hardware emergency shutdown of the first control circuit.

[0013] In some embodiments, the low-voltage side power supply module further includes a secondary power supply, the input terminal of which is coupled to the power supply output terminal of the low-voltage side power supply module, and the output terminal of which is coupled to the low-voltage power supply terminal of the driver chip and the power supply terminal of the microcontroller.

[0014] In this embodiment, the secondary power supply ensures that the low-voltage power supply to the MCU and driver chip undergoes two stages of regulation, resulting in a better power supply rejection ratio. This effectively filters out noise and ripple from the main power supply, providing a cleaner and more stable power supply for the MCU and driver chip, thus improving the system's anti-interference capability and operational reliability. When the primary power supply fluctuates or is lost due to an abnormality in the main power supply, the secondary power supply also fluctuates or is lost, ensuring consistent power supply status for all core components of the system and preventing unpredictable system behavior caused by abnormal power supply to some circuits while other circuits are powered normally.

[0015] In some embodiments, the control system of the motor controller further includes a logic circuit. The output terminals of the first control circuit and the second control circuit are respectively coupled to the input terminals of the logic circuit, and the output terminal of the logic circuit is coupled to the control terminal of the switching circuit. The logic circuit is configured to: when the first control circuit outputs a turn-off signal, the logic circuit outputs a switch turn-off signal to control the switching circuit to turn off; when the first control circuit does not output a turn-off signal, the logic circuit outputs a control signal from the second control circuit to control the switching circuit to turn on or off.

[0016] In this embodiment, the logic circuit resolves the potential control signal conflict between the first and second control circuits. When the hardware emergency shutdown requires the switching circuit to turn off while the MCU software requires the switching circuit to turn on, the logic circuit ensures the absolute priority of the emergency shutdown signal through hardware-level priority arbitration. The logic circuit is composed of pure hardware logic gates, without involving software operation, resulting in a fast response speed. Even in the event of a complete MCU failure, the emergency shutdown signal can still directly control the switching circuit to turn off through the logic circuit, forming a multi-layered safety management system: "software control when software is normal, hardware fallback when software fails, and hardware forced shutdown when a high-risk fault is detected."

[0017] In some embodiments, the driver chip further includes a third safety monitoring unit coupled to the microcontroller for providing fault detection signals to the microcontroller.

[0018] In this embodiment, the third safety monitoring unit enables the MCU to directly obtain power stage fault status information from the driver chip, including key safety parameters such as power transistor undervoltage, overcurrent, and overtemperature. The third safety monitoring unit, together with the first and second safety monitoring units, constitutes a fault monitoring network covering the entire chain from power input to power conversion stage to driver output stage, ensuring timely detection and reporting of any abnormality in any link. The driver chip's fault feedback provides a rapid hardware-level response, which is faster and more reliable than the MCU's ADC sampling method.

[0019] In some embodiments, the control system of the motor controller further includes a backup power supply and a backup switch circuit. The backup switch circuit is connected in series between the backup power supply and the motor controller, and the output terminal of the first control circuit is also coupled to the control terminal of the backup switch circuit. The first control circuit is used to control the backup switch circuit to conduct when it detects that the output voltage of the low-voltage side power supply module exceeds a preset overvoltage threshold.

[0020] In this embodiment, the introduction of a backup power supply allows the motor controller to smoothly transition to the backup power supply and continue operating without a complete power outage in the event of a severe power supply anomaly. This avoids power interruption caused by power supply switching and improves system availability and driving safety. The first control circuit simultaneously controls the main power supply switch circuit to turn off and the backup switch circuit to turn on. The switching process is entirely completed by hardware, is short, and ensures that the motor controller will not lose power and restart due to power interruption during the power supply switching process.

[0021] In some embodiments, the control system further includes a backup control circuit, which is connected to a backup switch circuit. The backup control circuit is used to control the on / off state of the backup switch circuit.

[0022] In this embodiment, the control system further includes a backup control circuit, which is connected to the backup switch circuit. The backup control circuit is used to control the on / off state of the backup switch circuit.

[0023] Secondly, this application provides a control method for a motor controller, applied to a control system of the motor controller provided in the first aspect. The control method for the motor controller includes: During power-on, when the main power supply is normal, the low-voltage side power supply module first establishes the output voltage. After the output voltage of the low-voltage side power supply module is established, the high-voltage side power supply module establishes the output in response to the enable signal received by the enable terminal of the high-voltage side power supply module.

[0024] When the main power supply is abnormal and the output voltage of the low-voltage side power supply module is zero (no output voltage), the output of the high-voltage side power supply module is turned off as the output voltage of the low-voltage side power supply module becomes zero.

[0025] When the main power supply malfunctions and the output voltage of the low-voltage side power supply module exceeds the preset overvoltage threshold, the first control circuit controls the switch circuit to shut down.

[0026] In some embodiments, the method further includes: When the main power supply is abnormal and the output voltage of the low-voltage side power supply module does not exceed the preset overvoltage threshold, the microcontroller of the control system executes a fault response based on the fault detection signals received from the high-voltage side power supply module, the low-voltage side power supply module and / or the driver chip.

[0027] In some embodiments, the microcontroller performs a fault response including: The microcontroller determines the fault level; Unless there is a pre-set serious fault, the microcontroller controls the driver chip to stop outputting drive signals. If a critical fault is pre-set, the microcontroller controls the driver chip to stop outputting drive signals and controls the switch circuit to turn off through the second control circuit of the control system.

[0028] Thirdly, this application provides a vehicle including a control system for a motor controller as provided in the first aspect. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of this application or the background art, the accompanying drawings used in the embodiments of this application will be described below.

[0030] Figure 1 This is a structural block diagram of the control system of the motor controller provided in the embodiments of this application; Figure 2 A circuit block diagram of the emergency shutdown control circuit provided in the embodiments of this application; Figure 3 A logic block diagram of a motor controller power supply anomaly response provided in an embodiment of this application; Figure 4 This is a schematic diagram of a power supply abnormality waveform provided in an embodiment of this application.

[0031] Explanation of reference numerals in the attached figures: 100 - Motor controller; 200 - Main power supply; 300 - External controller; 400 - High voltage module; 500 - Motor; 600 - Backup power supply; 700 - Backup switching circuit 110 - Switching circuit; 120 - High-voltage side power supply module; 121 - First safety monitoring unit; 130 - Low-voltage side power supply module; 131 - Primary power supply; 132 - Secondary power supply; 133 - Secondary safety monitoring unit; 140 - First control circuit; 150 - Microcontroller; 160 - Driver chip; 161 - Third security monitoring unit; 170 - Second control circuit; 180-Logic Circuit; 190 - Communication module. Detailed Implementation

[0032] The terms “first,” “second,” etc., are used for descriptive purposes only and have no sequential or technical meaning, nor should they be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated.

[0033] The term "electrical connection" refers to the flow of current or signal from one conductor to another. An electrical connection between A and B means that current or signal can flow from A to B and vice versa. This connection includes direct and indirect electrical connections. A direct electrical connection between A and B means that A and B are physically connected. An indirect electrical connection between A and B means that A and B are connected via C, where C can be at least one wire or device.

[0034] The embodiments of this application are described below with reference to the accompanying drawings.

[0035] The vehicles provided in this application embodiment can be, but are not limited to, new energy vehicles such as pure electric vehicles (PEV / BEV), hybrid electric vehicles (HEV), range-extended electric vehicles (REEV), plug-in hybrid electric vehicles (PHEV), and fuel cell vehicles (FCV).

[0036] In this embodiment of the application, the vehicle includes a body, a battery pack, a motor controller 100, and a motor 500.

[0037] The motor controller 100 communicates with the external controller 300 via a CAN bus to receive torque commands and report fault information. By mounting the motor controller 100 on the vehicle and establishing a communication connection between it and the external controller 300, the motor controller 100 can send a fault message to the external controller 300 via the CAN bus when it detects a power supply anomaly. Upon receiving the fault message, the external controller 300 can implement vehicle-level safety measures based on the fault information, such as illuminating the fault indicator light on the instrument panel and limiting the vehicle's power output. Therefore, power supply anomalies can not only be handled internally by the motor controller 100 but also transmitted to the vehicle level for coordinated response, improving the vehicle's safety and controllability in the face of power supply anomalies. Simultaneously, the motor controller 100 has fault recording and reporting capabilities, facilitating fault tracing and rapid location during after-sales maintenance.

[0038] The battery pack is fixedly mounted at the bottom of the vehicle body to store electrical energy and supply power to the vehicle's electrical equipment. The motor controller 100 is fixedly mounted at the front-wheel drive and / or rear-wheel drive position of the vehicle body and is fixedly connected to the vehicle body. The battery pack is electrically connected to the high-voltage input terminal of the motor controller 100 via a high-voltage wiring harness to provide high-voltage DC power to the motor controller 100. The vehicle's low-voltage battery (e.g., a 12V or 24V lead-acid battery or lithium battery) is electrically connected to the low-voltage power supply terminal of the motor controller 100 via a low-voltage wiring harness to provide low-voltage main power 200 to the motor controller 100. The AC output terminal of the motor controller 100 is electrically connected to the motor 500 via a three-phase power line. The motor controller 100 also communicates with external controllers 300, such as the vehicle control unit (VCU), via communication buses such as the CAN (Controller Area Network) bus to receive torque commands and report fault information.

[0039] After receiving power, the motor controller 100 inverts the high-voltage direct current into three-phase alternating current to drive the motor 500 to rotate, thereby converting electrical energy into mechanical energy to propel the vehicle. The vehicle controller sends torque commands to the motor controller 100 via the CAN bus, and the motor controller 100 controls the output torque and speed of the motor 500 according to the torque commands. When the motor controller 100 detects a power supply abnormality, it sends a fault message to the vehicle controller via the CAN bus. The vehicle controller then executes vehicle-level safety measures based on the fault information, such as illuminating the fault indicator light on the instrument panel, limiting the vehicle's power output, or taking other safety protection actions.

[0040] The vehicle provided in this embodiment, equipped with a motor controller 100 featuring power supply anomaly protection, can effectively handle various abnormal situations in the low-voltage power supply system during vehicle operation, preventing sudden loss of power due to minor power fluctuations and ensuring driving safety. Simultaneously, the motor controller 100 possesses comprehensive fault recording and reporting capabilities, facilitating fault tracing and rapid location during after-sales maintenance.

[0041] Please see Figure 1 The motor controller 100 is a core electronic control component of new energy vehicles, integrating a control board and a drive board. The control board includes a microcontroller 150 (MCU), a communication module 190, sensors, and signal acquisition circuits. The drive board includes a drive chip 160, a power module (IGBT or SiC MOSFET), a high-voltage side power supply module 120, and a low-voltage side power supply module 130.

[0042] By directly coupling the enable terminal of the high-voltage side power supply module 120 to the power output terminal of the low-voltage side power supply module 130, a power supply architecture that controls the high-voltage side power supply enable is formed. During power-up, the low-voltage side power supply module 130 establishes its output voltage first, and this output voltage is simultaneously applied as an enable signal to the enable terminal of the high-voltage side power supply module 120, ensuring that the high-voltage side power supply module 120 establishes its output only after the low-voltage side power supply is established. Thus, this power supply architecture ensures at the hardware level that the low-voltage side power supply of the driver chip 160 is established before the high-voltage side power supply, without relying on the MCU's software control, fundamentally eliminating the risk of PWM input floating and power transistor shoot-through failure due to power-up timing violations.

[0043] During the power-down process, when the main power supply 200 malfunctions and causes the low-voltage side power supply module 130 to lose its output voltage, the enable signal of the high-voltage side power supply module 120 is also lost, and the high-voltage side power supply module 120 immediately shuts down its output. Thus, the power-down sequence is automatically handled by hardware as a fallback, without relying on the software execution of the microcontroller 150, and the response speed is much faster than that of software control.

[0044] Furthermore, the first control circuit 140 monitors the output voltage of the low-voltage side power supply module 130 in real time. When the primary power supply 131 experiences overvoltage due to abnormal power supply fluctuations and exceeds a preset overvoltage threshold, the first control circuit 140 directly controls the switching circuit 110 to shut down without the involvement of the microcontroller 150. This physically cuts off the power supply path from the main power supply 200 to the motor controller 100, preventing abnormal overvoltage from being transmitted to downstream sensitive chips and avoiding damage to the core chip due to overvoltage.

[0045] The emergency shutdown path of the first control circuit 140 and the normal response process implemented by the microcontroller 150 form a hardware-software division of labor: for power supply anomalies that do not affect the safety of the core chip, the software logic performs fault diagnosis and graded response; for severe overvoltages that may directly damage the core chip, the pure hardware circuit implements rapid disconnection. This balances the accuracy of fault response with the safety of high-risk scenarios, enabling targeted responses to different power supply anomalies.

[0046] Please continue reading. Figure 1 In some embodiments, the motor controller 100 includes a control system, which includes a switching circuit 110, a high-voltage side power supply module 120, a low-voltage side power supply module 130, a first control circuit 140, a microcontroller 150, a driver chip 160, a second control circuit 170, a logic circuit 180, and a communication module 190.

[0047] The main power supply 200 (i.e., the output voltage of the vehicle's low-voltage battery) supplies power to the high-voltage side power supply module 120 and the low-voltage side power supply module 130 through the switching circuit 110. The switching circuit 110 is connected in series between the main power supply 200 and the internal power supply network of the motor controller 100, serving as the main switch for the main power supply. The switching circuit 110 can be implemented using controllable switching devices such as MOSFETs (Metal-Oxide-Semiconductor Field-Effect Transistors), IGBTs (Insulated Gate Bipolar Transistors), or relays. Its control terminal receives control signals from the logic circuit 180, enabling a rapid response to the on / off state of the main power supply 200.

[0048] The input terminal of the high-voltage side power supply module 120 is coupled to the main power supply 200 via a switching circuit 110. The high-voltage side power supply module 120 is primarily a DC-DC converter circuit, used to convert the voltage of the main power supply 200 (typically 12V or 24V) to the operating voltage required by the high-voltage side of the driver chip 160 (e.g., 15V or 18V). The high-voltage side power supply module 120 has an enable terminal, which is coupled to the power output terminal of the low-voltage side power supply module 130 (i.e., the output terminal of the primary power supply 131). The high-voltage side power supply module 120 only begins to establish output when a valid enable signal is received at the enable terminal; when the enable signal is lost, the high-voltage side power supply module 120 shuts down its output. The high-voltage side power supply module 120 integrates a first safety monitoring unit 121, used to monitor the output voltage, current, and other states of the high-voltage side power supply module 120, and generate a fault detection signal in case of abnormalities. The first safety monitoring unit 121 can be an integrated overvoltage protection (OVP), undervoltage protection (UVP), overcurrent protection (OCP), and overtemperature protection (OTP) module within the high-voltage side DC-DC chip, or it can be an independently set voltage detection circuit and current detection circuit.

[0049] The input terminal of the low-voltage side power supply module 130 is coupled to the main power supply 200 via a switching circuit 110. The low-voltage side power supply module 130 mainly consists of the SBC (System Base Chip) and its peripheral circuits. The SBC chip integrates power management, communication transceiver, watchdog, and other functions. The low-voltage side power supply module 130 includes a primary power supply 131 and a secondary power supply 132. The primary power supply 131 is the main output power supply of the SBC, typically 5V or 3.3V, used to power some circuits inside the motor controller 100 (such as sensors, signal acquisition circuits, etc.), and also serves as the input source for the secondary power supply 132. The output terminal of the primary power supply 131 is the power output terminal of the low-voltage side power supply module 130, which is coupled to the enable terminal of the high-voltage side power supply module 120, the input terminal of the first control circuit 140, and the input terminal of the secondary power supply 132. The secondary power supply 132 is obtained by stepping down the primary power supply 131 through the low-dropout linear regulator (LDO) or DC-DC converter inside the SBC, typically at a lower voltage level such as 3.3V or 1.8V. The output of the secondary power supply 132 is coupled to the low-voltage power supply terminal of the driver chip 160 and the power supply terminal of the microcontroller 150. The low-voltage side power supply module 130 integrates a second safety monitoring unit 133, which is used to monitor the output status of the primary power supply 131 and / or the secondary power supply 132. The second safety monitoring unit 133 can be a power monitoring function integrated within the SBC chip or an independent detection circuit. The second safety monitoring unit 133 is coupled to the microcontroller 150 and is used to provide fault detection signals to the microcontroller 150.

[0050] For example, the low-voltage side power supply module may consist of one or more power supply chips and peripheral circuits or circuits with voltage conversion functions. The low-voltage side power supply module is, for example, an SBC chip. The low-voltage side power supply module includes a primary power supply, which may be directly converted from the main power supply. The primary power supply has a power output terminal, and its input terminal is coupled to the main power supply through a switching circuit.

[0051] For example, the high-voltage side power supply module consists of one or more power chips and peripheral circuits or circuits with voltage conversion functions. The enable terminal of the high-voltage side power supply module is coupled to the power output terminal of the primary power supply.

[0052] The input terminal of the first control circuit 140 is coupled to the power output terminal of the low-voltage side power supply module 130 (i.e., the output terminal of the primary power supply 131), and the output terminal of the first control circuit 140 is coupled to the first input terminal of the logic circuit 180. The first control circuit 140 is used to output an emergency shutdown signal when the output voltage of the low-voltage side power supply module 130 exceeds a preset overvoltage threshold. The first control circuit 140 is a purely hardware-based emergency shutdown control circuit, and its structure will be described in detail in subsequent embodiments.

[0053] For example, the input terminal of the first control circuit is coupled to the power supply output terminal of the primary power supply, and the first control circuit is used to control the switch circuit to turn off when the output voltage of the primary power supply exceeds a preset overvoltage threshold.

[0054] The microcontroller 150 is the core control unit of the motor controller 100, responsible for executing motor control algorithms, fault diagnosis and response logic, and communication with the external controller 300. The microcontroller 150 can use an automotive-grade microcontroller chip (such as Infineon's TC series or NXP's S32K series), and its power supply is provided by the secondary power supply 132 in the low-voltage side power supply module 130. The microcontroller 150 is coupled to the first safety monitoring unit 121, the second safety monitoring unit 133, and the third safety monitoring unit 161 to receive fault detection signals reported by each safety monitoring unit. The microcontroller 150 is also coupled to the driver chip 160, controlling the driver chip 160 through PWM signals and interrupt control signals, thereby controlling the start, stop, and rotation of the motor 500 connected to the driver chip 160. The microcontroller 150 also communicates with the external controller 300 through the communication module 190 to report fault messages and receive control commands.

[0055] The driver chip 160 is the core device of the power drive module. It receives the PWM control signal from the microcontroller 150 and amplifies it into a drive signal sufficient to drive the gate of the power transistor. The driver chip 160 has a high-voltage side power supply terminal and a low-voltage side power supply terminal, receiving power from the secondary power supply 132 of the high-voltage side power supply module 120 and the low-voltage side power supply module 130, respectively. The driver chip 160 integrates a third safety monitoring unit 161, which can be a built-in undervoltage lockout (UVLO), overcurrent detection (DESAT), overtemperature protection, and fault feedback (FLT / FAULT) module. The third safety monitoring unit 161 is coupled to the microcontroller 150 and provides fault detection signals to the microcontroller 150.

[0056] The input terminal of the second control circuit 170 is coupled to the microcontroller 150, and the output terminal of the second control circuit 170 is coupled to the second input terminal of the logic circuit 180. The second control circuit 170 is used to output a switch control signal according to the instructions of the microcontroller 150. The second control circuit 170 can be implemented using a logic level driving circuit (such as a MOSFET driver or a transistor push-pull circuit) to convert the low-voltage logic signal output by the microcontroller 150 into a driving signal sufficient to drive the switch circuit 110.

[0057] The first input terminal of logic circuit 180 is coupled to the output terminal of the first control circuit 140, the second input terminal of logic circuit 180 is coupled to the output terminal of the second control circuit 170, and the output terminal of logic circuit 180 is coupled to the control terminal of switch circuit 110. Logic circuit 180 is configured such that: when the first control circuit 140 outputs an emergency shutdown signal, regardless of the signal output by the second control circuit 170, logic circuit 180 outputs a switch shutdown signal to control switch circuit 110 to shut down; when the first control circuit 140 does not output an emergency shutdown signal, logic circuit 180 outputs the control signal of the second control circuit 170 to control the on / off state of switch circuit 110. Logic circuit 180 can be implemented using basic digital logic gates such as AND gates and OR gates, or it can be implemented using more complex programmable logic devices (such as CPLDs and FPGAs) or simple diode logic circuits.

[0058] The communication module 190 is coupled to the microcontroller 150 and is used to realize communication between the microcontroller 150 and the external controller 300. The communication module 190 can be implemented using a CAN transceiver, LIN transceiver, or Ethernet transceiver, etc.

[0059] The motor controller 100 provided in this embodiment achieves targeted responses to different power supply anomalies through the architecture of the aforementioned control system. For severe overvoltage anomalies that may damage the core chip, the first control circuit 140 directly controls the switching circuit 110 to quickly shut down via the logic circuit 180, resulting in a short response time. For power supply anomalies that do not affect the core chip, the microcontroller 150 executes a software fault response based on the fault detection signals from each safety monitoring unit. The two response paths are arbitrated by the logic circuit 180 to ensure the absolute priority of the emergency shutdown signal. Simultaneously, the enable terminal of the high-voltage side power supply module 120 is controlled by the output voltage of the low-voltage side power supply module 130, ensuring the correct timing of the high and low voltage side power supplies to the driver chip 160 at the hardware level, without relying on the software control of the microcontroller 150.

[0060] Please continue reading. Figure 1 In some embodiments, the control system of the motor controller also includes a high-voltage module 400. The high-voltage module 400 is the high-voltage battery pack of the vehicle (e.g., a 400V or 800V power battery), and its output terminal is connected to the high-voltage input terminal of the motor controller 100 through a high-voltage wiring harness. After passing through the filtering and buffering circuit inside the motor controller 100, it is connected to the drive module (i.e., the drive chip 160 and the power module).

[0061] The high-voltage DC power supplied by the high-voltage module 400 is inverted into three-phase AC power by the power module (IGBT or SiC MOSFET) and then output to the motor 500 through the three-phase power lines to drive the motor 500 to rotate. The output terminal of the driver chip 160 is coupled to the gate of each power transistor in the power module and is used to control the turn-on and turn-off timing of the power transistors.

[0062] In the control system of this application, the connection between the high-voltage module 400 and the drive module is relatively independent of the low-voltage power supply system. An anomaly in the low-voltage power supply system (main power supply 200 → switching circuit 110 → low-voltage side power supply module 130 / high-voltage side power supply module 120) will not directly cause an abnormal high-voltage output from the high-voltage module 400. However, a power supply loss or timing error in the drive chip 160 caused by a low-voltage power supply anomaly may result in the power transistor not being driven correctly, leading to serious faults such as power transistor misfire or shoot-through between the upper and lower bridges. Therefore, this application controls the enable terminal of the high-voltage side power supply module 120 through the low-voltage side power supply module 130, ensuring that the drive chip 160 can be turned off according to the correct timing when a low-voltage power supply anomaly occurs, thereby ensuring the safety of the power module.

[0063] By clearly defining the connection relationship between the high-voltage module and the drive module, the positioning of the control system in the vehicle's high-voltage circuit is clearly demonstrated. The high-voltage side power supply module is controlled by the enable control mode of the low-voltage side power supply module, ensuring that the high-voltage side power transistor drive can be correctly shut down when the low-voltage power supply is abnormal, thus avoiding high-voltage side transistor failure caused by low-voltage power supply abnormalities.

[0064] Please continue reading. Figure 1 This embodiment provides a control system for a motor controller. The control system controls the enable terminal of the high-voltage side power supply module 120 through the output voltage of the low-voltage side power supply module 130, and sets up an independent first control circuit 140 to monitor the overvoltage of the output voltage of the low-voltage side power supply module 130. This architecture realizes the timing management of the high and low voltage side power supplies of the driver chip 160 and the rapid disconnection of high-risk overvoltage faults at the hardware level, taking into account both power-on timing safety and abnormal power supply hardware protection.

[0065] The control system includes a switching circuit 110, a high-voltage side power supply module 120, a low-voltage side power supply module 130, and a first control circuit 140.

[0066] A switching circuit 110 is connected in series between the main power supply 200 and the internal power supply network of the motor controller 100, serving as the main switch for the main power supply. The control terminal of the switching circuit 110 is coupled to the output terminal of the logic circuit 180, and the on / off control of the main power supply 200 is realized according to the control signal output by the logic circuit 180. The switching circuit 110 can be implemented using controllable switching devices such as MOSFETs, IGBTs, or relays. When implemented using a MOSFET, its gate serves as the control terminal, and its source and drain are connected in series in the power supply circuit of the main power supply 200; when implemented using a relay, its coil serves as the control terminal, and its contacts are connected in series in the power supply circuit of the main power supply 200.

[0067] The low-voltage side power supply module 130 has a power supply output terminal, and its input terminal is coupled to the main power supply 200 via a switching circuit 110. The low-voltage side power supply module 130 converts the voltage of the main power supply 200 into the operating voltage required by the low-voltage circuit inside the motor controller 100. The power supply output terminal of the low-voltage side power supply module 130 outputs the voltage of the primary power supply 131, which also serves as the enable signal for the high-voltage side power supply module 120, the input signal for the first control circuit 140, and the input power for the secondary power supply 132.

[0068] The input terminal of the high-voltage side power supply module 120 is coupled to the main power supply 200 via a switching circuit 110. The high-voltage side power supply module 120 has an enable terminal, which is coupled to the power output terminal of the low-voltage side power supply module 130. The high-voltage side power supply module 120 is used to convert the voltage of the main power supply 200 into the operating voltage required by the high-voltage side of the driver chip 160. The high-voltage side power supply module 120 only begins to establish an output when the enable terminal receives a valid enable signal from the low-voltage side power supply module 130. The output terminal of the high-voltage side power supply module 120 is coupled to the high-voltage power supply terminal of the driver chip 160.

[0069] The input terminal of the first control circuit 140 is coupled to the power output terminal of the low-voltage side power supply module 130, and the output terminal of the first control circuit 140 is coupled to the first input terminal of the logic circuit 180. The first control circuit 140 is used to monitor the output voltage of the low-voltage side power supply module 130 in real time. When the output voltage exceeds a preset overvoltage threshold, it outputs an emergency shutdown signal to the logic circuit 180 to control the switch circuit 110 to shut down. The first control circuit 140 is a pure hardware circuit without any software or firmware involvement, and has a short response time. The preset overvoltage threshold is set with reference to the pin withstand voltage value of the protected chip, for example, it can be set to a certain safe percentage (such as 90%) of the absolute maximum rated value of the SBC chip pin.

[0070] In this embodiment, after the output voltage of the low-voltage side power supply module 130 is established, this output voltage is simultaneously applied as an enable signal to the enable terminal of the high-voltage side power supply module 120, so that the high-voltage side power supply module 120 establishes its output only after the low-voltage side power supply is established. When the main power supply 200 malfunctions and causes the output voltage of the low-voltage side power supply module 130 to be lost, the enable signal of the high-voltage side power supply module 120 is also lost, and the output of the high-voltage side power supply module 120 is turned off as the output of the low-voltage side power supply module 130 is lost.

[0071] The enable terminal of the high-voltage side power supply module 120 is directly controlled by the output voltage of the low-voltage side power supply module 130, rather than relying on the software control of the microcontroller 150. During power-up, the low-voltage side power supply module 130 establishes its output voltage first, which is simultaneously applied as an enable signal to the enable terminal of the high-voltage side power supply module 120. This ensures that the high-voltage side power supply module 120 establishes its output only after the low-voltage side power supply is established, thus guaranteeing from a hardware perspective that the low-voltage side power supply of the driver chip 160 is established before the high-voltage side power supply, eliminating the risk of PWM input floating and power transistor overshoot due to power-up timing violations. During power-down, when the main power supply 200 malfunctions and causes the output voltage of the low-voltage side power supply module 130 to be lost, the enable signal of the high-voltage side power supply module 120 is also lost, and the high-voltage side power supply module 120 immediately shuts down its output. This provides hardware fallback for the power-down timing, without relying on the software execution of the microcontroller 150, and its response speed is much faster than software control methods.

[0072] The first control circuit 140 monitors the output voltage of the low-voltage side power supply module 130 in real time. When the primary power supply 131 experiences overvoltage due to abnormal power supply fluctuations and exceeds the preset overvoltage threshold, the first control circuit 140, without the participation of the microcontroller 150, directly controls the switch circuit 110 to shut down through the logic circuit 180, physically cutting off the power supply path from the main power supply 200 to the motor controller 100, preventing the abnormal overvoltage from being conducted to downstream sensitive chips (such as SBC, MCU, driver chip, etc.), and avoiding the core chip from burning out due to overvoltage.

[0073] The emergency shutdown path of the first control circuit 140 and the normal response process implemented by the microcontroller 150 form a software-hardware division of labor. For power supply anomalies that do not affect the safety of the core chip, the software logic is responsible for fault diagnosis and graded response; for severe overvoltages that may directly damage the core chip, the pure hardware circuitry performs rapid disconnection. This clearly defined architecture ensures the accuracy of fault response and provides a hardware-level safety net for high-risk scenarios.

[0074] Please see Figure 2The first control circuit 140 includes an overvoltage detection circuit. The input of the overvoltage detection circuit is coupled to the power output of the low-voltage side power supply module, and the output is coupled to the control terminal of the switching circuit. The overvoltage detection circuit compares the output voltage of the low-voltage side power supply module with a preset overvoltage threshold. When the output voltage exceeds the preset overvoltage threshold, an overvoltage signal is output to control the switching circuit to turn off. The preset overvoltage threshold is set according to the pin withstand voltage of the protected chip in the motor controller.

[0075] By directly coupling the output of the overvoltage detection circuit to the control terminal of the switching circuit 110, the overvoltage detection circuit immediately outputs an overvoltage signal to control the switching circuit 110 to shut down once it detects that the output voltage exceeds the preset overvoltage threshold. This process is entirely completed by the hardware circuit without any software involvement. Therefore, when the primary power supply 131 experiences overvoltage due to abnormal power supply fluctuations, the system can promptly cut off the power supply path from the main power supply 200 to the motor controller 100, preventing the abnormal overvoltage from being conducted to the downstream sensitive chip.

[0076] Meanwhile, by setting the preset overvoltage threshold according to the pin withstand voltage of the protected chip, the triggering condition of the overvoltage detection circuit is matched with the actual withstand capability of the chip. When the overvoltage amplitude reaches a level that may damage the chip, the overvoltage detection circuit activates immediately. This avoids both false triggering caused by setting the overvoltage threshold too low and damage to the chip before protection is activated due to setting the threshold too high, thus achieving effective protection of the core chip.

[0077] The overvoltage detection circuit achieves a rapid response to severe overvoltage through pure hardware, without relying on the software execution of the MCU. Even if the MCU fails due to power supply abnormality, the overvoltage detection circuit can still independently complete the overvoltage shutdown function.

[0078] For example, the overvoltage detection circuit can be a resistor divider combined with a comparator circuit, a Zener diode trigger circuit, a dedicated overvoltage monitoring IC, or other circuits with purely hardware-based overvoltage detection capabilities. The preset overvoltage threshold is set according to the pin withstand voltage of the protected chip in the motor controller. The protected chip is typically the power supply chip with the direct connection pin of the primary power supply.

[0079] Please continue reading. Figure 1 In some embodiments, the control system of the motor controller further includes a microcontroller 150, a first safety monitoring unit 121, a second safety monitoring unit 133, a driver chip 160, and a second control circuit 170 to construct a complete software fault response path.

[0080] The first safety monitoring unit 121 is located inside the high-voltage side power supply module 120 and is used to monitor the output status of the high-voltage side power supply module 120. The first safety monitoring unit 121 can be an integrated overvoltage protection (OVP), undervoltage protection (UVP), overcurrent protection (OCP), and overtemperature protection (OTP) module within the high-voltage side DC-DC chip, or it can be an independently set voltage detection circuit and current detection circuit. The first safety monitoring unit 121 is coupled to the general purpose input / output (GPIO) port or analog-to-digital converter (ADC) input pin of the microcontroller 150 and is used to provide fault detection signals (usually interrupt signals or level signals) to the microcontroller 150.

[0081] The second safety monitoring unit 133 is located inside the low-voltage side power supply module 130 and is used to monitor the output status of the primary power supply 131 and / or the secondary power supply 132. The second safety monitoring unit 133 can be a power monitoring function integrated within the SBC chip or an independent detection circuit. The second safety monitoring unit 133 is coupled to the microcontroller 150 and is used to provide fault detection signals to the microcontroller 150.

[0082] The driver chip 160 receives the PWM control signal from the microcontroller 150 and amplifies it into a gate drive signal for the power transistor. The driver chip 160 has a high-voltage side power supply terminal and a low-voltage side power supply terminal, which are respectively coupled to the output terminal of the high-voltage side power supply module 120 and the output terminal of the secondary power supply 132 of the low-voltage side power supply module 130. The microcontroller 150 is coupled to the driver chip 160 to control the driver chip 160 to output the PWM drive signal.

[0083] The input terminal of the second control circuit 170 is coupled to the microcontroller 150, and the output terminal of the second control circuit 170 is coupled to the second input terminal of the logic circuit 180. The second control circuit 170 is used to output a switch control signal to the logic circuit 180 according to the instructions of the microcontroller 150. The second control circuit 170 can be implemented using a logic level driving circuit to convert the low-voltage logic signal output by the microcontroller 150 into a driving signal sufficient to drive the switch circuit 110.

[0084] By setting up the internal safety monitoring functions (third safety monitoring unit 161) of the first safety monitoring unit 121, the second safety monitoring unit 133 and the driver chip 160, the system can obtain fault detection signals from multiple nodes when a power supply abnormality occurs, realize comprehensive fault monitoring, and achieve high fault diagnosis coverage and accurate positioning.

[0085] The microcontroller 150 executes fault response logic based on the received fault detection signal, which can distinguish the fault type and severity level. For non-severe faults, it only stops the PWM output without cutting off the main power supply 200, allowing the system to maintain operation or attempt recovery in a safe state, avoiding unnecessary power interruption due to minor power supply fluctuations, and improving the driving smoothness and user experience of the vehicle.

[0086] The second control circuit 170 enables the microcontroller 150 to actively shut down the switch circuit 110 via software instructions when it is confirmed that power supply needs to be cut off (e.g., when a serious fault requires complete power outage protection), thus realizing software-level power supply control and complementing the hardware emergency shutdown of the first control circuit 140.

[0087] The microcontroller 150 communicates with the external controller 300 through the communication module 190, and can report fault information to the vehicle controller, which facilitates collaborative processing and fault recording at the vehicle level, and makes it easier to trace the source of faults during after-sales maintenance.

[0088] For example, the first safety monitoring unit 121 is typically an internal module with safety monitoring function integrated into the power supply chip of the high-voltage side power supply module. The second safety monitoring unit 133 is typically an internal module with safety monitoring function integrated into the power supply chip of the low-voltage side power supply module.

[0089] Please continue reading. Figure 1 In some embodiments, the low-voltage side power supply module 130 further includes a secondary power supply 132. The input terminal of the secondary power supply 132 is coupled to the power supply output terminal of the low-voltage side power supply module 130 (i.e., the output terminal of the primary power supply 131), and the output terminal of the secondary power supply 132 is coupled to the low-voltage power supply terminal of the driver chip 160 and the power supply terminal of the microcontroller 150.

[0090] For example, the input of the secondary power supply 132 is coupled to the output of the primary power supply 131. The secondary power supply 132 can be obtained by stepping down the primary power supply 131 through the low-dropout linear regulator (LDO) or DC-DC converter inside the SBC, typically at a lower voltage level such as 3.3V or 1.8V. The secondary power supply 132 is specifically designed to power the low-voltage side of the microcontroller 150 and the driver chip 160.

[0091] In some SBC chips, the secondary power supply 132 can also be generated by the primary power supply 131 through an external independent LDO chip. For example, the secondary power supply consists of one or more power supply chips and peripheral circuits or circuits with voltage conversion functions. It is usually a module of the SBC chip and provides low-voltage power supply to various modules of the motor controller, typically 5V, 3.3V, 1.09V, etc.

[0092] The secondary power supply 132 ensures that the power supply to the low-voltage side of the microcontroller 150 and driver chip 160 is regulated by two stages (main power supply 200 → primary power supply 131 → secondary power supply 132), resulting in a better power supply rejection ratio (PSRR). This effectively filters out noise and ripple at the main power supply end, providing a cleaner and more stable operating power supply for the microcontroller 150 and driver chip 160, thereby improving the system's anti-interference capability and operational reliability.

[0093] The cascading relationship between the primary power supply 131 and the secondary power supply 132 ensures that when the primary power supply 131 experiences fluctuations or loss due to an anomaly in the main power supply 200, the secondary power supply 132 will also fluctuate or lose power, synchronously affecting the low-voltage side power supply of the microcontroller 150 and the driver chip 160. This power supply relationship ensures consistent power supply status for all core components of the system, avoiding unpredictable system behavior caused by abnormal power supply to some circuits while other circuits are powered normally.

[0094] After the power supply is restored from the abnormality, the primary power supply 131 is established first, followed by the secondary power supply 132, ensuring a reliable power-on sequence for the low-voltage side power supply of the microcontroller 150 and the driver chip 160.

[0095] By unifying the low-voltage power supply of the microcontroller 150 and the driver chip 160 with the secondary power supply 132, the design of the power distribution network is simplified, the number of external LDO chips is reduced, and the system cost and PCB area are reduced.

[0096] Please continue reading. Figure 1 In some embodiments, the control system of the motor controller further includes a logic circuit 180, the output terminal of the first control circuit 140 and the output terminal of the second control circuit 170 are respectively coupled to the input terminal of the logic circuit 180, and the output terminal of the logic circuit 180 is coupled to the control terminal of the switch circuit 110.

[0097] The logic circuit 180 is configured such that when the first control circuit 140 outputs an emergency shutdown signal (i.e., a severe overvoltage is detected), the logic circuit 180 outputs a switch shutdown signal to control the switch circuit 110 to shut down, regardless of what signal the second control circuit 170 outputs; when the first control circuit 140 does not output an emergency shutdown signal (i.e., no severe overvoltage is detected), the logic circuit 180 outputs the control signal of the second control circuit 170 to control the on / off state of the switch circuit 110.

[0098] For example, the logic circuit can be a purely hardware-responsive circuit such as a comparator and logic gates or a dedicated logic IC. For instance, logic circuit 180 can be implemented using basic digital logic gates such as AND gates and OR gates.

[0099] Specifically, when the emergency shutdown signal is active high, an OR gate can be used. The output signals of the first control circuit 140 and the second control circuit 170 are respectively input to the two input terminals of the OR gate, and the output terminal of the OR gate serves as the output terminal of the logic circuit 180. When the first control circuit 140 outputs a high level (emergency shutdown), the OR gate outputs a high level (switch off); when the first control circuit 140 outputs a low level (not off), the OR gate outputs the signal level of the second control circuit 170. When the emergency shutdown signal is active low, a similar logic function can be achieved using an AND gate in conjunction with an inverter.

[0100] The introduction of logic circuit 180 resolves the potential control signal conflicts between the first control circuit 140 and the second control circuit 170. Without logic circuit 180 for arbitration, when a hardware emergency shutdown requires switch circuit 110 to turn off while the microcontroller 150 software, due to a fault or misjudgment, requires switch circuit 110 to turn on, switch circuit 110 will be in an uncertain state, potentially leading to severe overvoltage that cannot be cut off. Logic circuit 180 ensures the absolute priority of the emergency shutdown signal through hardware-level priority arbitration.

[0101] The logic circuit 180 is composed of pure hardware logic gates and does not involve software operation, resulting in a fast response speed. Even in the event of a complete failure of the microcontroller 150 (such as power loss, system crash, or program crash), the emergency shutdown signal output by the first control circuit 140 can still directly control the switch circuit 110 to shut down through the logic circuit 180, achieving true hardware-level safety fallback.

[0102] The logic circuit 180 has a simple structure, low cost, and high reliability, and does not require additional software development work.

[0103] The design of logic circuit 180 makes the hardware emergency shutdown path and the software control path physically independent, yet organically combined through logic circuit 180, forming a multi-level safety control system of "software control when the software is normal, hardware backup when the software fails, and hardware forced shutdown when a high-risk fault is detected".

[0104] Please continue reading. Figure 1 In some embodiments, the driver chip 160 further includes a third safety monitoring unit 161. The third safety monitoring unit 161 is coupled to the microcontroller 150 and is used to provide fault detection signals to the microcontroller 150.

[0105] For example, the third safety monitoring unit 161 is integrated inside the driver chip 160 and is a built-in fault detection and protection module of the driver chip 160. Common driver chips (such as Infineon's EiceDRIVER series, TI's UCC series, etc.) usually have multiple built-in safety monitoring functions, including but not limited to: undervoltage lockout (UVLO), used to monitor whether the supply voltage of the driver chip 160 is lower than the normal operating threshold; overcurrent detection (DESAT), used to monitor whether the power transistor has a short circuit or overcurrent fault; overtemperature protection, used to monitor whether the temperature of the driver chip 160 or the power module exceeds the safety limit; fault feedback (FLT / FAULT), used to output a fault signal to the microcontroller 150 when any of the above faults are detected. The output terminal of the third safety monitoring unit 161 is coupled to the general purpose input / output port or interrupt input pin of the microcontroller 150. When a fault is detected, it outputs a fault detection signal (usually a fault flag signal that is active low) to the microcontroller 150.

[0106] The third safety monitoring unit 161 enables the microcontroller 150 to directly obtain fault status information of the power stage (IGBT / SiC MOSFET) from the driver chip 160, including key safety parameters such as power transistor undervoltage, overcurrent, and overtemperature. This information is crucial for determining the scope and severity of the power supply anomaly. For example, when an anomaly in the main power supply 200 causes undervoltage on the low-voltage side of the driver chip 160, the undervoltage lockout function of the third safety monitoring unit 161 will be triggered. After receiving the fault signal, the microcontroller 150 can determine that the fault source is a power supply anomaly rather than other causes, thereby executing an accurate fault response.

[0107] The third safety monitoring unit 161 inside the driver chip 160, together with the first safety monitoring unit 121 of the high-voltage side power supply module 120 and the second safety monitoring unit 133 of the low-voltage side power supply module 130, constitute a fault monitoring network covering the entire link from the power input terminal to the power conversion stage to the driver output stage. Any abnormality in any link can be detected and reported in a timely manner.

[0108] The fault feedback of the driver chip 160 is usually a fast hardware-level response (such as undervoltage lockout, which latches the output within microseconds after the supply voltage is lower than the threshold). Compared with the microcontroller 150, which judges by ADC sampling, it is faster and more reliable and can detect faults earlier.

[0109] The fault detection signal output by the third safety monitoring unit 161 can serve as one of the important inputs for the microcontroller 150 to perform fault classification criteria. For example, when fault signals are received simultaneously from the first safety monitoring unit 121 and the second safety monitoring unit 133, the microcontroller 150 can determine that it is a power supply side fault; when only the fault signal is received from the third safety monitoring unit 161, the microcontroller 150 can determine that it is a load side fault.

[0110] Please continue reading. Figure 1 In some embodiments, the control system of the motor controller further includes sensors and signal acquisition circuitry. The sensors and signal acquisition circuitry are located on the control board of the motor controller 100, and their outputs are coupled to the analog-to-digital converter (ADC) input pins and / or general-purpose input / output (GPIO) ports of the microcontroller 150.

[0111] The sensor and signal acquisition circuit is used to acquire various status signals during the operation of the motor controller 100, including but not limited to: rotor position signals of the motor 500 (from a rotary transformer or Hall sensor), three-phase current signals (from a current Hall sensor or shunt resistor), power module temperature signals (from an NTC thermistor), and DC bus voltage signals. After preprocessing these analog signals such as filtering, amplification, and level conversion, the sensor and signal acquisition circuit converts them into digital signals or analog voltage signals that can be recognized by the microcontroller 150, which serve as input signals for the microcontroller 150 to execute motor control algorithms and logic control.

[0112] Meanwhile, some information collected by the sensors and signal acquisition circuits (such as voltage, current, temperature, and other status data at the time of the fault) is transmitted to the external controller 300 (e.g., the vehicle controller) through the communication module 190 for vehicle-level status monitoring and fault recording. This enables the external controller 300 to know the working status of the motor controller 100 in real time and to obtain complete data before and after the fault when a power supply abnormality occurs, facilitating fault tracing and after-sales maintenance.

[0113] In this embodiment, the sensor and signal acquisition circuit provide the microcontroller 150 with the key input parameters required for performing fault classification judgment. For example, when the microcontroller 150 receives an overvoltage fault signal from the first safety monitoring unit 121, it can perform cross-verification with the DC bus voltage signal acquired by the sensor and signal acquisition circuit to confirm the authenticity of the fault and avoid unnecessary protection actions due to false alarms from a single fault signal. At the same time, the current, temperature, and other information acquired by the sensor and signal acquisition circuit are also important bases for the microcontroller 150 to judge the fault level (non-serious fault or preset serious fault).

[0114] The sensor and signal acquisition circuits provide the microcontroller with all the input signals required for motor control and fault diagnosis, making fault diagnosis more accurate and reliable. By reporting the acquired information to an external controller via the communication module, vehicle-level status monitoring and fault recording are achieved, facilitating fault tracing during after-sales maintenance. Cross-validation of sensor signals and safety monitoring unit signals improves the reliability of fault detection and reduces the false alarm rate.

[0115] Please continue reading. Figure 1 In some embodiments, the control system of the motor controller further includes a backup power supply 600 and a backup switch circuit 700. The backup switch circuit 700 is connected in series between the backup power supply 600 and the motor controller 100. The output terminal of the first control circuit 140 is also coupled to the control terminal of the backup switch circuit 700. The first control circuit 140 is used to control the backup switch circuit 700 to conduct when it detects that the output voltage of the low-voltage side power supply module 130 exceeds a preset overvoltage threshold.

[0116] The backup power supply 600 can be an independent branch of the vehicle's low-voltage battery, an independent DC-DC converter (e.g., low-voltage power obtained from a high-voltage battery pack via a flyback power supply), or an energy storage element such as a supercapacitor. The output of the backup power supply 600 is coupled to the input terminals of the high-voltage side power supply module 120 and the low-voltage side power supply module 130 inside the motor controller 100 via a backup switch circuit 700. The backup switch circuit 700 has a similar structure to the main power supply switch circuit 110 and can also be implemented using controllable switching devices such as MOSFETs, IGBTs, or relays. The control terminal of the backup switch circuit 700 is coupled to the output terminal of the first control circuit 140.

[0117] When the first control circuit 140 detects that the output voltage of the low-voltage side power supply module 130 exceeds the preset overvoltage threshold, its output terminal not only outputs a shutdown signal to the main power supply switching circuit 110 through the logic circuit 180, but also outputs a conduction signal to the backup switching circuit 700, thereby switching the power supply source of the motor controller 100 from the main power supply 200 to the backup power supply 600.

[0118] The introduction of backup power supply 600 allows the motor controller 100 to smoothly transition to backup power supply 600 to continue working in the event of a severe power supply anomaly, without completely shutting down. This avoids power interruption caused by power supply switching and improves system availability and driving safety.

[0119] The first control circuit 140 simultaneously controls the main power supply switch circuit 110 to turn off and the backup switch circuit 700 to turn on, achieving rapid switching. The switching process is entirely completed by hardware, with a short switching time, much faster than software detection and switching schemes, ensuring that the motor controller 100 will not lose power and restart due to power interruption during the power supply switching process.

[0120] When no overvoltage is detected, the backup switch circuit 700 remains off, the backup power supply 600 does not participate in power supply, which does not affect the normal operation of the main power supply 200 and also avoids the circulating current problem between the backup power supply 600 and the main power supply 200.

[0121] Please continue reading. Figure 1 In some embodiments, the control system further includes a backup control circuit connected to a backup switch circuit. The backup control circuit is used to control the on / off state of the backup switch circuit.

[0122] By setting up a backup control circuit, an independent path is provided to control the backup switch circuit. Both the backup control circuit and the first control circuit 140 (emergency shutdown circuit) can control the backup switch circuit, forming a redundant design with the two control paths.

[0123] Please see Figure 3 The control method for the motor controller provided in this embodiment is applied to the control system of the motor controller provided in any of the foregoing embodiments. The method includes the following steps.

[0124] S1. During power-on, when the main power supply 200 is normal, the low-voltage side power supply module 130 establishes its output voltage first. The output voltage of the low-voltage side power supply module 130 is simultaneously applied as an enable signal to the enable terminal of the high-voltage side power supply module 120. After the output voltage of the low-voltage side power supply module 130 is established, the high-voltage side power supply module 120 responds to this enable signal and establishes its output. This timing ensures that the low-voltage side power supply of the driver chip 160 is established before the high-voltage side power supply, avoiding mis-turn-on of the power transistor caused by a floating PWM input.

[0125] For example, "During the power-on process, when the main power supply 200 is normal, the low-voltage side power supply module 130 first establishes the output voltage" means that during the power-on process, when the main power supply 200 is normal, the primary power supply 131 establishes the output voltage.

[0126] S2. When the main power supply 200 malfunctions and the output voltage of the low-voltage side power supply module 130 is zero (i.e. completely lost), the enable signal of the high-voltage side power supply module 120 disappears. The output of the high-voltage side power supply module 120 is immediately turned off as the output voltage of the low-voltage side power supply module 130 becomes zero, thus realizing automatic hardware control of the power-down sequence without the need for microcontroller 150 intervention.

[0127] For example, "when the main power supply 200 malfunctions and the output voltage of the low-voltage side power supply module 130 is zero" means when the main power supply 200 malfunctions and the output voltage of the primary power supply 131 is zero.

[0128] S3. When the main power supply 200 malfunctions and the output voltage of the low-voltage side power supply module 130 exceeds the preset overvoltage threshold, the first control circuit 140 (pure hardware emergency shutdown circuit) controls the switch circuit 110 to shut down through the logic circuit 180, cutting off the power supply path from the abnormal main power supply 200 to the motor controller 100.

[0129] For example, "when the main power supply 200 malfunctions and the output voltage of the low-voltage side power supply module 130 exceeds the preset overvoltage threshold" means when the main power supply 200 malfunctions and the output voltage of the primary power supply 131 exceeds the preset overvoltage threshold.

[0130] During the power-on process (step S1), the high-voltage side power supply module 120 is controlled by the low-voltage side power supply module 130's enable control method, eliminating the risk of power transistor failure due to power-on timing violations at the hardware level. This is something that software control methods cannot fully guarantee, as software has uncertainties such as startup delays and incomplete initialization.

[0131] The hardware fallback mechanism that automatically shuts down the high-voltage side power supply module 120 when the low-voltage side power supply module 130 is lost during the power-down process (step S2) ensures that the driver chip 160 can be shut down according to the correct timing when the power supply fails, thus avoiding random gate voltage output and power transistor mis-turn-on caused by PWM input floating.

[0132] For instantaneous power surges (such as those caused by a rapid recovery and subsequent rapid decline of the main power supply after an abnormal power outage of 200V) Figure 4 (Voltage fluctuations during the power-on process shown) This power architecture ensures that the high-voltage side power supply module 120 will not be established before the low-voltage side power supply module 130 is fully established, nor will it continue to output after the low-voltage side power supply module 130 has been lost, thus effectively avoiding timing risks during repeated power-on and power-off processes.

[0133] When an overvoltage occurs (step S3), the first control circuit 140, being a purely hardware circuit that does not rely on software operation, can cut off the abnormal power supply in a very short time after the overvoltage occurs. This minimizes the damage time and extent of the overvoltage to subsequent chips.

[0134] In some embodiments, the control method of the motor controller further includes: S4. When the main power supply 200 malfunctions and the output voltage of the low-voltage side power supply module does not exceed the preset overvoltage threshold, the microcontroller 150 executes a fault response based on the fault detection signals received from the high-voltage side power supply module, the low-voltage side power supply module, and / or the driver chip 160.

[0135] When the main power supply 200 experiences an anomaly (e.g., voltage drop, voltage fluctuation, undervoltage, etc.), but the output voltage of the primary power supply 131 does not exceed the preset overvoltage threshold of the first control circuit 140, the first control circuit 140 does not activate, and the abnormal power supply continues to enter the motor controller 100. At this time, the first safety monitoring unit 121 inside the high-voltage side power supply module 120, the second safety monitoring unit 133 inside the low-voltage side power supply module 130, and / or the third safety monitoring unit 161 inside the driver chip 160 will detect the corresponding power supply anomaly (e.g., undervoltage, overcurrent, etc.) and output a fault detection signal to the microcontroller 150. After receiving these fault detection signals, the microcontroller 150 executes a fault response according to the preset fault handling logic.

[0136] For abnormal power supply fluctuations (such as slight voltage drops or voltage sags) that do not reach the overvoltage threshold, the system does not take hard shutdown measures. Instead, it diagnoses and responds through software, avoiding unnecessary power interruptions caused by minor power supply anomalies. For example, when the main power supply voltage 200 drops briefly but remains within the operating range of the SBC and driver chip 160, the system can continue to operate, and the vehicle will not experience power loss, improving driving smoothness.

[0137] The microcontroller 150 can comprehensively judge multiple fault detection signals from the first safety monitoring unit 121, the second safety monitoring unit 133, and the third safety monitoring unit 161, making fault diagnosis more accurate. It can accurately distinguish whether the fault source is on the power supply side or the load side, providing accurate basis for subsequent fault handling and after-sales maintenance. The microcontroller 150 sends fault messages to the external controller 300 (such as the vehicle controller) through the communication module 190, so that the vehicle level can know the abnormal power supply status of the motor controller 100, which facilitates coordinated handling by the whole vehicle (such as limiting power output, illuminating the fault light, recording fault codes, etc.). This division of labor mode of "hardware manages high risks, software manages routine risks" enables the system to maintain high availability while ensuring safety, avoiding the crude protection method of "one-size-fits-all".

[0138] In some embodiments, the microcontroller 150 performs a fault response including the following steps.

[0139] S51. Microcontroller 150 determines the fault level. Microcontroller 150 has a preset fault classification strategy, which classifies faults into different levels based on factors such as fault type, fault source, fault duration, and current system state. For example, faults that only affect the drive output (such as a slight overtemperature reported by the driver chip 160) can be classified as non-serious faults, while faults that may cause hardware damage (such as power transistor overcurrent, severe undervoltage on the high-voltage side, etc.) can be classified as preset serious faults.

[0140] "Preset critical faults" refer to the fault levels that the microcontroller determines, based on a preset fault classification strategy, that may lead to hardware damage in the motor controller. For example, power transistor overcurrent and severe undervoltage on the high-voltage side can be classified as preset critical faults; while faults that only affect the drive output and do not cause hardware damage (such as slight overheating of the drive chip) can be classified as non-preset critical faults.

[0141] S52. If it is not a preset serious fault, the microcontroller 150 controls the driver chip 160 to stop outputting PWM drive signals, so that all power transistors are turned off and the motor 500 enters a safe state (such as free stop), but keeps the switching circuit 110 on to maintain the power supply to the motor controller 100 for subsequent fault recovery or status monitoring.

[0142] S53. If it is a preset serious fault, the microcontroller 150 controls the driver chip 160 to stop outputting the PWM drive signal, and controls the switch circuit 110 to turn off through the second control circuit 170, completely cutting off the power supply from the main power supply 200 to the motor controller 100, and realizing physical isolation at the hardware level.

[0143] The fault classification response mechanism enables the system to take differentiated protection measures according to the severity of the fault, avoiding the problems of over-protection (cutting off power supply for non-serious faults) or under-protection (stopping PWM output without cutting off power supply for serious faults).

[0144] For non-critical faults, only the PWM output is stopped while the power supply is maintained, so that the microcontroller 150 and the communication module 190 can still work normally. They can continuously send fault messages, record fault data, wait for external commands, or attempt automatic recovery, providing conditions for fault-tolerant operation and post-fault analysis of the system.

[0145] For preset serious faults, the power supply is cut off after the PWM output is stopped, ensuring the correct protection sequence of "first turn off the power transistor safely, then cut off the system power supply". This avoids the risk of loss of control caused by the microcontroller 150 and driver chip 160 suddenly losing power during the shutdown process and failing to complete the safe shutdown of the power transistor if the power supply is cut off first.

[0146] The presence of the second control circuit 170 enables the microcontroller 150 to actively control the switching circuit 110 at the software level, complementing the hardware emergency shutdown of the first control circuit 140. The hardware shutdown is responsible for "high-risk overvoltages that cannot wait for software to react", while the software shutdown is responsible for "serious faults that require software judgment and confirmation". The two have their own division of labor and work together at different time scales and different fault types.

[0147] Please see Figure 4 , Figure 4This is a schematic diagram of a power supply anomaly waveform provided for an embodiment of this application. This embodiment, combined with a specific power supply anomaly scenario, illustrates the working process of the technical solution of this application in practical applications.

[0148] In some application scenarios of this invention, the vehicle's small battery is depleted, and its terminal voltage is too low to independently power the vehicle's low-voltage system or start the load. Therefore, it is necessary to use an external power source (jump switch or rescue vehicle battery) in parallel to provide jump-start power. The external power source supplements the voltage and current, supporting the vehicle's low-voltage wake-up and power-on. After the vehicle's own generator (generator or DC-DC converter) is working normally and the low-voltage system voltage stabilizes, the jump-start cable is removed.

[0149] Jump-starting is performed manually by the vehicle owner or rescue personnel. During the contact process at the small battery terminals, human factors such as shaking and friction can cause poor contact, introducing additional contact resistance. This can lead to abnormal power supply in the power supply circuit, such as momentary voltage drops and arcing voltage spikes. Figure 4 As shown.

[0150] During the time period t1, the main power supply voltage V3 is greater than the low-voltage wake-up threshold of the vehicle motor controller 100, and the motor controller 100 is woken up and starts to work normally.

[0151] During the tf time period, the main power supply suddenly drops to a voltage V1 below the low-voltage wake-up threshold. At this time, the output voltage of the low-voltage side power supply module 130 is lost, and the enable signal of the high-voltage side power supply module 120 is lost accordingly. The output of the high-voltage side power supply module 120 is turned off as the output of the low-voltage side power supply module 130 is lost, thus avoiding the situation of PWM input floating and random output gate voltage.

[0152] During the TR period, the main power supply is boosted again, and the motor controller 100 is woken up and started again. During this process, the high-voltage side power supply module 120 establishes its output after the low-voltage side power supply module 130 establishes its output, ensuring the correct power-on sequence of the driver chip 160 without the need for software control.

[0153] During the time period t3, the motor controller 100 operates normally.

[0154] During the tf time period, the main power supply suddenly drops to V2 (greater than the low-voltage wake-up threshold), and then quickly rises again during the tr time period. During this process, the motor controller 100 remains in a continuously woken-up state. This abnormal main power supply is directly fed into the subsequent circuitry of the motor controller 100 and directly conducted into the power chip directly connected to the main power supply. The automotive-grade power chip is a closed-loop control system; when the abnormal power supply jump rate exceeds the regulation rate, it is highly susceptible to regulation abnormalities, leading to overvoltage in the output power supply, corresponding to the primary power supply 131 in this embodiment. Severe overvoltage can directly damage the chip pins or components directly connected to this output power supply.

[0155] When the first control circuit 140 detects a severe overvoltage in the primary power supply 131, it directly controls the switching circuit 110 to shut down via the logic circuit 180, preventing the main power supply abnormality from being transmitted to the motor controller 100. After the main power supply is lost, the first control circuit 140 also loses power shortly thereafter, losing control of the switching circuit 110. At this time, within time t5, if the main power supply exceeds the low-voltage wake-up threshold, the control circuit (second control circuit 170) controls the switching circuit 110 to turn on again, ensuring that the main power supply without abnormalities powers the motor controller 100.

[0156] If the primary power supply 131 does not experience severe overvoltage, the abnormal power supply will normally enter the motor controller 100 system. Based on the fault manifestation caused by the abnormality, the microcontroller 150 will initiate a fault response based on the results of the first safety monitoring unit 121, the second safety monitoring unit 133, the third safety monitoring unit 161, and the internal safety monitoring results of the microcontroller 150.

[0157] In summary, this embodiment fully demonstrates the working process of the technical solution of this application in a typical power supply abnormality scenario such as jump-start operation, and verifies its reliability and effectiveness under various abnormal conditions such as instantaneous voltage drop, rapid voltage recovery, and severe overvoltage.

[0158] Based on the previous embodiments, this application proposes a dual-track parallel response mechanism with software and hardware division of labor: when the main power supply is abnormal, the system performs two processes simultaneously: normal response and emergency response. The normal response is handled by the MCU using software fault handling, while the emergency response is directly executed by the pure hardware emergency shutdown control circuit for rapid shutdown, thus taking into account both the accuracy and speed of fault response.

[0159] This application proposes a hardware timing control architecture in which the high-voltage side power supply enable terminal is controlled by the primary power supply. The primary power supply is directly connected to the enable terminal of the high-voltage side power supply module, controlling the high-voltage side power supply to be established only after the low-voltage side power supply is established, and to be immediately lost after the low-voltage side power supply is lost. This timing control does not rely on MCU software execution, thus eliminating illegal power-on timing from the hardware source.

[0160] This application proposes a parallel output and logic operation architecture for an emergency shutdown control circuit and a control circuit. The outputs of the two circuits serve as input signals for the logic circuit, and the control signals for the switching circuit are output through logic operations. This provides a hardware-level safety net for high-risk scenarios while ensuring normal software control.

[0161] It should be understood that the application of this application is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims. Those skilled in the art can understand that implementing all or part of the processes of the above embodiments and making equivalent changes according to the claims of this application still fall within the scope of this application.

Claims

1. A control system for a motor controller, characterized in that, include: Switching circuit, low-voltage side power supply module, high-voltage side power supply module, and first control circuit; The switching circuit is used to control the on / off state of the main power supply; The low-voltage side power supply module has a power output terminal, and the input terminal of the low-voltage side power supply module is coupled to the main power supply through the switching circuit. The input terminal of the high-voltage side power supply module is coupled to the main power supply through the switching circuit. The high-voltage side power supply module has an enable terminal, which is coupled to the power output terminal of the low-voltage side power supply module. The input terminal of the first control circuit is coupled to the power output terminal of the low-voltage side power supply module, and the output terminal of the first control circuit is coupled to the control terminal of the switching circuit. The first control circuit is used to control the switching circuit to turn off when the output voltage of the low-voltage side power supply module exceeds a preset overvoltage threshold. After the output voltage of the low-voltage side power supply module is established, the high-voltage side power supply module establishes its output; when the output voltage of the low-voltage side power supply module is lost, the high-voltage side power supply module shuts off its output.

2. The control system according to claim 1, characterized in that, The first control circuit includes an overvoltage detection circuit, the input terminal of which is coupled to the power supply output terminal of the low-voltage side power supply module, and the output terminal of which is coupled to the control terminal of the switching circuit. The overvoltage detection circuit is used to compare the output voltage of the low-voltage side power supply module with the preset overvoltage threshold. When the output voltage exceeds the preset overvoltage threshold, an overvoltage signal is output to control the switching circuit to turn off. The preset overvoltage threshold is set according to the pin withstand voltage of the protected chip in the motor controller.

3. The control system according to claim 1, characterized in that, The control system further includes: a microcontroller, a first safety monitoring unit, a second safety monitoring unit, a driver chip, and a second control circuit; The first safety monitoring unit is located in the high-voltage side power supply module, and the second safety monitoring unit is located in the low-voltage side power supply module. The first safety monitoring unit and the second safety monitoring unit are respectively coupled to the microcontroller and are used to provide fault detection signals to the microcontroller. The microcontroller is coupled to the driver chip to control the driver chip to output a drive signal. The input terminal of the second control circuit is coupled to the microcontroller, and the output terminal of the second control circuit is coupled to the control terminal of the switching circuit. The second control circuit is used to control the switching circuit to open or close according to the instructions of the microcontroller.

4. The control system according to claim 3, characterized in that, The low-voltage side power supply module also includes a secondary power supply. The input terminal of the secondary power supply is coupled to the power supply output terminal of the low-voltage side power supply module, and the output terminal of the secondary power supply is coupled to the low-voltage power supply terminal of the driver chip and the power supply terminal of the microcontroller.

5. The control system according to claim 3, characterized in that, The control system further includes a logic circuit, wherein the output terminals of the first control circuit and the second control circuit are respectively coupled to the input terminals of the logic circuit, and the output terminal of the logic circuit is coupled to the control terminal of the switching circuit. The logic circuit is configured as follows: When the first control circuit outputs a shutdown signal, the logic circuit outputs a switch shutdown signal to control the switch circuit to shut down. When the first control circuit does not output a shutdown signal, the logic circuit outputs a control signal from the second control circuit to control the on / off state of the switching circuit.

6. The control system according to claim 3, characterized in that, The driver chip also includes a third safety monitoring unit, which is coupled to the microcontroller; the third safety monitoring unit is used to provide fault detection signals to the microcontroller.

7. The control system according to claim 1, characterized in that, The control system further includes a backup power supply and a backup switch circuit. The backup switch circuit is connected in series between the backup power supply and the motor controller. The output terminal of the first control circuit is also coupled to the control terminal of the backup switch circuit. The first control circuit is used to control the backup switch circuit to turn on when it detects that the output voltage of the low-voltage side power supply module exceeds the preset overvoltage threshold.

8. The control system according to claim 7, characterized in that, The control system further includes: A backup control circuit, connected to the backup switch circuit, is used to control the on / off state of the backup switch circuit.

9. A control method for a motor controller, characterized in that, The method, applied to the control system as described in any one of claims 1 to 8, comprises: During the power-on process, when the main power supply is normal, the low-voltage side power supply module first establishes the output voltage. After the output voltage of the low-voltage side power supply module is established, the high-voltage side power supply module establishes the output in response to the enable signal received by the enable terminal of the high-voltage side power supply module. When the main power supply malfunctions and the output voltage of the low-voltage side power supply module is zero, the output of the high-voltage side power supply module is turned off as the output voltage of the low-voltage side power supply module becomes zero. When the main power supply malfunctions and the output voltage of the low-voltage side power supply module exceeds the preset overvoltage threshold, the first control circuit controls the switching circuit to shut down.

10. The method according to claim 9, characterized in that, Also includes: When the main power supply is abnormal and the output voltage of the low-voltage side power supply module does not exceed the preset overvoltage threshold, the microcontroller of the control system executes a fault response based on the fault detection signals received from the high-voltage side power supply module, the low-voltage side power supply module and / or the driver chip.

11. The method according to claim 10, characterized in that, The microcontroller performs fault response including: The microcontroller determines the fault level; Unless there is a pre-set serious fault, the microcontroller controls the driver chip to stop outputting drive signals; If the preset serious fault occurs, the microcontroller controls the driver chip to stop outputting the drive signal, and controls the switching circuit to turn off through the second control circuit of the control system.

12. A vehicle, characterized in that, The control system includes any one of claims 1 to 8.

Images