Control circuit of motor controller and method thereof, vehicle and computer storage medium

Abstract

The application provides a control circuit of a motor controller and a method thereof, a vehicle and a computer storage medium. The control circuit comprises a monitoring circuit, a main control circuit and an interlock gate circuit. The monitoring circuit comprises a collection end and a trigger end. The drive control ports of the main control circuit are connected with the first receiving ends of the upper bridge drive circuit and the lower bridge drive circuit respectively. The enable end and the trigger end of the interlock gate circuit are connected, the signal input end is connected with the interlock control port, and the signal output end is connected with the second receiving ends of the upper bridge drive circuit and the lower bridge drive circuit respectively. The interlock gate circuit is configured to: when the trigger level is received at the enable end, block the signal path between the signal input end and the signal output end, and output an active short circuit control signal through the signal output end, so that the upper bridge drive circuit and the lower bridge drive circuit enter an active protection state in which one of them is turned on and the other is turned off. The application does not need the participation of the main control algorithm and has fast response speed.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and in particular to a control circuit and method for a motor controller, a vehicle, and a computer storage medium. Background Technology

[0002] In recent years, with the rapid development of new energy vehicle technology, the motor controller, as a core component of vehicle power output, has become crucial for operational safety. During the operation of the motor controller, if sudden conditions such as high-voltage bus overvoltage, low-voltage power supply abnormality, or system failure occur, the back electromotive force generated by the motor, if not suppressed, will cause a sharp rise in bus voltage, endangering the downstream capacitors, battery, and the high-voltage safety of the entire vehicle.

[0003] Traditional passive protection (such as fuses) or software protection has a slow response time, making it difficult to meet the real-time safety response requirements of high-voltage platforms. Traditional active protection can quickly cut off the normal power output and put the power drive circuit into an active short-circuit state with one side of the bridge arm conducting, to prevent the motor from being in an uncontrolled generating state or causing more serious hardware damage. However, current active protection schemes mainly rely on software control, which has a long response time. When faced with extreme conditions such as system crashes, program malfunctions, or abnormal power supply, the software program itself is paralyzed and unable to output protection commands, causing the entire active protection mechanism to completely fail. Summary of the Invention

[0004] This application provides an improved control circuit and method for a motor controller, a vehicle, and a computer storage medium.

[0005] This application provides a control circuit for a motor controller, the motor controller including an upper bridge drive circuit and a lower bridge drive circuit, both the upper bridge drive circuit and the lower bridge drive circuit including a first receiving terminal and a second receiving terminal; including: The monitoring circuit includes a data acquisition terminal and a trigger terminal; the data acquisition terminal is connected to the sampling node of the motor controller, and the trigger terminal is used to output a trigger level. The main control circuit includes a drive control port and an interlock control port; the drive control port includes an upper bridge control pin and a lower bridge control pin, the upper bridge control pin is connected to the first receiving end of the upper bridge drive circuit, and the lower bridge control pin is connected to the first receiving end of the lower bridge drive circuit. An interlocking gate circuit includes a signal input terminal, an enable terminal, and a signal output terminal; the enable terminal is connected to the trigger terminal, the signal input terminal is connected to the interlocking control port, and the signal output terminal is connected to the second receiving terminals of the upper bridge drive circuit and the lower bridge drive circuit respectively. The interlock gate circuit is configured to: when the enable terminal receives the trigger level, block the signal path between the signal input terminal and the signal output terminal, and output an active short-circuit control signal through the signal output terminal, so that the upper bridge drive circuit and the lower bridge drive circuit enter an active protection state in which one is turned on and the other is turned off, and neither the upper bridge drive circuit nor the lower bridge drive circuit responds to the input signal of their respective first receiving terminal.

[0006] The motor controller control circuit in this embodiment establishes a low-level hardware intervention architecture through the coordinated action of the monitoring circuit, the main control circuit, and the interlocking gate circuit. When an anomaly occurs, the interlocking gate circuit, controlled by the trigger level output of the monitoring circuit, blocks the normal drive signal path of the main control circuit and actively inputs an active short-circuit control signal to the drive link. This hardware-level linkage between circuit modules bypasses the software response stage, avoiding the failure of active protection command issuance due to software lag, crashes, or response delays, thus ensuring the safe operation of power devices under extreme conditions. Furthermore, this process does not require main control computation, effectively avoiding the risk of bridge arm burnout caused by multiple concurrent faults.

[0007] In some embodiments, the signal output terminal includes an upper bridge output pin and a lower bridge output pin; the upper bridge output pin is connected to the second receiving terminal of the upper bridge driving circuit, and the lower bridge output pin is connected to the second receiving terminal of the lower bridge driving circuit; wherein... When the enable terminal receives a non-trigger level, the interlock gate circuit opens the signal path from the signal input terminal to the signal output terminal, and the interlock gate circuit is configured to: output a level state representing normal response, dual-path shutdown or single-path conduction to the upper bridge drive circuit and the lower bridge drive circuit respectively through the upper bridge output pin and the lower bridge output pin, according to the input level state of the signal input terminal; When the enable terminal receives the trigger level, the interlock gate circuit blocks the signal path of the signal input terminal, locks the upper bridge output pin to the off level state, and locks the lower bridge output pin to the on level state.

[0008] In this embodiment, the interlocking gate circuit opens the path from the signal input terminal to the signal output terminal when a non-trigger level is received; and when a trigger level is received, it blocks the path, locking the upper bridge output pin to the off state and the lower bridge output pin to the on state. By switching the on and off states of the signal input terminal and the upper and lower bridge output pins at different levels, interference between the conventional PWM pulse sequence and the emergency protection signal is effectively isolated, avoiding protection failure caused by residual or disordered front-end drive signals under abnormal operating conditions, thus ensuring system stability.

[0009] In some embodiments, the signal input terminal includes a first input pin and a second input pin; the interlock control port of the main control circuit includes a first interlock pin and a second interlock pin; the first interlock pin is connected to the first input pin, and the second interlock pin is connected to the second input pin; When the enable pin receives the non-trigger level, the main control circuit outputs different level combinations through the first interlock pin and the second interlock pin, so that the input level states of the first input pin and the second input pin have a mapping relationship with the output level states of the upper bridge output pin and the lower bridge output pin; wherein... When the first input pin and the second input pin receive the first combined level state, the upper bridge output pin and the lower bridge output pin output the level state representing the normal response; When the first input pin and the second input pin receive the second combined level state, the upper bridge output pin and the lower bridge output pin output a level state representing the dual-channel shutdown. When the first input pin and the second input pin receive the third combined level state, the upper bridge output pin and the lower bridge output pin output a level state representing the single-channel conduction; wherein, the level state representing the single-channel conduction is: one of the upper bridge output pin and the lower bridge output pin outputs a conduction level, and the other outputs a de-conducting level.

[0010] In the control circuit of this embodiment, the voltage levels received by the first and second input pins have a clear mapping relationship with the output voltage levels of the upper and lower bridge output pins, corresponding to normal response, dual-path shutdown, or single-path conduction states, respectively. By defining the specific correspondence between input and output voltage levels, the control action boundaries of the motor drive under normal operating conditions are standardized, effectively avoiding garbled voltage level inputs caused by electromagnetic interference or signal crosstalk, eliminating the potential for unknown drive states or decoding errors in the system, and improving the accuracy of the underlying control.

[0011] In some embodiments, the monitoring circuit includes a multi-channel acquisition module and a status monitoring module connected in parallel; the sampling nodes include a high-voltage bus node, a power supply node, and a status monitoring node of the main control circuit; each acquisition module is connected to a corresponding sampling node; the input terminal of the status monitoring module is connected to the output terminal of each acquisition module, and its output terminal serves as the trigger terminal; wherein... The status monitoring module is configured to compare the acquisition voltage of each acquisition module with the reference voltage provided by the reference source, and when any acquisition voltage is lower than the reference voltage, the trigger terminal outputs the trigger level.

[0012] The status monitoring module in this embodiment uses parallel multi-channel acquisition modules to collect the voltages of the high-voltage bus node, the power supply node, and the status monitoring node of the main control circuit, and outputs a trigger level when any of the acquired voltages falls below the reference voltage. This method of parallel acquisition across multiple nodes and triggering an output when any node malfunctions avoids missing protection opportunities due to a single fault source, such as a sudden drop in high voltage or a power outage due to low voltage. It eliminates monitoring blind spots in the underlying hardware protection and achieves full coverage of critical abnormal operating conditions of the entire system.

[0013] In some embodiments, the state monitoring module further includes a hysteresis comparison module; the state monitoring module is configured to: perform voltage hysteresis comparison on the acquired voltage of the acquisition module using the hysteresis comparison module; wherein... When the collected voltage is within a preset range, the trigger terminal outputs a non-trigger level to maintain the normal operation of the interlock gate circuit.

[0014] In this embodiment, the status monitoring module uses an internal hysteresis comparison module to perform voltage hysteresis comparison on the voltage collected by the acquisition module. When the collected voltage is within a preset range, the output maintains a non-trigger level. By comparing the collected voltage within the hysteresis range, common-mode interference and high-frequency glitches from the power grid are effectively filtered out, preventing false triggering or frequent state transitions in the interlocking gate circuit due to small voltage spikes at the threshold, thus ensuring the smoothness of the active protection action.

[0015] In some embodiments, the main control circuit includes a main processing module and a safety processing module connected to the main processing module; the main processing module is connected to the status monitoring module, the interlock gate circuit, the upper bridge drive circuit, and the lower bridge drive circuit, respectively; the safety processing module is connected to the acquisition module, and the output terminal of the safety processing module serves as the interlock control port of the main control circuit; wherein... The security processing module is configured to: when receiving an abnormal signal from the sampling node, lock the output level of the interlock control port of the main control circuit to a signal level representing the active protection state, and block the output signal of the main processing module.

[0016] In this embodiment, the main control circuit utilizes its internal security processing module to lock the level of the interlock control port to a signal level representing the active protection state when it receives an abnormal signal from the sampling node, and blocks the output signal of the main processing module. By combining the underlying hardware interlock blocking with the output signal blocking within the main control circuit, a dual-protection security strategy is established. This avoids the paralysis of the active protection scheme due to the failure of a single hardware link, and prevents the main processing module from continuously outputting erroneous instructions in an abnormal state, thereby improving the fault tolerance and reliability of the system.

[0017] In some embodiments, the interlock gate circuit is configured to: perform timing control on the driving states of the upper bridge driving circuit and the lower bridge driving circuit according to the target driving mode, so that before switching to the target driving mode, both the upper bridge driving circuit and the lower bridge driving circuit are first set to the off state and maintained for a preset time, and then at least one of the upper bridge driving circuit and the lower bridge driving circuit is switched to the on state corresponding to the target driving mode.

[0018] Before switching to the target drive mode, the interlock gate circuit in this embodiment first sets both the upper bridge drive circuit and the lower bridge drive circuit to the off state, maintains this state for a preset duration, and then switches to the on state. By maintaining the dual-path off state for a preset duration before the state switch, a dead zone isolation band is established at the instant the system transitions to the active short-circuit state. This avoids overlapping conduction of the upper and lower bridge arms within the extremely short time difference of state alternation, eliminates the risk of bridge arm through-short circuit caused by this, and eliminates the hidden danger of power devices being subjected to surge current.

[0019] In some embodiments, the interlock gate circuit further includes a fault latching module; the fault latching module is connected to the enable terminal and is configured to: after the trigger level is output at the trigger terminal, latch the enable state of the interlock gate circuit into an active protection state until an external reset signal is received.

[0020] In this embodiment, the control circuit uses a fault latch module to latch the enable state of the interlock gate circuit into an active protection state after outputting a trigger level, which is only released upon receiving an external reset signal. By latching the active protection state, unexpected automatic restarts of the system due to unstable power supply or poor contact are avoided, preventing hardware damage and ensuring safety before troubleshooting.

[0021] This application also provides a control method for a motor controller, applied to a control circuit as described in any of the above embodiments, wherein the motor controller includes an upper bridge drive circuit and a lower bridge drive circuit; the control method includes: Collect the voltage parameters of the motor controller; When an abnormality in the voltage parameter is detected, a trigger level is generated; In response to the trigger level, the signal path for transmitting drive commands to the upper bridge drive circuit and the lower bridge drive circuit is blocked, and an active short-circuit control signal is output; and based on the active short-circuit control signal, the upper bridge drive circuit and the lower bridge drive circuit enter an active protection state in which one of them is turned on and the other is turned off, and they no longer respond to the drive commands.

[0022] The control method of the motor controller in this embodiment sequentially performs the following steps: acquiring voltage parameters, generating a trigger level when an abnormal voltage parameter is detected, and blocking the signal path for transmitting drive commands in response to the trigger level. Based on the active short-circuit control signal, the upper and lower bridge drive circuits enter an active protection state with one side of the bridge arm conducting and no longer respond to drive commands. This setting ensures priority response to path blocking and state switching, avoids protection delays or failures caused by reliance on the main control program, and guarantees the safety of the motor drive system.

[0023] In some embodiments, the acquisition of the voltage parameters of the motor controller includes: The voltages of the high-voltage bus node, power supply node, and status monitoring node of the motor controller are collected respectively; The step of generating a trigger level when an abnormal voltage parameter is detected includes: The collected voltages are compared with the reference voltage using hysteresis. When any voltage is lower than the reference voltage, the voltage parameter is determined to be abnormal, and the trigger level is generated.

[0024] The control method in this embodiment collects the voltages of the high-voltage bus, power supply, and status monitoring nodes, and performs a hysteresis comparison between each voltage and a reference voltage. This setup filters and reduces noise in the source signals, eliminating false triggering caused by transient voltage fluctuations. It also prevents the vehicle from accidentally entering a safety mode due to electromagnetic interference during normal driving, thus ensuring the accuracy of the triggering strategy.

[0025] In some embodiments, the step of causing the upper bridge drive circuit and the lower bridge drive circuit to enter an active protection state where one is turned on and the other is turned off based on the active short-circuit control signal includes: Based on the active short-circuit control signal, both the upper bridge drive circuit and the lower bridge drive circuit are first set to the off state. After maintaining the off state for a preset time, one of the upper bridge drive circuit and the lower bridge drive circuit is switched to the on state, while the other is kept off, so as to enter the active protection state.

[0026] In this embodiment, the control method, upon entering the active protection state, first sets both the upper and lower bridge drive circuits to the off state based on the active short-circuit control signal, maintains this state for a preset duration, and then switches to the single-side bridge arm conduction state. This setting avoids conflicts caused by the instantaneous switching between the original drive signal and the protection command, and eliminates the risk of bridge arm shoot-through failure due to timing overlap.

[0027] In some embodiments, after entering the active protection state, the control method further includes: The latch blocks the signal path and the output state of the active short-circuit control signal; The latch is released only after an external reset signal is received.

[0028] The control method in this embodiment latches the blocking state of the signal path and the output state of the active short-circuit control signal after entering the active protection state, until an external reset signal is received and the latch is released. This configuration, by adding a state latching strategy, avoids oscillation and drift of the software state machine in abnormal critical regions or when voltage is unstable, thus ensuring the stability of the electric drive system.

[0029] This application also provides a computer storage medium storing a computer program thereon, which, when executed by a processor, implements the control method of the motor controller as described in any of the above embodiments.

[0030] This application also provides a vehicle, including: Power motor; and A motor controller, connected to the power motor, is used to control the operation of the power motor; wherein the motor controller employs a control circuit as described in any of the above embodiments. Attached Figure Description

[0031] Figure 1 The diagram shown is a schematic block diagram of one embodiment of the control circuit of the motor controller of this application.

[0032] Figure 2 As shown Figure 1 A schematic block diagram of another embodiment of the control circuit shown.

[0033] Figure 3 As shown Figure 1 A schematic block diagram of another embodiment of the control circuit shown.

[0034] Figure 4 The diagram shown is a flowchart of one embodiment of the control method of the motor controller of this application.

[0035] Figure 5 The diagram shown is a structural block diagram of one embodiment of the control device of this application. Detailed Implementation

[0036] The control circuit and method of the motor controller of this application, as well as the vehicle and computer storage medium, will be described in detail below with reference to the accompanying drawings. Unless otherwise specified, the features of the following embodiments and implementations can be mutually exclusive.

[0037] Figure 1 The diagram shown is a schematic block diagram of one embodiment of the control circuit 2 of the motor controller of this application. Figure 1As shown, the motor controller includes an upper bridge drive circuit 11 and a lower bridge drive circuit 12, both of which include a first receiving terminal and a second receiving terminal. The upper bridge drive circuit 11 includes an upper bridge first receiving terminal 111 and an upper bridge second receiving terminal 112. The lower bridge drive circuit 12 includes a lower bridge first receiving terminal 121 and a lower bridge second receiving terminal 122. The upper bridge drive circuit 11 can be an upper bridge isolated drive circuit, receiving the PWM (Pulse Width Modulation) control signal output from the main control circuit and the active short-circuit control signal output from the interlocking gate circuit, to control power switching transistors such as IGBTs (Insulated Gate Bipolar Transistors) or silicon carbide MOSFETs. Similarly, the lower bridge drive circuit 12 can be a lower bridge isolated drive circuit, receiving the PWM control signal output from the main control circuit and the active short-circuit control signal output from the interlocking gate circuit, to control power switching transistors such as IGBTs or silicon carbide MOSFETs.

[0038] The motor controller's control circuit 2 is configured to execute an Active Short Circuit (ASC) protection strategy. As a core active safety mechanism, ASC controls the inverter's power switching transistors to short-circuit the motor's three-phase windings, utilizing the winding resistance to quickly dissipate back EMF energy and prevent uncontrolled motor power generation. The core architectural advantage of control circuit 2 in this embodiment lies in its three-tiered safety control logic, achieving comprehensive safety coverage from software decision-making to direct hardware drive. Specifically, the system adopts a three-tiered safety architecture based on a tiered triggering mechanism of the L1 software layer, the L2 combined software and hardware layer, and the L3 pure hardware layer. This architecture provides progressively accelerating and mutually backup safety guarantees while ensuring normal control flexibility. In particular, the L3 pure hardware layer can operate independently of the main control circuit, meeting the independent hardware protection requirements of the highest automotive functional safety level. Furthermore, control circuit 2 employs a modular design to achieve rapid response. When faced with extreme faults, the L3 pure hardware layer takeover mechanism can dramatically improve the protection response time from the millisecond (ms) level of traditional software layers to the microsecond (μs) level, increasing the response speed by one to two orders of magnitude. Based on this three-layer architecture, the bottom-layer hardware interception part is divided into minimal reusable interlocking modules, effectively solving the timing dependency between software and hardware, supporting more complex decision-making logic at the upper layers, and meeting the ever-changing needs of the vehicle system.

[0039] Specifically, control circuit 2 includes monitoring circuit 21, main control circuit 22, and interlock gate circuit 23. Monitoring circuit 21 includes a data acquisition terminal and a trigger terminal. The data acquisition terminal is connected to the sampling node of the motor controller. Monitoring circuit 21 can be an automotive-grade voltage detection circuit integrating a reference voltage source and hysteresis comparison function, or a discrete comparator circuit with an external positive feedback network, used to acquire the voltage of each sampling node of the motor controller. The trigger terminal is used to output a trigger level to enter the active protection mode. Main control circuit 22 includes drive control port 221 and interlock control port 222. Drive control port 221 is connected to the first receiving terminal 111 of upper bridge drive circuit 11 and the first receiving terminal 121 of lower bridge drive circuit 12, respectively. Among them, drive control port 221 includes upper bridge control pin 221a and lower bridge control pin 221b. Upper bridge control pin 221a is connected to the upper bridge first receiving terminal 111 of upper bridge drive circuit 11, and lower bridge control pin 221b is connected to the lower bridge first receiving terminal 121 of lower bridge drive circuit 12. The main control circuit 22 can be a lockstep microcontroller with an integrated main processing core and hardware security core, or a control circuit formed by combining a general-purpose digital signal processor and an independent system basic circuit. The interlock gate circuit 23 includes a signal input terminal 231, an enable terminal 232, and a signal output terminal 233. The enable terminal 232 is connected to the trigger terminal, the signal input terminal 231 is connected to the interlock control port 222, and the signal output terminal 233 is connected to the second receiving terminals of the upper bridge drive circuit 11 and the lower bridge drive circuit 12, respectively. The signal input terminal 231 includes a first input pin 231a and a second input pin 231b. The interlock control port 222 of the main control circuit 22 includes a first interlock pin 222a and a second interlock pin 222b. The first input pin 231a is connected to the first interlock pin 222a, and the second input pin 231a is connected to the second interlock pin 222b. The signal output terminal 233 includes a first signal output terminal 233a and a second signal output terminal 233b. The first signal output terminal 233a is connected to the upper bridge second receiving terminal 112 of the upper bridge driving circuit 11, and the second signal output terminal 233b is connected to the lower bridge second receiving terminal 122 of the lower bridge driving circuit 12. The interlocking gate circuit 23 can be a logic array or integrated logic circuit formed by combining discrete AND gate and NOT gate logic components.

[0040] exist Figure 1In the illustrated embodiment, the interlock gate circuit 23 is configured to: when the enable terminal 232 receives a trigger level, block the signal path between the signal input terminal 231 and the signal output terminal 233, and output an active short-circuit control signal through the signal output terminal 233, so that the upper bridge drive circuit 11 and the lower bridge drive circuit 12 enter an active protection state where one is on and the other is off, and neither the upper bridge drive circuit 11 nor the lower bridge drive circuit 12 responds to the input signal of their respective first receiving terminals. Specifically, the monitoring circuit 21 of the L3 pure hardware layer is connected to the enable terminal 232 of the interlock gate circuit 23. When the enable terminal 232 receives a trigger level, it indicates that the motor controller is currently in an abnormal operating condition. At this time, the pure hardware interlock gate circuit 23 instantly blocks the normal main control signal path and latches the active protection state where one side of the bridge arm is on. Here, the single side of the bridge arm being on refers to an active short circuit of the upper bridge or an active short circuit of the lower bridge. In this context, an active short circuit in the upper bridge indicates that all power transistors in the upper bridge drive circuit are turned on, while all power transistors in the lower bridge drive circuit are turned off. Similarly, an active short circuit in the lower bridge indicates that all power transistors in the lower bridge drive circuit are turned on, while all power transistors in the upper bridge drive circuit are turned off.

[0041] In this embodiment, the control circuit 2 of the motor controller establishes a low-level hardware intervention architecture through the coordinated action of the monitoring circuit 21, the main control circuit 22, and the interlocking gate circuit 23. When an anomaly occurs, the interlocking gate circuit 23, controlled by the trigger level output by the monitoring circuit 21, blocks the normal drive signal path of the main control circuit 22 and actively inputs an active short-circuit control signal to the drive link. The hardware-level linkage between the various circuit modules can directly bypass the software response stage, avoiding the failure of active protection command issuance due to software lag, crashes, or response delays, thus ensuring the safe operation of power devices under extreme conditions. Furthermore, this process does not require the participation of the main control operation, effectively avoiding the risk of bridge arm burnout caused by multiple concurrent faults.

[0042] Figure 2 As shown Figure 1 The schematic block diagram shows another embodiment of the control circuit 2. Figure 1 and Figure 2In the illustrated embodiment, the monitoring circuit 21 includes a parallel multi-channel acquisition module 211 and a status monitoring module 212 connected to the acquisition modules 211. Sampling nodes include a high-voltage bus node, a power supply node, and a status monitoring node for the main control circuit 22. Each acquisition module 211 is connected to its corresponding sampling node and is used to acquire the bus voltage of the high-voltage bus node, the power supply voltage of the power supply node, and the voltage of the status monitoring node, respectively. The input terminal of the status monitoring module 212 is connected to the output terminal of each acquisition module 211, and its output terminal serves as a trigger terminal. The status monitoring module 212 is used to monitor the bus voltage of the high-voltage bus node, the power supply voltage of the power supply node, and the voltage of the status monitoring node in real time. Specifically, the status monitoring module 212 is configured to compare the acquired voltage of each acquisition module 211 with a reference voltage provided by a reference source, and when any acquired voltage is lower than the reference voltage, the trigger terminal outputs a trigger level. Specifically, the status monitoring module 212 can be a wire-OR circuit formed by connecting multiple open-drain voltage comparators in parallel at their output terminals, or it can employ a dedicated monitoring circuit that integrates multiple comparators and logic OR gates internally. A wire-OR circuit refers to connecting the output terminals of multiple logic gates or chips in parallel with a single wire, thereby implementing a logic OR function at the node. Through this pure hardware topology, the acquired voltage is compared with the voltage provided by the reference source, so that when any of the acquired voltages becomes abnormal, the trigger terminal immediately outputs a trigger level.

[0043] In this embodiment, the status monitoring module 212, through parallel multi-channel acquisition modules 211, acquires the voltages of the high-voltage bus node, the power supply node, and the status monitoring node of the main control circuit 22, respectively, and outputs a trigger level when any acquired voltage is lower than the reference voltage. This method of parallel acquisition of multiple nodes and triggering the output when any node malfunctions avoids missing protection opportunities due to a single fault source (such as a sudden drop in high voltage or a power outage due to low voltage), eliminates monitoring blind spots in the underlying hardware protection, and achieves full coverage of fatal abnormal operating conditions of the entire machine.

[0044] exist Figure 1 and Figure 2In the illustrated embodiment, the state monitoring module 212 further includes a hysteresis comparison module. The state monitoring module 212 is configured to perform voltage hysteresis comparison on the voltage acquired by the acquisition module 211. Specifically, when the acquired voltage is within a preset range, the trigger terminal outputs a non-trigger level to maintain the normal operation of the interlocking gate circuit 23. The hysteresis comparison module can be a hysteresis comparator. In this embodiment, the state monitoring module 212 performs voltage hysteresis comparison on the voltage acquired by the acquisition module 211 through its internal hysteresis comparison module. When the acquired voltage is within a preset range, it maintains a non-trigger level output. By comparing the acquired voltage within the hysteresis range, common-mode interference and high-frequency glitches are effectively filtered out, preventing the interlocking gate circuit 23 from being falsely triggered or experiencing frequent state jumps due to small voltage spikes at the threshold, thus ensuring the smoothness of the active protection action.

[0045] exist Figure 1 and Figure 2 In the illustrated embodiment, the main control circuit 22 includes a main processing module 223 and a safety processing module 224 connected to the main processing module 223. The input terminal of the safety processing module 224 is connected to each acquisition module 211, and the output terminal of the safety processing module 224 serves as the interlock control port 222 of the main control circuit 22. Specifically, the safety processing module 224 is configured to, upon receiving an abnormal signal from a sampling node, lock the output level of the interlock control port of the main control circuit 22 to a signal level representing an active protection state, and block the output signal of the main processing module 223. In this embodiment, the main processing module 223 is connected to the status monitoring module 212, the interlock gate circuit 23, the upper bridge drive circuit 11, and the lower bridge drive circuit 12, and is used to process the signals output by the status monitoring module 212, which may be, for example, normal operation signals or abnormal signals. The main processing module 223 includes an upper bridge control pin 221a and a lower bridge control pin 221b. The upper bridge control pin 221a is connected to the first receiving terminal 111 of the upper bridge drive circuit 11, and the lower bridge control pin 221b is connected to the first receiving terminal 121 of the lower bridge drive circuit 12. The input terminal of the safety processing module 224 is connected to the acquisition module 211. The output terminal of the safety processing module 224 serves as the first interlock pin 222a and the second interlock pin 222b of the interlock control port 222. The first interlock pin 222a is connected to the first input pin 231a, and the second interlock pin 222b is connected to the second input pin 231b. To prevent the link containing the interlock gate circuit 23 from failing and failing to enter the active short-circuit state under extreme conditions, the main control circuit 22 can utilize its internal safety processing module 224 to actively lock from the source, forming a safety defense and shortening the response time.

[0046] Specifically, upon receiving an abnormal signal from the sampling node, the safety processing module 224 locks the output levels of the first interlock pin 222a and the second interlock pin 222b of the interlock control port 222 to signal levels representing the active protection state, and blocks the output signal of the main processing module 223. By combining hardware interlock blocking with blocking the output signal inside the main control circuit 22, a dual internal and external protection safety strategy is established. This avoids the failure of the active protection scheme due to the failure of a single hardware link, and prevents the main processing module 223 from continuously outputting erroneous instructions in an abnormal state, thereby improving the fault tolerance and reliability of the system operation.

[0047] exist Figure 1 and Figure 2 In the illustrated embodiment, the signal output terminal 233 includes an upper bridge output pin 233a and a lower bridge output pin 233b. The upper bridge output pin 233a is connected to the second receiving terminal 112 of the upper bridge driving circuit 11, and the lower bridge output pin 233b is connected to the second receiving terminal 122 of the lower bridge driving circuit 12. The upper bridge output pin 233a is connected to the upper bridge second receiving terminal 112 of the upper bridge driving circuit 11. The lower bridge output pin 233b is connected to the lower bridge second receiving terminal 122 of the lower bridge driving circuit 12.

[0048] In some embodiments, when the enable terminal 232 receives a non-trigger level, the interlock gate circuit 23 opens the signal path from the signal input terminal 231 to the signal output terminal 233. The interlock gate circuit 23 is configured to output level states representing normal response, dual-path shutdown, or single-path conduction to the upper bridge drive circuit 11 and the lower bridge drive circuit 12 respectively, through the upper bridge output pin 233a and the lower bridge output pin 233b, according to the input level state of the signal input terminal 231. When the enable terminal 232 receives a non-trigger level, it indicates that the motor controller is operating normally. At this time, the L3 pure hardware layer is not triggered, the L2 software / hardware layer dominates, the signal path is opened, and normal signals, dual-path shutdown signals, or single-path conduction commands issued by the L2 software / hardware layer are allowed.

[0049] In some embodiments, when the enable terminal 232 receives a trigger level, the interlock gate circuit 23 blocks the signal path of the signal input terminal 231 and locks the upper bridge output pin 233a to the off level, while simultaneously locking the lower bridge output pin 233b to the on level. When the enable terminal 232 receives a trigger level, it indicates that the motor controller has malfunctioned. At this time, L3 pure hardware layer triggering mainly utilizes the interlock gate circuit 23 to block the aforementioned path, quickly entering the active short-circuit state.

[0050] In this embodiment, the interlocking gate circuit 23, upon receiving a non-trigger level, opens the path from the signal input terminal 231 to the signal output terminal 233. Upon receiving a trigger level, it blocks the path, locking the upper bridge output pin 233a to the off state and the lower bridge output pin 233b to the on state. By switching the on and off states of the first input pin 231a and the second input pin 231b with the upper bridge output pin 233a and the lower bridge output pin 233b at different levels, interference between the conventional PWM pulse sequence and the emergency protection signal is effectively isolated. This prevents protection failures caused by residual or disordered front-end drive signals under abnormal operating conditions, ensuring system stability.

[0051] exist Figure 1 and Figure 2 In the illustrated embodiment, when the enable pin 232 receives a non-trigger level, the main control circuit 22 outputs different level combinations through the first interlock pin 222a and the second interlock pin 222b, so that the input level states of the first input pin 231a and the second input pin 231b have a mapping relationship with the output level states of the upper bridge output pin 233a and the lower bridge output pin 233b. In this embodiment, the level states received by the first input pin 231a and the second input pin 231b have a clear mapping relationship with the output level states of the upper bridge output pin 233a and the lower bridge output pin 233b, respectively corresponding to normal response, dual-path shutdown, or single-path conduction. By determining the specific correspondence between the input level and the output level, the control action of the motor drive under normal operating conditions is made accurate, effectively avoiding garbled level inputs caused by electromagnetic interference or signal crosstalk, eliminating the hidden danger of unknown drive states or decoding errors in the system, and improving the accuracy of the underlying control.

[0052] In some embodiments, when the first input pin 231a and the second input pin 231b receive a first combined level state, the upper bridge output pin 233a and the lower bridge output pin 233b output a level state representing a normal response. In this embodiment, the first combined level state can be (1, 1). When the first input pin 231a and the second input pin 231b receive (1, 1), the upper bridge output pin 233a and the lower bridge output pin 233b output a normal PWM signal. The on / off state of the upper bridge drive circuit 11 and the lower bridge drive circuit 12 is controlled by the duty cycle of the PWM signal.

[0053] In some embodiments, when the first input pin 231a and the second input pin 231b receive a second combined level state, the upper bridge output pin 233a and the lower bridge output pin 233b output a level state representing a dual-channel shutdown. The second combined level state in this embodiment can be (0, 0). When the first input pin 231a and the second input pin 231b receive (0, 0), both the upper bridge output pin 233a and the lower bridge output pin 233b output a low level, causing both the upper bridge drive circuit 11 and the lower bridge drive circuit 12 to shut down.

[0054] In some embodiments, when the first input pin 231a and the second input pin 231b receive a third combined level state, the upper bridge output pin 233a and the lower bridge output pin 233b output a level state representing single-channel conduction. The level state representing single-channel conduction is defined as one of the upper bridge output pin 233a and the lower bridge output pin 233b outputting a conduction level, and the other outputting a de-conductor level. In this embodiment, the third combined level state can be (1, 0) or (0, 1). When the first input pin 231a and the second input pin 231b receive (1, 0), the upper bridge output pin 233a outputs a high level, turning on the upper bridge drive circuit 11. The lower bridge output pin 233b outputs a low level, turning off the lower bridge drive circuit 12. When the first input pin 231a and the second input pin 231b receive (0, 1), the lower bridge output pin 233b outputs a high level, turning on the lower bridge drive circuit 12. The upper bridge output pin 233a outputs a low level, which turns off the upper bridge drive circuit 11.

[0055] exist Figure 1 and Figure 2 In the illustrated embodiment, the interlock gate circuit 23 is configured to: perform timing control on the driving states of the upper bridge drive circuit 11 and the lower bridge drive circuit 12 according to the target driving mode, so that before switching to the target driving mode, both the upper bridge drive circuit 11 and the lower bridge drive circuit 12 are set to the off state and maintained for a preset time, and then at least one of the upper bridge drive circuit 11 and the lower bridge drive circuit 12 is switched to the on state corresponding to the target driving mode. The target driving mode refers to the desired operating mode that the motor controller needs to switch to next according to the current motor operating condition or system state. Specifically, the target driving mode includes not only the on state of the upper bridge drive circuit or the lower bridge drive circuit controlled by the PWM control signal when responding to input commands normally, but also the active protection state of the upper bridge drive circuit being on or the lower bridge drive circuit being on when a system abnormality is detected. The target driving mode in this embodiment can be set according to the actual situation.

[0056] Furthermore, before switching to the target drive mode, the interlock gate circuit 23 first sets both the upper bridge drive circuit and the lower bridge drive circuit to the off state and maintains this state for a preset duration. This process is essentially a hardware-level dead-time control mechanism. Regardless of the state from which the switch to the target drive mode occurs, as long as the conduction state of the drive circuit is changed, the interlock gate circuit 23 will forcibly insert a preset duration of full off dead time between state transitions. This mechanism can absolutely prevent the upper bridge drive circuit and the lower bridge drive circuit from experiencing a shoot-through short circuit at the moment of mode switching from the underlying hardware logic, thereby effectively protecting the safety of the switching devices and the high-voltage bus and improving the reliability of the system.

[0057] Specifically, in this embodiment, when the electric drive system switches from normal operating mode to active protection mode, it follows the principle of first shutting down and then short-circuiting. Regardless of which layer triggers the switch, the PWM drive signals of all power transistors are immediately shut down. According to the preset strategy (usually the lower bridge drive circuit 12 is in active protection state, keeping the three-phase lower bridge arm power transistors continuously conducting), the final effective control layer (software instructions of L1 / L2 or hardware level of L3) sends the corresponding active protection mode instruction to the drive circuit. Before switching to the target drive mode, the interlock gate circuit 23 first sets both the upper bridge drive circuit 11 and the lower bridge drive circuit 12 to the off state, maintains this state for a preset duration, and then switches to the on state. By maintaining the dual-path off state for a preset duration before the state switch, a dead zone isolation band is established at the moment the system transitions to the active short-circuit state, avoiding overlapping conduction of the upper and lower bridge arms within the extremely short time difference of state alternation, eliminating the risk of bridge arm through-circuit short circuit caused by this, and eliminating the hidden danger of power devices being subjected to surge current.

[0058] exist Figure 1 and Figure 2 In the illustrated embodiment, the interlock gate circuit 23 further includes a fault latch module. The fault latch module is connected to the enable terminal 232 and is configured to latch the enabled state of the interlock gate circuit 23 into an active protection state after a trigger level is output at the trigger terminal, until an external reset signal is received. In this embodiment, the control circuit 2, through the fault latch module, latches the enabled state of the interlock gate circuit 23 into an active protection state after outputting a trigger level, until an external reset signal is received. By latching the active protection state, unexpected automatic restarts of the system due to unstable power supply or poor contact are avoided, preventing hardware damage and ensuring safety performance before fault diagnosis.

[0059] Figure 3 As shown Figure 1 A schematic block diagram of another embodiment of the control circuit 2 shown. (In conjunction with...) Figures 1 to 3As shown, the electric drive system includes an L1 software layer, an L2 hardware / software layer, an L3 pure hardware layer, and upper / lower bridge drive circuits. The L1 software layer includes a main control module and a sampling circuit. The sampling circuit includes three-phase current sampling and bus voltage sampling. The main control module monitors the status based on the sampling circuit and controls the drive circuit output high and low levels by sending the L1_DRV_PWM_H / L signal. The L2 hardware / software layer includes a main control module and logic gates. The main control module sends DO_ASC_PRI_H / L and outputs DRV_ASC_PRI_H / L through the logic gates. This signal is connected to the ASC_H / L of the drive circuit, which can force the drive circuit into an active short-circuit state, with higher priority than the PWM control signal. When ASC_H / L is 1, 1, the drive circuit follows the PWM wave. When ASC_H / L is 0, 0 or 1, 0, the drive circuit is turned off and does not respond to the PWM wave. When ASC_H / L is 0, 1, the drive circuit switches on and off, and does not respond to the PWM wave. The L3 pure hardware layer includes comparators, logic gates, and a reference source. Independent of the MCU's monitoring loop, it monitors key signals such as bus voltage and drive circuit fault flags. Once a hardware-defined threshold is exceeded, an enable signal is sent to the drive circuit, achieving microsecond-level response.

[0060] Specifically, in the L1 software layer, detection is mainly done through the MCU. When the MCU detects general overcurrent (PHA_CUR_OCP), overvoltage (HV_VOL_OVP), undervoltage (HV_VOL_UVP), drive circuit fault (DRV_HS_FLT2_H), or software logic fault, the software, in conjunction with the current rotation speed, sets the L1_DRV_PWM_H / L output to an active short-circuit state (either the upper or lower transistor is fully on). The response time of this layer is in the millisecond range.

[0061] In the L2 hardware and software layer, a safety monitoring module is set up in the MCU to enable hardware-assisted monitoring of digital signals such as overvoltage and overcurrent from the ADC. Once triggered, a high-priority interrupt and a hardware PWM module forcefully switch the PWM output to an active short-circuit state, bypassing the main control algorithm and shortening the response time. As shown in Truth Table 1.

[0062] Table 1 As shown in Table 1, when DO_ASC_PRI_H / L is in the 1, 1 state, DRV_ASC_PRI_H / L outputs 1, 1, and the drive circuit is in normal PWM wave response mode. When DO_ASC_PRI_H / L is in the 0, 0 state, DRV_ASC_PRI_H / L outputs 0, 0, and the drive circuit is forcibly turned off, not responding to the PWM wave. When DO_ASC_PRI_H / L is in the 1, 0 state, DRV_ASC_PRI_H / L outputs 1, 0, the upper bridge drive circuit is turned on, and the lower bridge drive circuit is turned off, not responding to the PWM wave. When DO_ASC_PRI_H / L is in the 1, 0 state, DRV_ASC_PRI_H / L outputs 0, 1, the upper bridge drive circuit is turned off, the lower bridge drive circuit is turned on, and not responding to the PWM wave.

[0063] As shown in Table 1, under normal or L1 conditions, the L2 signal DO_ASC_PRI_H / L is 1, 1. This indicates normal following. Once L2 intervenes, the signal becomes 1, 0 (upper bridge ASC) or 0, 1 (lower bridge ASC). At this time, regardless of the PWM input of L1, the truth table will always show X, indicating that the drive circuit only listens to L2. Once the pure hardware protection of L3 is triggered, for example, if the low-voltage power supply LV_POWER is detected as L, regardless of what signals are sent by the MCU side (L1, L2), the truth table will always show X, and the module will ultimately execute the lower bridge ASC, with PWM_xH set to L and PWM_xL set to H. This setting can resolve the risk of the MCU sending incorrect instructions and causing a shoot-through between the upper and lower bridges under multi-point fault conditions.

[0064] Furthermore, the L3 pure hardware layer has completely independent analog hardware circuitry that can directly monitor analog bus voltage, low-voltage power supply, and MCU fault flags. Triggering any signal will pull L2_ASC_EN low through a hardware logic gate. At this time, DRV_ASC_PRI_H / L will be forced to output 0 or 1, and the system will enter the lower bridge ASC state. This layer serves as the final safety barrier, with a response time within microseconds.

[0065] This embodiment employs a three-tiered security architecture, based on a three-level active short-circuit triggering mechanism: an L1 software layer, an L2 combined software and hardware layer, and an L3 pure hardware layer. While ensuring control flexibility, it provides progressively accelerating and mutually redundant security guarantees. In particular, the L3 pure hardware layer can achieve the independent hardware protection required for the highest security level. Furthermore, modularity is used to achieve rapid response. The hardware response mechanism of the L3 pure hardware layer can improve the protection response time for critical faults from milliseconds to microseconds, an improvement of 1-2 orders of magnitude. Based on the three-tiered security architecture, the hardware components are broken down into minimum reusable modules, thereby supporting more complex decision-making logic and meeting diverse system requirements.

[0066] Figure 4 The diagram shown is a flowchart of one embodiment of the control method for the motor controller of this application. Figure 4 The control method of the motor controller shown is applied as described above. Figures 1 to 3 The control circuit 2 in any of the embodiments. The control method includes steps S1 to S3. Wherein, Step S1: Acquire voltage parameters of the motor controller. In this step, the voltage of the high-voltage bus node, the supply voltage of the power supply node, and the voltage of the status monitoring node of the main control circuit are monitored in real time through multi-channel parallel acquisition.

[0067] Step S2: When an abnormal voltage parameter is detected, a trigger level is generated. In this step, the multiple collected voltages are compared with the reference voltage provided by the reference source. When any of the collected voltages is abnormal (e.g., lower than the reference voltage), the trigger terminal immediately outputs a trigger level.

[0068] Step S3: In response to the trigger level, the signal path for transmitting drive commands between the upper bridge drive circuit 11 and the lower bridge drive circuit 12 is blocked, and an active short-circuit control signal is output. Based on the active short-circuit control signal, the upper bridge drive circuit 11 and the lower bridge drive circuit 12 enter an active protection state where one of them is on and the other is off, and they no longer respond to drive commands. In this step, when the trigger level is received, it indicates that the motor controller has malfunctioned. At this time, the main control signal transmission path is instantly blocked by pure hardware circuitry, and the active protection state of single-sided bridge arm conduction is latched.

[0069] The control method of the motor controller in this embodiment acquires voltage parameters, generates a trigger level when an abnormal voltage parameter is detected, and blocks the signal path for transmitting drive commands in response to the trigger level. Then, based on an active short-circuit control signal, the upper and lower bridge drive circuits enter an active protection state with one side of the bridge arm conducting and no longer responds to drive commands. This configuration ensures priority response to path blocking and state switching at the execution level, intercepts the control of the power circuit by conventional drive commands, avoids protection delays or failures caused by reliance on the main control program, and guarantees the safety of the motor drive system's shutdown in emergency situations.

[0070] In some embodiments, step S1 involves collecting voltage parameters of the motor controller, including collecting the voltages of the high-voltage bus node, power supply node, and status monitoring node of the motor controller. In some embodiments, step S2 involves generating a trigger level when an abnormal voltage parameter is detected, including performing a hysteresis comparison between the collected voltages and a reference voltage. When any voltage is lower than the reference voltage, an abnormal voltage parameter is determined, and a trigger level is generated. The control method of this embodiment collects the voltages of the high-voltage bus, power supply, and status monitoring node, and performs a hysteresis comparison between each voltage and a reference voltage. This setup filters and reduces noise in the source signal, eliminates false triggering caused by transient voltage jitter, and prevents the vehicle from accidentally entering a safe mode due to electromagnetic interference during normal driving, thus ensuring the accuracy of the triggering strategy.

[0071] In some embodiments, step S3, based on the active short-circuit control signal, causes the upper bridge drive circuit 11 and the lower bridge drive circuit 12 to enter an active protection state where one is on and the other is off. This includes: based on the active short-circuit control signal, first setting both the upper bridge drive circuit 11 and the lower bridge drive circuit 12 to the off state. After maintaining the off state for a preset time, then switching one of the upper bridge drive circuit 11 and the lower bridge drive circuit 12 to the on state, while maintaining the other in the off state, to enter the active protection state. In this embodiment, when entering the active protection state, the control method first sets both the upper and lower bridge drive circuits 12 to the off state based on the active short-circuit control signal, maintains it for a preset time, and then switches to the single-side bridge arm on state. This setting avoids conflicts caused by the instantaneous switching of the original drive signal and the protection command, and eliminates the risk of bridge arm shoot-through failure due to timing overlap.

[0072] In some embodiments, after entering the active protection state, the control method further includes: latching the blocking state of the signal path and the output state of the active short-circuit control signal. The latch is released only after receiving an external reset signal. In this embodiment, the control method latches the blocking state of the signal path and the output state of the active short-circuit control signal after entering the active protection state, and releases the latch only after receiving an external reset signal. This configuration, by adding a state latching strategy, avoids oscillation and drift of the software state machine in abnormal critical regions or when voltage is unstable, thus ensuring the stability of the electric drive system.

[0073] Figure 5 The diagram shown is a structural block diagram of one embodiment of the control device of this application. Figure 5 As shown, the control device includes one or more processors 31 for implementing, as Figure 4 The control method shown in the embodiment. The computer storage medium 32 of this application embodiment stores a program that, when executed by a processor, implements the control method described above. Figure 4The control method of the motor controller shown in the embodiment. The computer-readable storage medium 32 may store a program that can be called by the processor 31, and may include a non-volatile storage medium. In some embodiments, the processor 31 may include memory 33 and interface 34. In some embodiments, the processor 31 may also include other hardware depending on the actual application.

[0074] This application may take the form of a computer program product implemented on one or more computer-readable storage media 32 (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing program code. The computer-readable storage media 32 includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented using any method or technology. The information may be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media 32 include, but are not limited to: phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0075] This application also provides a vehicle, including a power motor and a motor controller. The motor controller is connected to the power motor and is used to control the operation of the power motor. The motor controller employs the method described above. Figures 1 to 3 Control circuit 2 of any one of the embodiments. The vehicle is equipped with... Figures 1 to 3 The control circuit 2 shown in the embodiment bypasses the software response stage through hardware-level linkage between various circuit modules, avoiding the failure of active protection command issuance due to software lag, crashes, or response delays, thus ensuring the safe operation of power devices under extreme conditions. This process does not require the participation of the main control unit, effectively avoiding the risk of bridge arm burnout caused by multiple concurrent faults and improving vehicle stability.

[0076] It should be understood that this application is not limited to the content already described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A control circuit for a motor controller, the motor controller comprising an upper bridge drive circuit and a lower bridge drive circuit, each of the upper bridge drive circuit and the lower bridge drive circuit comprising a first receiving terminal and a second receiving terminal; characterized in that, include: The monitoring circuit includes a data acquisition terminal and a trigger terminal; The acquisition terminal is connected to the sampling node of the motor controller, and the trigger terminal is used to output the trigger level; The main control circuit includes a drive control port and an interlock control port; the drive control port includes an upper bridge control pin and a lower bridge control pin, the upper bridge control pin is connected to the first receiving end of the upper bridge drive circuit, and the lower bridge control pin is connected to the first receiving end of the lower bridge drive circuit. An interlocking gate circuit includes a signal input terminal, an enable terminal, and a signal output terminal; the enable terminal is connected to the trigger terminal, the signal input terminal is connected to the interlocking control port, and the signal output terminal is connected to the second receiving terminals of the upper bridge drive circuit and the lower bridge drive circuit respectively. The interlock gate circuit is configured to: when the enable terminal receives the trigger level, block the signal path between the signal input terminal and the signal output terminal, and output an active short-circuit control signal through the signal output terminal, so that the upper bridge drive circuit and the lower bridge drive circuit enter an active protection state in which one is turned on and the other is turned off, and neither the upper bridge drive circuit nor the lower bridge drive circuit responds to the input signal of their respective first receiving terminal.

2. The control circuit according to claim 1, characterized in that, The signal output terminal includes an upper bridge output pin and a lower bridge output pin; the upper bridge output pin is connected to the second receiving terminal of the upper bridge driver circuit, and the lower bridge output pin is connected to the second receiving terminal of the lower bridge driver circuit; wherein... When the enable terminal receives a non-trigger level, the interlock gate circuit opens the signal path from the signal input terminal to the signal output terminal, and the interlock gate circuit is configured to: output a level state representing normal response, dual-path shutdown or single-path conduction to the upper bridge drive circuit and the lower bridge drive circuit respectively through the upper bridge output pin and the lower bridge output pin, according to the input level state of the signal input terminal; When the enable terminal receives the trigger level, the interlock gate circuit blocks the signal path of the signal input terminal, locks the upper bridge output pin to the off level state, and locks the lower bridge output pin to the on level state.

3. The control circuit according to claim 2, characterized in that, The signal input terminal includes a first input pin and a second input pin; the interlock control port of the main control circuit includes a first interlock pin and a second interlock pin; the first interlock pin is connected to the first input pin, and the second interlock pin is connected to the second input pin; When the enable pin receives the non-trigger level, the main control circuit outputs different level combinations through the first interlock pin and the second interlock pin, so that the input level states of the first input pin and the second input pin have a mapping relationship with the output level states of the upper bridge output pin and the lower bridge output pin; wherein... When the first input pin and the second input pin receive the first combined level state, the upper bridge output pin and the lower bridge output pin output the level state representing the normal response; When the first input pin and the second input pin receive the second combined level state, the upper bridge output pin and the lower bridge output pin output a level state representing the dual-channel shutdown. When the first input pin and the second input pin receive the third combined level state, the upper bridge output pin and the lower bridge output pin output a level state representing the single-channel conduction; wherein, the level state representing the single-channel conduction is: one of the upper bridge output pin and the lower bridge output pin outputs a conduction level, and the other outputs a de-conducting level.

4. The control circuit according to claim 1, characterized in that, The monitoring circuit includes a multi-channel acquisition module and a status monitoring module connected in parallel; the sampling nodes include a high-voltage bus node, a power supply node, and a status monitoring node of the main control circuit; each acquisition module is connected to a corresponding sampling node. The input terminal of the status monitoring module is connected to the output terminal of each of the acquisition modules, and its output terminal serves as the trigger terminal; wherein... The status monitoring module is configured to compare the acquisition voltage of each acquisition module with the reference voltage provided by the reference source, and when any acquisition voltage is lower than the reference voltage, the trigger terminal outputs the trigger level.

5. The control circuit according to claim 4, characterized in that, The status monitoring module further includes a hysteresis comparison module; the status monitoring module is configured to perform voltage hysteresis comparison on the acquired voltage of the acquisition module through the hysteresis comparison module; wherein... When the collected voltage is within a preset range, the trigger terminal outputs a non-trigger level to maintain the normal operation of the interlock gate circuit.

6. The control circuit according to claim 4, characterized in that, The main control circuit includes a main processing module and a safety processing module connected to the main processing module; the main processing module is connected to the status monitoring module, the interlock gate circuit, the upper bridge drive circuit, and the lower bridge drive circuit respectively; the safety processing module is connected to the acquisition module, and the output terminal of the safety processing module serves as the interlock control port of the main control circuit; wherein... The security processing module is configured to: when receiving an abnormal signal from the sampling node, lock the output level of the interlock control port of the main control circuit to a signal level representing the active protection state, and block the output signal of the main processing module.

7. The control circuit according to claim 1, characterized in that, The interlock gate circuit is configured to: perform timing control on the driving states of the upper bridge driving circuit and the lower bridge driving circuit according to the target driving mode, so that before switching to the target driving mode, both the upper bridge driving circuit and the lower bridge driving circuit are first set to the off state and maintained for a preset time, and then at least one of the upper bridge driving circuit and the lower bridge driving circuit is switched to the on state corresponding to the target driving mode.

8. The control circuit according to claim 1, characterized in that, The interlock gate circuit also includes a fault latching module; the fault latching module is connected to the enable terminal and is configured to: after the trigger terminal outputs the trigger level, latch the enable state of the interlock gate circuit into the active protection state until an external reset signal is received.

9. A control method for a motor controller, applied to a control circuit as described in any one of claims 1 to 8, wherein the motor controller includes an upper bridge drive circuit and a lower bridge drive circuit; characterized in that, The control method includes: Collect the voltage parameters of the motor controller; When an abnormality in the voltage parameter is detected, a trigger level is generated; In response to the trigger level, the signal path for transmitting drive commands to the upper bridge drive circuit and the lower bridge drive circuit is blocked, and an active short-circuit control signal is output; and based on the active short-circuit control signal, the upper bridge drive circuit and the lower bridge drive circuit enter an active protection state in which one of them is turned on and the other is turned off, and they no longer respond to the drive commands.

10. The control method according to claim 9, characterized in that, The acquisition of voltage parameters of the motor controller includes: The voltages of the high-voltage bus node, power supply node, and status monitoring node of the motor controller are collected respectively; The step of generating a trigger level when an abnormal voltage parameter is detected includes: The collected voltages are compared with the reference voltage using hysteresis. When any voltage is lower than the reference voltage, the voltage parameter is determined to be abnormal, and the trigger level is generated.

11. The control method according to claim 9, characterized in that, The active protection state, which causes the upper bridge drive circuit and the lower bridge drive circuit to enter a state where one is on and the other is off, based on the active short-circuit control signal, includes: Based on the active short-circuit control signal, both the upper bridge drive circuit and the lower bridge drive circuit are first set to the off state. After maintaining the off state for a preset time, one of the upper bridge drive circuit and the lower bridge drive circuit is switched to the on state, while the other is kept off, so as to enter the active protection state.

12. The control method according to claim 9, characterized in that, After entering the active protection state, the control method further includes: The latch blocks the signal path and the output state of the active short-circuit control signal; The latch is released only after an external reset signal is received.

13. A computer storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the control method of the motor controller as described in any one of claims 9 to 12.

14. A vehicle, characterized in that, include: Power motor; and A motor controller, connected to the power motor, is used to control the operation of the power motor; wherein the motor controller employs a control circuit as described in any one of claims 1 to 8.

Images