Extreme operating condition overcurrent overload fault protection method, system, controller and medium

Abstract

The application discloses an extreme working condition overcurrent overload fault-tolerant protection method, system, controller and medium, comprising the following steps: collecting multiple source operation variables and hardware fault flags of a motor driving system; obtaining candidate current states, calculating the reliability of each candidate current state according to the residual error between the candidate current states and the hardware fault flags, and fusing to obtain a fault-tolerant current state; predicting based on extreme working condition variables to obtain corresponding safety margins; calculating a dynamic safety current envelope to form a feasible current domain; discriminating fault types and risk levels; enabling the motor driving system to remain running or enter a safe state under the condition of meeting safety constraints; and performing hierarchical recovery. The application can be matched with a hierarchical recovery mechanism, suppress frequent jumps near the protection threshold, and quickly and smoothly enter a safe state when the risk is uncontrollable.

Description

Technical Field

[0001] This invention relates to the field of protection and control technology for motor drive systems, specifically to overcurrent and overload fault-tolerant protection methods, systems, controllers, and media under extreme operating conditions. Background Technology

[0002] Inverter-driven permanent magnet synchronous motors and induction motors have the advantages of high power density, fast dynamic response and wide speed range, and are widely used in industrial servo motors, engineering machinery, aviation electric actuators, pump compressors and electric transportation equipment. Under extreme conditions, sudden load increase, mechanical jamming, increased low-temperature lubrication resistance, decreased high-temperature heat dissipation capacity, bus voltage drop or rise and field weakening control saturation may all cause the phase current to increase rapidly within a few switching cycles, or cause the current to last too long even if it does not reach the instantaneous short circuit threshold, thereby causing the junction temperature of power devices and the temperature of motor windings to exceed the limits.

[0003] Existing overcurrent protection typically employs hardware comparators, desaturation detection, or fixed current thresholds. When the detected value exceeds the threshold, the gate driver directly blocks the pulse. This method offers fast response and is suitable for short-circuit protection, but fixed thresholds are difficult to simultaneously address low-temperature high-torque startup, short-term impact loads, and high-temperature cooling degradation conditions. If the threshold is too low, it will cause frequent false shutdowns, while if the threshold is too high, it may cause the device to exceed its safe operating area under high temperature or continuous overload conditions.

[0004] Therefore, it is necessary to achieve multi-dimensional and multi-timescale prediction and graded fault-tolerant protection of overcurrent and overload risks in motor drive systems under extreme operating conditions such as high and low temperatures, cooling degradation, bus fluctuations, load shocks, sensor anomalies, and partial power switch failures, so as to maintain system availability to the maximum extent while ensuring safety. Summary of the Invention

[0005] To overcome the shortcomings of fixed threshold protection, single temperature derating, and direct shutdown after a fault, this invention provides an overcurrent and overload fault-tolerant protection method, system, controller, and medium under extreme operating conditions, enabling the drive system to maintain limited output under short-term impacts and local fault-tolerant faults, and to quickly and smoothly enter a safe state when the risk is uncontrollable.

[0006] The technical solution of this invention is as follows:

[0007] In a first aspect, the present invention provides a fault-tolerant protection method for motor drive overcurrent and overload under extreme operating conditions, comprising the following steps:

[0008] S1, Collect multiple operating variables and hardware fault indicators of the motor drive system. The multiple operating variables include at least several of the following: phase current, DC bus current, DC bus voltage, rotor position or speed, power device temperature or radiator temperature, and motor temperature.

[0009] S2, candidate current states are obtained based on the phase current measurement branch, the DC bus current and switch state reconstruction branch, and the motor discrete model prediction branch, respectively. The reliability of each candidate current state is calculated based on the residual between the candidate current states and the hardware fault flag, and then fused to obtain the fault-tolerant current state.

[0010] S3, based on the fault-tolerant current state and extreme operating condition variables characterizing ambient temperature, cooling state, bus fluctuation, speed and load change, predict at least three of the following in the future preset time domain: peak current, power device junction temperature, motor winding temperature and cumulative electrothermal damage, to obtain the corresponding safety margin.

[0011] S4. Calculate the dynamic safety current envelope based on the safety margin, and construct a feasible current domain from the dynamic safety current envelope, voltage constraint, demagnetization constraint, and phase current constraint.

[0012] S5 determines the fault type and risk level based on the current change rate, predicted safety margin, candidate current state reliability, and hardware fault flags.

[0013] S6, perform protection actions according to the risk level, including at least one of the following: selecting reference current to project onto the feasible current domain, limiting torque command slope, cycle-by-cycle pulse clamping, replacing the measurement branch of the fault sensor with a backup observation branch, fault switch vector reconstruction, power device soft shutdown, and active short circuit or full bridge shutdown, so that the motor drive system can maintain operation or enter a safe state under the condition of meeting safety constraints.

[0014] S7, after the fault risk is reduced, performs graded recovery based on the recovery threshold below the trigger threshold, the minimum residence time, and the recovery threshold of cumulative electrothermal damage.

[0015] In a preferred embodiment, the credibility is obtained in the following manner:

[0016] For each phase or each coordinate axis current, calculate the first residual between the measured current and the model predicted current, the second residual between the measured current and the DC bus reconstructed current, and the third residual between the model predicted current and the DC bus reconstructed current; and form a health indicator based on the sliding mean square value, rate of change, and hardware fault flag of each residual.

[0017] When a bias fault is detected, the moving average of the residual shifts; when a gain fault is detected, the moving average of the residual changes proportionally with the current amplitude.

[0018] When a disconnection fault is detected, the sliding mean square value of the residual continuously exceeds the upper limit and the rate of change approaches zero; the health flag is multiplied by the residual decay function and normalized to obtain the confidence weight of each candidate current state.

[0019] As a preferred implementation method,

[0020] Multiple timescales include rapid electrical layers, device thermal layers, and motor thermal layers;

[0021] In the fast electrical layer, a motor discrete model is used to make rolling predictions of the current peak value and rate of change for the next H PWM cycles. The motor discrete model uses a rotating coordinate system voltage equation or a stationary coordinate system flux linkage equation. When the motor parameters change with temperature, the motor discrete model is updated using the online identified stator resistance, equivalent inductance or flux linkage parameters.

[0022] In the device thermal layer, the predicted junction temperature of the power device is obtained through online iteration of conduction loss, switching loss and at least a first-order thermal resistance and thermal capacitance network.

[0023] In the motor thermal layer, the predicted value of the motor winding temperature is obtained through online iteration of a lumped-parameter thermal network driven by copper loss, iron loss, ambient temperature, and cooling status; the cumulative electrothermal damage includes at least I decaying over time. 2 Damage amount and temperature cycling damage amount; the update cycle of the rapid electrical layer is 50μs to 200μs, the update cycle of the device thermal layer is 0.5ms to 2ms, and the update cycle of the motor thermal layer is 5ms to 20ms.

[0024] In a preferred embodiment, the dynamic safety current envelope satisfies:

[0025]

[0026] Among them, I ele I is the instantaneous current limit for the power circuit. Tj I is the current limit obtained by inverse solving of the junction temperature margin of the power device. w I is the current limit obtained by inverse solving of the winding temperature margin. pm I is the current limit obtained from the demagnetization margin of the permanent magnet. bus K is the current limit obtained from the DC bus energy constraint. ext K is the correction factor for extreme operating conditions. h The health correction coefficient is obtained from the health status of the sensors, power devices, and cooling system; the extreme condition correction coefficient K ext From the extreme working condition index χ ext The extreme condition index χ is obtained through mapping. ext Calculated using the following normalized weighting method:

[0027]

[0028] where ΔT env is the normalized value of temperature deviation of the environment or cooling medium, ΔFlow is the normalized value of cooling flow rate or air volume attenuation, ΔU dc is the normalized value of DC bus voltage deviation, ω n is the normalized value of rotational speed, dT load / dt is the normalized value of load torque change rate, N over is the normalized value of the number of consecutive overload times, to are the corresponding weight coefficients;

[0029] When projecting the original d-axis and q-axis current commands to the feasible current domain, at least two of the minimum current command deviation, the minimum output torque loss and the minimum electrothermal loss increment are taken as optimization objectives, and constraints are set for the phase current peak value, the available voltage of the inverter, the demagnetization boundary of the permanent magnet and the predicted junction temperature value of the power device.

[0030] As a preferred embodiment, the risk levels at least include a normal level, a transient overload tolerance level, a continuous overload suppression level, a degraded fault-tolerant operation level and a safe shutdown level; the entry threshold and exit threshold of each risk level are calibrated in the following manner: the maximum value or weighted fusion value of current out-of-bounds risk, junction temperature risk, winding risk, damage risk, sensor reliability risk and hardware fault risk is taken as the comprehensive risk index R, and the L1 entry threshold R1, L2 entry threshold R2, L3 entry threshold R3, L4 entry threshold R4 are set, with R1<R2<R3<R4; the exit threshold of each level is the corresponding entry threshold minus the preset hysteresis ΔR, and ΔR is greater than the measurement noise amplitude of the comprehensive risk index; a minimum residence time is set for adjacent risk levels to prevent repeated switching of the protection state near the threshold.

[0031] In a preferred implementation, when the reliability of the phase current sensor is lower than a preset reliability threshold and no hardware short-circuit flag appears in the power circuit, the corresponding measurement branch is disconnected, and the DC bus reconstructed current and the motor model predicted current are used as closed-loop feedback. The dynamic safety current envelope is reduced accordingly based on the degree of reliability reduction, allowing the motor to continue operating with limited torque. When a single power switch is found to be open-circuited, a single phase is disconnected, or the single phase current is uncontrollable and the drive topology has remaining controllable switching states, the switching vector that minimizes the weighted cost of predicted current error, torque ripple, and device thermal imbalance is selected from the pre-established fault topology switch vector set, and the upper limit of torque is reduced. The method for constructing the fault topology switch vector set is as follows: based on the current fault type, unusable vectors are removed from the switch vector space of the complete topology, the remaining controllable vectors are retained, and a candidate vector set is established according to the current output capability of each vector at different rotor positions.

[0032] Specifically, the fault topology switch vector set is pre-established in the following way: based on the current fault type, unusable vectors are removed from the switch vector space of the complete topology, the remaining controllable vectors are retained, and a candidate vector set is established according to the current output capability of each vector at different rotor positions.

[0033] As a preferred implementation, when a short circuit, shoot-through, control instability, or predicted junction temperature exceeding the protection time domain is detected, the gate driver first performs a phased soft shutdown to limit di / dt and shutdown overvoltage; then, a safe state is selected based on motor speed, back EMF, DC bus voltage, and predicted active short circuit current.

[0034] When the motor speed is lower than the preset speed threshold and the back electromotive force is lower than the safety threshold of the DC bus voltage, the full bridge shut-off free coasting is selected, and the upstream power supply is requested to be cut off.

[0035] When the motor speed is higher than the preset speed threshold or there is a risk of bus backflow, if the predicted active short circuit current is lower than the dynamic safety current envelope, then the upper arm active short circuit or the lower arm active short circuit is selected.

[0036] When the motor speed is higher than the preset speed threshold or there is a risk of bus backflow, and the active short-circuit predicted current exceeds the dynamic safety current envelope, or the system is equipped with a braking resistor or energy absorption branch, the controlled zero vector and the braking resistor are selected to consume energy in tandem.

[0037] The graded recovery includes: after all safety margins are continuously greater than the recovery margin and the hardware self-test passes, first increase the dynamic safety current envelope with a preset slope, and then remove the torque slope limit; if the accumulated electrothermal damage does not decrease to the recovery threshold, then maintain derating operation or prohibit restarting.

[0038] The phased soft turn-off includes three stages: the first stage reduces the gate voltage to the Miller plateau voltage within 0.5μs to 2μs; the second stage reduces the gate voltage from the Miller plateau voltage to below the threshold voltage within 2μs to 10μs at a voltage change rate not exceeding 10V / μs; and the third stage completely turns off the gate voltage to zero within 5μs to 20μs.

[0039] Secondly, the present invention provides a motor drive overcurrent and overload fault-tolerant protection system under extreme operating conditions, used to execute the aforementioned motor drive overcurrent and overload fault-tolerant protection method under extreme operating conditions, including:

[0040] The signal acquisition module is used to acquire multi-source operating variables and hardware fault indicators of the motor drive system;

[0041] The redundant current observation module is used to obtain candidate current states based on the phase current measurement branch, the DC bus current and switch state reconstruction branch, and the motor discrete model prediction branch, respectively. The reliability of each candidate current state is calculated based on the residual between the candidate current states and the hardware fault flag, and then fused to obtain the fault-tolerant current state.

[0042] The multi-timescale risk prediction module is used to predict the peak current, power device junction temperature, motor winding temperature and cumulative electrothermal damage in the future preset time domain based on the fault-tolerant current state and extreme operating condition variables, and obtain the corresponding safety margin.

[0043] The dynamic safety envelope calculation module is used to calculate the dynamic safety current envelope based on the safety margin, and the dynamic safety current envelope, voltage constraint, demagnetization constraint and phase current constraint constitute the feasible current domain;

[0044] The risk classification module is used to determine the fault type and risk level based on the current change rate, predicted safety margin, candidate current state reliability and hardware fault flags.

[0045] The fault-tolerant action module is used to perform corresponding protective actions according to the risk level.

[0046] The recovery management module is used to perform tiered recovery after the risk of failure has been reduced.

[0047] Thirdly, the present invention provides a motor controller, including a processor, a memory, a gate drive interface and a current and voltage sampling interface. The memory stores a computer program, which, when executed by the processor, can realize the aforementioned motor drive overcurrent and overload fault-tolerant protection method under extreme operating conditions.

[0048] Fourthly, the present invention provides a computer-readable medium storing computer-executable instructions for executing the motor drive overcurrent and overload fault-tolerant protection method under extreme operating conditions.

[0049] According to the above-described solution, the beneficial effects of this invention are as follows:

[0050] This invention provides a fault-tolerant protection method for motor drive overcurrent and overload under extreme operating conditions. It utilizes the fusion of multiple candidate currents to obtain the fault-tolerant current state, reducing the adverse effects of sensor anomalies on protection control. Based on extreme operating condition variables, it predicts multiple electrothermal indicators and constructs a dynamic feasible current domain, overcoming the limitations of traditional fixed threshold and single temperature derating schemes. It adaptively adapts to load impacts, bus fluctuations, high and low temperatures, and cooling degradation conditions. By identifying fault types and risk levels through multi-dimensional information, it selects different protection actions in stages, prioritizing the maintenance of limited system output and smoothly switching to a safe state after the risk exceeds the limit, overcoming the drawback of direct shutdown after a fault in existing solutions. Simultaneously, a graded recovery mechanism is provided to suppress frequent jumps near the protection threshold. Under the premise of constraining accumulated electrothermal damage and ensuring the safe operating range of components and the motor, it significantly improves the operational availability of the motor drive system under complex extreme operating conditions.

[0051] By fusing the reliability of three branches—phase current measurement, DC bus reconstruction, and model prediction—the system can maintain a closed-loop current flow even when a single current sensor is biased, saturated, or disconnected, and directly use the estimated uncertainty to tighten the safety current envelope. It unifies instantaneous electrical safety, power device junction temperature, motor winding temperature, permanent magnet demagnetization, and cumulative damage into a dynamic safety current envelope, which can adaptively change the allowable overload capacity under high and low temperatures, cooling degradation, and continuous impacts. Through feasible current domain projection and graded action, it prioritizes preserving available torque to avoid shutdown upon encountering short-term impacts, while smoothly derating during sustained overload phases to reduce thermal shock and torque surges. It implements degraded fault-tolerant control for local faults such as sensor failures, single-phase disconnections, or open circuits, improving the task continuity of safety-critical equipment. For non-fault-tolerant short circuits, it uses a combination of rapid hardware protection and software safety state selection for coordinated response. By employing different entry / exit thresholds, minimum dwell time, and damage memory, it reduces frequent switching of protection states and prevents secondary overcurrent caused by immediate full load after fault clearance. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of the overall process of the motor drive overcurrent and overload fault-tolerant protection method under extreme operating conditions in this invention.

[0053] Figure 2 This is a schematic diagram of the three-branch current redundancy observation and reliability fusion structure in this invention.

[0054] Figure 3This is a schematic diagram of multi-timescale risk prediction and dynamic safety current envelope calculation in this invention.

[0055] Figure 4 This is a schematic diagram of the risk classification and fault-tolerant protection state machine in this invention.

[0056] Figure 5 This is a schematic diagram of the process for soft shutdown and safety state selection under severe fault conditions in this invention. Detailed Implementation

[0057] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0058] It should be noted that the terms "comprising" and "having," and any variations thereof, in the specification and claims of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0059] Example 1

[0060] Please refer to Figure 1 This embodiment provides a method, system, controller, and medium for overcurrent and overload fault-tolerant protection under extreme operating conditions.

[0061] A fault-tolerant protection method for motor drive overcurrent and overload under extreme operating conditions includes the following steps:

[0062] S1, Collect multiple operating variables and hardware fault indicators of the motor drive system. The multiple operating variables include at least several of the following: phase current, DC bus current, DC bus voltage, rotor position or speed, power device temperature or radiator temperature, and motor temperature.

[0063] S2, candidate current states are obtained based on the phase current measurement branch, the DC bus current and switch state reconstruction branch, and the motor discrete model prediction branch, respectively. The reliability of each candidate current state is calculated based on the residual between the candidate current states and the hardware fault flag, and then fused to obtain the fault-tolerant current state.

[0064] S3, based on the fault-tolerant current state and extreme operating condition variables characterizing ambient temperature, cooling state, bus fluctuation, speed and load change, predict at least three of the following in the future preset time domain: peak current, power device junction temperature, motor winding temperature and cumulative electrothermal damage, to obtain the corresponding safety margin.

[0065] S4. Calculate the dynamic safety current envelope based on the safety margin, and construct a feasible current domain from the dynamic safety current envelope, voltage constraint, demagnetization constraint, and phase current constraint.

[0066] S5 determines the fault type and risk level based on the current change rate, predicted safety margin, candidate current state reliability, and hardware fault flags.

[0067] S6, perform protection actions according to the risk level, including selecting the reference current to project onto the feasible current domain, limiting the torque command slope, clamping the pulse cycle by cycle, replacing the observation of the fault sensor, reconstructing the fault switch vector, soft shutdown of the power device, and protection actions in active short circuit or full bridge shutdown, so that the motor drive system can maintain operation or enter a safe state under the condition of meeting the safety constraints.

[0068] S7, after the fault risk is reduced, performs graded recovery based on the recovery threshold below the trigger threshold, the minimum residence time, and the recovery threshold of cumulative electrothermal damage.

[0069] like Figure 2 As shown, the three-phase measuring current i output by the measuring branch is... m a i m b i m c If only two-phase sensors are configured, the third phase is obtained from the relationship that the sum of the three-phase currents is zero. The DC bus reconfiguration branch is based on the DC bus current i. dc and switching function S a S b S c Calculate the currently observable phase current; predict the dq axis current of the branch based on the discrete model of the motor.

[0070] Taking a permanent magnet synchronous motor as an example, when neglecting high-frequency parameter variations, the one-step prediction of the dq-axis current can be expressed as:

[0071]

[0072]

[0073] Among them, T s To control the cycle, R s L is the stator resistance. d and L q For the dq axis inductance, ψ f For permanent magnet flux linkage; R s It can be corrected online according to the winding temperature, L d L q and ψ fThe results can be updated using offline calibration tables or online identification results; for induction motors, the above equations can be replaced by stator flux linkage, rotor flux linkage, and slip frequency models.

[0074] The weighting coefficients ω1 to ω6 can be determined through analytic hierarchy process (AHP) or experimental calibration based on the application scenario and power level of the motor drive system. In one example, the values ​​of ω1 to ω6 are 0.20, 0.15, 0.15, 0.20, 0.15, and 0.15, respectively, with a sum of 1. For industrial servo scenarios where temperature rise is the primary limiting factor, ΔT can be increased. env The weights of ΔFlow; for new energy vehicle scenarios where bus fluctuations are the main risk, the weights of ΔU can be increased. dc and dT load The weight of / dt; each normalized value is based on its own rated operating condition, and when it exceeds the rated range, its normalized value is greater than 1.

[0075] For the j-th phase current, construct the normalized residual r j :

[0076]

[0077] Among them I b The reference current is α1, α2, and α3, which are weighting coefficients for each residual component. These coefficients are used to adjust the proportions of the first residual between the measured current and the model predicted current, the second residual between the measured current and the DC bus reconstructed current, and the third residual between the model predicted current and the DC bus reconstructed current in the normalized residual. The values ​​of α1, α2, and α3 are dynamically allocated based on the nominal measurement accuracy of each branch and the reliability under the current operating conditions. In one example, when all three branches are normal, α1, α2, and α3 are 0.4, 0.3, and 0.3, respectively, and satisfy α1 + α2 + α3 = 1.

[0078] The residuals were processed by moving mean square, slope and saturation detection to obtain the health marker H. j The confidence weight of a candidate branch can be calculated using the following formula:

[0079]

[0080] The fusion current is the weighted sum of the currents of all candidate branches. When a measurement branch exhibits an open circuit, zero drift, saturation, or hardware fault indication, its H... j Set to zero; when all measurement branches are unavailable, the system maintains a closed loop through bus reconfiguration and model prediction branches, and sets the health correction coefficient K to zero. h Reduce the current to decrease the allowable output current.

[0081] like Figure 3As shown, the fast electrical layer uses a discrete model to perform rolling prediction of the current for the next H PWM cycles, obtaining the predicted peak value I. pk,H and the time of crossing the boundary t cross H can be set from 2 to 20 depending on the controller's computing power; if an abnormal di / dt or desaturation warning is detected, the protection time domain is shortened and the risk level is increased.

[0082] Power device losses include conduction losses and switching losses. Taking the m-th switching device as an example, they can be estimated using the device datasheet or calibration table:

[0083]

[0084]

[0085] Junction temperature is achieved using at least a first-order Foster or Cauer thermal network iteration; taking an Nth-order Foster network as an example:

[0086]

[0087] Where T c For case temperature, substrate temperature, or cooling plate temperature, a n and b n The value is determined by thermal resistance and thermal capacity parameters and the thermal model update time. Based on the predicted losses in the future time domain, T can be calculated. j,pred And obtain the junction temperature margin M j =T j,max -ΔT j -T j,pred .

[0088] The motor windings utilize a lumped heat model of winding-core-environment. Copper losses are calculated according to... Iron loss is calculated by referring to tables based on rotational speed, flux linkage, and current. When cooling flow decreases, the fan malfunctions, or the coolant temperature rises, the equivalent thermal resistance is increased or the convective heat transfer coefficient is decreased.

[0089] To avoid repeated impacts depleting short-term overload capacity, a damped I is defined. 2 Damage amount D e :

[0090]

[0091] Where, λ e The cooling recovery coefficient represents the proportion of electrothermal damage from the previous cycle remaining in the current cycle, and its value ranges from 0 to λ. e ≤1, λ e The closer τ is to 0, the stronger the cooling recovery capability and the faster the damage decay; eThe reference time constant for electrothermal damage is determined by a combination of the motor winding insulation class and the thermal time constant of the power devices. It is used to normalize instantaneous current overload into equivalent sustained damage. It can also update the thermal cycling damage D based on the junction temperature swing and the number of cycles. th Health correction factor K h Can be derived from D e D th The sensor reliability and cooling health are jointly determined; to avoid meaningless accumulation of damage under rated operating conditions, when Irms(k)≤Irated, the second term of the above formula is zero, at which time De(k+1)=λeDe(k), and the damage is only reduced according to the cooling recovery coefficient; when Irms(k)>Irated, the above formula is used for complete calculation.

[0092] The dynamic safety current envelope is obtained by intersecting multiple independent limits:

[0093]

[0094] I ele Determined based on the short-circuit withstand capability of power devices, busbar, and current sensor range; I Tj The solution ensures that the future junction temperature will not exceed T. j,max -ΔT j The maximum current is obtained; I w By solving the problem, the hot spot temperature of the winding is ensured to not exceed T. w,max -ΔT w The maximum current is obtained; I pm Used to limit negative d-axis current under high temperature and weak magnetic conditions, preventing irreversible demagnetization; I bus It is determined based on the bus voltage, allowable reinjection power, and braking unit capacity.

[0095] K ext From the extreme working condition index χ ext The mapping is obtained; for example, χ ext It can be weighted by ambient temperature deviation, cooling attenuation, bus voltage deviation, normalized speed, load torque change rate, and recent overload count; χ ext The larger K is ext The smaller; K h It reflects the health status of sensors, devices, and cooling systems.

[0096] In the dq coordinate system, the feasible current domain Ω(k) must satisfy at least the following constraints:

[0097]

[0098]

[0099]

[0100] When the original current command is outside Ω(k), solving the constraint projection problem yields the safe current command i. * dq The optimization objective can be set as a weighted sum of current command deviation, torque loss, and predicted loss increment. For equipment that needs to maintain critical torque, the weight of the torque term can be increased. For equipment with low thermal margin, the weight of the loss term can be increased.

[0101] like Figure 4 As shown, this embodiment sets five states: L0 is normal control; L1 is transient overload tolerance state; L2 is continuous overload suppression state; L3 is degraded fault-tolerant operation state; L4 is safe shutdown or active short circuit state; the comprehensive risk index R can be the maximum value among current overrun risk, junction temperature risk, winding risk, damage risk, sensor risk and gate drive risk, or a weighted fusion can be used.

[0102] The entry thresholds R1, R2, R3, and R4 for each risk level are determined through offline calibration or online adaptive methods. For example, based on the steady-state operating risk value at rated current, R1 is set to 1.2 times the rated risk value to trigger transient overload tolerance; R2 is set to 1.8 times the rated risk value to trigger sustained overload suppression; R3 is set to 2.5 times the rated risk value to trigger degraded fault-tolerant operation; and R4 is set to 3.5 times the rated risk value to trigger safe shutdown. In the exit thresholds R1-ΔR, R2-ΔR, R3-ΔR, and R4-ΔR, ΔR takes a value between 0.1 and 0.3 times the rated risk value and is greater than the measurement noise amplitude of the comprehensive risk index during steady-state operation.

[0103] The minimum dwell time between each level is set to 50ms to 200ms to suppress frequent switching of protection status caused by fluctuations in the comprehensive risk index around the threshold.

[0104] In L1 state, the original current command is projected onto Ω(k), limiting the torque command slope and allowing in D e and T j When sufficient margin is available, a short-term overload envelope is used; in this case, the PWM is not immediately blocked, so it can pass through short-term load surges or low-temperature start-up phases.

[0105] In L2 state, in addition to performing the L1 action, the predicted phase current is compared with I on a cycle-by-cycle basis. lim When the predicted next sampling point exceeds the limit, insert a zero vector in advance or shorten the effective vector action time; when switching losses are the main heat source, the switching frequency can be reduced within the allowable current ripple range; when copper loss and current ripple are the main heat sources, the switching frequency can be increased or the PWM sequence can be changed to reduce the total predicted temperature rise.

[0106] In L3 state, if the fault is a current sensor fault, bus reconfiguration and model-predicted branch feedback are used to replace the feedback; if the fault is a single switch open circuit or a single-phase disconnection and the topology still has a controllable vector, the vector with the lowest cost is selected from the fault topology vector set. The cost function includes at least the next cycle current error, torque ripple, zero-sequence current, or residual switch thermal imbalance. The maximum torque in L3 state is less than that in normal state.

[0107] When hardware desaturation or overcurrent flag is triggered, predicted out-of-bounds time is less than the time required for soft current limiting, or the confidence level of all current branches is too low, or T j / T w When the safety margin is exhausted, it enters the L4 state. The gate driver first performs a soft shutdown to control di / dt and shutdown overvoltage, and the controller then follows... Figure 5 Choose between full bridge shutdown, active short circuit, or controlled energy dissipation.

[0108] The fault topology switch vector set is pre-stored offline in the controller's non-volatile memory, coded by fault type and indexed by rotor position range. During online operation, the candidate vector set is directly obtained by looking up a table based on the currently identified fault type and the sector where the real-time rotor position is located. Taking a three-phase two-level inverter as an example, the complete topology space contains 8 basic voltage vectors (6 effective vectors and 2 zero vectors). When an open-circuit fault is detected in the upper arm of phase A, all vectors that depend on the conduction of the upper arm of phase A are removed from the 8 vectors, and the remaining controllable vectors constitute the candidate set of fault topology switch vectors. At the same time, for each remaining vector, the current value that it can output in the next control cycle is calculated based on the current rotor angle and back electromotive force. Vectors whose current output capability is lower than the preset minimum torque requirement or that may produce excessive torque pulsation are removed, and finally, each selected vector set is formed.

[0109] like Figure 5 As shown, if the power device is uncontrollable or the gate drive power supply is abnormal, the full bridge is directly requested to be turned off and the upstream power supply is cut off; if the power device is still controllable, the safe state is selected based on the motor speed, back electromotive force, bus voltage, braking unit status and active short-circuit predicted current.

[0110] At low speeds and when the back EMF is below the bus safety threshold, full-bridge shutdown and free coasting can be selected. In high-speed permanent magnet motors, if full-bridge shutdown would lead to bus backflow risk and the predicted active short-circuit current is below the short-time current envelope, then active short-circuiting of the upper or lower three tubes can be selected. If the active short-circuit current is too large and the system is equipped with a braking resistor or energy absorption branch, then controlled zero vector and braking resistor can be selected for coordinated energy dissipation.

[0111] Specifically, the risk of bus backflow is judged based on the following conditions: when the peak value of the motor back electromotive force is... Greater than DC bus voltage When it is 1.05 times, that is It was determined that there was a risk of busbar backflow.

[0112] Recovery employs a dual-threshold hysteresis loop; for example, the risk threshold for entering L2 is R2, and the exit threshold is R2-ΔR; only continuous N... rec Each cycle satisfies the exit condition and T j T w D e The risk level is reduced only when all values ​​are below the recovery threshold; during the recovery process, I lim Increase the slope, first remove the cycle-by-cycle current limiting, then remove the torque slope limiting.

[0113] If the fault is a latching short circuit, gate drive undervoltage, power module overheating, or multiple sensor failures, a power-on self-test, insulation or phase resistance check, and temperature drop check must be completed before restarting is allowed.

[0114] In one example implementation, the current control cycle is 50 μs, the PWM frequency is 10 kHz, the junction temperature model is updated every 1 ms, the motor thermal model is updated every 10 ms, the hardware desaturation protection operates independently of the controller, and the software calculates I in each current control cycle. lim And Ω(k), the above values ​​are for illustrative purposes only and can be adjusted according to power level and processor performance.

[0115] During example calibration, V0 and R can be established first through double-pulse tests and steady-state loss tests. on E on E off Look up tables; identify thermal network parameters through power cycling or manufacturer's thermal impedance curves; identify winding thermal models through locked rotor or equivalent copper loss tests; calibrate K through high and low temperature, cooling attenuation, bus drop, and load step tests. ext With risk threshold.

[0116] The software implementation of the controller should prioritize hardware fault interruption, fast current prediction, and cycle-by-cycle current limiting; prioritize thermal modeling, damage memory, and recovery management; and for safety-critical applications, hardware overcurrent latching, PWM blocking, and active short-circuit interlocking can be implemented independently by FPGA or CPLD to prevent bridge arm shoot-through caused by processor failure.

[0117] The motor drive overcurrent and overload fault-tolerant protection device, controller and storage medium under extreme working conditions provided in this application embodiment can perform the above method embodiment, and their implementation principle and technical effect are similar, so they will not be described again here.

[0118] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuits,” “modules,” or “systems.”

[0119] Any one or more of the modules, submodules, units, and subunits according to this embodiment, or at least part of the functions of any one or more of them, can be implemented in one module. Any one or more of the modules, submodules, units, and subunits according to this embodiment can be implemented by dividing them into multiple modules. Any one or more of the modules, submodules, units, and subunits according to this embodiment can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or implemented by hardware or firmware in any other reasonable manner by integrating or packaging circuits, or implemented in software, hardware, and firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, one or more of the modules, submodules, units, and subunits according to this embodiment can be at least partially implemented as computer program modules, which, when run, can perform corresponding functions.

[0120] In one embodiment, the present invention provides a motor drive overcurrent and overload fault-tolerant protection device under extreme operating conditions, which may include at least one processing unit and at least one storage unit. The storage unit stores program code, which, when executed by the processing unit, causes the processing unit to perform the steps described above in the motor drive overcurrent and overload fault-tolerant protection under extreme operating conditions according to various exemplary embodiments of the present invention. For example, the processing unit may perform, as follows: Figure 1 The flowchart illustrates the fault-tolerant protection method for motor drive overcurrent and overload under extreme operating conditions.

[0121] In one embodiment, the present invention provides a computer-readable medium storing computer-executable instructions for performing the steps in the motor drive overcurrent and overload fault-tolerant protection method under extreme operating conditions according to various exemplary embodiments of the present invention, as described above.

[0122] A readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. A readable signal medium can include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. A readable signal medium can also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the readable medium can be transmitted using any suitable medium, including—but not limited to—wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0123] Furthermore, although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0124] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

[0125] The present invention has been described above with reference to the accompanying drawings. Obviously, the implementation of the present invention is not limited to the above-described manner. Any improvements made using the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other situations without modification, are all within the protection scope of the present invention.

Claims

1. A method for fault-tolerant protection against overcurrent and overload in motor drives under extreme operating conditions, characterized in that, Includes the following steps: S1, Collect multiple operating variables and hardware fault indicators of the motor drive system. The multiple operating variables include at least several of the following: phase current, DC bus current, DC bus voltage, rotor position or speed, power device temperature or radiator temperature, and motor temperature. S2, candidate current states are obtained based on the phase current measurement branch, the DC bus current and switch state reconstruction branch, and the motor discrete model prediction branch, respectively. The reliability of each candidate current state is calculated based on the residual between the candidate current states and the hardware fault flag, and then fused to obtain the fault-tolerant current state. S3, based on the fault-tolerant current state and extreme operating condition variables characterizing ambient temperature, cooling state, bus fluctuation, speed and load change, predict at least three of the following in the future preset time domain: peak current, power device junction temperature, motor winding temperature and cumulative electrothermal damage, to obtain the corresponding safety margin. S4. Calculate the dynamic safety current envelope based on the safety margin, and construct a feasible current domain from the dynamic safety current envelope, voltage constraint, demagnetization constraint, and phase current constraint. S5 determines the fault type and risk level based on the current change rate, predicted safety margin, candidate current state reliability, and hardware fault flags. S6, perform protection actions according to the risk level, including at least one of the following: selecting reference current to project onto the feasible current domain, limiting torque command slope, cycle-by-cycle pulse clamping, replacing the measurement branch of the fault sensor with a backup observation branch, fault switch vector reconstruction, power device soft shutdown, and active short circuit or full bridge shutdown, so that the motor drive system can maintain operation or enter a safe state under the condition of meeting safety constraints. S7, after the fault risk is reduced, performs graded recovery based on the recovery threshold below the trigger threshold, the minimum residence time, and the recovery threshold of cumulative electrothermal damage.

2. The method for fault-tolerant protection of motor drive overcurrent and overload under extreme operating conditions according to claim 1, characterized in that, The credibility was obtained in the following ways: For each phase or each coordinate axis current, calculate the first residual between the measured current and the model predicted current, the second residual between the measured current and the DC bus reconstructed current, and the third residual between the model predicted current and the DC bus reconstructed current; and form a health indicator based on the sliding mean square value, rate of change, and hardware fault flag of each residual. When a bias fault is detected, the moving mean of the residuals shifts; When a gain fault is detected, the sliding mean square value of the residual changes proportionally with the current amplitude. When a disconnection fault is detected, the sliding mean square value of the residual continuously exceeds the upper limit and the rate of change approaches zero; the health flag is multiplied by the residual decay function and normalized to obtain the confidence weight of each candidate current state.

3. The method for fault-tolerant protection of motor drive overcurrent and overload under extreme operating conditions according to claim 1, characterized in that, Multiple timescales include rapid electrical layers, device thermal layers, and motor thermal layers; At the fast electrical layer, a motor discrete model is adopted to perform rolling prediction on the current peak value and change rate in the next H PWM cycles. The motor discrete model uses a rotating coordinate system voltage equation or a stationary coordinate system flux linkage equation. When motor parameters change with temperature, the motor discrete model is updated by using the on-line identified stator resistance, equivalent inductance or flux linkage parameters; At the device thermal layer, the predicted junction temperature value of the power device is obtained through on-line iteration of conduction loss, switching loss and at least a first-order thermal resistance-capacitance network; In the motor thermal layer, the predicted value of the motor winding temperature is obtained through online iteration of a lumped-parameter thermal network driven by copper loss, iron loss, ambient temperature, and cooling status; the cumulative electrothermal damage includes at least I decaying over time. 2 Damage amount and temperature cycling damage amount; the update cycle of the rapid electrical layer is 50μs to 200μs, the update cycle of the device thermal layer is 0.5ms to 2ms, and the update cycle of the motor thermal layer is 5ms to 20ms.

4. The method for fault-tolerant protection of motor drive overcurrent and overload under extreme operating conditions according to claim 3, characterized in that, The dynamic safe current envelope satisfies: ； Among them, I ele I is the instantaneous current limit for the power circuit. Tj I is the current limit obtained by inverse solving of the junction temperature margin of the power device. w I is the current limit obtained by inverse solving of the winding temperature margin. pm I is the current limit obtained from the demagnetization margin of the permanent magnet. bus K is the current limit obtained from the DC bus energy constraint. ext K is the correction factor for extreme operating conditions. h The health correction coefficient is obtained from the health status of the sensors, power devices, and cooling system; the extreme condition correction coefficient K ext From the extreme working condition index χ ext The extreme condition index χ is obtained through mapping. ext Calculated using the following normalized weighting method: ； Where ΔT env ΔFlow is the normalized value of the ambient or cooling medium temperature deviation, and ΔU is the normalized value of the cooling flow rate or airflow attenuation. dc ω is the normalized value of the DC bus voltage deviation. n dT is the normalized value of the rotational speed. load / dt is the normalized value of the load torque change rate, N over This is the normalized value of the number of consecutive overloads. to These are the corresponding weighting coefficients; When projecting the original d-axis and q-axis current commands to the feasible current domain, at least two of the minimum current command deviation, the minimum output torque loss and the minimum electrothermal loss increment are taken as optimization objectives, and constraints are set for the phase current peak value, the available voltage of the inverter, the demagnetization boundary of the permanent magnet and the predicted junction temperature value of the power device.

5. The method for fault-tolerant protection of motor drive overcurrent and overload under extreme operating conditions according to claim 1, characterized in that, The risk levels at least include a normal level, a transient overload tolerance level, a continuous overload suppression level, a degraded fault-tolerant operation level and a safe shutdown level; The entry threshold and exit threshold of each risk level are calibrated in the following manner: the maximum value or weighted fusion value of current out-of-limit risk, junction temperature risk, winding risk, damage risk, sensor reliability risk and hardware fault risk is taken as the comprehensive risk index R, and an L1 entry threshold R1, an L2 entry threshold R2, an L3 entry threshold R3 and an L4 entry threshold R4 are set, with R1<R2<R3<R4; the exit threshold of each level is the corresponding entry threshold minus a preset hysteresis ΔR, and ΔR is greater than the measurement noise amplitude of the comprehensive risk index; a minimum residence time is set for adjacent risk levels to prevent the protection state from switching back and forth near the threshold.

6. The motor drive overcurrent and overload fault-tolerant protection method under extreme working conditions according to claim 1, characterized in that, When the reliability of the phase current sensor is lower than a preset reliability threshold and no hardware short-circuit flag appears in the power loop, the corresponding measurement branch is cut off, the reconstructed DC bus current and the motor model predicted current are taken as closed-loop feedback, and the dynamic safe current envelope is correspondingly reduced according to the reduction degree of the reliability, so that the motor continues to operate with limited torque; When an open circuit of a single power switch, single-phase disconnection or uncontrollable single-phase current is identified and the drive topology has remaining controllable switch states, a switch vector that minimizes the weighted cost of predicted current error, torque ripple and device thermal imbalance is selected from a pre-established fault topology switch vector set, and the torque upper limit is reduced; The construction method of the fault topology switch vector set is: according to the current fault type, eliminate unavailable vectors from the switch vector space of the complete topology, retain the remaining controllable vectors, and establish a candidate vector set according to the current output capability of each vector at different rotor positions.

7. The motor drive overcurrent and overload fault-tolerant protection method under extreme working conditions according to claim 1, characterized in that, When a short circuit, shoot-through, control instability or predicted junction temperature that will exceed the limit within the protection time domain is identified, the gate driver first performs staged soft turn-off to limit di / dt and turn-off overvoltage; then a safe state is selected according to the motor speed, back electromotive force, DC bus voltage and active short-circuit predicted current; When the motor speed is lower than the preset speed threshold and the back electromotive force is lower than the safety threshold of the DC bus voltage, the full bridge shut-off free coasting is selected, and the upstream power supply is requested to be cut off. When the motor speed is higher than the preset speed threshold or there is a risk of bus backflow, if the predicted active short circuit current is lower than the dynamic safety current envelope, then the upper arm active short circuit or the lower arm active short circuit is selected. When the motor speed is higher than the preset speed threshold or there is a risk of bus backflow, and the active short-circuit predicted current exceeds the dynamic safety current envelope, or the system is equipped with a braking resistor or energy absorption branch, the controlled zero vector and the braking resistor are selected to consume energy in tandem. The graded recovery includes: after all safety margins are continuously greater than the recovery margin and the hardware self-test passes, first increasing the dynamic safety current envelope with a preset slope, and then removing the torque slope limit. If the accumulated electrical thermal damage does not decrease to the recovery threshold, maintain derating operation or prohibit restarting.

8. A fault-tolerant protection system for motor drive overcurrent and overload under extreme operating conditions, characterized in that, A method for implementing the fault-tolerant protection method for motor drive under extreme operating conditions as described in any one of claims 1-7, comprising: The signal acquisition module is used to acquire multi-source operating variables and hardware fault indicators of the motor drive system; The redundant current observation module is used to obtain candidate current states based on the phase current measurement branch, the DC bus current and switch state reconstruction branch, and the motor discrete model prediction branch, respectively. The reliability of each candidate current state is calculated based on the residual between the candidate current states and the hardware fault flag, and then fused to obtain the fault-tolerant current state. The multi-timescale risk prediction module is used to predict the peak current, power device junction temperature, motor winding temperature and cumulative electrothermal damage in the future preset time domain based on the fault-tolerant current state and extreme operating condition variables, and obtain the corresponding safety margin. The dynamic safety envelope calculation module is used to calculate the dynamic safety current envelope based on the safety margin, and the dynamic safety current envelope, voltage constraint, demagnetization constraint and phase current constraint constitute the feasible current domain; The risk classification module is used to determine the fault type and risk level based on the current change rate, predicted safety margin, candidate current state reliability and hardware fault flags. The fault-tolerant action module is used to perform corresponding protective actions according to the risk level. The recovery management module is used to perform tiered recovery after the risk of failure has been reduced.

9. A motor controller, comprising a processor, a memory, a gate drive interface, and a current and voltage sampling interface, characterized in that, The memory stores a program that, when executed by the processor, causes the motor controller to perform a fault-tolerant protection method for motor drive overcurrent and overload under extreme operating conditions, as described in any one of claims 1 to 7.

10. A computer-readable medium storing computer-executable instructions, characterized in that, The computer-executable instructions are used to execute the motor drive overcurrent and overload fault-tolerant protection method under extreme operating conditions according to any one of claims 1 to 7.

Images