Method for controlling an inverter including the selection of a safety mode
The method addresses inverter control failures by using a redundant second control device to select safety modes based on simple parameters, effectively preventing system degradation and ensuring reliability in electric traction systems.
Patent Information
- Application Number
- FR2022002964
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2022-03-31
- Publication Date
- 2025-08-29
- Estimated Expiration
- 2042-03-31
AI Technical Summary
Existing inverter control systems in electric traction machines fail to effectively manage safety modes in the event of a main microcontroller failure, leading to potential damage from overheating, overvoltages, and excessive braking, without requiring complex and costly redundant components.
A method for controlling an inverter using a redundant second control device that selects safety modes based on simple parameters like bus voltage and machine rotation speed, avoiding the need for programmable logic components, to ensure functional safety and prevent system degradation.
The method provides effective and economical protection against overheating, overvoltages, and excessive braking by selecting appropriate safety modes, ensuring system reliability with minimal component complexity and cost.
Smart Images
Figure 00000015_0000 
Figure 00000016_0000
Abstract
Description
Title of the invention: Method for controlling an inverter comprising the selection of a safety mode
[0001] The present invention relates to the control of an inverter used to control an electric traction machine of a vehicle. It relates more specifically to the selection and application of a safety mode in the event of failure of the inverter control means, and applies in particular to traction systems comprising a permanent magnet synchronous machine.
[0002] The inverter is a device allowing, for example, to generate an alternating current from a direct current coming from an electrical source such as a battery.
[0003] Inverters comprise a power stage comprising, for example, power modules, and more generally the power electronics of the inverter. The power stage comprises a set of electronic switches. Several electronic switch technologies can be used in an inverter used in an electric traction system of a vehicle, including: - insulated gate bipolar transistors, also called "IGBT", from the English "Insulated Gate Bipolar Transistor", and - insulated gate field effect transistors also called "MOSFET", an acronym for "Metal Oxide Semiconductor Field Effect Transistor", and in particular Silicon Carbide (SiC) power transistors.
[0004] Thus, in a power module, by a set of appropriately controlled switches, the source is modulated in order to obtain an alternating signal of the desired frequency.
[0005] The power stage of the inverter is powered by the electrical source (i.e. generally the battery) via a so-called high voltage direct current bus, or "HVDC bus" (for "High Voltage Direct Current").
[0006] This voltage, greater than 60V (for example of the order of 200V, 400V, or 800V) corresponds in particular to the voltage of the current which is transformed by the inverter to power an electrical machine of the vehicle.
[0007] The inverter is controlled by a control device which generally includes a microcontroller.
[0008] Nevertheless, it is necessary to provide a solution for the case where the control device fails, that is to say in any situation where it is no longer able to correctly control the inverter. Such a situation can occur in the event of a power supply fault, but also in the event of a software fault, or in any other unexpected situation.
[0009] In such a situation, the inverter is controlled in a safety mode.
[0010] In order to cover all failure cases and all life situations, the management of the safety state requires having two redundant and independent electronic functions capable of managing the safety state.
[0011] Thus, a second microcontroller can be provided, as a redundant electronic function with respect to the microcontroller normally used (main microcontroller) and making it possible to control the inverter in the event of failure of the main microcontroller. It is notable that if the failure of the main microcontroller results from a power supply fault, it is possible to power the second microcontroller by an auxiliary power supply (generally of the “Flyback” type, sometimes translated as “indirect transfer”), corresponding to an electrical capacity (typically one or more capacitors) internal to the inverter.
[0012] As an alternative to a second microcontroller, the use of other complex components is possible, for example a CPLD (according to the English acronym for "Complex Programmable Logic Device", and which designates a complex combinatorial electronic component) or an FPGA (according to the English acronym for "Field Programmable Gate Array" and which designates a complex electronic component sometimes called "field programmable gate array"). Such a complex component is hereinafter referred to as a "programmable logic component".
[0013] For a permanent magnet synchronous motor (also designated by the English acronym PMSM for “Permanent Magnet Synchronous Motor”), two relevant safety modes exist.
[0014] A first safety mode is the active short circuit mode or ASC according to the English acronym for “Active Short Circuit”.
[0015] In ASC mode, the phases of the electrical machine are short-circuited. In this case, the electrical machine is isolated from the HVDC bus.
[0016] Without ASC mode, a loss of control of the inverter would leave the electronic switches (e.g. IGBTs) in an open, non-conducting state. This could prove critical when the electrical machine is rotating at high speed, because the rotor would then induce a voltage in the stator phases which could be higher than the electrical potential of the inverter. A current would then flow in the diodes of the electronic power switches and cause an uncontrolled charge of the inverter capacitors. The ASC mode provides a response to this situation, to avoid damage to the inverter or the battery. In this ASC mode, certain electronic switches of the inverter power stage, namely those located on the same side of the H-bridges formed in the inverter, are closed so that they at allow the passage of a current. The poles of the electric machine (typically three in number for a three-phase motor) are then in a short-circuit situation. However, while the ASC mode ensures that no unwanted regeneration operations occur, a significant current can flow in the phases of the electric machine, potentially causing overheating. The ASC mode should therefore preferably not be used for a long period.
[0017] A second safety mode is the "Open Circuit Freewheel" mode or FW mode for "freewheeling". In the FW mode the electronic switches of the inverter are all in the open state, and therefore do not allow the passage of a current.
[0018] In FW mode, the electrical machine is not disconnected from the HVDC bus.
[0019] This results, when the electrical machine is driven at high rotation speed, in an induced current which passes through the diodes of the electronic switches and recharges the capacitors of the inverter (as explained above).
[0020] In other words, the application of the FW mode can induce a current in the electrical machine and in the inverter, and inject energy onto the high voltage bus. If the battery is disconnected from the high voltage bus, this can cause a rise in the voltage in the part of the high voltage circuit of the inverter (high voltage bus), and therefore in the capacitors of the inverter. The inverter switches can then be damaged by the temperature. For example, the maximum permissible temperature is around 175°C for IGBTs. If the battery is connected to the high voltage bus, this can lead to uncontrolled regeneration (recharging) and excessive electrical braking of the electrical machine (and, where applicable, of the vehicle equipped with it).
[0021] However, if the speed of the electric machine is sufficiently low (so that the rectified back electromotive force is sufficiently low), there is no risk of untimely regeneration or overvoltage operation. In addition, no current flows in the lines of the electric machine, which avoids any risk of overheating of the system.
[0022] This mode must therefore normally be reserved for situations of low rotation speed of the electric machine.
[0023] The present invention aims to address the problems mentioned above.
[0024] In particular, the aim of the present invention is to propose control of the inverter in the event of failure of the main microcontroller, thanks to an electronic function redundant with respect to said main microcontroller, which is optimized from a functional point of view and with respect to the reliability of the system, while being simple and inexpensive to develop and to implement.
[0025] The control of the inverter proposed in the invention thus aims to avoid, in a simple, economical and effective manner, damage to the electrical machine due to overheating, to protection against overvoltages and against load drops (generally referred to by the English expression “load dump”), and to avoid excessive braking phenomena of the vehicle equipped with the electric machine.
[0026] Thus, the invention relates to a method for controlling an inverter comprising electronic switches and controlling an electrical machine, the inverter and the electrical machine being powered by a direct current bus called a high voltage bus. The inverter is controlled by a first control device such as a main microcontroller in a nominal operating mode, and the inverter is controlled by a second control device when the first control device is faulty. The second control device is adapted to apply a safety operating mode to the inverter. The security mode is chosen from: - a safety operating mode called ASC mode in which certain electronic switches of the inverter are closed so as to short-circuit phases of the electrical machine; and - a safety operating mode called FW mode in which all the electronic switches of the inverter are open, which puts the electrical machine into freewheel mode. The method comprises, to select the safety mode to be applied: determining the voltage on the high voltage bus, and - if the voltage on the high voltage bus is lower than a first voltage threshold, FW mode is selected, - if the voltage on the high voltage bus is higher than a second voltage threshold which is higher than the first voltage threshold, ASC mode is selected, - if the voltage is between the first voltage threshold and the second voltage threshold inclusive, a parameter distinct from the voltage on the high-voltage bus and representative of the possibility of injecting energy by the electrical machine onto said high-voltage bus without risk is determined, an absence of risk being determined when the parameter is lower than a threshold value; and - if the parameter is greater than or equal to the threshold value, ASC mode is selected, - if the parameter is less than the threshold value, FW mode is selected.
[0027] The control of the inverter proposed according to the present invention makes it possible to ensure functional safety and the absence of deterioration of the system in the event of failure of the system of the first control device, by a simple and effective selection of the safety mode to be applied. The selection being based on two simple parameters, starting with the voltage on the HVDC bus, and another parameter which may be available or simple to measure (rotation speed of the electrical machine, current in the phases of said machine, etc.), this selection can be carried out using simple electronic components, without requiring the use of programmable logic components or a second microcontroller. Taking into account a parameter representative of the possibility of injecting electrical energy into the high-voltage bus makes it possible in particular to limit the risks associated with such injection, namely uncontrolled regeneration and excessive electrical braking of the electrical machine when the system's high-voltage power supply (the battery) is connected to the high-voltage bus, or an overvoltage in the inverter when the system's high-voltage power supply (the battery) is disconnected from the high-voltage bus.
[0028] Before the step of determining the voltage on the high-voltage bus, the second control device can apply the FW mode to the inverter. The FW mode can then be applied, for example, for a duration of between 1 ps and 10 ps.
[0029] According to one embodiment, the parameter taken into account in the method is the rotation speed of the electrical machine.
[0030] Since the high voltage bus is connected to a battery, the rotation speed threshold value may correspond to the rotation speed of the electric machine from which a rectified counter electromotive force greater than the minimum battery voltage is generated.
[0031] The rotation speed threshold value for selecting the safety mode may, for example, be between 1000 revolutions per minute and 8000 revolutions per minute.
[0032] According to another embodiment, the electrical machine comprising phases, the parameter is the current in at least one of the phases of the electrical machine when the inverter operates in FW mode. The current threshold value in at least one of the phases of the electrical machine may be, for example, the current value from which uncontrolled regeneration of the battery may occur, or a zero value within a measurement uncertainty.
[0033] In this case, the method may comprise, when the ASC mode is selected, a predefined duration from the selection of the ASC mode followed by a switch to FW mode and the return to the step of determining the voltage on the high voltage bus. This predefined duration may for example be between 1 second and 30 seconds.
[0034] The invention also relates to a system which comprises an inverter and an electrical machine controlled by the inverter, the inverter comprising electronic switches, the system further comprising a direct current power supply bus called a high voltage bus. The system comprises a first control device such as a main microcontroller adapted to control the inverter in a nominal operating mode. The system also comprises a second control device adapted to control the inverter when the first control device is faulty. The second control device is adapted to be applied to the inverter a safety operating mode. The security mode is chosen from: - a safety operating mode called ASC mode in which certain electronic switches of the inverter are closed so as to short-circuit phases of the electrical machine; and - a safety operating mode called FW mode in which all the electronic switches of the inverter 4 are open, which puts the electrical machine into freewheel mode. In addition, the system comprises a device for determining the voltage on the high voltage bus and the second electronic control device is configured so that: - if the voltage on the high voltage bus (UHvdc) is lower than a first voltage threshold, FW mode is selected, - if the voltage on the high voltage bus is higher than a second voltage threshold which is higher than the first voltage threshold the ASC mode is selected, - if the voltage is between the first voltage threshold and the second voltage threshold inclusive, a parameter distinct from the voltage on the high-voltage bus and representative of the possibility of injecting energy by the electrical machine onto said high-voltage bus without risk is determined, an absence of risk being determined when the parameter is lower than a threshold value; and - if the parameter is greater than or equal to the threshold value, ASC mode is selected; - if the parameter is lower than the threshold value, FW mode is selected.
[0035] The second control device may consist of an electronic circuit without a microprocessor.
[0036] The invention finally relates to an electric vehicle or a hybrid electric vehicle which comprises a system as defined above.
[0037] The expression “hybrid electric vehicle” designates any vehicle which combines two traction modes, one of which uses an electric motor, typically a vehicle comprising a thermal engine and one (or more) electric motors. The invention relates in particular to motor vehicles.
[0038] Other features and advantages of the invention will become apparent in the description below.
[0039] In the attached drawings, given as non-limiting examples: - [Fig.l] schematically represents the general structure of an inverter control system, - [Fig.2] represents, according to a logic diagram, a method of controlling an inverter in accordance with a first embodiment of the invention, - [Fig.3] represents, according to a logic diagram, a process for controlling an inverter in accordance with a second embodiment of the invention.
[0040] [Fig. 1] schematically represents, by way of example, the general structure of a control system for an inverter 4, which controls an electrical machine 5 (in this case a traction machine of a motor vehicle). The control device comprises a first control device, namely a main microcontroller 1. The main microcontroller 1 is powered by a so-called low voltage LV power supply. The low voltage power supply is a direct current power supply, and generally comprises a battery, typically a 12V battery. When the inverter 4 is operating in nominal mode, that is to say when no event such as a failure requires operation according to a safety operating mode, the main microcontroller controls the inverter.
[0041] The control system further comprises a second control device 2. In the known state of the art, the second control device is generally a second microcontroller. As explained below, in the context of the present invention the second control device can be formed in a much simpler manner, in particular by an electronic card without a microcontroller, using only very simple logic circuits.
[0042] The second control device 2 is electrically powered by the low voltage LV power supply, or, if the latter is unavailable, by an auxiliary power supply 3.
[0043] The auxiliary power supply is itself provided with electricity by a high voltage HV power supply. The high voltage HV power supply may in particular comprise a traction battery of an electric vehicle, and may therefore have, in a non-limiting manner, a voltage of between 200V and 800V (corresponding to the nominal voltage of the battery or other source of electrical energy of the equipped vehicle).
[0044] The high voltage HT power supply also enables the power stage of the inverter 4 and ultimately of the electrical machine 5 to be powered, via a high voltage direct current bus (HVDC bus 6).
[0045] The main microcontroller and the second control device therefore collectively constitute a control system making it possible to apply, when necessary, a safety operating mode to the inverter (in particular the ASC mode or the FW mode described previously).
[0046] In practice, the second control device 2 is only used in the event of failure of the main microcontroller making it unable to control the inverter, according to a nominal mode or a safety mode.
[0047] This may occur for example when the low voltage power supply of said main microcontroller 1 is lost, or in the event of a software problem. This being the case, the presence of the second control device, which is redundant with respect to the micro- main processor, allows to cover any unforeseen failure of the latter.
[0048] [Fig.2] represents, according to a logic diagram, a method of controlling an inverter according to a first embodiment of the invention.
[0049] In a first step SI, it is detected that the first control device is faulty, so that correct control of the inverter can no longer be ensured by this first control device.
[0050] In a second step S2, the FW mode is applied by the second control device of the inverter. This is a temporary application. This prior switch to FW mode avoids the risk associated with a direct switch to ASC mode, in which the electronic switches of the power stage of the inverter located on the same side of the H-bridges formed in the inverter are closed. A direct switch from the nominal operating mode to the ASC mode could thus cause a situation known as cross conduction (more often referred to by the English term “cross conduction”) if one of the H-bridges on the opposite side is still closed (switch closed), and cause degradation of the inverter.
[0051] In the mode called “freewheeling”, the electronic switches are all in the open state, and therefore do not allow the passage of current.
[0052] It is therefore preferable to briefly apply the FW mode to the inverter before applying, if necessary, the ASC mode to it. This temporary default application of the FW mode can be carried out for a duration of between 1 ps and 10 ps, for example of the order of 3 ps. Once the desired duration has elapsed, it is then possible to switch (or not) to the ASC mode, depending on the conditions described below.
[0053] In a third step S3, the voltage on the UVDC bus UHvoc is compared to a first voltage threshold Uthi. UHvoc can be determined by measurement. Uthi is preferably a fixed, predetermined threshold, depending on the application considered.
[0054] If the voltage on the UVDC bus UHvdc is lower than (or equal to) the first voltage threshold Uthi, the FW mode is applied (step S4).
[0055] Indeed, by choosing a suitable first voltage threshold Uthi, it is possible to apply the FW mode without further consideration when necessary. Typically, if the first voltage threshold Uthi corresponds to the safety power supply undervoltage locking threshold (i.e. a predetermined minimum voltage which guarantees the correct operation of the second control device), the application of the FW mode makes it possible to maintain the HVDC bus at a sufficient voltage in order to power said second control device.
[0056] If the voltage on the UVDC bus Uhvdc is greater than the first voltage threshold Uth2, the voltage on the UVDC bus Uhvdc is then compared to a second voltage threshold Uth2, in a fifth step S5. The second voltage threshold Uth2 is greater than the first Uthi voltage threshold.
[0057] If the voltage on the UVDC bus UHvdc is greater than (or equal to) the second voltage threshold Uth2, the ASC mode is applied (sixth step S6).
[0058] By choosing a suitable second voltage threshold Uth2, overvoltage phenomena, in particular due to load dump, are avoided. Typically, if the second voltage threshold Uth2 corresponds to the maximum battery voltage (high voltage HV power source) in operation in UPS mode, it must necessarily be applied to avoid the risk of overvoltage phenomena occurring. In particular, the FW mode cannot in any case be applied without risk in this case.
[0059] If the voltage on the UVDC bus UHvdc is lower than the second voltage threshold Uth2 (which amounts to saying that UHvdc is between Uthi and Uth2), a parameter distinct from Uhvdc is then taken into account to determine the safety operating mode to be applied to the inverter.
[0060] In this case, the rotational speed N of the electrical machine is determined and used as a parameter. The rotational speed is for example determined using the signal from a position sensor fitted thereto. Alternatively, the rotational speed can be determined on the basis of the frequency of the current in the phases of the electrical machine.
[0061] The rotation speed N is compared to a rotation speed threshold value N*, in a seventh step S7.
[0062] The rotation speed threshold Nth may in particular correspond to the rotation speed of the electric machine from which a rectified counter electromotive force greater than the minimum voltage of the battery (voltage at its lowest acceptable state of charge) could occur, potentially leading to uncontrolled regeneration of the battery. The rotation speed threshold may be chosen to be lower than this rotation speed.
[0063] If the rotation speed N is greater than (or equal to) the rotation speed threshold value N*, the ASC mode is applied (eighth step S8). The ASC mode must be applied in this case to avoid any risk of excessive braking or overvoltage. The braking generated by the electric machine is in this case not excessive at this rotation speed.
[0064] If the rotation speed N is lower than the rotation speed threshold value N*, the FW mode is applied (ninth step S9).
[0065] The rotation speed threshold is preferably chosen as high as possible, within the limits explained above. Indeed, in this case the FW mode can be used with little or no risk of causing overheating of the electrical machine or the inverter, while significant braking which would not be acceptable at this low rotation speed of the machine (and therefore low speed of the equipped vehicle) is not generated by the FW mode.
[0066] Since the method described with reference to [Fig. 2] is based on very simple parameter comparisons, it can be applied using very simple electronic components. In particular, the use of a microprocessor, a CPLD or an FPGA is not necessary. As a result, the costs of design, manufacturing, integration, etc. of the second control device are very low. The redundancy of the inverter control function is thus obtained at a very low cost, while guaranteeing the desired functions and safety.
[0067] [Fig. 3] represents, according to a logic diagram, a method of controlling an inverter according to a second embodiment of the invention.
[0068] Steps S1 to S6 of the method of [Fig.3] are identical to those of the method described with reference to [Fig.2], and one can therefore refer to the description of [Fig.2] above for these steps.
[0069] If, at the end of the fifth step S5, it is determined that the voltage on the UVDC bus Uhvdc is lower than the second voltage threshold Uth2 (which amounts to saying that Uhvdc is between U*i and 11*2), just as in the method described with reference to [Fig. 3], a parameter distinct from Uhvdc is then taken into account to determine the safety operating mode to be applied to the inverter.
[0070] In this case, the current I in at least one phase of the electrical machine is determined and used as a parameter. It is important to note that this parameter is only relevant when the inverter is in FW mode (in ASC mode a phase current is necessarily generated, which would exceed the fixed threshold detailed below). To the extent that the inverter has been placed in FW mode in the second step S2 of the method, the first occurrence of the determination of the current I can be carried out without any additional special condition.
[0071] The phase current I can be determined using a suitable sensor.
[0072] The current I is then compared to a threshold value of current I*. The threshold value of Ith current can in particular correspond to a value from which uncontrolled regeneration of the battery can occur. The current threshold value can alternatively correspond to a zero value, within measurement uncertainties.
[0073] If the current I is lower than the current threshold value I*, the FW mode is applied (ninth step S9').
[0074] In the absence of phase current, the FW mode can in fact be used with little or no risk of causing overheating of the electrical machine or the inverter, while significant braking which would not be acceptable is not generated by the FW mode.
[0075] If the current I is greater than (or equal to) the current threshold I*, the ASC mode is applied (eighth step S8'). ASC mode must be applied, which avoids overvoltage phenomena while the braking generated by the electric machine is not excessive in this situation.
[0076] In this embodiment of the invention, once the ASC mode has been selected and applied, a predefined duration (for example a few seconds) is waited for to elapse in a tenth step S10.
[0077] The FW mode is then applied again (eleventh step SI 1).
[0078] The method then returns to the third step S3.
[0079] The transition to FW mode of the eleventh step SI 1 makes it possible to maximize the use of this safety mode, while making it possible to re-evaluate the low phase current condition to maintain FW mode, or if necessary return to ASC mode (and again attempt to return to FW mode after the predetermined time has elapsed).
[0080] Obviously, in any embodiment of the invention, if at any time the first control device is again capable of controlling the inverter, the second control device is deactivated and the first control device takes over control of the inverter.
[0081] The invention thus developed allows control of an inverter according to a safety mode in the event of failure of its main control device, in a simple manner and therefore at lower cost, while guaranteeing functional safety and limiting the risk of degradation for the system, in particular for the electrical machine, the inverter, and the battery which supplies them. The present invention is particularly relevant in the context of an electric (or hybrid) vehicle, in particular a motor vehicle.
[0082] .
Claims
Claims
1. Method for controlling an inverter (4) comprising electronic switches and controlling an electrical machine (5), the inverter (4) and the electrical machine (5) being powered by a direct current bus called a high voltage bus (6), said inverter (4) being controlled by a first control device (1) such as a main microcontroller in a nominal operating mode, said inverter being controlled by a second control device (2) when the first control device (1) is faulty, the second control device (2) being adapted to apply to the inverter (4) a safety operating mode, characterized in that the safety mode is chosen from: - a safety operating mode called ASC mode in which certain electronic switches of the inverter (4) are closed so as to short-circuit phases of the electrical machine (5); and - a safety operating mode called FW mode in which all the electronic switches of the inverter (4) are open, which puts the electrical machine (5) in freewheel mode, and in that the method comprises, for selecting the safety mode to be applied: determining the voltage on the high voltage bus (UHvdc), and - if the voltage on the high voltage bus (Uhvdc) is lower than a first voltage threshold (Uthi), the FW mode is selected (S4), - if the voltage on the high voltage bus (Uhvdc) is higher than a second voltage threshold (Uth2) which is higher than the first voltage threshold (Uthi), the ASC mode is selected (S6), - if the voltage is between the first voltage threshold (Uthi) and the second voltage threshold (Uth2) inclusive, a parameter distinct from the voltage on the high-voltage bus and representative of the possibility of injecting energy by the electrical machine onto said high-voltage bus without risk is determined, an absence of risk being determined when the parameter is lower than a threshold value; and - if the parameter is greater than or equal to the threshold value, the ASC mode is selected (S8, S8'); - if the parameter is lower than the threshold value, the FW mode is se- selected (S9, S9').
2. A control method according to claim 1, wherein, before the step of determining the voltage on the high voltage bus, the second control device applies the FW mode (S2) to the inverter.
3. A driving method according to claim 2, wherein the FW mode is applied for a duration of between 1 ps and 10 ps.
4. Method for controlling an inverter according to one of claims 1 to 3, in which the parameter is the rotation speed (N) of the electrical machine.
5. Method for controlling an inverter according to claim 4, in which, the high voltage bus (6) being linked to a battery, the rotation speed threshold value (N*) corresponds to the rotation speed of the electrical machine from which a rectified counter electromotive force greater than the minimum battery voltage is generated.
6. Method for controlling an inverter according to claim 4 or claim 5, in which the rotation speed threshold value (N*) for the selection of the safety mode is between 1000 revolutions per minute and 8000 revolutions per minute.
7. Method for controlling an inverter according to claim 2 or claim 3, in which, the electrical machine (5) comprising phases, the parameter is the current (I) in at least one of the phases of the electrical machine (5) when the inverter operates in FW mode.
8. Method for controlling an inverter according to claim 7, in which the current threshold value (Ith) in at least one of the phases of the electrical machine is the current value from which uncontrolled regeneration of the battery can occur, or a zero value within a measurement uncertainty.
9. A method of controlling an inverter according to claim 7 or claim 8, the method further comprising, when the ASC mode is selected, a predefined duration (S 10) passing from the selection of the ASC mode followed by a switch to FW mode (SI 1) and returning to the step of determining the voltage on the high voltage bus.
10. A method of controlling an inverter according to claim 9, wherein said predefined duration is between 1 second and 30 seconds.
11. System comprising an inverter and an electrical machine controlled by the inverter, the inverter (4) comprising electronic switches, the system further comprising a direct current power supply bus called a high voltage bus (6), the system comprising a first control device (1) such as a main microcontroller adapted to control the inverter (4) in a nominal operating mode; the system comprising a second control device (2) adapted to control the inverter (4) when the first control device (1) is faulty, the second control device (2) being adapted to apply a safety operating mode to the inverter, characterized in that the safety mode is chosen from: - a safety operating mode called ASC mode in which certain electronic switches of the inverter are closed so as to short-circuit phases of the electrical machine; and - a safety operating mode called FW mode in which all the electronic switches of the inverter (4) are open, which puts the electrical machine (5) into freewheel mode, and in that the system comprises a device for determining the voltage on the high voltage bus (Uhvdc) and the second electronic control device (2) is configured so that: - if the voltage on the high voltage bus (Uhvdc) is lower than a first voltage threshold (Uthi), the FW mode is selected (S4), - if the voltage on the high voltage bus (UHvdc) is higher than a second voltage threshold (Uth2) which is higher than the first voltage threshold (Uthi), the ASC mode is selected (S6), - if the voltage is between the first voltage threshold (Uthi) and the second voltage threshold (Uth2) inclusive, a parameter distinct from the voltage on the high-voltage bus and representative of the possibility of injecting energy by the electrical machine onto said high-voltage bus without risk is determined, an absence of risk being determined when the parameter is lower than a threshold value; and - if the parameter is greater than or equal to the threshold value, the ASC mode is selected (S8, S8'); - if the parameter is lower than the threshold value, FW mode is selected (S9, S9').
12. The system of claim 11, wherein the second control device consists of an electronic circuit without a microprocessor or programmable logic component.
13. An electric vehicle or hybrid electric vehicle comprising a system according to claim 11 or claim 12.