Safety device for semiconductor switches of an inverter output stage

Abstract

The invention relates to a safety device (1) for semiconductor switches (4a,5a,4b,5b,4c,5c) of an inverter output stage (2), comprising a plurality of half-bridges (3a,3b,3c), each of which has an HS semiconductor switch (4a,4b,4c) and an LS semiconductor switch (5a,5b,5c). A respective driver circuit (6a,7a,6b,7b,6c,7c) is provided for each semiconductor switch (4a,5a,4b,5b,4c,5c) of the inverter output stage (2), wherein each driver circuit (6a,7a,6b,7b,6c,7c) is configured as a driver circuit (6a,6b,6c) for a corresponding HS semiconductor switch (4a,4b,4c) or as a driver circuit (7a,7b,7c) for a corresponding LS semiconductor switch (5a,5b,5c), and each driver circuit (6a,7a,6b,7b,6c,7c) has a safety logic (10a,11a,10b,11b,10c,11c) which is designed so that after a safety state is activated, the safety logic actuates the corresponding semiconductor switch (4a,5a,4b,5b,4c,5c) according to a programmed safety configuration such that the inverter output stage (2) assumes the safety state.

Description

[0001] Description

[0002] title

[0003] Safety device for semiconductor switches of an inverter power stage

[0004] The invention relates to a safety device for semiconductor switches of an inverter output stage and a method for putting an inverter output stage into a safe state.

[0005] State of the art

[0006] Electric and hybrid vehicles often have power electronic circuit components in the drive system between the traction battery and the electric motor, which are typically designed as voltage source converters. A DC link serves as a coupling element between the traction battery and an inverter, which can be controlled to transfer electrical power from the DC link to the electric motor.

[0007] Inverters can have an inverter output stage, which can be designed as a full-bridge circuit with a number of bridge branches, each with two semiconductor switches. The semiconductor switches of the bridge branches connected to a first (positive) output terminal of the DC link are each referred to as high-side (HS) switches, and the semiconductor switches of the bridge branches connected to the second (negative) output terminal of the DC link are each referred to as low-side (LS) switches. Each semiconductor switch of the inverter output stage receives a driver signal from a driver circuit. The inverter output stage has at least one half-bridge, which comprises series-connected semiconductor switches with associated driver circuits. Typically, the inverter output stage has three half-bridges, each with two series-connected semiconductor switches.

[0008] A safe state or safe operating state is a static state of the power semiconductor switches within the inverter output stage (B6 bridge).

[0009] The safe state is requested via a HW signal independent of the pC-SW as soon as an error occurs, in particular if there is a failure of the supply voltage on the NV side (NV = low voltage) (detected by 5V monitoring), a failure of the processor or pC (watchdog) and / or a failure of the NV-HV communication (NV = low voltage / HV = high voltage).

[0010] The safe state of the inverter output stage can be achieved either by an AKS on all LS switches of the inverter output stage (i.e. all LS switches of the inverter output stage are permanently switched on) and simultaneously a freewheel on all HV switches of the inverter output stage (i.e. all HV switches of the inverter output stage are permanently switched off).

[0011] The safe state of the inverter output stage can also be achieved by an AKS on all HV switches of the inverter output stage (i.e. all HV switches of the inverter output stage are permanently switched on) and at the same time a freewheel on all LS switches of the inverter output stage (i.e. all LS switches are permanently switched off).

[0012] Furthermore, the safe state of the inverter output stage can be achieved when all switches (ie LS switch and HV switch) are in freewheeling or switched off.

[0013] An electrical load is connected to the output side of the inverter power stage. In many applications, this load is an electric motor, which requires a safe state of the inverter power stage according to its motor type or design. For a permanent magnet synchronous motor (PSM), the safe state is defined as the LS ASIC (the driver circuit of a LS switch) entering a voltage-dependent safe state (VDSS) and the HS ASIC (the driver circuit of a HS switch) setting the associated HS switch to freewheel mode, i.e., turning it off.

[0014] For an asynchronous motor (ASM), the safe state is defined in such a way that both the LS-ASIC (the driver circuit of an LS switch) and the HS-ASIC (the driver circuit of an HS switch) put the corresponding switch into freewheeling or switch it off.

[0015] In the voltage-dependent safe state VDSS (Voltage Dependent Safe State), the intermediate circuit voltage of the intermediate circuit is evaluated at the circuit breakers. If the intermediate circuit voltage Uzk is below a first lower limit or threshold, freewheeling is activated at all circuit breakers of the inverter output stage. However, if the intermediate circuit voltage Uzk is above a second upper limit or threshold, an AKS is activated at all circuit breakers of the inverter output stage. The hardware thresholds used to achieve the voltage-dependent safe state VDSS can only be changed by adjusting the circuit board configuration.

[0016] In conventional circuits, these states and monitoring functions are implemented by a discrete hardware circuit on the inverter output stage's circuit breakers with fixed thresholds. Providing the discrete hardware circuitry for implementing the various monitoring functions (5V monitoring / low-voltage-high-voltage monitoring) and the VDSS function is complex in terms of circuitry and requires a relatively large amount of layout space on a circuit board.

[0017] The high-voltage switches of the inverter output stage are indirectly triggered into freewheeling by switching off the high-voltage supply. However, this results in longer lead times for the reaction time to reach the safe state, since the supply to the high-voltage switches must first be switched off before the AKS can be set on the circuit breakers. This results in a poorly defined time dependency due to the ramp-down of the high-voltage supply.

[0018] Furthermore, the safety function is rigidly implemented through discrete hardware circuitry. In addition to the voltage-dependent safe state (VDSS), no other operating point-dependent functions, such as a speed-dependent safe state (SDSS), can be implemented. The evaluation circuit, which is provided for achieving the voltage-dependent safe state (VDSS), is only present once, thus eliminating redundancy in the system.

[0019] Disclosure of the invention

[0020] The present invention provides a safety device according to claim 1, a drive system according to claim 14 and a method according to claim 13.

[0021] Preferred further training is the subject of the subclaims.

[0022] According to a first aspect, the invention provides a safety device for semiconductor switches of an inverter output stage with a plurality of half-bridges, each of which has an HS semiconductor switch and an LS semiconductor switch, wherein a driver circuit is provided for each semiconductor switch of the inverter output stage, wherein the driver circuit is configured as a driver circuit for an associated HS semiconductor switch or as a driver circuit for an associated LS semiconductor switch, and wherein each driver circuit has a safety logic which is designed, after activation of a safe state, to control the associated semiconductor switch according to a programmed safety configuration such that the inverter output stage assumes the safe state.

[0023] According to a further aspect, the invention provides a method for putting an inverter output stage into a safe state, wherein the inverter output stage has a plurality of half-bridges, each comprising an HS semiconductor switch and an LS semiconductor switch, wherein a driver circuit is provided for each semiconductor switch of the inverter output stage, comprising the steps:

[0024] Configuring the driver circuits each as a driver circuit for an associated HS semiconductor switch or as a driver circuit for an associated LS semiconductor switch; and

[0025] Controlling the semiconductor switches of the inverter output stage by a safety logic of the associated driver circuits according to a programmed safety configuration such that the inverter output stage assumes the safe state.

[0026] According to a further aspect, the invention provides a drive system for an n-phase electrical machine, where n > 1, with an inverter output stage having at least one half-bridge comprising series-connected semiconductor switches with associated driver circuits, wherein the inverter output stage is supplied with electrical energy from an intermediate circuit capacitor of a high-voltage circuit and is designed to generate an n-phase supply voltage for the electrical machine, wherein the driver circuits are each configured as a driver circuit for an associated HV semiconductor switch or as a driver circuit for an associated LS semiconductor switch, and wherein the driver circuits each have a safety logic which is designed toAfter activation of a safe state for the inverter output stage, the associated semiconductor switch is controlled according to a programmed safety configuration in such a way that the inverter output stage of the drive system assumes the safe state.

[0027] Advantages

[0028] One idea of ​​the invention is to integrate the safety logic for achieving the safe state of the inverter output stage in the driver circuit, in particular on the HV side of a gate driver ASIC. The safety device according to the invention and the method according to the invention offer the advantage that the safe state of the inverter output stage can be set quickly and in a defined manner.

[0029] A further advantage is that additional operating point-dependent functions, such as a speed-dependent safe state (SDSS) or special customer requirements, can be easily implemented without any additional circuitry effort.

[0030] In addition, there is redundancy in the voltage-dependent safe state (VDSS), since each half-bridge of the inverter output stage operates independently.

[0031] A further advantage is that discrete hardware circuitry for the voltage-dependent safe state (VDSS), 5V monitoring, and low-voltage-voltage monitoring is eliminated. This reduces circuit complexity and saves space on the circuit board.

[0032] According to one embodiment of the safety device, each driver circuit has a programmable configuration stored in a configuration memory, which indicates whether the driver circuit is intended for an associated HS semiconductor switch or the driver circuit is intended for an associated LS semiconductor switch.

[0033] This allows the safety device to be flexibly adapted to different applications and fault situations.

[0034] According to one embodiment of the safety device, a switching configuration is stored in the configuration memory, which specifies the switching state to which the associated semiconductor switch within the inverter output stage must be placed by the associated driver circuit so that the inverter output stage assumes the safe state. According to one embodiment of the safety device, the switching state of the semiconductor switch comprises an on (ACS) switching state or a off (freewheeling) switching state.

[0035] According to one embodiment of the safety device, the safety logic of the driver circuit is designed to set the associated semiconductor switch into the switching state suitable for achieving the safe state of the inverter output stage in accordance with the switching configuration stored in the configuration memory as soon as the safety logic receives an activation signal for activating the safe state.

[0036] This allows the safety device to react quickly if an error occurs.

[0037] According to one embodiment of the safety device, the safety logic of the driver circuit receives the activation signal for activating the safe state via an interface from a processor of the safety device.

[0038] This offers the advantage that the processor can monitor and pre-process various received digital signals within the system in order to generate an activation signal when required.

[0039] According to one embodiment of the safety device, the safety logic of the driver circuit receives the activation signal for activating the safe state from a monitoring circuit integrated in the driver circuit.

[0040] This offers the advantage that the monitoring circuit, as a hardware circuit, can monitor certain signals or operating states and, upon the occurrence of certain operating states, can generate an activation signal with a short response time. This applies both to an activation signal from outside (e.g., pC) and to an activation signal from internal VDD5 monitoring (5V monitoring). According to one embodiment of the safety device, each driver circuit has a low-voltage circuit, a high-voltage circuit, and an isolation barrier between the low-voltage circuit and the high-voltage circuit of the respective driver circuit, which provides galvanic isolation between the low-voltage circuit and the high-voltage circuit of the respective driver circuit.

[0041] Galvanic isolation protects the components on the low-voltage side from the high electrical voltage present on the high-voltage side.

[0042] According to one embodiment of the safety device, the low-voltage circuit of the driver circuit has a communication interface to the processor of the safety device and / or a low-voltage monitoring unit.

[0043] This allows operating states and other information to be communicated quickly and efficiently in order to ensure a rapid and reliable response to possible fault conditions and to put the inverter output stage into a suitable switching state to achieve the safe state.

[0044] According to one embodiment of the safety device, the high-voltage circuit of the driver circuit has a finite state machine (FSM) of the safety logic integrated in the driver circuit for controlling the associated semiconductor switch.

[0045] By monitoring the HV side of its own LV side, each switch of the B6 bridge of the inverter output stage can assume its defined safe state. This allows the safe state to be established in the event of a failure on the LV side. This is also possible thanks to the existing galvanic isolation. This offers the advantage that state transitions occur reliably, robustly, and in a defined manner.

[0046] Further features and advantages of embodiments of the invention will become apparent from the following description with reference to the accompanying drawings.

[0047] Short description of the drawings

[0048] The present invention is explained in more detail below with reference to the exemplary embodiments shown in the schematic figures of the drawing.

[0049] They show:

[0050] Fig. 1 is a block diagram schematically illustrating a possible embodiment of a safety device according to the invention;

[0051] Fig.2 is a flowchart of a possible embodiment of the method according to the invention;

[0052] Fig.3 is a block diagram showing a possible implementation of the safety device according to the invention;

[0053] Fig.4 Time signals to explain the operation of the safety device according to the invention.

[0054] In the figures, the same reference symbols denote the same or functionally identical elements,

[0055] According to a first aspect, the invention provides a safety device 1, as shown schematically in a block diagram in Fig. 1. An inverter output stage 2 comprises several half-bridges 3a, 3b, 3c, each of which has a high-voltage semiconductor switch 4a, 4b, 4c and a short-circuit semiconductor switch 5a, 5b, 5c connected in series therewith. A corresponding driver circuit 6a, 7a, 6b, 7b, 6c, 7c is provided for each of the various semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c of the inverter output stage 2.

[0056] The inverter output stage 2 preferably forms part of an inverter. The inverter output stage 2 has at least one half-bridge comprising two series-connected semiconductor switches with associated driver circuits. As shown in Fig. 1, the inverter output stage 2 in one possible embodiment comprises three half-bridges 3a, 3b, 3c, with each half-bridge of the inverter output stage 2 comprising two series-connected semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c. The number of half-bridges can vary in different embodiments.

[0057] In one possible embodiment, the semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c are formed by transistors, in particular field-effect transistors, or IGBTs. In one possible embodiment, the semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c are each IGBTs (Insulated Gate Bipolar Transistors). However, it is also possible to provide other semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c in a corresponding form, for example in the form of JFETs (Junction Field-Effect Transistors) or MOSFETs (Metal Oxide Semiconductor Field-Effect Transistors), in particular also SiC power transistors.

[0058] The half-bridges 3a, 3b, 3c of the inverter output stage 2 are connected in parallel between a positive terminal T+ and a negative terminal T- of a high-voltage circuit, in particular an intermediate circuit. High-voltage semiconductor switches 4a, 4b, 4c are connected to the positive terminal T+, and the low-voltage semiconductor switches 5a, 5b, 5c are connected to the negative terminal T- of the high-voltage circuit. In a preferred embodiment, the high-voltage circuit is an intermediate circuit with an intermediate circuit voltage Uzk.

[0059] The driver circuit 6a, 7a, 6b, 7b, 6c, 7c of a semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c can be configured either as a driver circuit 6a, 6b, 6c for an associated HS semiconductor switch 4a, 4b, 4c or as a driver circuit 7a, 7b, 7c for an associated LS semiconductor switch 5a, 5b, 5c. Each driver circuit 6a, 7a, 6b, 7b, 6c, 7c has a safety logic 10a, 11a, 10b, 11b, 10c, 11c integrated therein, which is designed, after activation of a safe state, to control the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c according to a programmed safety configuration such that the inverter output stage 2 assumes the safe state.

[0060] According to a preferred embodiment of the safety device 1, each driver circuit 6a, 7a, 6b, 7b, 6c, 7c has a programmable configuration stored in a configuration memory 29a, 30a, 29b, 30b, 29c, 30c, which indicates whether the respective driver circuit 6a, 7a, 6b, 7b, 6c, 7c is provided or functions as a driver circuit 6a, 6b, 6c for an associated HS semiconductor switch 4a, 4b, 4c or whether the respective driver circuit 6a, 7a, 6b, 7b, 6c, 7c is provided or functions as a driver circuit 7a, 7b, 7c for an associated LS semiconductor switch 5a, 5b, 5c.

[0061] In one embodiment of the safety device 1, a switching configuration is stored in the configuration memory 29a, 30a, 29b, 30b, 29c, 30c of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c, which switching configuration indicates the switching state to which the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c within the inverter output stage 2 is to be placed by the safety logic 10a, 11a, 10b, 11b, 10c, 11c of the associated driver circuit 6a, 7a, 6b, 7b, 6c, 7c, so that the inverter output stage 2 assumes the safe state. The switching state of the semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c has an on AKS switching state or an off freewheeling switching state.

[0062] In one embodiment of the safety device 1, the safety logic 10a, 11a, 10b, 11b, 10c, 11c of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c is designed to set the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c into the switching state suitable for achieving the safe state of the inverter output stage 2 in accordance with the switching configuration stored in the configuration memory 29a, 30a, 29b, 30b, 29c, 30c, as soon as ... Receives activation signal to activate the safe state.

[0063] In one embodiment of the safety device 1, the safety logic 10a, 11a, 10b, 11b, 10c, 11c of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c receives the activation signal for activating the safe state via an interface from a processor 12 of the safety device 1. In an alternative embodiment of the safety device 1, the safety logic 10a, 11a, 10b, 11b, 10c, 11c of the driver circuit

[0064] 6a, 7a, 6b, 7b, 6c, 7c the activation signal for activating the safe state of a monitoring circuit integrated in the driver circuit 6a, 7a, 6b, 7b, 6c, 7c, which can monitor one or more operating parameters.

[0065] The control of the semiconductor switches 4a, 5a, 4b, 5b, 4c, 5 to achieve the safe state by the gate driver ASICs or the driver circuits 6a, 7a, 6b, 7b, 6c, 7c and the HV-NV monitoring (NV = low voltage / HV = high voltage) are implemented in the safety logic or the safety logic 10a, 11a, 10b, 11b, 10c, 11c of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c.

[0066] The B6 bridge switches (high-side => HS and low-side => LS) of the inverter output stage 2 are controlled by the respective gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c.

[0067] As can be seen in Fig.3, each gate driver ASIC or each driver circuit 6a, 7a, 6b, 7b, 6c, 7c has three circuit parts, namely a low voltage circuit (NV side), a high voltage circuit (HV side) and an isolation barrier IB in between.

[0068] The isolation barrier IB provides galvanic isolation between the low-voltage circuit and the high-voltage circuit of the respective driver circuit 6a, 7a, 6b, 7b, 6c, 7c.

[0069] The low-voltage circuit or NV side of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c preferably has a UART communication interface 14, 15 to the processor 12 of the safety device 1 for information or data transmission. The data received by the processor 12 can be buffered in a register R-NV on the NV side, which is connected to a register R-HV on the HV side, as shown in Fig. 3. Furthermore, the low-voltage circuit of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c can contain a low-voltage monitoring unit NÜE (e.g., for 5V monitoring).

[0070] The high-voltage circuit or the HV side of the driver circuit

[0071] 6a, 7a, 6b, 7b, 6c, 7c preferably includes a finite state machine (FSM) of the safety logic (SL) 10a, 11a, 10b, 11b, 10c, 11c integrated in the driver circuit 6a, 7a, 6b, 7b, 6c, 7c, which is provided for controlling the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c. The high-voltage circuit of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c performs the normal control of the power semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c (for example, SiC MOSFETs or IGBTs) and has a booster, as shown in Fig. 3.

[0072] The implementation of the NV-HV monitoring (NVHV) preferably takes place on the HV side of the gate driver ASICs 6a, 7a, 6b, 7b, 6c, 7c. The implementation of a 5V monitoring (NÜE) preferably takes place on the NV side of the gate driver ASICs 6a, 7a, 6b, 7b, 6c, 7c. The NV side also contains a gate driver logic (GTR), which is connected to the PWM interface 16, 17 and controls the booster on the HV side. The gate driver logic (GTR) forms part of a primary switching path for switching the associated power semiconductor switch 4, 5.

[0073] An intermediate circuit voltage detection 31 a, 31 b, 31 c for the LS gate driver ASICs 7a, 7b, 7c is used to implement the voltage-dependent safe state (VDSS) and detects the intermediate circuit voltage Uzk of the intermediate circuit between its terminals T+, T-, as shown in Fig.1 and Fig.3.

[0074] The configuration of the required switching states of the semiconductor switches

[0075] 4a, 5a, 4b, 5b, 4c, 5c for achieving the safe state of inverter output stage 2, including the voltage-dependent safe state (VDSS), is programmable in the respective OTP configuration memory 29a, 30a, 29b, 30b, 29c, 30c. The OTP configuration memories 29a, 30a, 29b, 30b, 29c, 30c are preferably located on the HV side of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c.

[0076] In one possible embodiment, the safe state is triggered by the external hardware signal "NABE" 32 or by an internal NV-HV monitoring unit contained in the ASIC. NABE is a digital bidirectional pin on the NV side of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c. The trigger signal is generated by the NV-PC or processor 12 or by a watchdog of an NV voltage regulator and applied to the NABE pin on the NV side of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c.

[0077] The 5V monitoring by the low-voltage monitoring unit (NÜE) can be integrated into the gate driver AS IC or the driver circuit 6a, 7a, 6b, 7b, 6c, 7c. Each gate driver AS IC 6a, 7a, 6b, 7b, 6c, 7c preferably monitors the functionality of its own NV side (NV-HV monitoring) on ​​its HV side using an NVHV unit shown in Fig. 3. The driver circuit 6a, 7a, 6b, 7b, 6c, 7c also contains an error logic (EL). In one possible implementation, the low-voltage monitoring unit (NÜE) activates the bidirectional NABE signal, i.e., the gate driver ASIC sets NABE active.

[0078] Other monitoring circuits can also activate the NABE and request a safe state. For example, the CY329 (Stabi) monitors the PC or processor and can activate the NABE signal in the event of a PC error.

[0079] The safe state has the highest priority in the gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c and must first be acknowledged by the processor 12 via a special UART command to exit.

[0080] The gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c is informed via the OTP configuration which safe switching state (VDSS or freewheel) should be set by it when the safe state of the inverter output stage 2 is activated at the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c.

[0081] LS Gate Driver ASIC:

[0082] With a permanent magnet synchronous motor (PSM) as the load of the inverter output stage 2, with an LS gate driver ASIC 7a, 7b, 7c, the state required to achieve the safe state is the voltage-dependent safe state (VDSS), whereby the LS gate driver ASIC 7a, 7b, 7c independently switches the switching state of the associated semiconductor switch 5a, 5b, 5c between AKS switching state and freewheeling switching state depending on the detected intermediate circuit voltage Uzk.

[0083] With an asynchronous motor (ASM) as the load of the inverter output stage 2, with an LS gate driver ASIC 7a, 7b, 7c, the state required to achieve the safe state is the freewheeling of the associated semiconductor switch 5a, 5b, 5c.

[0084] HS-Gate Driver ASIC:

[0085] Both in the case of a permanent magnet synchronous motor (PSM) and an asynchronous motor (ASM) as the load of the inverter output stage 2, the safe switching state to be assumed by the associated semiconductor switch 4a, 4b, 4c in the case of an HS gate driver ASIC 6a, 6b, 6c is always the freewheeling of the associated semiconductor switch 4a, 4b, 4c.

[0086] The OTP configuration data is programmed at the inverter level via the UART communication interface 14, 15 in the inverter factory at the end of the line. This allows the gate driver ASIC or driver circuit 6a, 7a, 6b, 7b, 6c, 7c to control the safe switching state of the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c independently of the processor 12.

[0087] In a possible implementation, the programming of the OTP configuration data determines whether the gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c forms an HS gate driver ASIC 6a, 6b, 6c or an LS gate driver ASIC 7a, 7b, 7c.

[0088] Furthermore, the programming of the OTP configuration data determines the required safe switching state of the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c, which the gate driver ASIC has to set or control on the semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c using a driver signal TS so that the safe state of the inverter output stage 2 can be achieved.

[0089] Furthermore, by programming the OTP configuration data, a switch-on and switch-off current profile can be defined for the transition to the safe switching state of the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c.

[0090] Furthermore, voltage thresholds or threshold values ​​for the voltage-dependent safe state (VDSS) can be defined by programming the OTP configuration data.

[0091] Furthermore, by programming the OTP configuration data, expiration times for the safe state for the Finite State Machine (FSM) can be defined.

[0092] The defined transition from the AKS switching state to the freewheeling switching state at an HV switch 4a, 4b, 4c, or from the freewheeling switching state to the AKS switching state at an LS switch 5a, 5b, 5c, is preferably controlled by a programmable time in the gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c. This ensures that a half-bridge short circuit does not occur in a half-bridge 3a, 3b, 3c of the inverter output stage 2 during the transition to the safe state.

[0093] The intermediate circuit voltage Uzk is detected on the high-voltage side of an LS gate driver ASIC 7a, 7b, 7c. This allows the voltage-dependent safe state (VDSS) to be controlled by the internal safety logic (SL) 10a, 11a, 10b, 11b, 10c, 11c. The voltage thresholds VDSS_H and VDSS_L for the VDSS are stored in the OTP configuration memory 29a, 30a, 29b, 30b, 29c, 30c of the gate driver ASICs 6a, 7a, 6b, 7b, 6c, 7c.

[0094] When the lower threshold VDSS_L is undershot, the gate driver signal for the semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c changes from AKS to the freewheeling switching state FW (freewheeling), while when the upper threshold VDSS_H is exceeded, the gate driver signal for the semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c changes from the freewheeling switching state to the AKS switching state, as shown in Fig.4.

[0095] The safety device 1 has at least one processor 12, which is connected via an interface to the associated driver circuits

[0096] 6a, 7a, 6b, 7b, 6c, 7c of the inverter output stage 2. The processor 12 can adjust the parameters for the voltage-dependent safe state (VDSS) via the communication interface 14, 15 (UART).

[0097] Each of the six semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c of a three-phase inverter output stage 2 has a control input 8a, 9a, 8b, 9b, 8c, 9c, which is designed to receive a driver signal TS from the associated driver circuit 6a, 7a, 6b, 7b, 6c, 7c of the inverter output stage 2.

[0098] In one embodiment of the control device 1, each half-bridge 3a, 3b, 3c of the inverter output stage 2 has two semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c connected in series with one another, which are designed to supply a sinusoidal phase current Ipha for an electrical load connected thereto at a connection node 13a, 13b, 13c during normal operation of the inverter output stage 2, as shown in Fig.1.

[0099] The connection nodes 13a, 13b, 13c are connected via lines 21a, 21b, 21c to output terminals 22a, 22b, 22c of the inverter output stage 2, as shown in Fig. 1. The connected electrical load may comprise an inductive load, in particular a winding of an electric motor. The electric motor comprises, for example, a three-phase permanent magnet synchronous motor (PSM) or a three-phase asynchronous motor (ASM). The communication interface 14, 15 is formed by a UART interface in one possible embodiment. Other embodiments may also comprise other forms of communication interface. The driver circuits 6a, 7a, 6b, 7b, 6c, 7c may be formed by ASICs in one possible implementation.

[0100] The control of switching to the safe state is integrated in the gate driver ASICs 6a, 7a, 6b, 7b, 6c, 7c, ie the AKS or the freewheel is actively provided by the respective gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c, independently of the supply voltage.

[0101] The safe state is activated via a HW input signal (NABE) 32 on the NV (low voltage) side on the gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c or by an NV-HV monitoring unit NVHV (NV = low voltage / HV = high voltage) integrated in the gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c.

[0102] The gate driver ASICs 6a, 7a, 6b, 7b, 6c, 7c are informed via an OTP (One Time Programmable) configuration which function the respective gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c has in the B6 bridge of inverter output stage 2. This function can be "LS gate driver" or "HS gate driver."

[0103] The gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c is also informed by an OTP configuration which switching state (AKS or freewheel) is to be set on the associated semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c after activation of the safe state by an activation signal from the respective gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c.

[0104] The defined transition from AKS to freewheeling at the high-voltage switch 4a, 4b, 4c or from freewheeling to AKS at the low-voltage switch 5a, 5b, 5c is preferably controlled by a programmable time in the gate driver ASIC 6a, 7a, 6b, 7b, 6c, 7c. This ensures that a half-bridge short circuit does not occur in one of the half-bridges 3a, 3b, 3c during a transition to the safe state.

[0105] At the LS gate driver ASIC 7a, 7b, 7c, the intermediate circuit voltage Uzk on the HV side is detected, for example, by means of an associated HV voltage detection unit 31a, 31b, 31c. This allows the voltage-dependent safe state VDSS to be controlled by the internal safety logic (SL) 10a, 11a, 10b, 11b, 10c, 11c of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c. The voltage thresholds are stored in the OTP configuration memory 29a, 30a, 29b, 30b, 29c, 30c of the driver circuit 6a, 7a, 6b, 7b, 6c, 7c. The voltage thresholds or threshold values ​​can be changed by means of data transmission by the processor 12 during active operation.

[0106] Fig. 2 shows a simple flow chart illustrating a possible embodiment of the method according to the invention for putting an inverter output stage 2 into a safe state.

[0107] The inverter output stage 2 comprises a plurality of half-bridges 3a, 3b, 3c, each having an HS semiconductor switch 4a, 4b, 4c and an LS semiconductor switch 5a, 5b, 5c, wherein a driver circuit 6a, 7a, 6b, 7b, 6c, 7c is provided for each semiconductor switch 4a, 5a, 4b, 5b, 4c, 5c of the inverter output stage 2.

[0108] The process shown in Fig. 2 essentially comprises two main steps.

[0109] In a first step S1, the driver circuits 6a, 7a, 6b, 7b, 6c, 7c are each configured as a driver circuit 6a, 6b, 6c for an associated HS semiconductor switch 4a, 4b, 4c or as a driver circuit 7a, 7b, 7c for an associated LS semiconductor switch 5a, 5b, 5c.

[0110] In a second step S2, the semiconductor switches 4a, 5a, 4b, 5b, 4c, 5c of the inverter output stage 2 are each controlled by a safety logic 10a, 11a, 10b, 11b, 10c, 11c of the associated driver circuits 6a, 7a, 6b, 7b, 6c, 7c according to a programmed safety configuration such that the inverter output stage 2 assumes the safe state.

[0111] 5

Claims

Patent claims:

1. Safety device (1) for semiconductor switches (4a, 5a, 4b, 5b, 4c, 5c) of an inverter output stage (2) with several half-bridges (3a, 3b, 3c), each having an HS semiconductor switch (4a, 4b, 4c) and an LS semiconductor switch (5a, 5b, 5c), wherein for each semiconductor switch (4a, 5a, 4b, 5b, 4c, 5c) of the inverter output stage (2) a driver circuit (6a, 7a, 6b, 7b, 6c, 7c) is provided, wherein the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) is each used as a driver circuit (6a, 6b, 6c) for an associated HS semiconductor switch (4a, 4b, 4c) or as a driver circuit (7a, 7b, 7c) is configured for an associated LS semiconductor switch (5a, 5b, 5c), and wherein each driver circuit (6a, 7a, 6b, 7b, 6c, 7c) has a safety logic (10a, 11a, 10b, 11b, 10c, 11c) which is designed to, after activation of a safe state, switch off the associated semiconductor switch (4a, 5a, 4b, 5b, 4c,5c) according to a programmed safety configuration in such a way that the inverter output stage (2) assumes the safe state., 2. Safety device according to claim 1, wherein each driver circuit (6a, 7a, 6b, 7b, 6c, 7c) has a configuration memory (29a, 30a, 29b, 30b, 29c, 30c) has a stored programmable configuration which indicates whether the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) is provided as a driver circuit (6a, 6b, 6c) for an associated HS semiconductor switch (4a, 4b, 4c) or whether the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) is provided as a driver circuit (7a, 7b, 7c) for an associated LS semiconductor switch (5a, 5b, 5c).

3. Safety device according to claim 2, wherein a switching configuration is stored in the configuration memory (29a, 30a, 29b, 30b, 29c, 30c), which indicates the switching state to which the associated semiconductor switch (4a, 5a, 4b, 5b, 4c, 5c) within the inverter output stage (2) is to be placed by the associated driver circuit (6a, 7a, 6b, 7b, 6c, 7c) so that the inverter output stage (2) assumes the safe state.

4. Safety device according to claim 3, wherein the switching state of the semiconductor switch (4a, 5a, 4b, 5b, 4c, 5c) has an on AKS switching state or a off freewheeling switching state.

5. Safety device according to one of the preceding claims 1 to 4, wherein the safety logic (10a, 11a, 10b, 11b, 10c, 11c) of the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) is designed to switch the associated semiconductor switch (4a, 5a, 4b, 5b, 4c, 5c) on or off according to the configuration stored in the configuration memory (29a, 30a, 29b, 30b, 29c, 30c) stored switching configuration into the switching state suitable for achieving the safe state of the inverter output stage (2) as soon as the safety logic (10a,11 a,10b,11 b,10c,11 c) receives an activation signal to activate the safe state.

6. Safety device according to claim 5, wherein the safety logic (10a, 11a, 10b, 11b, 10c, 11c) of the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) receives the activation signal for activating the safe state via an interface from a processor (12) of the safety device (1).

7. Safety device according to claim 5, wherein the safety logic (10a, 11a, 10b, 11b, 10c, 11c) of the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) receives the activation signal for activating the safe state from a monitoring circuit integrated in the driver circuit (6a, 7a, 6b, 7b, 6c, 7c).

8. Safety device according to one of the preceding claims 1 to 7, wherein each driver circuit (6a, 7a, 6b, 7b, 6c, 7c) has a low-voltage circuit, a high-voltage circuit and an isolation barrier (IB) between the low-voltage circuit and the high-voltage circuit of the respective driver circuit (6a, 7a, 6b, 7b, 6c, 7c), which provides galvanic isolation between the low-voltage circuit and the high-voltage circuit of the respective driver circuit (6a, 7a, 6b, 7b, 6c, 7c).

9. Safety device according to claim 8, wherein an HV-NV monitoring unit is provided in the high-voltage circuit of the respective driver circuit (6a, 7a, 6b, 7b, 6c, 7c) 10. Safety device according to claim 8 or 9, wherein the low-voltage circuit of the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) has a communication interface to the processor (12) of the safety device (1) and / or a low-voltage monitoring unit (NÜE).

11. Safety device according to claim 9, wherein the high-voltage circuit of the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) is a finite state machine (FSM) of the safety logic integrated in the driver circuit (6a, 7a, 6b, 7b, 6c, 7c) (10a,11a,10b,11b,10c,11c) for controlling the associated semiconductor switch (4a, 5a, 4b, 5b, 4c, 5c).

12. A method for putting an inverter output stage (2) into a safe state, wherein the inverter output stage (2) has a plurality of half-bridges (3a, 3b, 3c), each comprising an HS semiconductor switch (4a, 4b, 4c) and an LS semiconductor switch (5a, 5b, 5c), wherein a driver circuit (6a, 7a, 6b, 7b, 6c, 7c) is provided for each semiconductor switch (4a, 5a, 4b, 5b, 4c, 5c) of the inverter output stage (2), comprising the steps: Configuring (S1) the driver circuits (6a, 7a, 6b, 7b, 6c, 7c) each as a driver circuit (6a, 6b, 6c) for an associated HS semiconductor switch (4a, 4b, 4c) or as a driver circuit (7a, 7b, 7c) for an associated LS semiconductor switch (5a, 5b, 5c); and Controlling (S2) the semiconductor switches (4a, 5a, 4b, 5b, 4c, 5c) of the inverter output stage (2) by a safety logic (10a, 11a, 10b, 11b, 10c, 11c) of the associated driver circuits (6a, 7a, 6b, 7b, 6c, 7c) in accordance with a programmed safety configuration such that the inverter output stage (2) assumes the safe state.

13. Drive system for an n-phase electrical machine, where n > 1, with an inverter output stage (2) which has at least one half-bridge (3a, 3b, 3c) which has series-connected semiconductor switches (4a, 5a, 4b, 5b, 4c, 5c) with associated driver circuits (6a, 7a, 6b, 7b, 6c, 7c), wherein the inverter output stage (2) is supplied with electrical energy from an intermediate circuit capacitor of a high-voltage circuit and is designed to generate an n-phase supply voltage for the electrical machine, wherein the driver circuits (6a, 7a, 6b, 7b, 6c, 7c) are each configured as a driver circuit (6a, 6b, 6c) for an associated HS semiconductor switch (4a, 4b, 4c) or as a driver circuit (7a, 7b, 7c) for an associated LS semiconductor switch (5a, 5b, 5c), and wherein the driver circuits (6a, 7a, 6b, 7b, 6c, 7c) each have a safety logic (10a, 11a, 10b, 11b, 10c, 11c) which is designed, after activation of a safe state for the inverter output stage (2), to control the associated semiconductor switch (4a, 5a, 4b, 5b, 4c, 5c) in accordance with a programmed safety configuration,that the inverter output stage (2) of the drive system assumes the safe state.,

Images