Rotor Winding Drive Circuit With Redundant Safe-State Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing drive devices for electric machines struggle to ensure a safe state in the event of faults such as highside switch continuous ON, lowside switch interruption, de-energizing switch continuous ON, discharge resistor short circuit or non-conduction, undetected faults, internal faults in drive circuits, faults in MCU communication, and latent faults affecting passive voltage limiting.
Innovation Solution
The implementation of redundant switches, diodes, and safety interrogation circuits within the drive device. Specifically, additional highside and de-energizing switches are connected in series, with diodes like TVS or Zener diodes connected in parallel to ensure de-excitation even if primary components fail. Additionally, multiple safety interrogation circuits and overvoltage measuring devices are used to independently detect faults and initiate a safe state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If redundant switches and diodes are added to ensure safe state entry, then system reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements redundant highside and de-energizing switches along with TVS or Zener diodes connected in parallel before faults occur. These components act as pre-positioned safety mechanisms that automatically activate when primary components fail, ensuring the system can enter a safe state without requiring complex real-time decision-making or additional control logic.
Solution Approach 2:
The patent applies redundancy selectively to specific critical components (highside switches and de-energizing switches) rather than uniformly across the entire system. The TVS or Zener diodes are placed locally in parallel with specific switches to provide targeted protection against voltage spikes and component failures, optimizing the balance between reliability and complexity.
2Reliability
If multiple safety interrogation circuits and overvoltage measuring devices are implemented, then fault detection capability is improved, but device complexity increases
Solution Approach 1:
The patent divides the safety monitoring function into multiple independent safety interrogation circuits, each capable of detecting faults and initiating safe state entry. This segmentation allows each circuit to operate independently with simpler logic, while collectively providing comprehensive fault detection coverage across different failure modes.
Solution Approach 2:
The safety interrogation circuits are designed to handle multiple fault detection functions universally, including detecting faults in switches, diodes, and other components. This multi-functionality reduces the need for separate specialized detection circuits for each component type, thereby managing complexity while maintaining comprehensive monitoring capability.
3Reliability
If redundant components are added to protect against component failures, then system safety is improved, but manufacturing cost increases
Solution Approach 1:
The patent employs TVS (Transient Voltage Suppression) diodes and Zener diodes as sacrificial protection components. These diodes are designed to fail safely by clamping voltage spikes and protecting more expensive critical components like the main switches and control electronics. Their lower cost and simpler failure mode make them economically viable for redundancy applications.
Data Source
AI summary
A drive device for operating an electrical machine has a regulator for driving a rotor winding, which has a highside switch and a de-energization switch. A first terminal of the rotor winding can be connected to a positive supply terminal via the high-side switch, the first terminal of the rotor winding can be connected to a negative supply terminal via a semiconductor component, and a second terminal of the rotor winding can be connected to the negative supply terminal via the de-energization switch. The drive device is arranged to enter a safe state in the presence of at least one fault by disconnecting and/or de-energizing the rotor winding from the positive supply terminal. At least one of the switches is designed to be redundant; and/or the regulator has a plurality of measuring points.