Summary of the invention
The object of the present invention is to provide a kind of security monitoring circuit and control method thereof of vehicle motor controller, realize the chip-scale monitoring between two chips by SPI communication, by ADC and the existing monitoring to the analog-and digital-amount of key of I/O cause for gossip of chip self; Once find electric machine controller operation irregularity switch-off power switch at once, avoid the damage of device or the generation of accident, the circuit of invention can also be avoided the straight-through generation of the upper and lower bridge of power switch in addition.On the basis of original electric machine control system, propose a kind of security monitoring circuit of vehicle motor controller, filled up the white space of conventional vehicle motor controller security monitoring with this, improved the safety by bus of new-energy automobile.Concrete technical scheme is as follows:
A security monitoring circuit for vehicle motor controller, further, comprises chip power supply circuit, chip monitoring circuit, fault diagnosis circuit, wherein,
Described chip power supply circuit comprises main control chip power circuit and monitoring chip power circuit, main control chip power circuit is for converting supply voltage to main control chip needed voltage, and monitoring chip power circuit is for converting supply voltage to monitoring chip needed voltage;
Described chip monitoring circuit comprises main control chip and monitoring chip, and main control chip is mainly responsible for controlling motor rotation, and monitoring chip is for monitoring the running status of main control chip;
Described fault diagnosis circuit comprises electric machine phase current over-current detection circuit, power switch excess temperature testing circuit, bus overvoltage testing circuit, IGBT enable signal a, IGBT enable signal b and power bridge enable signal, when power switch excess temperature testing circuit, bus overvoltage testing circuit, IGBT enable signal a and IGBT enable signal b are high level, power bridge enable signal corresponds to high level, when power switch excess temperature testing circuit, and/or, bus overvoltage testing circuit, and/or, when IGBT enable signal a and/or IGBT enable signal b are low level, power bridge enable signal is correspondingly low level.
Further, also comprise PWM interlock circuit, described PWM interlock circuit is for obtaining pwm signal and the power bridge enable signal of upper and lower bridge, and output power bridge drives signal H and power bridge to drive signal L to open and close power bridge switching tube.
Further, chip power supply circuit also comprises switching device, and whether it powers on for controlling controller; Described power supply is accumulator, and its amount voltage is 12V, for providing supply voltage to main control chip and monitoring chip.
Further, described voltage comprises the needed analog voltage of main control chip, digital voltage, reference voltage and core voltage, the supply voltage that monitoring chip is required and reference voltage.
Further, main control chip power circuit is for converting battery tension to main control chip needed voltage, and described monitoring chip power circuit, for monitoring chip provides power supply and reference voltage, connects by SPI communication between main control chip and monitoring chip.
Further, described running status comprises the running status of the interior peripheral hardware of the sheet in main control chip and storer, the working condition of power supply.
Further, monitoring chip has ADC sampling module, and for monitoring the working condition of power supply of main control chip, main control chip has ADC sampling module, for gathering simulating signal and controlling motor rotation, and the power supply of supervision monitoring chip.
Further, main control chip has GPIO, and the digital signal of overcurrent by GPIO monitor for faults diagnostic circuit, excess temperature, overvoltage.Power switch pipe, its control end receives by PWM interlock circuit the PWM drive control signal that main control chip sends, and can open or turn-off according to the low and high level state of PWM interlock circuit output, PWM interlock circuit has three-phase, provides three-phase 6 road pwm signals.
The control method of the security monitoring circuit of above-mentioned vehicle motor controller, comprises the steps:
(1) controller powers on;
(2) supply voltage converts the needed voltage of main control chip to by the power circuit of main control chip;
(3) simultaneously, supply voltage converts the required voltage of monitoring chip to by monitoring chip power circuit;
(4) main control chip and the operation of monitoring chip enable power switching tube;
(5) monitoring chip is monitored the running status of main control chip, once monitoring chip notes abnormalities, closes power switch pipe and failure message is passed to main control chip, and failure message is sent to entire car controller by main control chip;
(6) simultaneously, monitoring chip detects the working condition of the power supply of main control chip, once detect that power work is abnormal, and switch-off power switch immediately;
(7) simultaneously, main control chip gathers simulating signal and controls motor rotation, and also the digital signal of monitor for faults diagnostic circuit, carrys out power ratio control switching tube with this, and status information is sent to entire car controller;
(8) when motor and electric machine controller are in normal condition situation, fault diagnosis circuit makes power switch pipe be subject to master control chip controls according to level signal;
(9) in the time of motor and/or electric machine controller operation irregularity, fault diagnosis circuit is closed power switch pipe according to level signal.
Further, further comprise step (10): when motor and electric machine controller are in normal condition situation, the power bridge enable signal that PWM interlock circuit obtains is high level, the pwm signal of upper and lower bridge can flow through PWM interlock circuit and carry out gauge tap pipe, when appearring in main control chip, the pwm signal of bridge up and down abnormal and/or main control chip output is interfered while causing upper and lower bridge pwm signal simultaneously for high level, upper and lower bridge pwm signal is after PWM interlock circuit, it is low level that PWM interlock circuit forces power bridge to drive signal H, power bridge drives signal L to become high level, thereby prevent that the hazard event that power bridge leads directly to up and down from occurring, in the time that power bridge enable signal is low level, PWM interlock circuit cuts out the transmission channel of pwm signal, and make its output power bridge drive signal be all low level, thereby close all switching tubes of power bridge.
Compared with prior art; the present invention has been realized the vital state of safety (running status, overcurrent, overvoltage, excess temperature, chip power supply power supply in chip slapper) has been monitored by simple security monitoring circuit; protection controller in time when abnormal state; the reliability of controller and the safety by bus of vehicle are improved; in addition; this circuit can also avoid the bridge up and down of power switch pipe straight-through, has further improved the reliability of controller.
Embodiment
Describe the present invention with reference to the accompanying drawings below, it is a kind of preferred embodiment in numerous embodiments of the present invention.
In a preferred embodiment, a kind of vehicle motor controller security monitoring circuit, this circuit is monitored the ruuning situation of main control chip by a newly-increased monitoring chip, can also monitor the working condition of main control chip power supply simultaneously.The present fast development along with chip technology, its processing speed is more and more faster, integrated level is also more and more higher, this is just also stricter to the requirement of its power supply, the voltage that the power supply of main control chip need to be lower, larger electric current, more stable power supply, whether can normally work so the power supply quality of power supply directly affects main control chip, it is also the key factor that affects electric automobile security simultaneously.Once the monitoring chip in invention is found main control chip or its power supply operation exception, it can by related circuit, closing switch pipe be (for example: IGBT immediately, MOSFET etc.), because electric machine controller is will input high-voltage d. c inverse transform by full-bridge switch pipe to become three-phase alternating current, control motor rotation by the frequency and the size that change three-phase alternating current, if main control chip operation irregularity, can cause full-bridge switch operation irregularity, may cause like this switching tube to burn or cause the anxious acceleration of vehicle, anxious deceleration waited the fault that jeopardizes personal safety, just can avoid the generation of device failure and hazard event so only have the energy transmission of closing in time between battery and motor.
Main control chip need to be controlled motor rotation by the simulating signal that in sheet, ADC pick-up transducers passes in addition, these analog quantitys will participate in the calculating of control algolithm mostly, in order to ensure that electric machine controller has higher performance, ADC must have higher sampling precision, so outside general high-precision ADC reference voltage that uses of main control chip, obtain high-precision sampled value with this, if losing efficacy, ADC reference power source will cause motor misoperation, thereby bring unpredictable serious consequence to car load, therefore the present invention adopts monitoring chip to monitor the reference voltage of main control chip ADC, when reference voltage is abnormal, monitoring chip can be closed full-bridge switch pipe in time, thereby avoid above problem.
In the time that breaking down, monitoring chip monitoring can failure message be issued to entire car controller by the CAN communication of main control chip, so that staff carries out malfunction elimination and analysis, make like this electric machine controller accurately and timely failure message to be transmitted out, strengthened the maintainability of electric machine controller.
Conventional motors controller only has a road power circuit to parts power supplies such as main control chip, companion chip, mimic channel and digital circuits, once power circuit goes wrong, the electronic devices and components in electric machine controller all will be affected.Because monitoring chip is most important to ensureing the reliability of electric machine controller, so its power supply has also been done to Redundancy Design, even if also can ensure monitoring chip when main control chip power work is abnormal can normally work, to ensure that electric machine controller can turn-off full-bridge switch pipe in time, thereby avoid the generation of vehicle unsafe condition.
Main control chip can also be monitored the ruuning situation of monitoring chip by SPI communication, simultaneously main control chip also by ADC sample the power supply of supervising monitoring chip with and ADC reference power source, once power supply, ADC reference power source or the monitoring chip operation exception of monitoring chip, main control chip is closed full-bridge switch pipe, then by CAN, failure message is passed to entire car controller, thereby ensured that electric machine controller monitoring chip is also operated in the situation of monitoring always.In addition, main control chip is also monitored quantity of states such as overvoltage, overcurrent, excess temperature, IGBT enable signals, and in the time there is hardware protection, main control chip can be issued entire car controller by failure message.
When electric machine controller operation irregularity, the function of closing full-bridge switch pipe realizes by fault diagnosis circuit and PWM interlock circuit.Under normal circumstances, fault diagnosis circuit can be exported a high level in the situation that fault not detected, this high level has been opened PWM interlock circuit, detect and extremely will export a low level once fault diagnosis, this low level can make the output of PWM interlock circuit be low level, so just can ensure that 6 way switch pipes of full-bridge are all in off state.The interior main control chip of electric machine controller can produce 6 road pwm signals of three-phase drive in addition, each drives signal all to comprise the pwm signal of the 2 upper and lower bridges in tunnel mutually, under abnormal conditions, if being all high level, two-way pwm signal can cause upper and lower bridge switch straight-through, thereby cause switching tube to burn, and PWM interlock circuit can be avoided this problem, in the time that the two-way pwm signal of input is all high level, it is low level that PWM interlock circuit can make to export brachium pontis PWM, avoids upper and lower bridge pwm signal simultaneously as the situation of high level taking this.
In a preferred embodiment; a kind of security monitoring circuit of vehicle motor controller is by 4 electronic circuits: chip power supply circuit, chip monitoring circuit, fault diagnosis circuit, PWM interlock circuit form; transmit and the work such as protection these 4 mutual co-ordinations of electronic circuit the outside that has jointly completed monitoring to phase current, busbar voltage, temperature, chip ruuning situation in electric machine controller, diagnosis, failure message, and below in conjunction with drawings and Examples, the present invention is further described.
With reference to accompanying drawing 1:
After controller powers on (the switch SW closure in figure), the 12V voltage of little accumulator becomes the needed analog voltage of main control chip, digital voltage, reference voltage and core voltage by the power circuit conversion (DC-DC conversion) of main control chip, in above conversion, the 12V voltage of little accumulator also converts the required supply voltage of monitoring chip and reference voltage to by monitoring chip power circuit, and two change-over circuits have met main control chip and monitoring chip required different supply voltage requirement separately.
With reference to accompanying drawing 2:
Under normal circumstances, when electric machine controller powers on, main control chip and monitoring chip complete after the initialization of sheet internal program, main control chip and monitoring chip are by self I/O mouth output IGBT enable signal (being now high level), thus enable power switching tube (for example: IGBT, MOSFET etc.) operation.Monitoring chip will to peripheral hardware and storer in the sheet in main control chip (for example: the ADC in main control chip sheet pass through SPI communication afterwards, ePWM, Watchdog, GPIO, SPI, CAN, RAM, ROM, flash etc.) running status monitor, once monitoring chip notes abnormalities, close power switch pipe by its I/O mouth output low level, thereby avoid the generation of hazard event, monitoring chip passes to main control chip by SPI by failure message afterwards, main control chip sends to entire car controller by the CAN module of self by failure message again, so that the fault diagnosis of controller and maintenance.
Monitoring chip is also monitored the working condition of the power supply of main control chip in monitoring main control chip ruuning situation by the ADC sampling module of self, once detect that power work is abnormal, carry out switch-off power switch by the I/O mouth output low level of himself immediately, to avoid the generation of hazard event.
When monitoring chip is to main control chip monitoring, main control chip is gathered simulating signal and is controlled motor rotation by ADC in sheet, the also digital signal of the overcurrent (A) by its GPIO monitor for faults diagnostic circuit, excess temperature (B), overvoltage (C) of main control chip in addition, once detect that in A, B, C, any road signal is low level, main control chip sends to entire car controller by inner CAN communication by failure message again.In addition in above monitoring, main control chip is by the power supply of the continuous monitoring chip of self ADC module, abnormal once monitoring chip power supply, main control chip output IGBT enable signal a (being now low level), close power switch pipe with this, by main control chip CAN communication, failure message is sent to entire car controller more afterwards.
With reference to accompanying drawing 3:
After electric machine controller powers on, motor and motor are all in normal condition situation, fault diagnosis circuit is from electric machine phase current over-current detection circuit (its output level represents with A), the level that device for power switching excess temperature testing circuit (its output level represents with B) and bus overvoltage testing circuit (its output level represents with C) obtain is high level, at this moment IGBT enable signal a (its output level represents with D) and IGBT enable signal b (its output level represents with E) are also high level, the power bridge enable signal (its output level represents with F) of fault diagnosis circuit output is high level, power switch can normally receive the PWM drive control signal of main control chip, thereby can normally control motor rotation after making electric machine controller receive the instruction of entire car controller.
In the time of electric machine controller operation irregularity, once fault diagnosis circuit finds that in A, B, C, D, E, any road level becomes after low level, fault diagnosis circuit output F level becomes low level at once, thereby effectively closes power switch pipe, to prevent the generation of hazard event.
Following table 1 has been enumerated the duty of fault diagnosis circuit:
The duty of table 1 fault diagnosis circuit
Diagnostic result |
A |
B |
C |
D |
E |
F |
The function that circuit output realizes |
Normally |
H |
H |
H |
H |
H |
H |
Open pwm signal transmission channel |
Extremely |
L |
X |
X |
X |
X |
L |
Close pwm signal transmission channel |
Extremely |
X |
L |
X |
X |
X |
L |
Close pwm signal transmission channel |
Extremely |
X |
X |
L |
X |
X |
L |
Close pwm signal transmission channel |
Extremely |
X |
X |
X |
L |
X |
L |
Close pwm signal transmission channel |
Extremely |
X |
X |
X |
X |
L |
L |
Close pwm signal transmission channel |
Annotation: H represents that high level, L represent that low level, X represent any level
With reference to accompanying drawing 4:
Because electric machine controller general control three phase electric machine, its inner use three phase full bridge switch is realized DC inversion and is become three-phase alternating current, so main control chip need to provide three-phase 6 road pwm signals to carry out power ratio control switching tube, Fig. 3 only provides the PWM interlock circuit of A phase, and the PWM interlock circuit of two-phase is just the same with A phase PWM interlock circuit in addition.
Under normal circumstances, the power bridge enable signal (its output level represents with G) that PWM interlock circuit obtains is high level, (upper bridge pwm signal level represents with P the pwm signal of upper and lower bridge, lower bridge pwm signal level represents with Q) can flow through PWM interlock circuit and carry out gauge tap pipe, when appearring in main control chip, the pwm signal of bridge up and down abnormal or main control chip output is interfered while causing upper and lower bridge pwm signal simultaneously for high level, upper and lower bridge pwm signal is after PWM interlock circuit, it is low level that PWM interlock circuit is forced " A phase power bridge drives signal H " (its output level represents with J), A phase power bridge drives signal L (its output level represents with K) to become high level, thereby prevent that the hazard event that power bridge leads directly to up and down from occurring.
In addition, in the time that power bridge enable signal is low level, PWM interlock circuit can cut out the transmission channel of pwm signal, and to make " the A phase power bridge drive signal H " of its output and " A phase power bridge driving signal L " be all low level, thereby closes all switching tubes of power bridge.
Following table 2 has been enumerated the duty of PWM interlock circuit:
The duty of table 2 PWM interlock circuit
Controller state |
G |
P |
Q |
J |
K |
Remarks |
Normally |
H |
H |
L |
H |
L |
? |
Normally |
H |
L |
H |
L |
H |
? |
Normally |
H |
L |
L |
L |
L |
? |
Extremely |
H |
H |
H |
L |
H |
Forcing to drive signal H is low level |
Extremely |
L |
X |
X |
L |
L |
Close PWM transmission channel |
Annotation: H represents that high level, L represent that low level, X represent any level
By reference to the accompanying drawings the present invention is exemplarily described above; obviously specific implementation of the present invention is not subject to the restrictions described above; as long as the various improvement that adopted method design of the present invention and technical scheme to carry out; or directly apply to other occasion without improvement, all within protection scope of the present invention.