CN114670638A

CN114670638A - Safety state control method and device and motor controller

Info

Publication number: CN114670638A
Application number: CN202210004863.0A
Authority: CN
Inventors: 李玮
Original assignee: Beijing Electric Vehicle Co Ltd
Current assignee: Beijing Electric Vehicle Co Ltd
Priority date: 2022-01-05
Filing date: 2022-01-05
Publication date: 2022-06-28
Anticipated expiration: 2042-01-05
Also published as: CN114670638B

Abstract

The invention provides a safety state control method, a safety state control device and a motor controller, wherein the safety state control method comprises the following steps: determining the working condition state of the driving system according to the collected working signal of the driving system; and controlling the safety state of the driving system according to the working condition state of the driving system. According to the scheme, the working condition state of the driving system is determined through the collected working signal of the driving system, and the safety state of the driving system is controlled according to the working condition state of the driving system, so that reasonable design can be made according to the working condition of the system, and the safety state of the driving system can reasonably exert the advantages of the ASC safety state and the SPO safety state.

Description

Safety state control method and device and motor controller

Technical Field

The invention relates to the technical field of vehicle control, in particular to a safety state control method and device and a motor controller.

Background

The power of the pure electric vehicle is derived from a driving motor, the driving motor controls the pure electric vehicle through a motor controller, and a computer of a power battery is converted into mechanical energy to realize the motion of the pure electric vehicle. A Permanent Magnet Synchronous Motor (PMSM) is currently the mainstream of a pure electric vehicle drive system because of its advantages of high efficiency, high output torque, high power density, good dynamic performance, and the like.

For a pure electric vehicle equipped with a permanent magnet synchronous motor, after a serious failure occurs in a driving system, the driving system needs to be controlled to enter a safe state to ensure the safety of the driving system and even the whole vehicle. The safety state of the permanent magnet synchronous motor driving system is divided into two types, namely: active Short Circuit (ASC) and close drive Output (SPO). The two safety states have respective advantages and disadvantages, and the ASC safety state only generates lower braking torque and does not generate back electromotive force under the condition of high rotating speed of the motor, so that the ASC safety state has important protection value on the safety of vehicles running under the high-speed condition; compared with the ASC safety state, the SPO safety state may generate a larger braking torque and a larger counter electromotive force under a high rotation speed condition of the motor, thereby posing a threat to driving safety, wherein the braking torque and the counter electromotive force generated by the SPO safety state are reduced along with the reduction of the rotation speed. On the other hand, the ASC safe state may generate a large current in a large current generated in the motor stator winding and the motor controller power conversion module, the current may cause the temperature of the power conversion module and the motor to increase, and the driving system is in the ASC safe state for a long time, which may easily cause the driving system to be burnt; under the working condition of low rotating speed, the ASC safety state can enable the driving motor to generate larger braking torque, so that the driving feeling of personnel on the vehicle is damaged; compared with the ASC safety state, the SPO safety state does not generate larger current, and in addition, under the working condition of low rotating speed, the braking torque generated by the control of the SPO safety state is smaller, so that the driving feeling of a driver can be better protected. From the above analysis, the ASC safe state and the SPO safe state have advantages and disadvantages.

Therefore, it is necessary to design a safety state control method to realize the advantages of the ASC safety state and the SPO safety state according to the system working condition and to limit the disadvantages of the ASC safety state and the SPO safety state.

Disclosure of Invention

Embodiments of the present invention provide a safety state control method and apparatus, and a motor controller, so as to solve the problem that in the prior art, the advantages of the ASC safety state and the SPO safety state cannot be brought into play according to the working condition of a motor drive system, and the disadvantages of the ASC safety state and the SPO safety state are limited.

In order to solve the above technical problem, an embodiment of the present invention provides the following technical solutions:

the embodiment of the invention provides a safety state control method, which comprises the following steps:

determining the working condition state of a driving system according to the acquired working signal of the driving system;

and controlling the safety state of the driving system according to the working condition state of the driving system.

Optionally, the operating signal comprises at least one of:

an insulated gate bipolar transistor IGBT module temperature signal; a motor temperature signal; a low voltage power supply signal; a motor speed signal; an insulated gate bipolar transistor IGBT module bridge arm fault signal; a security status request signal; the system enables the signal.

Optionally, the security status comprises at least one of:

a standby state; an operating state; closing the driving output SPO safety switching state; closing the driving output SPO safety control state; active short ASC safe state.

Optionally, the controlling the safety state of the driving system according to the working condition state of the driving system includes at least one of:

under the condition that the working condition state of the driving system is a first state and the safety state of the driving system is a target state, controlling the safety state to be switched from the target state to an SPO safety switching state;

under the condition that the working condition state of the driving system is a second state and the safety state of the driving system is an SPO safety conversion state, controlling the safety state to be switched from the SPO safety conversion state to an ASC safety state;

under the condition that the working condition state of the driving system is a third state and the safety state of the driving system is an SPO safety switching state, controlling the safety state to be switched from the SPO safety switching state to an SPO safety control state;

wherein the target state is the standby state or the operating state.

Optionally, in a case that the target state is the standby state, the first state includes:

the IGBT module bridge arm fault state or the safety request state; the failure-free state of the bridge arm of the IGBT module is determined according to a fault signal of the bridge arm of the IGBT module; the security request state is determined from a security state request signal;

the low-voltage power supply supplies power in a normal state; the normal state of the low-voltage power supply is determined according to the low-voltage power supply signal.

Optionally, in a case that the target state is the operating state, the first state includes at least one of:

an IGBT module bridge arm fault state; the fault state of the bridge arm of the IGBT module is determined according to a fault signal of the bridge arm of the IGBT module;

a non-enabled state; the disable state is determined from a system enable signal;

a security request state; the security request state is determined from a security state request signal.

Optionally, the second state comprises:

an electric motor overspeed state; the motor overspeed state is determined according to a motor speed signal;

The IGBT module bridge arm fault state is an IGBT module upper bridge arm fault state or an IGBT module lower bridge arm fault state;

the ASC safety state is an upper bridge arm ASC safety state or a lower bridge arm ASC safety state;

under the condition that the bridge arm fault state of the IGBT module is the upper bridge arm fault state of the IGBT module, the ASC safety state is the lower bridge arm ASC safety state;

and under the condition that the IGBT module bridge arm fault state is the IGBT module lower bridge arm fault state, the ASC safety state is the upper bridge arm ASC safety state.

Optionally, in a case that the ASC safe state is a lower bridge arm ASC safe state, after controlling the safe state of the driving system to be switched from the SPO safe transition state to the ASC safe state, the method further includes:

and controlling the three lower bridge arms of the IGBT module of the driving system to be connected and controlling the three upper bridge arms of the IGBT module of the driving system to be disconnected.

Optionally, in a case that the ASC safe state is an upper bridge arm ASC safe state, after controlling the safe state of the driving system to be switched from the SPO safe transition state to the ASC safe state, the method further includes:

and controlling the three upper bridge arms of the IGBT module of the driving system to be connected and controlling the three lower bridge arms of the IGBT module of the driving system to be disconnected.

Optionally, the third state comprises:

the IGBT module bridge arm fault state is an IGBT module upper bridge arm fault state and an IGBT module lower bridge arm fault state.

Optionally, after controlling the safety state of the drive system to be switched from the target state to the SPO safety transition state, the method further includes:

and when the working condition state of the driving system is a fourth state, controlling the safety state of the driving system to be switched from the SPO safety switching state to the standby state.

Optionally, the fourth state comprises:

the bridge arm of the IGBT module is in a fault-free state; the fault-free state of the bridge arm of the IGBT module is determined according to a fault signal of the bridge arm of the IGBT module;

no security request state; the no-secure request state is determined from a secure state request signal;

the motor is not in an overspeed state; the motor no-overspeed condition is determined from a motor speed signal.

Optionally, after controlling the safety state of the drive system to be switched from the SPO safety transition state to the ASC safety state, the method further includes:

And when the working condition state of the driving system is a fifth state, controlling the safety state of the driving system to be switched from an ASC (automatic switch control) safety state to an SPO (shortest path first) safety switching state.

Optionally, when the ASC safe state is a lower bridge arm ASC safe state, the fifth state includes one of:

the first module is in an over-temperature state and the motor is not in an overspeed state; the motor non-overspeed state is determined according to a motor rotating speed signal;

a fault state of a lower bridge arm of the IGBT module; the fault state of the lower bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

the first module is an IGBT module or a motor;

the over-temperature state of the IGBT module is determined according to the temperature signal of the IGBT module;

the motor over-temperature state is determined according to the motor temperature signal.

Optionally, in a case that the ASC safe state is an upper bridge arm ASC safe state, the fifth state includes one of:

the upper bridge arm of the IGBT module is in a fault state; the fault state of the upper bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

The first module is an IGBT module or a motor;

Optionally, after controlling the safety state to be switched from the SPO safety transition state to the SPO safety control state, the method further includes:

and when the working condition state of the driving system is a sixth state, controlling the safety state of the driving system to be switched from the SPO safety control state to the SPO safety conversion state.

Optionally, the sixth state comprises one of:

the upper bridge arm of the IGBT module is in a fault recovery state; the recovery state of the bridge arm fault on the IGBT module is determined according to the bridge arm fault signal of the IGBT module;

the lower bridge arm of the IGBT module is in a fault recovery state; and the fault recovery state of the lower bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module.

An embodiment of the present invention further provides a safety state control apparatus, including:

the first determining module is used for determining the working condition state of the driving system according to the collected working signal of the driving system;

and the control module is used for controlling the safety state of the driving system according to the working condition state of the driving system.

Optionally, the operating signal comprises at least one of:

Optionally, the security state comprises at least one of:

Optionally, the control module is specifically configured to at least one of:

Wherein the target state is the standby state or the operating state.

the low-voltage power supply supplies power to the normal state; the normal state of the low-voltage power supply is determined according to the low-voltage power supply signal.

an IGBT module bridge arm fault state; the IGBT module bridge arm fault state is determined according to the IGBT module bridge arm fault signal;

a security request state; the security request state is determined from the security state request signal.

Optionally, the second state comprises:

Optionally, when the ASC safe state is the lower arm ASC safe state, after the control module controls the safe state of the driving system to be switched from the SPO safe transition state to the ASC safe state, the control module is further configured to:

Optionally, when the ASC safe state is the upper arm ASC safe state, after the control module controls the safe state of the driving system to be switched from the SPO safe transition state to the ASC safe state, the control module is further configured to:

Optionally, the third state comprises:

Optionally, after the control module controls the safety state of the driving system to be switched from the target state to the SPO safety transition state, the control module is further configured to:

Optionally, the fourth state comprises:

no security request status; the no-secure request state is determined from a secure state request signal;

Optionally, after the control module controls the safety state of the drive system to be switched from the SPO safety transition state to the ASC safety state, the control module is further configured to:

Optionally, in a case that the ASC safe state is a lower bridge arm ASC safe state, the fifth state includes one of:

the first module is an IGBT module or a motor;

An upper bridge arm fault state of the IGBT module; the fault state of the upper bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

the first module is an IGBT module or a motor;

Optionally, after the control module controls the safety state to be switched from the SPO safety transition state to the SPO safety control state, the control module is further configured to:

Optionally, the sixth state comprises one of:

An embodiment of the present invention further provides a motor controller, including: a processor, a memory and a program stored on the memory and executable on the processor, the program, when executed by the processor, implementing the steps of the secure state control method as claimed in any one of the above.

An embodiment of the present invention further provides a readable storage medium, where a program is stored, and when the program is executed by a processor, the method implements the steps in the safety state control method described in any of the above.

The invention has the beneficial effects that:

according to the scheme, the working condition state of the driving system is determined through the collected working signal of the driving system, and the safety state of the driving system is controlled according to the working condition state of the driving system, so that reasonable design can be made according to the working condition of the system, and the safety state of the driving system can reasonably exert the advantages of the ASC safety state and the SPO safety state.

Drawings

Fig. 1 is a flow chart of a safety state control method according to an embodiment of the present invention;

fig. 2 is a diagram illustrating a hardware architecture of a motor controller according to an embodiment of the present invention;

FIG. 3 is a diagram illustrating a security state switching according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a safety state control device according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in detail with reference to the accompanying drawings and specific embodiments.

The invention provides a safety state control method, a safety state control device and a motor controller, aiming at the problem that the prior art can not play the advantages of an ASC safety state and an SPO safety state according to the working condition of a motor driving system and limit the defects of the ASC safety state and the SPO safety state.

As shown in fig. 1, an embodiment of the present invention provides a method for controlling a security state, including:

step 101: and determining the working condition state of the driving system according to the collected working signal of the driving system.

It should be noted that, Programmable logic devices, such as Field Programmable Gate Array (FPGA), Complex Programmable Logic Device (CPLD), etc., have been abundantly applied in motor controllers of pure electric vehicles in recent years due to their own characteristics of fast operation speed, strong computing capability, rich interfaces, etc., based on the above characteristics, the safety state control method provided by the embodiments of the present invention is applied to a motor controller based on a Programmable logic device, a hardware architecture diagram of a motor controller based on a Programmable logic device is shown in fig. 2, a motor controller based on a Programmable logic device includes a Programmable logic device, such as FPGA, CPLD, a power conversion module driving circuit, a power conversion Insulated Gate Transistor (IGBT) module, and a driving motor connected to the power conversion IGBT module in fig. 2, namely a permanent magnet synchronous machine. The programmable logic device is responsible for signal acquisition, signal processing, safety state management, and Pulse Width Modulation (PWM) control signal output for the core of the architecture.

And a state mode management module in the programmable logic device outputs a PWM control signal, the PWM control signal acts on the power conversion IGBT module through the power conversion module driving circuit, and then the permanent magnet synchronous motor is driven to normally work.

In the embodiment of the invention, the working signals of the driving system are collected through the programmable logic device, and the working condition state of the driving system is determined.

Step 102: and controlling the safety state of the driving system according to the working condition state of the driving system.

Specifically, after the programmable logic device determines the working state of the drive system, the state mode management module in the programmable logic device designs a reasonable strategy to control the safety state of the drive system, so that the safety state of the system can reasonably exert the advantages of the ASC safety state and the SPO safety state.

Optionally, the operating signal comprises at least one of:

an Insulated Gate Bipolar Transistor (IGBT) module temperature signal; a motor temperature signal; a low voltage power supply signal; a motor speed signal; an insulated gate bipolar transistor IGBT module bridge arm fault signal; a security status request signal; the system enables the signal.

In the implementation of the invention, the programmable logic device collects and processes the key working signals by relying on strong hardware resources.

Specifically, the programmable logic device acquires an IGBT module temperature signal through an A/D port of the programmable logic device, analyzes the IGBT module temperature signal to obtain a physical value of the IGBT module temperature, and then judges the IGBT module temperature in an overtemperature mode through a hardware comparator, namely when the IGBT module temperature exceeds a specified threshold T_{IGBT_E}The over-temperature state mark of the IGBT module is output,when the temperature of the IGBT module is lower than a specified threshold value T_{IGBT_R}Clearing the over-temperature state mark of the IGBT module, wherein T_{IGBT_E}>T_{IGBT_R}The purpose is to form a temperature hysteresis loop, prevent the frequent switching of the over-temperature state mark of the IGBT module and further influence the subsequent safety state management. And the over-temperature state of the IGBT module obtained according to the module temperature signal is used for subsequent safety state control management.

The programmable logic device collects temperature voltage signals (motor temperature signals) of a motor stator through an A/D port of the programmable logic device, then analyzes the signals to obtain a physical value of the motor temperature, and then judges the motor temperature in an overtemperature mode through a hardware comparator, namely when the motor temperature exceeds a specified threshold T_{MOTOR_E}Outputting motor over-temperature state mark when the motor temperature is lower than the specified threshold value T_{MOTOR_R}Clearing the over-temperature status flag of the motor, wherein T _{MOTOR_E}>T_{MOTOR_R}The purpose is to form a temperature hysteresis loop, prevent frequent switching of the motor over-temperature state mark and further influence subsequent safety state management. And the motor over-temperature state obtained according to the motor temperature signal is used for subsequent safety state control management.

The programmable logic device collects a low-voltage power supply signal (low-voltage power supply signal) of the motor controller through an A/D port of the programmable logic device, obtains a physical value of low-voltage power supply voltage through analysis, and then judges the physical value of the low-voltage power supply voltage in an out-of-range mode through a hardware comparator, namely when the low-voltage power supply voltage exceeds a specified threshold T_{LV_H}Or below a prescribed threshold value T_{LV_L}When the motor controller is in a low-voltage power supply abnormal state, outputting a low-voltage power supply abnormal mark, indicating that the current low-voltage power supply can not ensure the normal work of the motor controller, and when the voltage of the low-voltage power supply is in a specified threshold value T_{LV_H}And a prescribed threshold value T_{LV_L}In the meantime, the motor controller is in a normal state of low-voltage power supply, the power supply abnormal mark of the low-voltage power supply disappears, and the current low-voltage power supply can guarantee the normal work of the motor controller.

The programmable logic device receives the motor speed signal And analyzing to obtain a motor rotating speed value, comparing the motor rotating speed value with a threshold value, and judging whether the motor exceeds a preset rotating speed. When the rotating speed of the motor exceeds a specified threshold value R_{MOTOR_E}When the motor speed is lower than the specified threshold value R_{MOTOR_R}Clearing of the time motor overspeed status flag, wherein R_{MOTOR_E}>R_{MOTOR_R}The purpose is to form a hysteresis loop of the rotating speed, prevent the frequent switching of the motor overspeed state mark and further influence the subsequent safety state management.

The programmable logic device receives the bridge arm fault signals of the IGBT module fed back by the hardware, and according to the bridge arm fault signals of the IGBT module, bridge arm fault states of the IGBT module are summarized into an upper bridge arm fault state of the IGBT module, a lower bridge arm fault state of the IGBT module and upper and lower bridge arm fault states of the IGBT module, and the bridge arm fault states of the IGBT module are used for subsequent safety state control management.

The programmable logic device collects a security state request signal and a system enable signal.

The motor controller can detect the fault state of the system in real time in the operation process, and when serious faults (such as hardware overcurrent, hardware overvoltage, direct connection of an IGBT module bridge arm and the like) occur, a safety protection mechanism can be triggered, namely, a request for entering a safety state is sent through a hardware detection circuit, a power supply chip or a main control chip, namely, a safety state request signal is sent. The programmable device just collects the safety state request signal for subsequent safety state management control.

For the motor controller, the main control chip controls the enabling of the system according to the state of the driving system, namely, when the condition that the system has output power is judged, an enabling instruction is given, namely, a system enabling signal is sent. The programmable device just collects the system enabling signal for subsequent safety state management control.

Optionally, the security state comprises at least one of:

It should be noted that the security states provided by the embodiments of the present invention are: the system comprises a standby state, an operating state, an SPO safety switching state, an SPO safety control state and an ASC safety state, wherein the ASC safety state comprises an upper bridge arm ASC safety state and a lower bridge arm ASC safety state. The safety state management is to make a reasonable control strategy through a state mode management module in the programmable logic device shown in fig. 2 to control the system to switch and jump among the above six safety states, the safety state switching process is shown in fig. 3, and the safety state switching provides guarantee for the normal operation of the system.

Specifically, the above six safety states are explained:

standby state: the standby state is a default mode after the motor controller is electrified and initialized, and when the system is in the standby state, no power is output, and at the moment, six bridge arms of the IGBT module are in a disconnected state, namely an SPO safe state.

The operation state is as follows: the running state indicates that the system is in a normal working state, namely the IGBT module normally sends waves to control the driving motor to output expected torque.

SPO secure transition state: six bridge arms of the IGBT module are in an off state.

SPO safety control state: six bridge arms of the IGBT module are in an off state.

It should be noted that, when the motor driving system is in the SPO safe switching state and the SPO safe control state, although the six bridge arms of the IGBT module are all in the off state, the SPO safe switching state is different from the SPO safe control state, as can be seen from fig. 3, the SPO safe switching state is a pivot of all the safe states, that is, the SPO safe switching state can jump to other safe states, and the SPO safe control state is an ultimate safe state, at this time, the upper bridge arm and the lower bridge arm of the six bridge arms of the IGBT module are both faulty and do not have a condition of entering the ASC safe state, and at this time, the SPO safe control state is the only choice.

Upper bridge arm ASC safety state: and three upper bridge arms of the IGBT module are in a conducting state, and three lower bridge arms of the IGBT module are in a disconnecting state.

Lower bridge arm ASC safe state: and three lower bridge arms of the IGBT module are in a conducting state and three upper bridge arms of the IGBT module are in a disconnecting state.

wherein the target state is the standby state or the operating state.

In the embodiment of the invention, the driving system is controlled to jump among six safe states according to the working condition state of the driving system, so that the safe state of the driving system can reasonably exert the advantages of an ASC safe state and an SPO safe state.

Continuing with FIG. 3, the process of controlling the drive system to jump between the six safe states is described.

When the current safety state of the driving system is a standby state or an operating state and the working condition state of the driving system is a first state, controlling the safety state of the driving system to be switched from the standby state or the operating state to an SPO safety conversion state;

when the safety state of the driving system is converted into the SPO safety conversion state and the working condition state of the driving system is the second state, controlling the safety state of the driving system to be switched from the SPO safety conversion state to the upper bridge arm ASC safety state or the lower bridge arm ASC safety state;

and when the safety state of the driving system jumps to the SPO safety conversion state and the working condition state of the driving system is the third state, controlling the safety state of the driving system to be switched from the SPO safety conversion state to the ASC safety state.

The IGBT module bridge arm fault state or the safety request state; the fault-free state of the bridge arm of the IGBT module is determined according to a fault signal of the bridge arm of the IGBT module; the security request state is determined from a security state request signal;

Specifically, when the safety state of the driving system is the standby state and the working condition state of the driving system is the first sub-state in the first state, the safety state of the driving system is controlled to be switched from the standby state to the SPO safety transition state, and when the following conditions are all met, the first sub-state in the first state is satisfied:

the IGBT module bridge arm fault state or the safety request state;

and the low-voltage power supply supplies power to a normal state.

That is, in the event of an IGBT module leg fault or a safety request signal being active (a request for the drive system to enter a safe state), in this state, the first sub-state in the first state is satisfied if the low-voltage supply signal is normal (the supply voltage is in the normal range).

It should be noted that when a bridge arm of the IGBT module fails or the system needs to enter a safe state, the IGBT module should enter the safe state, but considering that the normal power supply of the low-voltage power supply is a premise that the system is guaranteed to normally enter the safe state (the abnormal low-voltage power supply will cause the bridge arm of the IGBT module to be unable to be driven normally), a constraint condition of the low-voltage power supply is added. When the first sub-state in the first state is satisfied, the system jumps from the "standby state" to the "SPO safe transition state".

a security request status; the security request state is determined from a security state request signal.

Specifically, when the current safe state of the drive system is the running state and the working condition state of the drive system is the second sub-state in the first state, the safe state of the drive system is controlled to be switched from the running state to the SPO safe transition state, and when any one of the following conditions is met, the second sub-state in the first state is satisfied:

an IGBT module bridge arm fault state;

a non-enabled state;

a security request state;

that is, when any one of the conditions of the arm fault of the IGBT module, the non-enabled state of the system, and the validity of the safety request signal is satisfied, the second sub-state in the first state is satisfied.

It should be noted that when any one of the above three conditions is satisfied, it indicates that the system does not have a condition for normal operation, and therefore needs to enter a protection mode in a fault state, and when the second sub-state in the first state is satisfied, the system jumps from the "running state" to the "SPO safe transition state".

It should be further noted that, when the current safety state of the driving system is the standby state and the working condition state of the driving system is the seventh state, the safety state of the driving system is controlled to be switched from the standby state to the operating state;

the seventh state includes:

the low-voltage power supply supplies power in a normal state; the power supply normal state of the low-voltage power supply is determined according to a low-voltage power supply signal;

an enable state; the enable state is determined from a system enable signal;

no security request state; the no-secure request state is determined based on the secure state request signal.

That is, when the safety state of the drive system is currently in the standby state and the operating state of the drive system is the seventh state, the safety state of the drive system is controlled to be switched from the standby state to the operating state, and the seventh state is satisfied when the following conditions are all satisfied:

the low-voltage power supply supplies power in a normal state;

the bridge arm of the IGBT module is in a fault-free state;

an enable state;

no security request state.

That is, when the low-voltage power signal is normal (the low-voltage power supply voltage is in a normal range), the IGBT module bridge arm has no fault, the driving system is in an enabled state (the system enable signal is valid), and the safety state signal is invalid (the system has no safety state request), that is, when all the above conditions are satisfied, the driving system has a condition for normal operation, and therefore, the safety state of the driving system is switched from a standby state to an operating state.

Optionally, the second state comprises:

Specifically, when the current safety state of the driving system is the SPO safety transition state and the working condition state of the driving system is the first sub-state in the second state, the safety state of the driving system is controlled to be switched from the SPO safety transition state to the lower bridge arm ASC safety state, and when the following conditions are all met, the first sub-state in the second state is met:

The motor is in an overspeed state;

and the IGBT module has upper bridge arm fault.

That is, when the motor rotation speed is in an overspeed state and an upper arm fault of the IGBT module occurs, the first sub-state in the second state is satisfied.

It should be noted that, in the SPO safe switching state, when the rotation speed of the motor exceeds the threshold (the rotation speed of the motor is in an overspeed state), it indicates that the back electromotive force generated by the SPO control will impact the system, at this time, the control system needs to enter the ASC safe state to avoid the damage of the back electromotive force to the system, and continues to determine the bridge arm state of the IGBT module in this state, if the upper bridge arm of the IGBT module fails and the lower bridge arm does not fail, the control system enters the lower bridge arm ASC safe state, and in the lower bridge arm ASC safe state, the lower bridge arm of the IGBT module is controlled to be on, and the upper bridge arm is controlled to be off to implement ASC control.

When the current safety state of the driving system is the SPO safety conversion state and the working condition state of the driving system is the second sub-state in the second state, the safety state of the driving system is controlled to be switched from the SPO safety conversion state to the upper bridge arm ASC safety state, and when the following conditions are all met, the second sub-state in the second state is met:

The motor is in an overspeed state;

and the IGBT module has a lower bridge arm fault.

That is, when the motor rotation speed is in an overspeed state and a lower arm fault of the IGBT module occurs, the second sub-state in the second state is satisfied.

It should be noted that, in the SPO safe switching state, when the motor rotation speed exceeds the threshold (the motor rotation speed is in an overspeed state), it indicates that the back electromotive force generated by the SPO control will impact the system at this time, the control system needs to enter the ASC safe state to avoid the damage of the back electromotive force to the system, in this state, the bridge arm state of the IGBT module is continuously determined, if the lower bridge arm of the IGBT module fails and the upper bridge arm does not fail, the control system enters the upper bridge arm ASC safe state, and in the upper bridge arm ASC safe state, the upper bridge arm of the IGBT module is controlled to be on, and the lower bridge arm is controlled to be off to realize ASC control.

Namely, when the system is in a lower bridge arm ASC safe state, the three lower bridge arms of the IGBT module are controlled to be conducted, and the three upper bridge arms are controlled to be disconnected, so that ASC control is realized.

Optionally, when the ASC safe state is an upper bridge arm ASC safe state, after controlling the safe state of the driving system to be switched from the SPO safe conversion state to the ASC safe state, the method further includes:

and controlling the three upper bridge arms of the IGBT module of the driving system to be switched on and controlling the three lower bridge arms of the IGBT module of the driving system to be switched off.

That is, when the system is in the upper bridge arm ASC safe state, the three upper bridge arms of the IGBT module are controlled to be on, and the three lower bridge arms are controlled to be off, so that the ASC control is realized.

Optionally, the third state comprises:

Specifically, when the current safety state of the drive system is the SPO safety transition state and the working condition state of the drive system is the third state, the safety state of the drive system is controlled to be switched from the SPO safety transition state to the SPO safety control state, and the third state is satisfied when the following conditions are all satisfied:

And the upper bridge arm of the IGBT module is in a fault state, and the lower bridge arm of the IGBT module is in a fault state.

That is, the third state is satisfied when both the upper arm and the lower arm of the IGBT module fail.

It should be noted that, in the SPO safe switching state, if both the upper bridge arm and the lower bridge arm of the IGBT module have a fault, the control system jumps from the SPO safe switching state to the SPO safe control state. Although the SPO safe control state and the SPO safe switching state both adopt the SPO control method, which is not helpful to alleviate the problem of back electromotive force, the SPO safe switching state is responsible for the function of the state switching transfer station, and the switching between the standby state, the operating state and all other safe states needs to pass through the SPO safe switching state, so that it is necessary to set a safe state, that is, the SPO safe control state, for the state where the upper arm of the IGBT module has a fault and the lower arm of the IGBT module has a fault. In fact, the SPO safety control state more represents an uncontrollable safety state.

Referring to fig. 3, when the current safety state of the driving system is the SPO safety transition state and the working condition state of the driving system is the fourth state, the safety state of the driving system is controlled to be switched from the SPO safety transition state to the standby state.

Optionally, the fourth state comprises:

Specifically, when the current safety state of the driving system is the SPO safety conversion state and the working condition state of the driving system is the fourth state, the safety state of the driving system is controlled to be switched from the SPO safety conversion state to the standby state, and when the following conditions are all met, the fourth state is met:

the bridge arm of the IGBT module is in a fault-free state;

no security request status;

the motor is not in an overspeed state.

That is, when neither the upper arm nor the lower arm of the IGBT module fails, the system has no request for a safe state, and the rotational speed of the motor is in an overspeed-free state, the fourth state is satisfied.

It should be noted that, in the SPO safe switching state, if the bridge arm of the IGBT module has no fault and the safety request signal is invalid, it indicates that the system does not need to be protected by the safe control state, and in this state, it is determined whether the motor rotation speed exceeds the predetermined threshold, and considering that the system is in the SPO state in the standby state, and the problem of back electromotive force is caused by the excessively high motor rotation speed, therefore, if the motor rotation speed does not exceed the predetermined threshold, the condition of entering the standby state is satisfied, and at this time, the system jumps from the SPO safe switching state to the standby state.

Referring to fig. 3, when the current safety state of the driving system is the ASC safety state and the working condition state of the driving system is the fifth state, the safety state of the driving system is controlled to be switched from the ASC safety state to the SPO safety transition state.

The ASC safety state comprises an upper bridge arm ASC safety state and a lower bridge arm ASC safety state, so that when the working condition state of the driving system is the first sub-state in the fifth state, the safety state of the driving system is controlled to be switched from the lower bridge arm ASC safety state to the SPO safety conversion state; and when the working condition state of the driving system is the second sub-state in the fifth state, controlling the safe state of the driving system to be switched from the ASC safe state of the upper bridge arm to the SPO safe conversion state.

the first module is in an over-temperature state and the motor is not in an overspeed state; the motor non-overspeed state is determined according to a motor speed signal;

the first module is an IGBT module or a motor;

Specifically, when the current safe state of the driving system is the lower bridge arm ASC safe state and the working condition state of the driving system is the first sub-state in the fifth state, the safe state of the driving system is controlled to be switched from the lower bridge arm ASC safe state to the SPO safe conversion state, and when any one of the following conditions is met, the first sub-state in the fifth state is satisfied:

the IGBT module is in an over-temperature state or a motor over-temperature state, and the motor is not in an overspeed state;

and (5) a fault state of a lower bridge arm of the IGBT module.

That is, condition one: when the temperature of the IGBT module or the temperature of the motor exceeds a corresponding threshold value, the IGBT module is in an over-temperature state, and the rotating speed of the motor is not in an overspeed state; or, condition two: and when the lower bridge arm of the IGBT module breaks down and is met, the first sub-state in the fifth state is met.

It should be noted that, in the lower arm ASC safe state, the driving system is controlled by the lower arm ASC safe state, and in this state, if the lower arm of the IGBT module fails, it is necessary to exit from the lower arm ASC safe state, that is, the lower arm ASC safe state jumps back to the SPO safe switching state again, and then the SPO safe switching state is used as the transfer station to realize the subsequent jumping of the safe state according to the predetermined logic, in the lower arm ASC safe state, if the motor rotation speed does not exceed the specified threshold (the motor rotation speed does not overspeed), and in the motor rotation speed does not overspeed state, if the temperature of the IGBT module or the motor is too high, continuing the ASC safe control will make the problem of heat accumulation of the IGBT module or the motor more serious, and at this time, the control by the SPO safe state is more reasonable (because the motor does not overspeed, there is no problem of excessive back electromotive force), by switching the system from the lower bridge arm ASC safe state to the SPO safe switching state, the temperature of the IGBT module or the motor can be prevented from being further increased.

the first module is an IGBT module or a motor;

Specifically, when the current safe state of the driving system is the upper bridge arm ASC safe state and the working condition state of the driving system is the second sub-state in the fifth state, the safe state of the driving system is controlled to be switched from the upper bridge arm ASC safe state to the SPO safe conversion state, and when any one of the following conditions is met, the second sub-state in the fifth state is satisfied:

and (4) the fault state of an upper bridge arm of the IGBT module.

That is, condition one: when the temperature of the IGBT module or the temperature of the motor exceeds a corresponding threshold value, the IGBT module is in an over-temperature state, and the rotating speed of the motor is not in an overspeed state; or, condition two: and when the upper bridge arm of the IGBT module breaks down and is met, the second sub-state in the fifth state is met.

It should be noted that, in the upper arm ASC safe state, the driving system is controlled by the upper arm ASC safe state, and in this state, if an upper arm failure occurs in the IGBT module, it is necessary to exit from the upper arm ASC safe state, that is, the upper arm ASC safe state jumps back to the SPO safe switching state again, and then the SPO safe switching state is used as the transfer station to realize the subsequent jumping of the safe state according to the predetermined logic, and in the upper arm ASC safe state, if the motor rotation speed does not exceed the predetermined threshold (the motor rotation speed does not overspeed), and in the motor rotation speed does not overspeed state, if the temperature of the IGBT module or the motor is too high, continuing the ASC safe control will make the problem of heat accumulation of the IGBT module or the motor more serious, and at this time, the control by the SPO safe state is more reasonable (because the motor does not overspeed, there is no problem of excessive back electromotive force), by switching the system from the upper bridge arm ASC safe state to the SPO safe switching state, the temperature of the IGBT module or the motor can be prevented from being further increased.

Referring to fig. 3, when the current safety state of the driving system is the SPO safety control state and the working condition state of the driving system is the sixth state, the safety state of the driving system is controlled to be switched from the SPO safety control state to the SPO safety transition state.

Optionally, the sixth state comprises one of:

Specifically, when the current safety state of the drive system is the SPO safety control state and the working condition state of the drive system is the sixth state, the safety state of the drive system is controlled to be switched from the SPO safety control state to the SPO safety transition state, and when any one of the following conditions is met, the sixth state is satisfied:

The upper bridge arm of the IGBT module is in a fault recovery state;

and (5) recovering the fault of the lower bridge arm of the IGBT module.

That is, when the upper arm fault of the IGBT module or the lower arm fault of the IGBT module is detected to recover, the sixth state is satisfied.

It should be noted that, in the SPO safety control state, if it is detected that the upper arm fault of the IGBT module or the lower arm fault of the IGBT module recovers, it indicates that the drive system has a condition of entering the ASC safety state, and therefore, in this working condition state, the drive system jumps back to the SPO safety conversion state from the SPO safety control state, and then, the subsequent safety state jump is completed by using the SPO safety conversion state as a transfer station.

The embodiment of the invention is based on the characteristics of programmable logic devices such as FPGA, CPLD and the like, such as high operation speed, strong calculation capability, rich interfaces and the like, and is widely applied to a motor controller of a pure electric vehicle in recent years. On the basis of finishing the division of the safety state of the system, the embodiment of the invention can also enable the driving motor to enter a reasonable safety state according to the working condition state of the system, realizes the fine management of the safety state by the system temperature, the motor rotating speed, the direct current bus voltage and the fault state of the system, fully exerts the advantages of the two safety states of the ASC safety state and the SPO safety state, and avoids the defects to the maximum extent, thereby achieving the purpose of protecting the system. In addition to the above, since the security state control method provided by the embodiment of the present invention is implemented by a programmable logic device, the security state control method has a hardware-level protection speed, and thus, a highest-level system protection response speed can be achieved. The pure electric vehicle motor controller safety state control method based on the programmable logic device has the characteristics of clear thought, reasonable protection mechanism, easiness in engineering realization and the like, and can provide hardware-level protection for a system, so that the pure electric vehicle motor controller safety state control method based on the programmable logic device has good popularization value.

As shown in fig. 4, an embodiment of the present invention further provides a safety state control device, including:

the first determining module 401 is configured to determine a working condition state of the driving system according to the collected working signal of the driving system;

and the control module 402 is configured to control the safety state of the drive system according to the working condition state of the drive system.

According to the embodiment of the invention, the working condition state of the driving system is determined through the collected working signal of the driving system, and the safety state of the driving system is controlled according to the working condition state of the driving system, so that a reasonable design can be made according to the working condition of the system, and the safety state of the driving system can reasonably exert the advantages of an ASC (automatic start control) safety state and an SPO (shortest path first) safety state.

Optionally, the operating signal comprises at least one of:

Optionally, the security status comprises at least one of:

Optionally, the control module 402 is specifically configured to at least one of:

wherein the target state is the standby state or the operating state.

a non-enabled state; the non-enabled state is determined according to a system enable signal;

Optionally, the second state comprises:

And under the condition that the fault state of the bridge arm of the IGBT module is the fault state of the lower bridge arm of the IGBT module, the ASC safety state is the ASC safety state of the upper bridge arm.

Optionally, when the ASC safe state is the lower bridge arm ASC safe state, after the control module 402 controls the safe state of the driving system to be switched from the SPO safe transition state to the ASC safe state, the control module 402 is further configured to:

and controlling the three lower bridge arms of the IGBT module of the driving system to be switched on and controlling the three upper bridge arms of the IGBT module of the driving system to be switched off.

Optionally, when the ASC safe state is the upper arm ASC safe state, after the control module 402 controls the safe state of the driving system to be switched from the SPO safe transition state to the ASC safe state, the control module 402 is further configured to:

Optionally, the third state comprises:

Optionally, after the control module 402 controls the safety state of the driving system to be switched from the target state to the SPO safety transition state, the control module 402 is further configured to:

Optionally, the fourth state comprises:

Optionally, after the control module 402 controls the safety state of the drive system to be switched from the SPO safety transition state to the ASC safety state, the control module 402 is further configured to:

the first module is an IGBT module or a motor;

Optionally, after the control module 402 controls the safety state to be switched from the SPO safety transition state to the SPO safety control state, the control module 402 is further configured to:

Optionally, the sixth state comprises one of:

the upper bridge arm of the IGBT module is in a fault recovery state; the fault recovery state of the upper bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

It should be noted that the safety state control device provided in the embodiments of the present invention is a device capable of executing the above-mentioned safety state control method, and all embodiments of the above-mentioned safety state control method are applicable to the device and can achieve the same or similar technical effects.

The embodiment of the invention also provides a motor controller, which comprises a processor and a memory; the memory is used for storing programs and data used by the processor when executing operations, and the processor calls and executes the programs and data stored in the memory.

Wherein the motor controller further comprises a transceiver for receiving and transmitting data under control of the processor.

Specifically, the processor is configured to determine a working condition state of the driving system according to an acquired working signal of the driving system; and controlling the safety state of the driving system according to the working condition state of the driving system.

Optionally, the operating signal comprises at least one of:

Optionally, the security state comprises at least one of:

Optionally, the processor is specifically configured to at least one of:

wherein the target state is the standby state or the operating state.

Optionally, the second state comprises:

Optionally, when the ASC safe state is the lower arm ASC safe state, after the processor controls the safe state of the driving system to be switched from the SPO safe transition state to the ASC safe state, the processor is further specifically configured to:

Optionally, when the ASC safe state is the upper bridge arm ASC safe state, after the processor controls the safe state of the driving system to be switched from the SPO safe conversion state to the ASC safe state, the processor is further specifically configured to:

Optionally, the third state comprises:

Optionally, after the processor controls the safety state of the driving system to be switched from the target state to the SPO safety transition state, the processor is further specifically configured to:

Optionally, the fourth state comprises:

Optionally, after the processor controls the safety state of the driving system to be switched from the SPO safety transition state to the ASC safety state, the processor is further specifically configured to:

the first module is an IGBT module or a motor;

Optionally, when the ASC safe state is an upper bridge arm ASC safe state, the fifth state includes one of:

the first module is an IGBT module or a motor;

Optionally, after the processor controls the safety state to be switched from the SPO safety transition state to the SPO safety control state, the processor is further specifically configured to:

Optionally, the sixth state comprises one of:

The fault recovery state of an upper bridge arm of the IGBT module; the fault recovery state of the upper bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

the fault recovery state of a lower bridge arm of the IGBT module; and the fault recovery state of the lower bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module.

An embodiment of the present invention further provides a readable storage medium, where a program is stored, and when the program is executed by a processor, the program implements the steps in the safety state control method described in any one of the above.

While the foregoing is directed to the preferred embodiment of the present invention, it will be appreciated by those skilled in the art that various changes and modifications may be made therein without departing from the spirit and scope of the invention as defined in the appended claims.

Claims

1. A method of controlling a safety state, comprising:

determining the working condition state of the driving system according to the collected working signal of the driving system;

2. The safety state control method of claim 1, wherein the operational signal comprises at least one of:

3. The safety state control method according to claim 1, wherein the safety state comprises at least one of:

4. The safety state control method according to claim 3, wherein the controlling the safety state of the drive system according to the operating condition state of the drive system comprises at least one of:

wherein the target state is the standby state or the operating state.

5. The safety-state control method according to claim 4, wherein, in a case where the target state is the standby state, the first state includes:

6. The safety state control method according to claim 4, wherein in a case where the target state is the operation state, the first state includes at least one of:

7. The safety state control method according to claim 4, wherein the second state comprises:

8. The method according to claim 7, wherein when the ASC safe state is a lower bridge arm ASC safe state, after controlling the safe state of the drive system to be switched from the SPO safe transition state to the ASC safe state, the method further comprises:

9. The method according to claim 7, wherein, when the ASC safe state is an upper arm ASC safe state, after controlling the safe state of the drive system to be switched from the SPO safe transition state to the ASC safe state, the method further comprises:

10. The secure state control method according to claim 4, characterized in that the third state includes:

11. The safety state control method according to claim 4, wherein after controlling the safety state of the drive system to switch from the target state to the SPO safety transition state, the method further comprises:

12. The safety state control method according to claim 11, wherein the fourth state comprises:

13. The safety state control method according to claim 4, wherein after controlling the safety state of the drive system to be switched from the SPO safety transition state to the ASC safety state, the method further comprises:

14. The safety state control method according to claim 13, wherein in a case where the ASC safety state is a lower arm ASC safety state, the fifth state includes one of:

the first module is an IGBT module or a motor;

15. The method according to claim 13, wherein in a case where the ASC safe state is an upper arm ASC safe state, the fifth state includes one of:

the first module is an IGBT module or a motor;

16. The method of claim 4, wherein after controlling the safe state to switch from the SPO safe transition state to the SPO safe control state, the method further comprises:

17. The safety state control method of claim 16, wherein the sixth state comprises one of:

18. A safety state control device, comprising:

19. A motor controller, comprising: processor, memory and program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the safety state control method according to any of claims 1 to 17.

20. A readable storage medium, characterized in that the readable storage medium has stored thereon a program which, when executed by a processor, implements the steps in the safety state control method according to any one of claims 1 to 17.