CN114670638B

CN114670638B - Safety state control method and device and motor controller

Info

Publication number: CN114670638B
Application number: CN202210004863.0A
Authority: CN
Inventors: 李玮
Original assignee: Beijing Electric Vehicle Co Ltd
Current assignee: Beijing Electric Vehicle Co Ltd
Priority date: 2022-01-05
Filing date: 2022-01-05
Publication date: 2024-04-30
Anticipated expiration: 2042-01-05
Also published as: CN114670638A

Abstract

The invention provides a safety state control method, a safety state control device and a motor controller, wherein the safety state control method comprises the following steps: according to the collected working signals of the driving system, determining the working condition state of the driving system; and controlling the safety state of the driving system according to the working condition state of the driving system. According to the scheme, the working condition state of the driving system is determined through the collected working signals of the driving system, and the safety state of the driving system is controlled according to the working condition state of the driving system, so that the safety state of the driving system can reasonably play the advantages of the ASC safety state and the SPO safety state according to the working condition of the system.

Description

Safety state control method and device and motor controller

Technical Field

The present invention relates to the field of vehicle control technologies, and in particular, to a method and an apparatus for controlling a safety state, and a motor controller.

Background

The power of the pure electric automobile is derived from a driving motor, the driving motor controls the implementation of the pure electric automobile through a motor controller, and a computer of a power battery is converted into mechanical energy to realize the movement of the automobile. Permanent magnet synchronous motors (PERMANENT MAGNETIC synchronous machine, PMSM) are currently becoming the main stream of pure electric vehicle driving systems due to the advantages of high efficiency, high output torque, high power density, good dynamic performance and the like.

For pure electric vehicles equipped with permanent magnet synchronous motors, when a driving system fails seriously, the driving system needs to be controlled to enter a safe state to ensure the safety of the driving system and even the whole vehicle. The safety state of the permanent magnet synchronous motor driving system is divided into two types, namely: active shorting (Active Short Circuit, ASC) and closing drive outputs (Stop Pulse Width Modulation Output, SPO). The two safety states have advantages and disadvantages, and the ASC safety state only generates lower braking torque and no back electromotive force under the condition of high rotating speed of the motor, so that the ASC safety state has important protection value for the safety of a vehicle running under the condition of high speed; compared with an ASC safety state, the SPO safety state can generate larger braking torque and counter electromotive force under the working condition of high rotating speed of the motor, so that the running safety is threatened, wherein the braking torque and the counter electromotive force generated in the SPO safety state are reduced along with the reduction of the rotating speed. On the other hand, the ASC safety state can generate larger current in larger current generated in the motor stator winding and the motor controller power conversion module, the current can cause the temperature rise of the power conversion module and the motor, and the driving system is in the ASC safety state for a long time, so that the driving system is easy to burn; under the working condition of low rotation speed, the ASC safety state can enable the driving motor to generate larger braking torque, so that the driving feeling of personnel on the vehicle is damaged; compared with an ASC safety state, the SPO safety state does not generate larger current, and in addition, under the working condition of low rotation speed, the braking torque generated by SPO safety state control is smaller, so that the driving feeling of a driver can be better protected. From the above analysis, both the ASC security state and the SPO security state have advantages and disadvantages.

Therefore, a safety state control method is needed to be designed, so that the advantages of the ASC safety state and the SPO safety state are exerted according to the working condition of the system, and the disadvantages of the ASC safety state and the SPO safety state are limited.

Disclosure of Invention

The embodiment of the invention provides a safety state control method, a safety state control device and a motor controller, which are used for solving the problems that the advantages of an ASC safety state and an SPO safety state cannot be exerted according to the working condition of a motor driving system and the defects of the ASC safety state and the SPO safety state are limited in the prior art.

In order to solve the technical problems, the embodiment of the invention provides the following technical scheme:

the embodiment of the invention provides a safety state control method, which comprises the following steps:

according to the collected working signals of the driving system, determining the working condition state of the driving system;

And controlling the safety state of the driving system according to the working condition state of the driving system.

Optionally, the working signal includes at least one of:

Insulated Gate Bipolar Transistor (IGBT) module temperature signals; a motor temperature signal; a low voltage power supply signal; a motor rotational speed signal; insulated gate bipolar transistor IGBT module bridge arm fault signals; a security status request signal; a system enable signal.

Optionally, the security state includes at least one of:

a standby state; an operating state; closing the drive output SPO safe conversion state; closing the drive output SPO safety control state; active short ASC safe state.

Optionally, according to the working condition state of the driving system, the safety state of the driving system is controlled, including at least one of the following:

When the working condition state of the driving system is a first state and the safety state of the driving system is a target state, controlling the safety state to be switched from the target state to an SPO safety conversion state;

When the working condition state of the driving system is a second state and the safety state of the driving system is an SPO safety conversion state, controlling the safety state to be switched from the SPO safety conversion state to an ASC safety state;

When the working condition state of the driving system is a third state and the safety state of the driving system is an SPO safety conversion state, controlling the safety state to be switched from the SPO safety conversion state to an SPO safety control state;

Wherein the target state is the standby state or the running state.

Optionally, in the case that the target state is the standby state, the first state includes:

the IGBT module bridge arm fault state or the safety request state; the fault-free state of the IGBT module bridge arm is determined according to the fault signal of the IGBT module bridge arm; the security request state is determined according to a security state request signal;

The power supply of the low-voltage power supply is in a normal state; the low voltage power supply normal state is determined according to the low voltage power supply signal.

Optionally, in the case that the target state is the running state, the first state includes at least one of:

IGBT module bridge arm fault state; the fault state of the IGBT module bridge arm is determined according to the fault signal of the IGBT module bridge arm;

A disabled state; the disable state is determined from a system enable signal;

A security request state; the security request state is determined from a security state request signal.

Optionally, the second state includes:

An overspeed state of the motor; the motor overspeed state is determined according to a motor rotating speed signal;

The IGBT module bridge arm fault state is an IGBT module upper bridge arm fault state or an IGBT module lower bridge arm fault state;

the ASC safety state is an upper bridge arm ASC safety state or a lower bridge arm ASC safety state;

Under the condition that the fault state of the bridge arm of the IGBT module is the fault state of the upper bridge arm of the IGBT module, the ASC safety state is the ASC safety state of the lower bridge arm;

And under the condition that the bridge arm fault state of the IGBT module is the lower bridge arm fault state of the IGBT module, the ASC safety state is the upper bridge arm ASC safety state.

Optionally, after controlling the safety state of the driving system to be switched from the SPO safety transition state to the ASC safety state in the case that the ASC safety state is the lower bridge arm ASC safety state, the method further includes:

And controlling the three lower bridge arms of the IGBT module of the driving system to be conducted and controlling the three upper bridge arms of the IGBT module of the driving system to be disconnected.

Optionally, after controlling the safety state of the driving system to be switched from the SPO safety transition state to the ASC safety state in the case that the ASC safety state is the upper bridge arm ASC safety state, the method further includes:

And controlling the three upper bridge arms of the IGBT module of the driving system to be conducted and controlling the three lower bridge arms of the IGBT module of the driving system to be disconnected.

Optionally, the third state includes:

the IGBT module bridge arm fault state is an IGBT module upper bridge arm fault state and an IGBT module lower bridge arm fault state.

Optionally, after controlling the safety state of the driving system to switch from the target state to the SPO safety transition state, the method further includes:

and when the working condition state of the driving system is a fourth state, controlling the safety state of the driving system to be switched from the SPO safety switching state to the standby state.

Optionally, the fourth state includes:

the bridge arm of the IGBT module has no fault state; the fault-free state of the IGBT module bridge arm is determined according to the fault signal of the IGBT module bridge arm;

A no security request state; the non-security request state is determined according to a security state request signal;

a motor non-overspeed state; the motor non-overspeed state is determined from a motor speed signal.

Optionally, after controlling the switching of the security state of the drive system from the SPO security transition state to the ASC security state, the method further comprises:

and when the working condition state of the driving system is a fifth state, controlling the safety state of the driving system to be switched from an ASC safety state to the SPO safety conversion state.

Optionally, in the case that the ASC security state is a lower bridge arm ASC security state, the fifth state includes one of:

the first module is in an over-temperature state and the motor is not in an over-speed state; the motor non-overspeed state is determined according to a motor rotating speed signal;

the fault state of the lower bridge arm of the IGBT module; the fault state of the lower bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

The first module is an IGBT module or a motor;

The over-temperature state of the IGBT module is determined according to the temperature signal of the IGBT module;

The motor overtemperature condition is determined based on the motor temperature signal.

Optionally, in the case that the ASC security state is an upper bridge arm ASC security state, the fifth state includes one of:

the fault state of the upper bridge arm of the IGBT module; the fault state of the upper bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

The first module is an IGBT module or a motor;

Optionally, after controlling the switching of the security state from the SPO security transition state to the SPO security control state, the method further includes:

and when the working condition state of the driving system is a sixth state, controlling the safety state of the driving system to be switched from the SPO safety control state to the SPO safety conversion state.

Optionally, the sixth state includes one of:

The fault recovery state of the upper bridge arm of the IGBT module; the fault recovery state of the upper bridge arm of the IGBT module is determined according to the fault signal of the bridge arm of the IGBT module;

The fault recovery state of the lower bridge arm of the IGBT module; and the fault recovery state of the lower bridge arm of the IGBT module is determined according to the fault signals of the bridge arm of the IGBT module.

The embodiment of the invention also provides a safety state control device, which comprises:

The first determining module is used for determining the working condition state of the driving system according to the collected working signals of the driving system;

And the control module is used for controlling the safety state of the driving system according to the working condition state of the driving system.

Optionally, the working signal includes at least one of:

Optionally, the security state includes at least one of:

Optionally, the control module is specifically configured to at least one of:

Wherein the target state is the standby state or the running state.

A disabled state; the disable state is determined from a system enable signal;

Optionally, the second state includes:

Optionally, in the case that the ASC security state is a lower bridge arm ASC security state, the control module is further configured to, after controlling the security state of the driving system to be switched from the SPO security switching state to the ASC security state:

Optionally, in the case that the ASC security state is an upper bridge arm ASC security state, the control module is further configured to, after controlling the security state of the driving system to be switched from the SPO security switching state to the ASC security state:

Optionally, the third state includes:

Optionally, after the control module controls the safety state of the driving system to switch from the target state to the SPO safety transition state, the control module is further configured to:

Optionally, the fourth state includes:

Optionally, after the control module controls the safety state of the driving system to be switched from the SPO safety transition state to the ASC safety state, the control module is further configured to:

The first module is an IGBT module or a motor;

Optionally, after the control module controls the safety state to be switched from the SPO safety transition state to the SPO safety control state, the control module is further configured to:

Optionally, the sixth state includes one of:

The embodiment of the invention also provides a motor controller, which comprises: a processor, a memory and a program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the safety state control method as claimed in any one of the preceding claims.

The embodiment of the present invention also provides a readable storage medium having a program stored thereon, which when executed by a processor, implements the steps in the safety state control method as set forth in any one of the above.

The beneficial effects of the invention are as follows:

According to the scheme, the working condition state of the driving system is determined through the collected working signals of the driving system, and the safety state of the driving system is controlled according to the working condition state of the driving system, so that the safety state of the driving system can reasonably play the advantages of the ASC safety state and the SPO safety state according to the working condition of the system.

Drawings

FIG. 1 shows a flow chart of a security state control method provided by an embodiment of the present invention;

fig. 2 shows a hardware architecture diagram of a motor controller according to an embodiment of the present invention;

FIG. 3 is a schematic diagram illustrating a security state switching scheme according to an embodiment of the present invention;

Fig. 4 is a schematic structural diagram of a safety state control device according to an embodiment of the present invention.

Detailed Description

The present invention will be described in detail below with reference to the drawings and the specific embodiments thereof in order to make the objects, technical solutions and advantages of the present invention more apparent.

Aiming at the problems that the ASC safety state and the SPO safety state cannot be exerted according to the working condition of a motor driving system in the prior art and the defects of the ASC safety state and the SPO safety state are limited, the invention provides a safety state control method, a safety state control device and a motor controller.

As shown in fig. 1, an embodiment of the present invention provides a method for controlling a security state, including:

step 101: and determining the working condition state of the driving system according to the collected working signals of the driving system.

It should be noted that, the programmable logic device, such as the field programmable array (Field Programmable GATE ARRAY, FPGA), the complex programmable logic device (complex programmable logic device, CPLD), and the like, has been abundantly applied in the motor controller of the pure electric vehicle in recent years due to the characteristics of fast operation speed, strong computing capability, abundant interfaces, and the like, and based on the characteristics, the safety state control method provided by the embodiment of the invention is applied to the motor controller based on the programmable logic device, and the hardware architecture diagram of the motor controller based on the programmable logic device is shown in fig. 2, and includes the programmable logic device, such as the FPGA, the CPLD, the power conversion module driving circuit, the power conversion insulated gate bipolar transistor (Insulated Gate Bipolar Transistor, IGBT) module, and the driving motor connected with the power conversion IGBT module, that is, the permanent magnet synchronous motor, in fig. 2. The programmable logic device is a core of the architecture and plays roles of signal acquisition, signal processing, safety state management and pulse width modulation (Pulse Width Modulation, PWM) control signal output.

The state mode management module in the programmable logic device outputs a PWM control signal, and the PWM control signal acts on the power conversion IGBT module through the power conversion module driving circuit and then drives the permanent magnet synchronous motor to work normally.

In the embodiment of the invention, the working signal of the driving system is collected through the programmable logic device, and the working condition state of the driving system is determined.

Step 102: and controlling the safety state of the driving system according to the working condition state of the driving system.

Specifically, after the programmable logic device determines the working state of the driving system, the security state of the driving system is controlled by a strategy with reasonable design of a state mode management module in the programmable logic device, so that the security state of the system can reasonably exert the advantages of ASC security state and SPO security state.

Optionally, the working signal includes at least one of:

In the implementation of the invention, the programmable logic device collects and processes key working signals by depending on the powerful hardware resources.

Specifically, the programmable logic device collects an IGBT module temperature signal through an A/D port of the programmable logic device, analyzes the signal to obtain a physical value of the temperature of the IGBT module, and then judges the temperature of the IGBT module in an over-temperature mode through a hardware comparator, namely, when the temperature of the IGBT module exceeds a specified threshold T _{IGBT_E}, an over-temperature state mark of the IGBT module is output, and when the temperature of the IGBT module is lower than the specified threshold T _{IGBT_R}, the over-temperature state mark of the IGBT module is cleared, wherein T _{IGBT_E}>T_{IGBT_R} aims to form a hysteresis loop of the temperature, so that frequent switching of the over-temperature state mark of the IGBT module is prevented, and further the subsequent safety state management is affected. And the over-temperature state of the IGBT module obtained according to the module temperature signal is used for subsequent safety state control management.

The programmable logic device acquires a temperature voltage signal (motor temperature signal) of a motor stator through an A/D port of the programmable logic device, analyzes the temperature voltage signal to obtain a physical value of the motor temperature, and then judges the motor temperature in an over-temperature mode through a hardware comparator, namely, when the motor temperature exceeds a specified threshold T _{MOTOR_E}, a motor over-temperature state mark is output, and when the motor temperature is lower than the specified threshold T _{MOTOR_R}, the motor over-temperature state mark is cleared, wherein T _{MOTOR_E}>T_{MOTOR_R} aims to form a hysteresis loop of the temperature, prevent frequent switching of the motor over-temperature state mark and further influence subsequent safety state management. And the motor overtemperature state obtained according to the motor temperature signal is used for subsequent safety state control management.

The programmable logic device collects a low-voltage power supply signal (low-voltage power supply signal) of the motor controller through an A/D port of the programmable logic device, obtains a physical value of the low-voltage power supply voltage through analysis, then judges the physical value of the low-voltage power supply voltage in an out-of-range mode through a hardware comparator, namely when the low-voltage power supply voltage exceeds a specified threshold T _{LV_H} or is lower than a specified threshold T _{LV_L}, when the low-voltage power supply voltage is between a specified threshold T _{LV_H} and a specified threshold T _{LV_L}, the low-voltage power supply abnormality flag disappears, and the current low-voltage power supply is indicated to ensure the normal operation of the motor controller.

The programmable logic device receives the motor rotation speed signal, analyzes the motor rotation speed signal to obtain a motor rotation speed value, compares the motor rotation speed value with a threshold value, and judges whether the motor exceeds a preset rotation speed. And outputting a motor overspeed state mark when the motor rotation speed exceeds a specified threshold R _{MOTOR_E}, and clearing the motor overspeed state mark when the motor rotation speed is lower than a specified threshold R _{MOTOR_R}, wherein R _{MOTOR_E}>R_{MOTOR_R} aims to form a hysteresis loop of the rotation speed and prevent frequent switching of the motor overspeed state mark so as to influence subsequent safety state management.

The programmable logic device receives the hardware feedback IGBT module bridge arm fault signals, and according to the IGBT module bridge arm fault signals, the bridge arm fault states of the IGBT module are classified into three types, namely an IGBT module upper bridge arm fault state, an IGBT module lower bridge arm fault state and an IGBT module upper bridge arm and lower bridge arm fault state, wherein the bridge arm fault states of the IGBT module are used for subsequent safety state control management.

The programmable logic device collects a security status request signal and a system enable signal.

The motor controller detects the fault state of the system in real time in the running process, and when serious faults (such as hardware overcurrent, hardware overvoltage, IGBT module bridge arm direct connection and the like) occur, a safety protection mechanism is triggered, namely, a request for entering the safety state is sent out through a hardware detection circuit, a power chip or a main control chip, namely, a safety state request signal is sent out. The programmable device is used for collecting the safety state request signal and controlling the subsequent safety state management.

For the motor controller, the main control chip can control the enabling of the system according to the state of the driving system, namely, when judging that the system has the condition of outputting power, an enabling instruction is given, namely, a system enabling signal is sent out. The programmable device is used for collecting the system enabling signals and is used for subsequent safety state management control.

Optionally, the security state includes at least one of:

It should be noted that, the security state provided by the embodiment of the present invention is divided into: the system comprises a standby state, an operating state, an SPO safety conversion state, an SPO safety control state and an ASC safety state, wherein the ASC safety state comprises an upper bridge arm ASC safety state and a lower bridge arm ASC safety state. The safety state management is to make a reasonable control strategy to control the system to switch and jump in the above six safety states through a state mode management module in the programmable logic device shown in fig. 2, the safety state switching flow is shown in fig. 3, and the safety state switching provides guarantee for the normal operation of the system.

Specifically, the above six safety states are described:

Standby state: the standby state is a default mode after the motor controller is powered on and initialized, no power is output when the system is in the standby state, and six bridge arms of the IGBT module are in the disconnected state, namely the SPO safe state.

Operating state: the running state indicates that the system is in a normal working state, namely the IGBT module normally waves to control the driving motor to output expected torque.

SPO safe transition state: six bridge arms of the IGBT module are all in an off state.

SPO safety control state: six bridge arms of the IGBT module are all in an off state.

It should be noted that, when the motor driving system is in the SPO safe switching state and the SPO safe control state, although the six bridge arms of the IGBT module are in the off state, the SPO safe switching state and the SPO safe control state are different, and as can be seen from fig. 3, the SPO safe switching state is a hub of all the safe states, that is, the SPO safe switching state can be skipped to other safe states, and the SPO safe control state is a final safe state, at this time, both the upper bridge arm and the lower bridge arm of the six bridge arms of the IGBT module have faults, and do not have a condition of entering the ASC safe state, at this time, the SPO safe control state is the only choice.

Upper arm ASC safe state: the three upper bridge arms of the IGBT module are in a conducting state, and the three lower bridge arms are in a disconnecting state.

Lower bridge arm ASC safety state: the three lower bridge arms of the IGBT module are in a conducting state, and the three upper bridge arms are in a disconnecting state.

Wherein the target state is the standby state or the running state.

In the embodiment of the invention, the driving system is controlled to jump among six safety states according to the working condition state of the driving system, so that the safety state of the driving system can reasonably exert the advantages of the ASC safety state and the SPO safety state.

Next, please continue to refer to fig. 3, specifically, a process of controlling the driving system to jump between six safety states is described.

When the current safety state of the driving system is a standby state or an operation state and the working condition state of the driving system is a first state, the safety state of the driving system is controlled to be switched from the standby state or the operation state to an SPO safety conversion state;

When the safety state of the driving system is changed into an SPO safety conversion state and the working condition state of the driving system is a second state, the safety state of the driving system is controlled to be switched from the SPO safety conversion state to an upper bridge arm ASC safety state or a lower bridge arm ASC safety state;

when the safety state of the driving system is changed into the SPO safety conversion state and the working condition state of the driving system is the third state, the safety state of the driving system is controlled to be switched from the SPO safety conversion state to the ASC safety state.

Specifically, when the current safety state of the driving system is a standby state and the working condition state of the driving system is a first sub-state in the first state, the safety state of the driving system is controlled to be switched from the standby state to the SPO safety transition state, and when all the following conditions are met, the first sub-state in the first state is satisfied:

the IGBT module bridge arm fault state or the safety request state;

the power supply of the low-voltage power supply is in a normal state.

That is, in the event of an IGBT module bridge fault or a valid safety request signal (the drive system has a request to enter a safe state), the first sub-state in the first state is satisfied if the power supply signal is normal (the power supply voltage is in the normal range).

It should be noted that, when the bridge arm of the IGBT module fails or the system has a requirement for entering the safe state, the safe state should be entered, but considering that the normal power supply of the low voltage power supply is a precondition for ensuring that the system normally enters the safe state (the bridge arm of the IGBT module cannot be normally driven due to the abnormal low voltage power supply), the constraint condition of the low voltage power supply is added. When a first sub-state in the first state is satisfied, the system jumps from the "standby state" to the "SPO safe transition state".

A disabled state; the disable state is determined from a system enable signal;

Specifically, when the current safe state of the driving system is an operation state and the working condition state of the driving system is a second sub-state in the first state, the safe state of the driving system is controlled to be switched from the operation state to the SPO safe transition state, and when any one of the following conditions is met, the second sub-state in the first state is satisfied:

IGBT module bridge arm fault state;

a disabled state;

a security request state;

That is, when any one of the conditions that the IGBT module bridge arm failure occurs, the system is in the disabled state, and the security request signal is valid is satisfied, the second sub-state in the first state is satisfied.

It should be noted that, when any one of the above three conditions is satisfied, it indicates that the system does not have a normal operation condition, and therefore, it is necessary to enter a protection mode in a fault state, and when the second sub-state in the first state is satisfied, the system jumps from the "running state" to the "SPO safe transition state".

It should be noted that, when the current safety state of the driving system is a standby state and the working condition state of the driving system is a seventh state, the safety state of the driving system is controlled to be switched from the standby state to the running state;

The seventh state includes:

The power supply of the low-voltage power supply is in a normal state; the normal state of the low-voltage power supply is determined according to the low-voltage power supply signal;

An enable state; the enabling state is determined according to a system enabling signal;

a no security request state; the no-security-request state is determined from a security state request signal.

That is, when the current safe state of the driving system is the standby state and the working condition state of the driving system is the seventh state, the safe state of the driving system is controlled to be switched from the standby state to the running state, and when all the following conditions are satisfied, the seventh state is satisfied:

the power supply of the low-voltage power supply is in a normal state;

The bridge arm of the IGBT module has no fault state;

an enable state;

no security request state.

That is, when the low-voltage power supply signal is normal (the low-voltage power supply voltage is in the normal range), the bridge arm of the IGBT module has no fault, the driving system is in the enabled state (the system enable signal is valid), and the safety state signal is invalid (the system has no safety state request), that is, when all the above conditions are satisfied, the driving system has the condition of normal operation, and therefore, the safety state of the driving system is switched from the standby state to the operating state.

Optionally, the second state includes:

Specifically, when the current safety state of the driving system is the SPO safety transition state and the working condition state of the driving system is the first sub-state in the second state, the safety state of the driving system is controlled to be switched from the SPO safety transition state to the lower bridge arm ASC safety state, and when all the following conditions are met, the first sub-state in the second state is satisfied:

the motor is in an overspeed state;

The IGBT module has an upper bridge arm fault.

That is, the first sub-state in the second state is satisfied when the motor speed is in an overspeed state and a failure of the upper leg of the IGBT module occurs.

It should be noted that, in the SPO safe conversion state, when the motor rotation speed exceeds the threshold value (the motor rotation speed is in the overspeed state), it indicates that the counter electromotive force generated by the SPO control will impact the system at this time, the control system needs to enter the ASC safe state to avoid the damage caused by the counter electromotive force to the system, in this state, the bridge arm state of the IGBT module is continuously judged, if the upper bridge arm of the IGBT module fails and the lower bridge arm does not fail, the control system enters the ASC safe state of the lower bridge arm, in the ASC safe state of the lower bridge arm, the ASC control is realized by controlling the conduction of the lower bridge arm of the IGBT module and the disconnection of the upper bridge arm.

When the current safety state of the driving system is an SPO safety conversion state and the working condition state of the driving system is a second sub-state in a second state, the safety state of the driving system is controlled to be switched from the SPO safety conversion state to an ASC safety state of an upper bridge arm, and when all the following conditions are met, the second sub-state in the second state is satisfied:

the motor is in an overspeed state;

the IGBT module has a lower bridge arm fault.

That is, the second sub-state in the second state is satisfied when the motor speed is in an overspeed state and a lower leg failure of the IGBT module occurs.

It should be noted that, in the SPO safe conversion state, when the motor rotation speed exceeds the threshold value (the motor rotation speed is in the overspeed state), it indicates that the counter electromotive force generated by the SPO control will impact the system at this time, the control system needs to enter the ASC safe state to avoid the damage caused by the counter electromotive force to the system, in this state, the bridge arm state of the IGBT module is further judged, if the lower bridge arm of the IGBT module fails and the upper bridge arm does not fail, the control system enters the ASC safe state of the upper bridge arm, and in the ASC safe state of the upper bridge arm, the ASC control is realized by controlling the upper bridge arm of the IGBT module to be turned on and the lower bridge arm to be turned off.

That is, when the system is in the lower bridge arm ASC safe state, ASC control is realized by controlling the conduction of three lower bridge arms and the disconnection of three upper bridge arms of the IGBT module.

That is, when the system is in the upper bridge arm ASC safe state, ASC control is realized by controlling the conduction of three upper bridge arms and the disconnection of three lower bridge arms of the IGBT module.

Optionally, the third state includes:

Specifically, when the current safety state of the driving system is the SPO safety transition state and the working condition state of the driving system is the third state, the safety state of the driving system is controlled to be switched from the SPO safety transition state to the SPO safety control state, and when all the following conditions are met, the third state is satisfied:

and the IGBT module is in an upper bridge arm fault state and in a lower bridge arm fault state.

That is, the third state is satisfied when both the upper leg and the lower leg of the IGBT module fail.

In the SPO safe switching state, if both the upper bridge arm and the lower bridge arm of the IGBT module fail, the control system jumps from the SPO safe switching state to the SPO safe control state. Although the SPO safety control state and the SPO safety switching state both adopt the SPO control method, which is not helpful to alleviate the problem of back electromotive force, the SPO safety switching state is responsible for the function of the state switching transfer station, and the switching among the standby state, the running state and all other safety states needs to be performed through the SPO safety switching state, so that it is necessary to set a safety state, namely the SPO safety control state, for the state of the upper bridge arm failure of the IGBT module and the lower bridge arm failure of the IGBT module. In fact, the SPO security control state more represents an uncontrollable security state.

With continued reference to fig. 3, when the current safety state of the driving system is the SPO safety transition state and the working condition state of the driving system is the fourth state, the safety state of the driving system is controlled to be switched from the SPO safety transition state to the standby state.

Optionally, the fourth state includes:

Specifically, when the current safety state of the driving system is the SPO safety transition state and the working condition state of the driving system is the fourth state, the safety state of the driving system is controlled to be switched from the SPO safety transition state to the standby state, and when all the following conditions are met, the fourth state is satisfied:

The bridge arm of the IGBT module has no fault state;

A no security request state;

the motor is not in an overspeed state.

That is, when no faults occur in the upper bridge arm and the lower bridge arm of the IGBT module, the system has no safety state request, and the motor rotation speed is in the non-overspeed state, the fourth state is satisfied.

In the SPO safe switching state, if the bridge arm of the IGBT module has no fault and the safety request signal is invalid, it indicates that the system is not required to be protected by the safety control state, in this state, whether the motor rotation speed exceeds the predetermined threshold value is determined, and in consideration of the standby state, the system is in the SPO state, and the back electromotive force problem is caused by the excessive motor rotation speed, so that if the motor rotation speed does not exceed the predetermined threshold value, the condition of entering the standby state is satisfied, and the system jumps from the SPO safe switching state to the standby state.

With continued reference to fig. 3, when the current safety state of the driving system is an ASC safety state and the working condition state of the driving system is a fifth state, the safety state of the driving system is controlled to be switched from the ASC safety state to an SPO safety switching state.

Because the ASC safety state comprises an upper bridge arm ASC safety state and a lower bridge arm ASC safety state, when the working condition state of the driving system is the first sub-state in the fifth state, the safety state of the driving system is controlled to be switched from the lower bridge arm ASC safety state to the SPO safety conversion state; and when the working condition state of the driving system is the second sub-state in the fifth state, controlling the safety state of the driving system to be switched from the ASC safety state of the upper bridge arm to the SPO safety conversion state.

The first module is an IGBT module or a motor;

Specifically, when the current safety state of the driving system is the lower bridge arm ASC safety state and the working condition state of the driving system is the first sub-state in the fifth state, the safety state of the driving system is controlled to be switched from the lower bridge arm ASC safety state to the SPO safety conversion state, and when any one of the following conditions is met, the first sub-state in the fifth state is satisfied:

An IGBT module overtemperature state or a motor overtemperature state, and the motor is not in an overspeed state;

And the lower bridge arm of the IGBT module is in a fault state.

That is, condition one: when the temperature of the IGBT module or the temperature of the motor exceeds a corresponding threshold value, the motor is in an overtemperature state, and the rotating speed of the motor is not in an overspeed state; or, condition two: and when the lower bridge arm of the IGBT module fails and is satisfied, the first sub-state in the fifth state is satisfied.

In the lower arm ASC safety state, if the IGBT module fails, it is necessary to exit from the lower arm ASC safety state, that is, to re-jump from the lower arm ASC safety state to the SPO safety transition state, and then to switch the system from the lower arm ASC safety state to the SPO safety transition state according to a predetermined logic to implement a subsequent jump of the safety state, in which if the motor rotation speed does not exceed a predetermined threshold (the motor rotation speed does not overspeed), and in which if the temperature of the IGBT module or the motor exceeds an overspeed, continuing to perform ASC safety control will cause a serious heat accumulation problem of the IGBT module or the motor, and in this case, the SPO safety state control is more reasonable (because the motor does not overspeed, there is no excessive back emf problem), and therefore, by switching the system from the lower arm ASC safety state to the SPO safety transition state, a further increase in the temperature of the IGBT module or the motor can be avoided.

The first module is an IGBT module or a motor;

Specifically, when the current safety state of the driving system is the upper bridge arm ASC safety state and the working condition state of the driving system is the second sub-state in the fifth state, the safety state of the driving system is controlled to be switched from the upper bridge arm ASC safety state to the SPO safety conversion state, and when any one of the following conditions is met, the second sub-state in the fifth state is satisfied:

and the IGBT module is in a bridge arm fault state.

That is, condition one: when the temperature of the IGBT module or the temperature of the motor exceeds a corresponding threshold value, the motor is in an overtemperature state, and the rotating speed of the motor is not in an overspeed state; or, condition two: and when the upper bridge arm of the IGBT module fails and is satisfied, the second sub-state in the fifth state is satisfied.

In the upper arm ASC safety state, if the upper arm of the IGBT module fails, the drive system must exit from the upper arm ASC safety state, i.e., the upper arm ASC safety state is restarted to the SPO safety switching state, then the SPO safety switching state is taken as a transfer station to implement the subsequent jump of the safety state according to the predetermined logic, in the upper arm ASC safety state, if the motor rotation speed does not exceed the specified threshold (the motor rotation speed does not overspeed), and in the motor rotation speed does not overspeed state, if the temperature of the IGBT module or the motor exceeds the temperature, continuing to perform the ASC safety control will cause the heat accumulation problem of the IGBT module or the motor to be more serious, and in this case, the SPO safety state control is adopted more reasonably (because the motor does not overspeed, there is no excessive problem), so by switching the system from the upper arm ASC safety state to the SPO safety switching state, the temperature of the IGBT module or the motor can be prevented from further rising.

With continued reference to fig. 3, when the current safety state of the driving system is the SPO safety control state and the working condition state of the driving system is the sixth state, the safety state of the driving system is controlled to be switched from the SPO safety control state to the SPO safety transition state.

Optionally, the sixth state includes one of:

Specifically, when the current safety state of the driving system is the SPO safety control state and the working condition state of the driving system is the sixth state, the safety state of the driving system is controlled to be switched from the SPO safety control state to the SPO safety switching state, and when any one of the following conditions is met, the sixth state is satisfied:

The fault recovery state of the upper bridge arm of the IGBT module;

and recovering the fault state of the lower bridge arm of the IGBT module.

That is, the sixth state is satisfied when a failure of the upper bridge arm of the IGBT module or a failure recovery of the lower bridge arm of the IGBT module is detected.

In the SPO safety control state, if a fault of the upper bridge arm of the IGBT module or a fault of the lower bridge arm of the IGBT module is detected to be recovered, it indicates that the driving system has a condition of entering the ASC safety state, so that in the working condition state, the driving system jumps from the SPO safety control state to the SPO safety transition state, and then, the following safety state jump is completed by taking the SPO safety transition state as the transfer station.

The embodiment of the invention is widely applied to a motor controller of a pure electric automobile in recent years based on the characteristics of programmable logic devices such as FPGA (field programmable gate array), CPLD (complex programmable logic device) and the like, such as high operation speed, high computing capacity, rich interfaces and the like, and is used for obtaining the working condition states of a driving system such as the temperature value of an IGBT (insulated gate bipolar transistor) module and a motor, the voltage value of a direct current bus, the current rotating speed of the motor, the low-voltage power supply state of the system, the system fault state and the like, and managing the safety state of the system through the information of the working condition states, wherein the safety state is divided into six safety states including a standby state, an operating state, an SPO safety conversion state, an SPO safety control state, an upper bridge arm ASC safety state and a lower bridge arm ASC safety state. On the basis of completing the safety state division of the system, the embodiment of the invention can also enable the driving motor to enter a reasonable safety state according to the working condition state of the system, and realize the fine management of the safety state by the system temperature, the motor rotating speed, the direct current bus voltage and the fault state of the system, thereby fully playing the advantages of the ASC safety state and the SPO safety state, avoiding the defects to the greatest extent and further achieving the purpose of protecting the system. In addition to the above, since the security state control method provided by the embodiment of the present invention is completed by a programmable logic device, it has a protection speed of a hardware level, so that the highest level of system protection response speed can be achieved. The method for controlling the safety state of the motor controller of the pure electric vehicle based on the programmable logic device has the characteristics of clear thought, reasonable protection mechanism, easy engineering realization and the like, and can provide hardware-level protection for the system, so that the method has good popularization value.

As shown in fig. 4, an embodiment of the present invention further provides a safety state control device, including:

A first determining module 401, configured to determine, according to an acquired working signal of a driving system, a working condition state of the driving system;

The control module 402 is configured to control a safety state of the driving system according to a working condition state of the driving system.

According to the embodiment of the invention, the working condition state of the driving system is determined through the collected working signals of the driving system, and the safety state of the driving system is controlled according to the working condition state of the driving system, so that the safety state of the driving system can reasonably play the advantages of ASC safety state and SPO safety state according to the working condition of the system.

Optionally, the working signal includes at least one of:

Optionally, the security state includes at least one of:

Optionally, the control module 402 is specifically configured to at least one of:

Wherein the target state is the standby state or the running state.

A disabled state; the disable state is determined from a system enable signal;

Optionally, the second state includes:

Optionally, in the case that the ASC security state is a lower bridge arm ASC security state, the control module 402 is further configured to, after controlling the security state of the driving system to be switched from the SPO security switching state to the ASC security state, the control module 402:

Optionally, in the case that the ASC security state is an upper bridge arm ASC security state, the control module 402 is further configured to, after controlling the security state of the driving system to be switched from the SPO security switching state to the ASC security state, the control module 402:

Optionally, the third state includes:

Optionally, after the control module 402 controls the safety state of the driving system to switch from the target state to the SPO safety transition state, the control module 402 is further configured to:

Optionally, the fourth state includes:

Optionally, after the control module 402 controls the safety state of the driving system to be switched from the SPO safety transition state to the ASC safety state, the control module 402 is further configured to:

The first module is an IGBT module or a motor;

Optionally, after the control module 402 controls the switching of the security state from the SPO security transition state to the SPO security control state, the control module 402 is further configured to:

Optionally, the sixth state includes one of:

It should be noted that, the safety state control device provided in the embodiment of the present invention is a device capable of executing the above-mentioned safety state control method, and all embodiments of the above-mentioned safety state control method are applicable to the device, and can achieve the same or similar technical effects.

The embodiment of the invention also provides a motor controller, which comprises a processor and a memory; the memory is used for storing programs and data used by the processor in executing operations, and the processor calls and executes the programs and data stored in the memory.

Wherein the motor controller further comprises a transceiver for receiving and transmitting data under the control of the processor.

Specifically, the processor is used for determining the working condition state of the driving system according to the collected working signals of the driving system; and controlling the safety state of the driving system according to the working condition state of the driving system.

Optionally, the working signal includes at least one of:

Optionally, the security state includes at least one of:

Optionally, the processor is specifically configured to at least one of:

Wherein the target state is the standby state or the running state.

A disabled state; the disable state is determined from a system enable signal;

Optionally, the second state includes:

Optionally, in the case that the ASC security state is a lower bridge arm ASC security state, after the processor controls the security state of the driving system to be switched from the SPO security transition state to the ASC security state, the processor is further specifically configured to:

Optionally, in the case that the ASC security state is an upper bridge arm ASC security state, after the processor controls the security state of the driving system to be switched from the SPO security transition state to the ASC security state, the processor is further specifically configured to:

Optionally, the third state includes:

Optionally, after the processor controls the safety state of the driving system to switch from the target state to the SPO safety transition state, the processor is further specifically configured to:

Optionally, the fourth state includes:

Optionally, after the processor controls the safety state of the driving system to be switched from the SPO safety transition state to the ASC safety state, the processor is further specifically configured to:

The first module is an IGBT module or a motor;

Optionally, after the processor controls the security state to be switched from the SPO security transition state to the SPO security control state, the processor is further specifically configured to:

Optionally, the sixth state includes one of:

While the foregoing is directed to the preferred embodiments of the present invention, it will be appreciated by those skilled in the art that various modifications and changes can be made without departing from the principles of the present invention, and such modifications and changes are intended to be within the scope of the present invention.

Claims

1. A safety state control method, characterized by comprising:

Controlling the safety state of the driving system according to the working condition state of the driving system;

Wherein the security state comprises at least one of:

A standby state; an operating state; closing the drive output SPO safe conversion state; closing the drive output SPO safety control state; active short ASC safety state;

according to the working condition state of the driving system, the safety state of the driving system is controlled, and the method comprises the following steps:

the second state includes:

2. The safety state control method according to claim 1, wherein the operation signal includes at least one of:

3. The method of claim 1, wherein the controlling the safety state of the driving system according to the operating condition of the driving system further comprises at least one of:

Wherein the target state is the standby state or the running state.

4. A safety state control method according to claim 3, wherein in the case where the target state is the standby state, the first state includes:

5. A safety state control method according to claim 3, wherein in the case where the target state is the running state, the first state includes at least one of:

A disabled state; the disable state is determined from a system enable signal;

6. The safety state control method according to claim 1, wherein, in the case where the ASC safety state is a lower arm ASC safety state, after controlling the safety state of the drive system to be switched from the SPO safety transition state to the ASC safety state, the method further comprises:

7. The safety state control method according to claim 1, wherein, in the case where the ASC safety state is an upper arm ASC safety state, after controlling the switching of the safety state of the drive system from the SPO safety transition state to the ASC safety state, the method further comprises:

8. A safety state control method according to claim 3, wherein the third state includes:

9. A security state control method according to claim 3, wherein after controlling the security state of the drive system to be switched from the target state to the SPO security transition state, the method further comprises:

10. The safety state control method according to claim 9, wherein the fourth state includes:

11. The method of claim 1, wherein after controlling the switching of the security state of the drive system from the SPO security transition state to the ASC security state, the method further comprises:

12. The safety state control method according to claim 11, wherein in the case where the ASC safety state is a lower arm ASC safety state, the fifth state includes one of:

The first module is an IGBT module or a motor;

13. The safety state control method according to claim 11, wherein in the case where the ASC safety state is an upper arm ASC safety state, the fifth state includes one of:

The first module is an IGBT module or a motor;

14. A security state control method according to claim 3, wherein after controlling the security state to be switched from the SPO security transition state to the SPO security control state, the method further comprises:

15. The safety state control method according to claim 14, wherein the sixth state includes one of:

16. A safety state control device, characterized by comprising:

the control module is used for controlling the safety state of the driving system according to the working condition state of the driving system;

Wherein the security state comprises at least one of:

The control module is specifically configured to:

the second state includes:

17. A motor controller, comprising: a processor, a memory and a program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the safety state control method according to any one of claims 1 to 15.

18. A readable storage medium, characterized in that the readable storage medium has stored thereon a program which, when executed by a processor, implements the steps in the safety state control method according to any one of claims 1 to 15.