DE102005025994B4 - Method for operating an electric machine and drive system for this purpose - Google Patents

Abstract

Control system for an electrical machine (1), comprising a control unit (3) and a monitoring unit (4) independent thereof, wherein a data line (12) is provided, via which the monitoring unit (4) sends the control command for a reset to the control unit (4). 3), characterized in that the control unit (3) is connected to two data communication blocks (5, 6), wherein the first data communication block (5) forwards function messages and can be deactivated by the monitoring unit (4), and the second data communication block (6) Forward data for reprogramming the control unit (3) and / or the monitoring unit (4).

Description

The invention relates to a drive system for an electrical machine.

From the publication DE 102 51 095 A1 a method for operating an electrical machine is known, with a drive system, wherein an operating variable of the electrical machine and / or the drive system is monitored, and wherein the permissibility of an actual torque of the electric machine is checked and an error reaction is initiated in the event of inadmissibility of the actual torque. The permissibility of the actual torque is preferably checked in such a way that an allowable torque is formed from a desired torque and predefined limit values for the desired torque, and that the actual torque is permissible if its deviation from the permissible torque does not exceed a certain amount. The invention can be used to monitor an electrical machine used as a starter / generator in a motor vehicle.

From the DE 10 2004 022 767 A1 a method for operating an electric machine is known, with a drive system, wherein an operating variable of the electric machine and / or the drive system is monitored, in which at least one torque mode, a charge mode and a speed mode are provided.

DE 198 16 046 A 1 discloses a safety device for a drive with a monitoring device that evaluates a variable describing the operating state of the drive. whether an emergency operation should be started to protect the drive instead of normal operation. The monitoring device generates at least a first output signal for an energy supply to the motor influencing control element, wherein in normal operation an alternating signal and in emergency operation, a DC signal are used as the output signal.

The DE 699 28 846 T2 , Translation of the European patent specification EP 0 937 600 A2 discloses a hybrid drive system for a multi-mode vehicle of the electric motor drive. When the driving force command value is negative, using the electric motors as generators, regenerative energy can be stored in the battery. In addition, when an error occurs, the mode is changed to an error mode associated with the error, which is suitable for coping with the error.

DE 197 56 616 A1 relates to a device for monitoring a microcontroller-controlled electric motor drive, in particular a garage door drive. In this case, at least one of the strength of the drive motor flowing stream indicating first monitoring signal is fed to a control microcontroller. This outputs a drive motor decommissioning fuse signal when the monitoring signal indicates a certain motor maximum current exceeding value. It is provided by a control microcontroller separate monitoring module, the first monitoring signal is supplied in parallel to the control microcontroller and regardless of the first backup signal from the control microcontroller, the drive motor with a second backup signal out of service, if the first backup signal is either not generated or does not lead to decommissioning of the drive motor.

EP 1 352 186 B1 shows a method for controlling a motor vehicle transmission, in which the current driving situation of the motor vehicle characterizing signals are evaluated, therefrom control signals for the selection of a switching characteristic are generated and a switch to a corresponding switching map or shifting a switching map is effected.

DE 100 35 783 A1 shows a device for monitoring a measuring system of an electric drive, comprising a measuring system for detecting at least one measured variable of an electric drive, at least one controller to which at least the measured variable detected by the measuring system is supplied, and generates at least one manipulated variable for driving the drive, wherein at least one signal detection for error detection of the measuring system is provided.

In contrast, the object of the present invention is to increase the availability of the electrical machine.

This object is achieved according to the invention by the features of the independent claims.

To this end, the unclaimed method of operating an electrical machine provides that a separate emergency mode is started when the monitor detects an error requiring the activation of an emergency mode.

An error is defined here as a non-fulfillment of a request to a particular unit or unit. Double errors are two errors which occur within a short time window or period and are not causally related to each other. Two single errors that occur outside of this short time window and are also not causally related are called double errors. Advantageously, these types of errors, if they lead to deviations in the desired states, can be detected by the method according to the invention.

A possible error is implausible data. Data is considered plausible if it is up to date and without transmission errors.

Another error occurs when state variables are inadmissible. For this purpose, admissibility checks take place in the monitoring unit. Actual values are then checked to see if they are within the permissible limits assigned to them. The present invention is particularly effective when the fault is a failure or faulty operation of the data network.

Of course, this enumeration of the types of errors is not conclusive, and with the method according to the invention or the device according to the invention, other types of errors, for example, causally related errors, can be detected.

If an error is detected, it is decided whether this error disturbs the proper operation of the electrical machine. Typically, this is the case when the data network has failed or is operating incorrectly, so that no or only erroneous data from the data network is fed to the process.

The data network can for example be based on a CAN bus (Controller Area Network), on MOST (Media Oriented System Technology) or an optical fiber bus, or on a Flex-Ray communication system.

If the proper operation of the electrical machine in the activated operating mode can not be ensured with certainty, an emergency mode is activated. The emergency mode is designed so that critical operating conditions of the electrical machine are excluded. Thus, the electric machine can continue to operate even when a fault occurs. This increases the availability of the electrical machine. This also leads to increased availability of the overall system associated with the electrical machine.

Such an overall system may include, for example, in addition to the electric machine, an internal combustion engine, another electric machine and / or a battery. Such an overall system can be designed as a hybrid drive of a vehicle. Also, an oil pump or other actuator may be connected to the electric machine in an overall system.

In a non-claimed embodiment, a target torque with the value zero is specified in emergency mode. This avoids the risk of a critical fault control of the electric machine without the electric machine being switched off or short-circuited.

In an unclaimed embodiment, an operating mode designated as a charge mode is associated with a separate emergency mode that allows only negative target torques. This emergency mode represents a safe charging mode. The charging function is largely retained, the risk of incorrect loading of the electrical machine is eliminated. This mode can also be used as an emergency mode for the generator mode of the torque mode.

In an embodiment not claimed, an operating mode designated as a speed mode is assigned a separate emergency mode. Here, a fixed speed is set as the setpoint speed internally by the control system. Thus, the engine start of an internal combustion engine can also be performed when the control of the electric machine with a normal operating mode is no longer possible without errors. The engine start of the internal combustion engine is typically initiated via a hardware line.

In a non-claimed embodiment, an additional torque-influencing engagement is performed regardless of the driver's torque demand. This enables cooperation of the procedure with other methods. In particular, cooperation with an anti-Sudder is foreseen in this context. Shudders are vibrations of the electric machine caused by the torsion of components of the drive train during torque transmission. The electric machine has an internal control that detects these vibrations and generates corresponding compensating moments. This torque-influencing intervention is called antishudder.

In an embodiment not claimed, the time integral of the nominal torque of the torque-influencing engagement of the electric machine is compared with a predeterminable upper limit and a predeterminable lower limit to monitor the torque-influencing engagement and an error of the torque-influencing engagement is detected when the time integral from the desired torque of the torque-influencing engagement leaves the area enclosed by these boundaries.

This checks the additional torque-influencing intervention for its plausibility. The time integral of the target torque should be zero on average. It can be positive or negative over a period of time. But if it increases continuously or goes down to negative, the cause must be found in an error that causes a permanent one-sided intervention. Such an error is detected by the method step just described. In one embodiment, the erroneously operating torque-influencing engagement is turned off.

In an unclaimed embodiment, a suitable emergency mode is selected when an error has been detected that requires activation of an emergency mode. Subsequently, the plausibility of the request of the emergency mode is checked. If the request is plausible, the emergency mode is activated. In the case of an implausible request for the emergency mode, a reset of the electrical control system is carried out. This procedure prevents switching to emergency mode for no reason. This increases the extent of the availability of the electrical machine and its associated overall system.

In an unclaimed embodiment, the activated emergency mode is monitored. This will ensure that the emergency mode is working properly. In addition, it can be monitored when a return to a normal operating mode can take place.

The invention relates to a drive system for an electrical machine, comprising a control unit and a monitoring unit independent thereof, wherein a data line is provided, via which the monitoring unit can forward the control command for a reset to the control unit.

According to the invention, the drive system in a first embodiment is characterized in that the control unit is connected to two data communication blocks, wherein the first data communication module forwards function messages and can be deactivated by the monitoring unit, and the second data communication module can forward data for reprogramming the control unit and / or the monitoring unit.

The drive system for an electrical machine has a control unit and a monitoring unit, wherein the control unit is connected to two data communication blocks. The first data communication module forwards function messages and can be deactivated by the monitoring unit. The second data communication module can forward data for reprogramming the control unit and / or the monitoring unit. Also data for diagnosis, for applications or other can be passed on the second data communication block.

This means that the input for function messages is separate from the input for applications and for the transfer of new software. When transferring new software, the input for function messages can be deactivated. This has the advantage that in this period no false or unreasonable data can be transmitted via this input or processes can become unsynchronized. This serves to avoid errors.

The monitoring of the corresponding components or signals and, if appropriate, the initiation of an error reaction or suitable measures takes place independently, i. regardless of a user reaction or, when used in a motor vehicle, regardless of a driver's reaction.

In response to a detected error, different error responses are possible. For example, the electric machine can be put out of operation. Depending on the type of electrical machine, the output stage can be disabled or the electrical machine is short-circuited via the power stage. The user can be informed in the event of a fault by optical or acoustic signals.

A particularly favorable error response is the activation of an emergency mode for operating the electric machine.

If an error occurs, the system can be reset. A reset is understood to mean the transfer of a system to a controlled state. This can be triggered by a software function call (ROM, RAM test, etc.) or by hardware measures such as watchdog, power-on reset, or the like. With a reset, a system that is in a faulty or undefined state can be restored to a permitted and defined state. This increases the availability of the system.

If an error occurs only for a meaningless short time, or if there is an error that does not affect the proper operation, an error response may be omitted. For example, for a certain time, the last error-free value may replace the current value that is not present because of the error. Only when the error lasts longer than allowed, an error reaction is triggered (debouncing).

In one embodiment of the drive system, the monitoring unit is connected via a data line to the control unit, via which the control unit can pass a reset-disable control command to the monitoring unit to prevent the transmission of a reset control command (from the monitoring unit to the control unit).

If the control unit is re-flashed (this refers to the dubbing of new or updated software), there will be no normal communication with the monitoring unit during this time. This situation could interpret the monitoring unit as an error in the control unit. In response, the monitoring unit would perform a reset of the control unit. This reaction is undesirable. Therefore, it is provided that the control unit can prevent a reset. In the embodiment described above, the control unit sends to a reset-disable control command to the monitoring unit. Such functionality is not critical, as it only restricts the availability of the system acquired by the reset when an error occurs, but can not itself generate errors.

• 1 Einen schematischen Aufbau der Vorrichtung zur Durchführung des Verfahrens,
• 2 ein Beispiel für den zeitlichen Verlauf des Istmoments und der zugehörigen Grenzmomente in Momentenmodus und Lademodus,
• 3 eine Darstellung der erlaubten Wertebereiche für das Istmoment mit den zugehörigen Grenzwerten in Momentenmodus, Lademodus und Drehzahlmodus,
• 4 eine Darstellung der erlaubten Wertebereiche für das Istmoment mit den zugehörigen Grenzwerten in Moment-0-Notmodus, Lade-Notmodus und VMStart-Notmodus.

Further advantageous embodiments of the invention will become apparent from the dependent claims and with reference to the drawings. Showing:

• 1 A schematic structure of the device for carrying out the method,
• 2 an example of the time profile of the actual torque and the associated torque limits in torque mode and charging mode,
• 3 a representation of the permitted value ranges for the actual torque with the associated limit values in torque mode, charging mode and speed mode,
• 4 a representation of the permitted value ranges for the actual torque with the associated limit values in torque 0 emergency mode, charge emergency mode and VMStart emergency mode.

1 shows a possible embodiment of the device according to the invention. Here is an electric machine 1 via a power amplifier 2 connected to a drive system.

Electrical machines 1 find their application in the most diverse areas. Used in a motor vehicle is the electric machine 1 for example, as a starter / generator or as a motor / generator operable. Likewise, the electric machine 1 can be used as the main drive of a motor vehicle, as an additional drive or for driving support of an internal combustion engine provided in the motor vehicle and / or for the energy supply of a vehicle electrical system provided in the motor vehicle.

The electric machine 1 For example, it can be designed as a permanent-magnet machine or as an asynchronous machine.

About the power amplifier 2 be amplitude, frequency and phase of the phase currents of the electric machine 1 set. In one embodiment, the final stage 2 in the control unit 3 be integrated with the drive system.

The drive system has a control unit 3 and a monitoring unit 4 on. The control unit 3 is with two data communication blocks 5 . 6 connected via a transciever 7 with a data network 8th are connected.

The control unit 3 includes functions for controlling or operating the electric machine 1 , This part can therefore also be called a functional level.

In the control unit 3 there is a monitoring of the operation of the electrical machine 1 relevant components, the diagnosis of input and output variables, as well as a control of system reactions in the event of an error, wherein under a system, both the control system and the electric machine 1 as well as the combination of both components is understood.

The control unit 3 In particular, it has a function block in which drive signals for the output stage 2 be formed. These drive signals are the final stage 2 supplied via unspecified lines.

The monitoring unit 4 is preferably used to monitor the control unit 3 or the functional sequences in the control unit 3 , It is the task of the monitoring unit 4 To recognize mistakes.

Further details and embodiments of the control unit 3 and the monitoring unit 4 and the method for error detection are the DE 102 004 002 767 removable and will therefore not be explained here.

As already described, the control unit 3 with two data communication blocks 5 . 6 connected via a transciever 7 with a data network 8th are connected.

The data communication blocks 5 . 6 can data from the data network 8th received and sent to the control unit 3 pass on.

Likewise, the data blocks 5 . 6 Data from the control unit 3 received and to the data network 8th pass on. The data communication blocks 5 . 6 , all received data or only a certain selection of received data can forward. In particular, they can filter out the data assigned to them from a common data set. For example, the data block 5 be provided for the transmission of functional data. In particular, it can be provided a data communication module 6 to provide for the transfer of new software.

During the transfer of new software through the data communication module 6 For reasons of security, it makes sense to use the data communication module 5 to disable. This is indicated by the connection between Transciever 7 and the data communication module 5 a switch 13 on, the transfer of data towards Transciever 7 and data network 8th can interrupt. Via a data line 9 can be the control of the switch 13 through the monitoring unit 4 respectively. Task of the switch 13 is to prevent useless or erroneous data from being sent to the data network 8th be passed on. The desk 13 can also (eg as a software solution) in the data communication block 5 be integrated. Other equivalent solutions are possible.

control unit 3 and monitoring unit 4 are via a communication path 11 connected with each other. This communication path 11 transmits data from the control unit 3 to the monitoring unit 4 and vice versa.

The control unit 3 and the monitoring unit 4 are via a reset path 12 connected with each other. About this reset path 12 can be a reset command from the monitoring unit 4 to the control unit 3 be passed on.

The control unit 3 and the monitoring unit 4 are via a reset-disable path 10 connected with each other. About this reset-disable path 10 can the control unit 3 a reset-disable command to the monitoring unit 4 send and thus the transmission of a reset command from the monitoring unit 4 to the control unit 3 prevention.

Both the control unit 3 as well as the monitoring unit 4 have their own shutdown path 14 . 15 to switch off the power amplifier 2 ,

The control system may be assigned to a further monitoring level, not shown, which by a question / answer principle, the proper operation of the control system or the control unit 3 or the monitoring unit 4 testing. Should an error occur, the triggering of corresponding system reactions or error measures is preferably independent of the control unit 3 , regardless of the monitoring unit 4 and independent of the power amp 2 ,

To power the drive system and the electrical machine 1 an unillustrated current or voltage source is provided.

The control of the electric machine 1 via the control system. In this case, the electric machine 1 be operated in different modes. For example, a torque mode, and a charging mode may be provided. This has the advantage that the electric machine 1 exactly to the behavior desired by the consumer is adjustable. Of course, other modes can be provided. In 2 is an example of the timing of the actual torque in torque mode and charging mode and the associated limit moments shown. The time is shown on the x-axis and the moment on the y-axis. In the example shown, the electric machine starts 1 at time zero with a moment zero. The electric machine 1 is in torque mode. In moment mode is the electric machine 1 in motor operation (positive setpoint torque Mmax) or in generator mode (negative setpoint torque Mmax) operable.

First, the torque mode is operated in the example shown in the engine operation. The setpoint Mmax is first raised from 0 Nm to 10 Nm and later to 100 Nm. Subsequently, will Mmax lowered from 100 Nm to 50 Nm. Starting from Mmax = 50 Nm, the torque mode of the electric machine changes from engine operation to generator operation. For this purpose, a setpoint value of -100 Nm is specified for generator operation.

The change of the setpoint value Mmax takes place without transition as a step function. The actual torque M_act adapts to the target value Mmax, approaching Mmax asymptotically. This results in the change of Mmax = 100 Nm to Mmax = 50 Nm and in the change of Mmax = 50 Nm to Mmax = -100 Nm causes M_ist during the approach to the new setpoint ( 50 Nm or -100 Nm) is above Mmax.

The permissible limits Mmax_z and Mmin_z adapt to the setpoint Mmax. When the setpoint Mmax is increased, the upper limit value also jumps Mmax_z to a higher value. If the setpoint Mmax is lowered, the upper limit approaches Mmax_z asymptotically to his new value, that he is always at a distance above M_act remains. Mmax_ z is therefore always larger than Mmax. Does the setpoint go? Mmax In the generator mode of the torque mode to negative values, so approaches the upper limit Mmax_z a fixed low positive value (eg 5 Nm).

The lower limit Mmin_z assumes a fixed low negative value (eg -5 Nm) as long as the torque mode is in motor mode. In generator mode, the lower limit value increases Mmin_z a value at a specified distance below the Mmax. Mmin_z jumps down when the new setpoint Mmax is more negative than the previous setpoint Mmax , If the setpoint Mmax goes from a negative value to a smaller negative setpoint Mmax (or a positive setpoint Mmax), so is approaching Mmin_z asymptotic to the new limit Mmin_z , It lies Mmin_z always at a distance below Mmax.

From the generator mode of the torque mode changes the electric machine 1 and their drive system in the in 2 Example shown in the charging mode.

In charge mode, a setpoint voltage Usoll is specified, which is to be converted by an actual voltage Uist. This requires a correspondingly suitable negative moment M_act be generated. From the data network 8th a minimum torque Mmin is given, which is the lower limit for the actual torque M is serves. Like Mmax in torque mode, Mmin changes its value without transition in load mode. In this example, the setpoint for the moment is entered Mmin specified by -50 Nm.

The M_act is approaching in 2 starting from the previous one M_act from -100 Nm asymptotically to the new setpoint of -50 Nm.

Mmin_z asymptotically approaches the new limit Mmin_z , It lies Mmin_z always at a distance below Mmin.

When switching from torque mode to the charging mode Mmax changes from a variable default value to a fixed upper limit, which is approximately 10 Nm in the example shown. The change takes place as a jump. Likewise, jumps Mmax_z to a fixed value that is above Mmax_z is about 20 Nm and in the example shown.

The following table shows the control variables of the different operating modes: moment mode charging mode Speed mode M = 0 emergency mode Charging emergency mode VMStart-emergency mode to be controlled actual value M_act U_ist n_act M_act U_ist n_act Setpoint from the data network Mmax Uset nsetp none None none Setpoint from intern none none none Mset = 0 Usoll_int Nsoll_int Limits of the data network none Mmin Mmin Mmax none None none Limits of intern Mmax_z Mmin_z Mmax_z Mmax_z Mlim Mmin_z Mmax_z Mmax_z Mmin_z Mmin_L Mmax_L Mmax_z Mmin_z

The torque control of the operating modes is in 3 shown.

In moment mode, the moment should be M_act be managed. For this purpose, the data network becomes a setpoint Mmax specified. Mmax is then considered admissible if it is less than or equal to the upper permissible limit Mmax_z and greater than or equal to the lower allowable limit Mmin_z is. In this case, the torque mode distinguishes between a motor operation of the electric machine and a generator operation of the electric machine.

During engine operation of the torque mode, a positive actual torque should be generated M_act be generated. Accordingly, a positive setpoint torque Mmax is specified. This target torque Mmax may be in the range between the positive upper limit Mmax_z and the slightly negative lower limit Mmin_z move.

In the generator mode of the torque mode should be generated by braking the electric machine power. So it has to be a negative actual moment M_act be generated. Accordingly, a negative target torque Mmax specified. This nominal torque Mmax may be in the range between the slightly positive upper limit Mmax_z and the negative lower limit Mmin_z move.

In charging mode, the electric machine 1 regulated so that an effective charge of a battery can be achieved. The variable to be controlled is the voltage Uist. It will be over the data network 8th upcoming target voltage Usoll controlled. The moment M_act is set in charge mode so that Uist = Usoll can be achieved. Default for the moment M_act is Mmin, which is from the data network 8th comes. The allowable limits for M_ist are from Mmin_z . Mmax_z and mlim set. It should be M_act preferably in the range between Mmin_z (better Mmin ) and Mlim. A value between mlim and Mmax_z is only allowed for a specified limited time.

In speed mode, the speed is the amount that should be kept constant or varied according to the wishes of the consumer. The variable to be controlled is the speed of the electric machine Nist. It will be over the data network 8th next target speed Nsoll controlled. Specification for the limits of the moment M is are Mmin and Mmax.

If Nset is greater than or equal to Nist then Mmax is the maximum allowable limit for M_act and a controller for the speed should specify a positive torque setpoint Msetpoint. In this case, a positive value for the upper limit Mmax_z and a slightly negative value for the lower limit Mmin_z specified.

If Nset is less than Nist, Mmin is the minimum allowable limit for M_act and a speed governor should set a negative torque setpoint Msetpoint. In this case, it becomes a slightly positive value for the upper limit Mmax_z and a negative value for the lower limit Mmin_z specified.

In case of failure of the data network 8th No control variables can be supplied externally to the control system. In case of failure of the data network 8th nevertheless, to ensure safe operation of the electric machine, albeit to a limited extent, emergency modes are provided.

In 4 the emergency modes are shown. In the emergency modes, the setpoints and the tolerance limits are specified internally. This allows the electric machine 1 even if the data network fails 8th operate.

In moment 0-emergency mode, the moment M_act is set to zero. These are the internal limits Mmax_z and Mmin_z internally specified. M_act is then considered admissible if it is less than or equal to the upper permissible limit Mmax_z and greater than or equal to the lower allowable limit Mmin_z is.

In charging emergency mode, the electric machine 1 regulated so that a charge of a battery is possible. The variable to be controlled is the voltage Uist. It is via an internally specified setpoint voltage Usoll_int controlled. The moment M_act should preferably be negative. Therefore, should be M_act preferably in the range between Mmin and stop Mmax. The permissible upper limits for M_act be of Mmin_z and Mmax_z established.

The speed mode is needed especially for starting an internal combustion engine. To this function even in case of failure of the data network 8th To be able to guarantee an emergency mode is provided, which is referred to below as VMStart emergency mode.

In VMStart emergency mode, the speed of the electric machine Nist is the quantity to be controlled. It is controlled by the internally specified setpoint speed Nset_int. The setpoint for the moment M is bounded by Mmin and Mmax.

Preferably, the setpoint corresponds to the moment M_act Mmin or Mmax ,

If Nist is less than or equal to Nset_int, then Mmax is the setpoint for M_act , In this case, a positive value for the upper limit Mmax_z and a slightly negative value for the lower limit Mmin_z internally specified.

If Nist is greater than Nset_int, then Mmin is the setpoint for M_act , In this case, a slightly positive value for the upper limit Mmax_z and a negative value for the lower limit Mmin_z internally specified.

Claims (2)

Control system for an electrical machine (1), comprising a control unit (3) and a monitoring unit (4) independent thereof, wherein a data line (12) is provided, via which the monitoring unit (4) sends the control command for a reset to the control unit (4). 3), characterized in that the control unit (3) is connected to two data communication blocks (5, 6), wherein - the first data communication block (5) forwards function messages and can be deactivated by the monitoring unit (4), and - the second data communication block (6) Forward data for reprogramming the control unit (3) and / or the monitoring unit (4). Control system for an electrical machine (1), comprising a control unit (3) and a monitoring unit (4) independent thereof, wherein a data line (12) is provided, via which the monitoring unit (4) sends the control command for a reset to the control unit (4). 3), characterized in that the monitoring unit (4) via a data line (10) with the control unit (3) is connected, via which the control unit (3) can pass a reset-disable control command to the monitoring unit (4).

Images