WO2010022674A1

WO2010022674A1 - A safety monitoring system for a hybrid car and a method thereof

Info

Publication number: WO2010022674A1
Application number: PCT/CN2009/073614
Authority: WO
Inventors: 邹海斌
Original assignee: 奇瑞汽车股份有限公司
Priority date: 2008-08-29
Filing date: 2009-08-28
Publication date: 2010-03-04
Also published as: CN101353044B; CN101353044A

Abstract

A safety monitoring system for a hybrid car comprises a hybrid control module, an engine management system, a battery management system, a hybrid control unit and a motor control unit. The monitoring method for said system mainly monitors whether the automatic restart of the engine is carried out in conditions of complete cut-off of the power system and whether the engine permissible torque that is transported to an engine control unit by the hybrid control unit is within the effective safety range, as a safety control unit SCU separated from HCU is arranged in the system, the system can use SCU to accept the working state of real time measurement of various gasoline engines, an ISG motor and a high pressure nickel-hydrogen battery through CAN, simulated torque distribution is carried out in SCU, and the distribution result is compared with the distribution situation of HCU. If abnormality is found, a failure mode is started, thus reducing accidents.

Description

Hybrid vehicle safety monitoring system and monitoring method

The invention relates to the field of vehicle driving safety monitoring, in particular to a monitoring system and a monitoring method for comprehensively managing safety of multiple power torques in a multi-powered automobile, in particular an internal combustion engine and a motor hybrid vehicle. Background technique

Hybrid vehicles are vehicles with multi-energy hybrid drive, high-efficiency operating point drive and power generation for internal combustion engines, energy recovery braking, vehicle electrical load optimization and automatic engine start-stop operation. Figure 1 shows a multi-energy system control scheme for a medium-sized hybrid vehicle. The hybrid car is equipped with a 144V high-voltage battery, a high-voltage nickel-hydrogen battery, which is the energy storage and output unit of the hybrid vehicle. It can store the vehicle's mechanical energy recovered during vehicle braking or in the efficient working area of the engine. The mechanical energy, which can output energy to compensate for insufficient engine power during vehicle start or acceleration conditions. The hybrid vehicle is equipped with a 1.3L gasoline internal combustion engine independently developed by the inventor as the first power output device of the hybrid vehicle, and the internal combustion engine system is the first output device of the whole vehicle power drive system, which converts the fuel raw material conversion chemistry. An energy system device that can be mechanical energy. Another large power output device in this hybrid vehicle is a motor/generator unit (referred to as ISG) with a rated power of 10 kw for mechanical energy. It is coaxially assembled with the crankshaft of the internal combustion engine system described above, and belongs to a second power output conversion device in which the power source is connected in parallel. On the one hand, it can provide stable starting at low speed and high torque as the electric motor when the internal combustion engine needs to start quickly, and convert the chemical energy in the energy storage unit into electric energy in the form of electric energy through the power transmission when the whole vehicle system needs power to speed up. The device is transmitted to the drive system of the whole vehicle, and can be used as a generator to convert the mechanical energy of the whole vehicle into electric energy in the form of chemical energy stored in the energy storage unit high-voltage nickel-hydrogen battery in the case of deceleration of the entire vehicle system.

In the above system scheme, since there are two kinds of power to drive the vehicle at the same time, that is, the gasoline internal combustion engine and the ISG motor simultaneously output torque to the 5-speed AMT transmission, it is necessary to distribute the torque of each power output, so that the gasoline internal combustion engine works at the most Good working condition, Hybrid Control Unit (HCU) is used as the vehicle multi-energy management system to complete the torque distribution task. The HCU can interpret the driver's request intention according to the driver's pedal signal and engine speed, and then according to the engine status. , motor status, high voltage battery status, and other subsystem status of the vehicle to distribute the torque required by the engine and motor.

HCU and gasoline internal combustion engine control system, ie engine control unit (Engine Management System, referred to as EMS) is a control area network (CAN), which is a local area network used in modern vehicle control systems. It communicates to interpret the accelerator pedal signal, and the driver's accelerator pedal requests torque calculation. The vehicle accelerator pedal angle sensor is installed at the pedal position, and the EMS processes and diagnoses the original electrical signal of the sensor and performs safety signal processing on the failure of the pedal or the pedal sensor. Under the condition that the accelerator pedal sensor is not faulty and the accelerator pedal angle signal received by the HCU is valid, the HCU calculates the torque request amount of the vehicle under the reverse working condition and the low vehicle speed condition according to the accelerator pedal angle signal and the engine speed signal. The torque request amount and the torque request amount under the high vehicle speed condition are calculated based on the preset vehicle speed limit value, and the driver torque request amount of the vehicle in the forward speed condition is calculated. These request quantities are a percentage relative amount between [0, 100] and are defined as relative request torque.

The Motor Control Unit (MCU) calculates the maximum output torque and minimum output torque of the motor within the normal range of motor speed. The HCU and the MCU are connected by a single CAN. The HCU simultaneously calculates the maximum output torque within the normal range of the motor speed, and considers that the minimum output torque of the ISG motor can be zero; because the output power of the high-voltage battery follows the load of the high-voltage battery itself. The reduction of the electrical state (referred to as SOC) is attenuating. For the high-voltage battery hybrid vehicle, there is a battery management system (BMS), and the HCU communicates with the BMS through the whole vehicle CAN. Therefore, the output torque of the entire high-voltage electric power system also varies with the state of charge of the high-voltage battery, so the maximum output torque of the motor needs to be corrected according to the SOC of the high-voltage battery. The HCU calculates an absolute driver accelerator pedal request torque value based on the driver's accelerator pedal relative request torque amount, the EMS calculated engine maximum output torque, the minimum torque, and the SOC corrected motor maximum output torque value using the high voltage battery. The torque calculated by this algorithm is the absolute torque in Nm.

The HCU monitors the status of each subsystem, including engine temperature, speed, and engine dynamic optimum operating point determined by these parameters, motor speed, temperature, voltage at high voltage system, current, state of charge of high voltage battery, aging status, Temperature, licensed power, current, voltage, etc. These signals are collected by the vehicle CAN in communication with other electronic control units (ECUs). And the vehicle state to request the driver's accelerator pedal to apply torque between the engine and the motor. After the driver requests the torque to be distributed between the motor and the engine, the HCU transmits the torque that the engine needs to output through the vehicle CAN network, and transmits the torque that the motor needs to transmit to the MCU through a separate CAN network.

From the perspective of safety control, the HCU must have a limit function for the torque that the engine needs to output. The relative amount of the total permissible torque of the entire power system is determined according to the engine speed and the angle signal of the driver's accelerator pedal, which is [0, 100]. The percentage between. Calculate the maximum net twist of the hybrid first energy output source engine that can be output to the powertrain based on the maximum torque that can be output from the engine and the minimum stable torque that must be output. Moment. The maximum output torque of the motor is calculated according to the characteristics of the motor, and the maximum output net torque of the hybrid second momentum output source is corrected according to the state of charge of the high-voltage battery. The dynamic powertrain permissible torque relative amount is calculated based on the total relative allowable torque amount of the powertrain and the absolute maximum torque that the total powertrain can output. The HCU has calculated the torque value that the motor needs to output, and it can be assumed that the modern motor control system can fully satisfy the torque value that the distributed motor needs to output, and the loss torque of the motor itself is quite small. Thus the absolute value of the total powertrain permissible torque plus the minimum stabilizing torque that the engine must output and then the output torque assigned to the electric motor is the permissible output torque of the engine. The HCU sends the absolute value of this permissible torque to the EMS via the vehicle CAN network.

The functions of the above hybrid control unit HCU can be summarized as signal processing of the driver's accelerator pedal, calculation of driver requested torque, distribution of power system demand torque, and calculation of engine permitted torque. However, since each electromechanical system is composed of a mechanical system and an electronic control system, the electronic control system is composed of software and hardware. If there is a loophole in the software, or a component in the hardware fails, or an actuator fails. And the malfunction, then the actual action of the output of the engine and the motor after the last execution may be very different from the action expected by the initial driver or may not be the action desired by the driver at all. If this action is the request and control of the torque, then the total drive torque reflected to the entire power take-off system has a large difference from the torque requested by the driver's pedal. If the difference exhibits the effect of torque reduction, then The result is only a reduction in the power to drive the vehicle, but if this difference presents the effect of increased torque, then the power driving the vehicle will exhibit an unacceptable acceleration condition of transient high torque, and if it is serious, it will cause a collision of the vehicle. accident. If this action is the request and control of the hybrid motor or the small starter of the vehicle to start the engine, then the result reflected to the vehicle power output system is that the start of the vehicle is completely safe when the vehicle power system is completely disconnected; System engagement, that is, starting without the clutch being fully disengaged and the gearbox in gear, is not safe. Summary of the invention

In order to overcome the deficiencies in the prior art, it is an object of the present invention to provide a hybrid vehicle safety monitoring system.

The technical solution of the present invention is: a hybrid vehicle safety monitoring system, including a hybrid control module; the hybrid control module further includes a hybrid control unit and a safety control unit, the safety control unit monitoring the engine automatic restart Whether to perform and monitor whether the engine permitted torque delivered to the engine control unit by the hybrid control unit is within an effective safety range under the condition that the power system is completely disconnected. The security control unit includes a processor and a memory; the processor is coupled to the memory, and is connected to a vehicle control local area network by using a network transceiver in the hybrid control module, and a control signal output end thereof is respectively It is coupled to a switch end of the high voltage battery, a switch end of the inverter, and a control end of the transceiver.

Another object of the present invention is to provide a monitoring method of the above security monitoring system.

The technical scheme is: a monitoring method of a hybrid vehicle safety monitoring system, and the working mode of the hybrid vehicle monitoring system is divided into a startup initialization mode, a normal working mode, and a fault protection operation mode, and the working process of the hybrid vehicle safety monitoring system Includes the following steps:

A. When the hybrid control module is powered up, it enters the startup initialization mode, and after initialization, it enters the step.

B.

B. Determine whether the hybrid vehicle is in an idle stop state.

Bl, if the step B is affirmative, the operating power of the inverter of the motor control module is turned off by the safety control unit, and it is determined whether the hybrid vehicle power system is in the power transmission system disconnected state, and the Whether the hybrid control unit requests the engine to automatically restart; if it is all positive, proceed to step C; otherwise, return to step 8.

B2. If the step B is negative, the licensed engine output torque calculated by the hybrid control unit is received by the safety control unit; and the real-time operating condition signal of the hybrid vehicle is received at the same time to calculate the permitted engine output torque in the safety control unit. Value; compare the two torque values, if the comparison result exceeds the predetermined value, proceed to step C; otherwise, return to step B.

C. Enter the fault protection operation mode.

In this system, due to the installation of a Safety Control Unit (SCU) independent of the HCU, the SCU receives the real-time measurement of each gasoline internal combustion engine and ISG motor through the CAN, and the working state of the high-voltage nickel-hydrogen battery, in the SCU. The analog torque distribution is performed, and the distribution result is compared with the HCU distribution. In addition, when the hybrid vehicle is in the idle mode, the SCU judges the hybrid vehicle power system based on the hybrid vehicle mounted on the clutch bottom switch and the transmission empty switch signal. It is safe and reliable to be in the disconnected state of the powertrain. If an abnormality is found, it enters the fault mode and reduces the accident.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. DRAWINGS

Figure 1 is a block diagram of a multi-energy control system for a hybrid vehicle.

2 is a schematic block diagram of a hybrid vehicle safety monitoring system according to the present invention. 3 is a flow chart of a hybrid vehicle safety monitoring method according to the present invention. detailed description

As shown in Fig. 2, a hybrid vehicle safety monitoring system includes a hybrid control module HCM, an engine management system EMS, a battery management system BMS, and a vehicle control local area network CAN.

The hybrid control module HCM comprises: a hybrid control unit HCU, a motor control unit MCU, a first control local area network CAN and a safety control unit SCU.

The hybrid control unit performs signal processing on the driver's accelerator pedal, calculation of driver requested torque, distribution of power system demand torque, and calculation of engine permitted torque.

The motor control unit is on the same controller as the hybrid control unit and is coupled to the inverter for management control of the motor.

The safety control unit monitors whether the automatic engine restart is performed and monitors whether the engine permitted torque delivered to the engine control unit by the hybrid control unit is within an effective safety range under the condition that the power system is completely disconnected.

The security control unit includes a processor and a memory; the processor is coupled to the memory, and respectively connected to a vehicle control local area network and a first control local area network, a switch end of a high voltage battery, a switch end of the inverter, and The hybrid control unit is coupled to a control end of the vehicle control local area network transceiver.

The first control local area network is coupled to the hybrid control unit and the motor control unit, respectively.

The engine management system performs management control of the internal combustion engine.

The battery management system controls and controls the high voltage battery system.

The vehicle control local area network is coupled to the hybrid control unit, the engine management system, and the battery management system, respectively. Each unit communicates with the vehicle's local area through its transceiver with the vehicle's local area network.

In the above hybrid safety monitoring system: when the hybrid vehicle control module is powered on for the first time, or when the key switch is turned off and re-powered, the SCU enters the startup initialization mode, and the initialization mode is started. Next, the SCU disconnects the motor drive module inverter power supply, disconnects the high voltage battery high voltage end connection, and turns on the hybrid control module CAN transmitter to enable the hybrid control unit HCU to send out the CAN message. The SCU also performs self-test of the chip during startup initialization. The self-test function includes detection of its internal memory. If the detection fails, it enters the program boot mode and waits for the program to refresh. If the test is successful, it enters the normal operating mode.

In the normal operation mode of the safety monitoring system, the SCU judges by receiving the CAN message sent by the HCU. Whether the engine is in an idle stop state, if the engine idles in the automatic stop mode, the SCU turns off the operating power of the inverter of the motor control module; the SCU judges according to the clutch bottom switch and the gearbox neutral switch signal installed in the hybrid vehicle Whether the hybrid vehicle power system is safely and reliably disconnected from the powertrain; at the same time, the SCU determines whether the HCU requests the engine to automatically restart through the received CAN message of the HCU, if the SCU determines that the power system is not reliably completely disconnected at the same time The HCU requests the engine to automatically restart, then it will enter the fault protection mode. The SCU will disconnect the CAN transmitter of the hybrid control module, disconnect the high voltage connection of the high voltage battery, and disconnect the inverter operating power of the motor control module. At this time, the HCU no longer controls the EMS. The engine is controlled by the EMS separately and enters an ordinary single-powered vehicle driving state until the vehicle is working properly through external intervention or other means. This fault operation mode does not affect the safety of the car when the vehicle is idling. In normal driving, since the engine can still work normally under the control of the EMS, there may be no dual power, so it is also safe to drive the vehicle and other vehicles. The operation does not have an effect.

In the normal operation mode of the safety monitoring system, the SCU obtains the permitted engine output torque calculated by the HCU by receiving the CAN sent by the HCU, and the SCU receives the real-time working condition information about the hybrid vehicle, mainly including the engine speed signal and the driver throttle. Pedal signal, high-voltage battery state of charge signal, engine minimum stable torque signal, engine maximum capacity output torque signal, motor DC terminal voltage signal. The SCU then calculates the permissible engine output torque value. Here, the SCU uses the same calculation formula of the HCU and checks the same table to obtain the real-time engine torque value, and the HCU is the theoretically derived estimate. The SCU compares the permitted engine output torque value calculated by the received HCU with the permitted engine output torque value calculated by the SCU itself, and if the permissible engine output torque value calculated by the HCU exceeds the permissible engine output torque value calculated by the SCU, Then the SCU working mode will enter the fault protection operation mode, and the SCU will shut down the high voltage end of the high voltage battery, turn off the inverter power of the motor control module, and turn off the CAN information transmitter of the hybrid control module. The SCU determines the relative torque output relative to the total powertrain based on the same driver accelerator pedal signal as the HCU and the engine speed, based on the maximum torque that the engine can output and the minimum stable torque of the engine and the maximum motor output. Torque to calculate the torque value of the licensed total power system output. The operating power of the motor is calculated based on the DC voltage and the DC current of the motor, and the output torque of the motor is calculated based on the operating power of the motor and the speed of the motor and the efficiency at the dynamic speed, power, and current temperature of the motor. According to the calculated motor output torque, the proportional coefficient Kl is obtained, and a constant edge error Κ2 is set. Therefore, the permitted engine output torque calculated by the SCU is expressed as follows:

SCU Permitted Torque = K1 * (Permitted Total Powertrain Torque - Actual Motor Output Torque) + Κ2 The permissible engine output torque is calculated from the above equation. The SCU determines whether the current HCU allocation request and the controlled engine and motor torque are within a safe range based on whether the permitted engine output torque calculated by the HCU received from the CAN network exceeds the allowable engine output torque calculated by the SCU itself. Inside. If the test result is a failure, the SCU operating mode enters the failsafe operating mode. Then the SCU will disconnect the CAN transmitter of the hybrid control module, disconnect the high voltage connection of the high voltage battery, and disconnect the inverter operating power of the motor control module. This serves as a security protection.

In the normal working mode of the safety monitoring system, external commands can also be accepted through the CAN. For example, the refresh command can be issued to the safety monitoring system through the control system of the car. When the new control program is replaced with the current program, the refresh operation can be entered. Mode, after the program is refreshed, enter the system startup initialization mode.

In the normal working mode of the safety monitoring system, the power-on and power-off signals of the key switch can also be accepted through the CAN. When the key switch power-off signal is received, the key power-off mode is entered, and the SCU is in the key power-off mode. Keep receiving external CAN messages for a short period of time. This short time can be set by a timer, such as a frame data containing the state of the key switch. When the key is detected, the key is re-turned to the ON position within this short time. After power-on, the SCU directly goes into the normal working mode. If after the short period of time, the time set by the timer expires and the key switch position is not detected to be turned ON again, the SCU starts to sleep, on the next key. Enter the initialization mode when the power is on.

When the safety monitoring system is in the fault operation mode: The safety control unit will disconnect the hybrid control unit from the transmitter of the vehicle control local area network, disconnect the high voltage battery, and disconnect the inverter operating power. When there is a key switch power-off signal, the safety monitoring system switches to the key power-off mode. When the power is not applied for a short period of time, the safety monitoring system enters the shutdown state, and the next time the power is turned on, it will need to enter the startup initialization mode. . If the startup initialization is normal, the normal operation mode is entered. In the normal operation mode, if the hybrid vehicle has not changed in the state of the previous failure operation mode, the fault operation mode is continued. If the state of the last fault operation mode has changed and overcomes the fault, that is, in the idle state, when restarting, it is confirmed that the hybrid vehicle power system has been safely and reliably in the powertrain disconnect state, and Receiving the permitted engine output torque calculated by the hybrid control unit through the safety control unit; receiving the engine speed signal, the driver accelerator pedal signal, the high voltage battery state of charge signal, the engine minimum stable torque signal, and the engine maximum capacity output torque Signal, motor DC terminal voltage signal, motor DC terminal current signal, calculate the allowable engine output torque value; compare the two torque values, the comparison result does not exceed the predetermined value, then in the normal working mode.

The working process of this safety monitoring system is as follows: The monitoring method of the hybrid vehicle safety monitoring system divides the working mode of the hybrid vehicle monitoring system into a startup initialization mode, a normal operation mode, and a failure protection operation mode, and the working process of the hybrid vehicle safety monitoring system, that is, the invention The flow of the hybrid vehicle safety monitoring method is shown in FIG. 3, and specifically includes the following steps:

A. When the hybrid control module is powered on, enter the startup initialization mode, at which time the safety control unit disconnects the inverter power supply, disconnects the high voltage battery, opens the hybrid control module, and controls the vehicle. The transmitter of the LAN, and conduct a self-test. After initialization is normal, proceed to step B. If not, go to step Al o

A1, refresh working mode: The internal control unit of the security control unit refreshes by calling a program in the memory, and proceeds to step 8.

B. Determine whether the hybrid vehicle is in an idle stop state;

Bl, if the step B is affirmative, the operating power of the inverter of the motor control module is turned off by the safety control unit, and it is determined whether the hybrid vehicle power system is safely and reliably in the power transmission system disconnected state. At the same time, it is determined whether the hybrid control unit requests automatic restart of the engine; if it is all positive, then proceeds to step C; otherwise, returns to step B;

B2, if the step B is negative, receiving the permitted engine output torque calculated by the hybrid control unit through the safety control unit; receiving the engine speed signal, the driver accelerator pedal signal, the high-voltage battery state of charge signal, and the engine Minimum stable torque signal, engine maximum capacity output torque signal, motor DC terminal voltage signal, motor DC terminal current signal, calculate the permitted engine output torque value; compare the two torque values, if the comparison result exceeds the predetermined value, proceed to step C ; otherwise return to step B;

C. Enter the fault protection operation mode: The safety control unit will disconnect the hybrid control unit from the transmitter of the vehicle control LAN, disconnect the switch of the high voltage battery, and disconnect the operating power of the inverter.

Claims

Claim

A hybrid vehicle safety monitoring system, comprising a hybrid control module; wherein: the hybrid control module further comprises a hybrid control unit and a safety control unit, wherein the safety control unit monitors an automatic restart of the engine Whether to perform and monitor whether the engine permitted torque delivered by the hybrid control unit to the engine control unit is within an effective safety range under the condition that the power system is completely disconnected;

The security control unit includes a processor and a memory; the processor is coupled to the memory, and is coupled to a vehicle control local area network by using a network transceiver in the hybrid control module, and a control signal output end thereof is respectively It is coupled to a switch end of the high voltage battery, a switch end of the inverter, and a control end of the transceiver.

2. The monitoring method of a hybrid vehicle safety monitoring system according to claim 1, wherein: the operating mode of the hybrid vehicle monitoring system is divided into a startup initialization mode, a normal operation mode, and a failure protection operation mode, wherein the hybrid power The working process of the vehicle safety monitoring system includes the following steps:

B;

B. Determine whether the hybrid vehicle is in an idle stop state;

If the step B is affirmative, the operating power of the inverter of the motor control module is turned off by the safety control unit, and it is determined whether the hybrid vehicle power system is in the power transmission system disconnected state, and the hybrid power is judged. Whether the control unit requests the engine to automatically restart; if it is all positive, proceed to step C; otherwise, return to step B;

B2. If the step B is negative, the licensed engine output torque calculated by the hybrid control unit is received by the safety control unit; and the real-time operating condition signal of the hybrid vehicle is received at the same time to calculate the permitted engine output torque in the safety control unit. Value; compare the two torque values, if the comparison result difference exceeds the predetermined value, proceed to step C; otherwise, return to step B;

C. Enter the fault protection operation mode.

3. The method according to claim 2, wherein in step A, the safety control unit disconnects the inverter power supply, disconnects the high voltage battery, and turns on hybrid control. The module and the vehicle control the transmitter of the local area network and perform self-test.

4. The method according to claim 3, wherein: when the security control unit self-test is abnormal, the startup initialization mode further comprises the following steps:

Al, refresh working mode: The internal control unit of the security control unit refreshes by calling a program in the memory, and proceeds to step 8.

5. The method according to claim 4, wherein in step B, when there is an external indication signal controlling the security control unit to cause the security control unit to enter the refresh mode, the process proceeds to step A1.

6. The method of claim 2, wherein in step B, the security control unit determines whether the hybrid vehicle is in an idle stop state by receiving a message from the hybrid control unit.

7. The method according to claim 2, wherein in step B1, the safety control unit determines whether the hybrid vehicle power system is in the power transmission system according to the hybrid vehicle mounted on the clutch bottom switch and the transmission empty switch signal. Open state.

8. The method according to claim 2, wherein in the step B, the real-time operating condition signal of the hybrid vehicle comprises: an engine speed signal, a driver accelerator pedal signal, a high-voltage battery state of charge signal, an engine Minimum stable torque signal, engine maximum capacity output torque signal or / and motor DC terminal current signal.

9. The method according to claim 2, wherein in step B, when it is detected that the key switch is powered off, the following steps are performed:

B3. Set a timer. When the timer has not timed out, it detects that the key switch power-on signal goes to step B. Otherwise, when the key switch is powered on, it transfers to the step.

10. The method according to claim 2, wherein in step C, the safety control unit disconnects the hybrid control unit from the transmitter of the vehicle control local area network, disconnects the switch of the high voltage battery, and disconnects the The inverter works as a power source.