Controller method, apparatus and article suitable for electric drive

• US 7,426,099 B2
• Filed: 06/29/2006
• Issued: 09/16/2008
• Est. Priority Date: 06/30/2005
• Status: Expired due to Fees

• Current Assignee: Continental Automotive Systems, Inc. (Continental AG)
• Original Assignee: Continental Automotive Systems US Incorporated (Continental AG)
• Inventors: Hampo, Richard J., Nallapa, Venkatapathi R., Cheng, Bing, Soudier, Christophe, Kowalec, Steven J.
• Primary Examiner(s): IP, SHIK LUEN PAUL
• Application Number:
  US11/480,311
• Publication Number:
  US 20070016340A1
• Time in Patent Office: 810 Days
• Field of Search: 318/139, 318/470, 701/29, 701/36, 701/41, 701/45, 701/114, 701/33, 707/100, 361/5, 361/93.1, 361/18, 361/90, 361/62
• US Class Current: 361/23
• CPC Class Codes: B60L 3/0084 relating to control modules
• CPC Class Codes: B60L 3/0092 with use of redundant elements for safety purposes
• CPC Class Codes: B60L 3/04 Cutting off the power supply under fault conditions protective devices and circuit arrangements in general H01H; H02H
• CPC Class Codes: B60L 3/12 Recording operating variables ; Monitoring of operating variables
• CPC Class Codes: B60L 50/51 characterised by AC-motors
• CPC Class Codes: B60W 50/029 Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: G05B 19/042 using digital processors G05B19/05 takes precedence
• CPC Class Codes: G05B 2219/24208 Go into safety mode if communications are interrupted
• CPC Class Codes: G05B 2219/2637 Vehicle, car, auto, wheelchair
• CPC Class Codes: H02P 29/02 Providing protection against overload without automatic interruption of supply protection against faults of stepper motors H02P8/36
• CPC Class Codes: H02P 29/0241 the fault being an overvoltage
• CPC Class Codes: Y02T 10/64 Electric machine technologies in electromobility
• CPC Class Codes: Y02T 10/70 Energy storage systems for electromobility, e.g. batteries
• CPC Class Codes: Y02T 10/72 Electric energy management in electromobility
• CPC Class Codes: Y02T 90/16 Information or communication technologies improving the operation of electric vehicles

Abstract

A control system, method and article allows a monitoring module to monitor operation of a main controller in an electric drive, by providing questions and evaluating the accuracy and/or timeliness of responses from the main controller. Upon detection of an excessive number of incorrect or late responses, the monitoring module can shutdown operation, and may provide an alternative communications path, thereby preventing corrupt data from reaching a vehicle network, while providing communications for diagnostic and recovery such as by provision of new software or firmware instructions. The main controller may monitor the operation of the monitoring module, taking appropriate action if a fault is detected. Disabling a supply of power to a traction motor may be based on current operating conditions, such as speed.

Claims

1. A control system to control an electric drive, the control system comprising:

a main controller operable to execute instructions including the computation of a value based on at least one parameter; and

a monitoring module operable to provide queries from time-to-time to the main controller, operable to evaluate an accuracy of an answer to a query returned to the monitoring module by the main controller, and operable to execute a protective state entry procedure in response to a determination that a number of answers returned by the main controller that are determined to be incorrect exceeds a threshold value, wherein executing the protective state entry procedure comprises disabling a first communications path between the main controller and a vehicle.

2. The control system of claim 1 wherein executing the protective state entry procedure further comprises disabling a gate drive providing drive control signals to a power converter supplying power to a traction motor.

3. The control system of claim 2 wherein executing the protective state entry procedure further comprises disabling the gate drive providing drive control signals to the power converter such that the traction motor is electrically shorted.

4. The control system of claim 2 wherein executing the protective state entry procedure further comprises disabling the gate drive providing drive control signals to the power converter such that all the semiconductor switches are placed in a non-conducting state.

5. The control system of claim 1 wherein the main controller comprises a microprocessor and the monitoring module comprises monitoring logic configured in a reconfigurable electronic circuit device.

6. The control system of claim 1 wherein the monitoring module is further operable to determine whether a response to the answer to the query is timely received from the main controller.

7. The control system of claim 1 wherein the monitoring module provides queries comprising a speed value and a torque value, and receives answers in the form of a power value computed based on the speed and torque values.

8. A control system to control an electric drive, comprising:

a main controller operable to execute instructions including the computation of a value based on at least one parameter; and

a monitoring module operable to provide queries from time-to-time to the main controller, to evaluate an accuracy of an answer to the query returned to the monitoring module by the main controller, and to enter a protective state in response to a determination that a number of answers returned by the main controller that are determined to be incorrect exceeds a threshold value, wherein the main controller is further operable to, from time-to-time provide an intentionally incorrect answer to a query from the monitoring module and to evaluate an operation of the monitoring module based on a handling of the intentionally incorrect answer by the monitoring module.

9. The control system of claim 8 wherein the main controller evaluates the operation of the monitoring module by evaluating a wrong answer counter returned to the main controller by the monitoring logic.

10. The control system of claim 8 wherein the main controller is further operable to shutdown operation of the monitoring module in response to an evaluation that the monitoring logic is not operating correctly.

11. A control system to control an electric drive, comprising:

a main controller operable to execute instructions including the computation of a value based on at least one parameter;

a communications subsystem selectively operable to provide a first communications path between the main controller and a vehicle network in a first state, and a second communications path between the main controller and an interface suitable for downloading new instructions to the main controller in a second state; and

a monitoring module operable to provide queries from time-to-time to the main controller, to evaluate an accuracy of an answer to the query returned to the monitoring module by the main controller, and to cause the communications system to enter the second state from the first state in response to a determination of an existence of a fault condition in an operation of the main controller.

12. The control system of claim 11 wherein the interface is suitable for performing diagnostic queries of the main controller via the second communications path.

13. The control system of claim 11 wherein the monitoring module is further operable to enter a protective state in response to a determination that a number of answers returned by the main controller that are determined to be incorrect exceeds a threshold value, wherein the main controller is further operable to, from time-to-time provide an intentionally incorrect answer to a query from the monitoring module and to evaluate an operation of the monitoring module based on a handling of the intentionally incorrect answer by the monitoring module.

14. A control system to control an electric drive, comprising:

a main controller operable to execute instructions including the computation of a value based on at least one parameter;

a fault logic module operable to determine an appropriate procedure for discontinuing a supply of electrical power to a traction motor by a power converter based on a speed of the traction motor and/or a fault history;

a communications subsystem selectively operable to provide a first communications path between the main controller and a vehicle network in a first state, and a second communications path between the main controller and an interface suitable for downloading new instructions to the main controller in a second state; and

a monitoring module operable to provide queries from time-to-time to the main controller, to evaluate an accuracy of an answer to the query returned to the monitoring module by the main controller, and to cause the communications system to enter the second state from the first state in response to a determination of an existence of a fault condition in an operation of the main controller.

15. The control system of claim 14 wherein the power converter is a DC/AC power converter comprising a plurality of power semiconductor switches in a bridge configuration and the fault logic module places all of the power semiconductor switches in a non-conducting state if the speed of the traction motor is below a threshold speed.

16. The control system of claim 14 wherein the power converter is a DC/AC power converter comprising a plurality of power semiconductor switches in a bridge configuration and the fault logic module places some of the power semiconductor switches in a non-conducting state, and some of the power semiconductor switches in a conducting state to electrically short the traction motor if the speed of the traction motor is above a threshold speed.