The following points will introduce the safety protection strategies for high-voltage electric drive systems:
What is ASC?
The trend of current variation with rotational speed under ASC state;
The trend of motor torque as speed changes under ASC condition;
What is ****OC?
What is 0-torque control?
Security protection strategies: Selection mechanism for OC, ASC, and 0-torque
1. Active short-circuit operating state: ASC
Active short circuit, also known as ASC, is a safe operating state for active short circuit protection. Taking an electric drive system equipped with a three-phase IGBT power module as an example, it is achieved by turning off the three transistors of the upper bridge arm of the IGBT while turning on the three transistors of the lower bridge arm, as shown in Figure 1; or by turning on the three transistors of the upper bridge arm of the IGBT while turning off the three transistors of the lower bridge arm.
Figure 1. Operating state of IGBT when the lower bridge arm is actively short-circuited.
In active short-circuit operation, the motor stator windings and the IGBTs of the lower bridge arm form a closed loop. The back electromotive force energy generated by the motor is released through the stator windings, and a corresponding braking torque is generated at the motor output. Taking a permanent magnet synchronous motor with a peak power of 150 kW as an example, the changes in current and motor torque with speed under ASC operation are simulated.
The flux linkage equation of a permanent magnet synchronous motor is as follows:
When entering ASC operating mode, the motor input voltages for the d-axis and q-axis are 0. When steady state is reached, then:
When ASC is in operation, the steady-state Id current increases rapidly with increasing speed at different speeds. After reaching a certain speed, the current remains basically constant and equals the characteristic current, as shown in Figure 2, for reference only. The specific value is related to the motor's design parameters: flux linkage, inductance, number of pole pairs, winding resistance, etc.
Figure 2. Simulation curve of Id current under ASC state
When ASC is in operation, at different speeds, the steady-state Id current increases rapidly with increasing speed in the low-speed region, then decreases rapidly with increasing speed, and tends to stabilize in the high-speed region, as shown in Figure 3.
Figure 3. Simulation curve of Iq current under ASC state
When ASC is in operation, at different speeds, the motor output torque increases rapidly in the low-speed range as the speed increases, then decreases rapidly as the speed increases, and tends to stabilize in the high-speed range, as shown in Figure 4.
Figure 4. Simulation curve of motor driving torque under ASC state
Characteristics of the electric drive system when actively short-circuiting ASC****:
Significant braking torque is generated in the low-speed range;
The continuous current generated by the back electromotive force may cause the motor to overheat;
Overheating of the motor may lead to demagnetization of the rotor magnets;
Overheating of the motor caused the inverter to overheat, resulting in inverter damage.
2. Open circuit operating state: OC
The open circuit protection working state is also called OC (open circuit) or Freewheeling. Taking an electric drive system equipped with a three-phase IGBT power module as an example, by turning on all the transistors of the upper and lower IGBT arms, the inverter enters the passive rectification state, which is open circuit protection, as shown in Figure 5.
Figure 5. IGBT operating state with open circuit
When the motor operates at high speed, if it enters the open-circuit protection state, the back electromotive force generated by the motor is higher than the bus voltage. This back electromotive force is rectified and fed back to the high-voltage battery through the freewheeling diode, forming a closed loop, as shown in Figure 5. At this time, a large braking torque is generated at the motor end. Simultaneously, this uncontrollable passive rectification causes the motor's back electromotive force to exert significant impact damage on devices connected to the DC bus, such as bus capacitors and IGBTs.
When the motor operates at low speed, if it enters the open-circuit protection state, the back electromotive force generated by the motor is lower than the bus voltage. It cannot be rectified and fed back to the high-voltage battery through the freewheeling diode, thus failing to form a closed circuit. In this situation, the motor operates under no-load conditions. At this time, the motor's back electromotive force will not cause any impact damage to the devices connected to the DC bus.
Characteristics of the electric drive system during open-circuit protection (OC):
High-speed phase current flows through the freewheeling diode;
The high back electromotive force in the high-speed zone causes impact damage to the components on the busbar;
Unexpectedly large braking torque is generated at the motor output in the high-speed range;
In the low-speed range, only the frictional torque of the bearings exists at the motor output end.
3. 0-torque control of working state
0-torque control, as the name suggests, means that the inverter enters a 0Nm control state, that is, the motor output torque is 0Nm. However, the prerequisite for 0-torque control is that the high-voltage and low-voltage power supplies are normal, and the electric drive system can execute 0Nm output.
4. Security Protection Strategies: Selection Mechanisms for ASC, OC, and 0-torque
The automotive functional safety standard ISO 26262 strictly requires that when the electric drive system and other vehicle systems (such as the battery, DC-DC converter, charger, and vehicle VCU) malfunction, the motor controller receives the fault and responds promptly, entering a safe operating state to ensure the electric drive operates in an appropriate condition, preventing injury to personnel and minimizing further damage to the electric drive system. When the electric drive system is operating in a safe operating state, the following events must be avoided:
To avoid causing personal injury or death due to aimless torque and speed output from the vehicle;
To avoid personal injury caused by excessively high back electromotive force or high battery pack voltage output;
To avoid damage to components (such as IGBTs and DC capacitors) connected to the busbar due to excessively high back electromotive force;
To avoid damage to the inverter or demagnetization of the rotor magnets due to excessively high temperatures;
etc……..
By analyzing the characteristics of the safe operating states of the electric drive system, namely ASC and OC, the safe operating state can be entered roughly according to the following mechanism, as shown in Figure 6:
When the bus voltage is sufficiently high, consider entering the open-circuit protection operating state (OC).
When the bus voltage is insufficient and a back EMF exceeds the bus voltage, it is considered to enter open-circuit protection (OC) mode in the low-speed range and active short-circuit protection (ASC) mode in the high-speed range. Therefore, OC mode is used in the low-speed range to avoid the large braking force generated by ASC, which could cause significant impact on vehicle operation and affect driving comfort; ASC mode is used in the high-speed range to avoid the large back EMF generated by OC, which could cause impact damage to components on the bus.
Figure 6. Safe Working Status Selection Mechanism 1
Considering that active short-circuit operation can easily cause overheating of the motor or inverter, a combination of active short-circuit and 0-torque control can be designed in the high-speed range to regulate the safe operating state, as shown in Figure 7. When 0-torque control is introduced, if the functional safety standard ISO26262 is also considered, the control system of the entire safe operating state selection mechanism will need to be designed to be more complex: when a fault occurs, it is not only necessary to monitor in real time whether 0-torque control can be executed normally, but also to monitor whether the path of 0-torque control will cause aimless torque output. The control of the fault tolerance time interval (FTTI) is also a severe challenge.
Figure 7. Safe working status selection mechanism II
When a fault occurs in the vehicle system or electric drive system that affects driving safety, the vehicle system will immediately disconnect the high-voltage relay to prevent the battery from outputting high voltage, thus avoiding the danger to personnel caused by the high-voltage power supply still being output when the fault occurs. At this time, 0-Torque control cannot be executed.
In comparison, OC and ASC are simpler and faster to implement. Regardless of the type of system or hardware failure, the inverter hardware can quickly achieve and switch between OC and ASC through mutual monitoring of devices or circuits. Therefore, in pursuit of simplicity and efficiency, most electric drive systems currently adopt the first safe operating state selection mechanism as shown in Figure 6. Of course, a few suppliers use a combination of ASC and 0-torque control, as shown in the second safe operating state selection mechanism in Figure 7.
Based on system architecture, software architecture, and hardware architecture, a safe operating state is triggered. For different faults, it is necessary to combine information such as the time and location of the fault occurrence and functional safety to select whether to trigger the corresponding safe operating state at the software or hardware level.
5. Trailer protection application
When a vehicle malfunctions or encounters certain special circumstances requiring temporary towing with its drive wheels on the ground, if there is no disengagement device between the electric vehicle's drive motor and drive shaft, the motor will generate a back electromotive force. In this situation, we need to consider the safe operating conditions of the electric vehicle during temporary towing:
If the electric drive system is put into OC mode, a back electromotive force poses a safety threat to the motor controller switching transistors, bus capacitors and other components;
If the electric drive system is put into ASC mode, the back EMF energy is released through the motor stator winding, which effectively protects the safety of electrical appliances. However, there is also a risk of overheating due to large braking torque when towing at low speeds and long towing times at high speeds.
As the saying goes, "Choose the lesser of two evils," so electric vehicles often put their electric drive system into ASC mode when temporarily towed. Those who have purchased new energy electric vehicles will find that the user manual states: "Towing is not allowed with the drive wheels on the ground," as shown in Figure 8. If necessary, short-distance, short-time towing at low speeds (e.g., 5 km/h) is permitted, precisely because the electric drive system enters ASC mode when towed. Additionally, some might suggest using 0-torque control for temporary towing, but this is usually only requested when a vehicle malfunctions. As mentioned earlier, for functional safety reasons, the bus voltage is disconnected after a malfunction, making 0-torque control impossible.
In special circumstances, such as low battery power and no backup power available, requiring temporary towing assistance, the electric vehicle can be towed with its drive wheels on the ground. The specific operation is as follows: the towed electric vehicle must be engaged in Drive (D) and the accelerator pedal must be pressed to maintain a certain distance. This operation simulates the towed vehicle's electric drive system entering generator mode, provided the vehicle's power/control system is functioning normally and the towing speed can reach a relatively high speed, such as 45 km/h. In this scenario, the towed vehicle is essentially charging.
