Sage Journals: Discover world-class research

Abstract

Motor as well as its controller plays an important role in driving electric vehicle. As sole power device, it is closely related with actual torque accuracy to make sure security during EV driving. Due to complex controlling system for motor, there are some random failures of hardware and software which can bring a series of unexpected risks for EV acceleration or deceleration. A novel method based on motor parameters feature is proposed to estimate motor torque based on parameters feature extraction for three-phase of volts and currents. Additionally, Quality Factor ( $QF$ ) and confidence coefficient are also adopted to judge whether motor estimation torque is reasonable or not and motor failure torque is limited to be output by setting fault flag in controller software. Finally, test bench is built to analyze torque accuracy compared with actual test value and verify security control strategy at failure modes, test results show that estimation torque accuracy is within ±5 Nm which is compared with actual test torque and motor system can effectively come into security state from failure state by security control strategy which is proposed in this paper.

Keywords

Electric vehicle torque estimation security control failure state parameters feature

Introduction

With increasing awareness of energy conservation and environmental protection all over the world, government and automobile enterprises put much focus on electric vehicle.^1–4 Permanent Magnet Synchronous Motor (PMSM) is widely used in electric vehicle due to its wide range of higher efficiency and higher power density.^5–8 Currently, high efficiency and power density is used with integration improvement for motor system. Meanwhile, system failure risk is gradually produced due to deeper integration complexity. Motor system failures bring a series of hazards to pedestrians or passengers, additionally great business profits and brand losses which are caused by motor system failure enforce automobile enterprises to take effective measurement and put motor function security all over the world.⁹

Abnormal torque output to drive electric vehicle is main part for motor system failures. Torque failure which brings electric vehicle to unexpected acceleration or deceleration state includes unacceptable torque and torque opposite direction failures chiefly. Therefore, it is very important to estimate motor actual torque accurately and cut off torque output to make sure no generation of unexpected acceleration or deceleration within proper time when motor system comes into software or hardware failures during electric vehicle running.¹⁰

Obviously, it is significant to build a method and architecture scheme to estimate motor actual torque precisely, then the protection strategy of motor torque security should be designed to ensure vehicle from hazard state to security state when motor torque comes into serious failure state. Therefore, researches on actual torque estimation and torque security control are concerned among automobile enterprises and scientific research units.

Zhao¹¹ designs a security monitoring model of torque control strategy for pure electric vehicles and security analysis methods based on international standard ISO 26262, and the design of security mechanism ensures the system into safe state when failures were checked. Wu et al.¹² introduces basic method of Hazard Analysis and Risk Assessment (HARA) related with functional security standard, then security goal and Automotive Security Integration Level (ASIL) of Motor Control Unit (MCU) have been derived according to HARA and the implementation of function monitoring level was proposed by analysis of function security architecture. Song¹³ studies the fault modeling of MCU by carrying out fault tree analysis, then the software architecture of motor function security is designed based on the idea of layering and modularization. Sabbella and Arunachalam¹⁴ develops the functional security and technical security concept of related functions such as torque monitoring, Additionally, he also designs technical security requirements and the functional security concept by using three-level security monitoring architecture.

According to previous summary, there are common analysis and development process based on ISO 26262 all over the world. The accuracy of classic torque estimation based on current method of d and q axis coordinate is easily affected by other inherent parameters such as inductance of d and q axis coordinate as well as motor flux linkage. Meanwhile, these parameters which is adopted to estimate torque may cause invalid fault torque if there is no consideration of confidence coefficient for each parameter. Therefore, parameters feature extraction for three-phase of volts and currents as well as confidence coefficient and QF are used to develop algorithm to monitor motor actual torque accurately and ensure motor system safety.

The process of function security development

Due to increasing with new function development and integration complexity, software and hardware may cause greater risks of random system faults.¹⁵ Therefore, a series of effective security methods and protection measurements should be applied to avoid serious hazard based on ISO 26262 development process.^10,16 Firstly, risks and hazards related with main driving functions for power system should be analyzed and identified according to Figure 1. Then, function security requirement and function security goal are figured out by analyzing levels of exposure (E), severity (S) as well as controllability (C), next technical security requirements are decomposed into hardware and software requirements based on the determination of security goal. Lastly, a novel algorithm of torque estimation is proposed in the phase of software security requirement determination based on parameters feature extraction for three-phase of volts and currents.

Figure 1.

The process of function security development.

The concept design of motor torque security

Firstly, the aim of concept design is to ensure function items and usage scenario of electric vehicle. Then failure risks are analyzed. Finally, security goals and solution measurements are worked out for each risk.¹⁷

Usage scenario analysis for function item

There are three main function items including propulsion, braking, and parking based on requirements from vehicle to motor. For propulsion and braking function items, when motor system receives requirement torque and operation mode from Vehicle Control Unit (VCU), electric vehicle may run forward or backward direction at different road states such as icy road, wet, slippery pavement as well as dry pavement, and so on. For parking function items, when MCU receives “Zero” torque and power-down mode from VCU, electric vehicle comes into state of stationary.

Hazard analysis and risk assessment (HARA)

When hazard function happens due to software and hardware failures, it is necessary to consider and finish hazard analysis as well as risk assessment in Table 1 and take a series of effective measurements to eliminate unreasonable torque execution which will suddenly bring unexpected acceleration or deceleration.¹⁸

Table 1.

The table of hazard analysis and risk assessment for motor system.

Fault types	Usage scenario	Risk types	E	S	C	Securitylevel	Security goal	Security state
Unexpected torqueoutput	Parking, creeping	Crash, harm	E4	S3	C2	C	Prohibit output torque	No outputtorque
Excessive torquedeviation	Accelerating,decelerating,or constant speed	Crash, harm	E3	S3	C3	C	Output torque less than requirement torque	No outputtorque
Reverse torquedirection	Creeping,deceleratingor reversing	Crash, harm	E4	S3	C2	C	Torque directionsame withrequirement torque	No outputtorque
Three-phasecurrents or voltagescheck faults	Run withelectromagneticinterference,starting	Power lose	E3	S3	C3	C	Prohibit output torque	No outputtorque

After usage scenario is confirmed, function security levels for motor system are defined as four layers from ASIL A to ASIL D by setting indicator parameters E, S, and C of function risks which comes from actual usage scenario for electric vehicle.^19,20 E includes five layers from E0 to E4 increasing with hazard exposure probability level. S includes four layers from S0 to S3 increasing with hazard severity level. C includes four layers from C0 to C3 decreasing with hazard controllability level. Function security level and goal are evaluated and confirmed by combining actual usage scenario and road situation with hazard occurrence of E, S, and C.²¹

The design of motor torque estimation and security control

The normality of motor torque operation plays an important role for electric vehicle security based on HARA analysis. Therefore, it is vital to design reasonable and effective architecture scheme of motor torque estimation. Here, three-layer architecture scheme of torque estimation is designed including input level, control level, and output layer in Figure 2.

Figure 2.

The architecture scheme of torque monitoring.

Input signal process

In input layer, three-phase volts and currents are obtained with filtering process as important parameters for motor torque estimation.²² Additionally, the signal of rotary transformer angle is used as a redundancy design to calculate motor speed when three-phase volts and currents go to be fault.

Confidence flag evaluation

In order to obtain reliable calculation parameters, it is necessary to check the confidence flag for three-phase volts and currents before they are used to estimate motor torque. Here, three-phase volts and currents are transformed into constant amplitude volts ( $U_{α}$ , $U_{β}$ ) and currents ( $I_{α}$ , $I_{β}$ ) of α and β axis as equation (1).

{\begin{matrix} U_{α} = U_{u} \\ U_{β} = \frac{\sqrt{3}}{3} (U_{v} - U_{w}) \\ I_{α} = I_{u} \\ I_{β} = \frac{\sqrt{3}}{3} (I_{v} - I_{w}) \end{matrix}

(1)

Where $U_{u}$ , $U_{v}$ , and $U_{w}$ are three-phase volts respectively. $I_{u}$ , $I_{v}$ , and $I_{w}$ are three-phase currents respectively.

Then, the sum of squares for constant amplitude volts ( $U_{α}$ , $U_{β}$ ) is considered to be greater than that of minimal constant amplitude volts and also the change rate of electrical angle is not beyond the maximal value when three-phase volts and currents is normal.

Therefore, confidence flag of volts ( $B_{U}$ ) are obtained as below. Similarly, the judgment logic of confidence flag for currents $B_{I}$ is same with $B_{U}$ .

(1) $U_{α}^{2} + U_{β}^{2} < U_{\min}^{2}$ or $Δ φ$ > $Δ φ_{\max}$ , $B_{U} = 0$ .

(2) $U_{α}^{2} + U_{β}^{2} > U_{\min}^{2}$ and $Δ φ$ < $Δ φ_{\max}$ , $B_{U} = 1$ .

Where $U_{\min}$ is the minimal constant amplitude volts, $Δ φ$ is the rate of change for electrical angle between a sample time interval, $Δ φ_{\max}$ is the maximal rate of change for electrical angle.

Plausibility check and deviation correction

Kirchhoff law for three-phase volts and currents is used to judge whether “Null Shift” which affects $QF$ meets requirement or not. Volts and currents of $Q F_{(U)}$ and $Q F_{(I)}$ are set to 2 when it meets the requirement of in equation (2), otherwise $Q F_{(U)}$ and $Q F_{(I)}$ are set to 0 irreversibly.

{\begin{matrix} U_{u} + U_{v} + U_{w} < U_{\lim} \\ I_{u} + I_{v} + I_{w} < I_{\lim} \end{matrix}

(2)

Where $U_{\lim}$ and $I_{\lim}$ are the deviation limit of three-phase sum of volts and currents.

If the sum of three-phase volts and currents don’t exceed to the limit value, deviation correction of volts and currents for each phase is just need as equation (3).

{\begin{matrix} {(U_{u}, U_{v}, U_{w})}_{upd} = (U_{u}, U_{v}, U_{w}) - Δ U_{cor} \\ {(I_{u}, I_{v}, I_{w})}_{upd} = (I_{u}, I_{v}, I_{w}) - Δ I_{cor} \\ Δ U_{cor} = (U_{u} + U_{v} + U_{w}) / 3 \\ Δ I_{cor} = (I_{u} + I_{v} + I_{w}) / 3 \end{matrix}

(3)

Where ${(U_{u}, U_{v}, U_{w})}_{upd}$ and ${(I_{u}, I_{v}, I_{w})}_{upd}$ are updated vector value of three-phase volts and currents. $Δ U_{cor}$ and $Δ I_{cor}$ are correction value of three-phase volts and currents.

Additionally, plausibility check in equation (3) is also adopted to consider $QF$ as below. Volts and currents of $Q F_{(U)}$ and $Q F_{(I)}$ are set to 2 when it meets the requirement of in equation (4), otherwise $Q F_{(U)}$ and $Q F_{(I)}$ are set to 0 irreversibly.

{\begin{matrix} U_{pha_\min} < [U_{u}, U_{v}, U_{w}] < U_{pha_\max} \\ I_{pha_\min} < [I_{u}, I_{v}, I_{w}] < I_{pha_\max} \end{matrix}

(4)

Where $U_{pha_\min}$ and $U_{pha_\max}$ are the minimal and the maximum volts for each phase. $I_{pha_\min}$ and $I_{pha_\max}$ are the minimal and the maximum currents for each phase respectively.

Motor speed calculation and average power

Motor mechanical speed is obtained based on constant amplitude volts ( $U_{α}$ , $U_{β}$ ) and currents ( $I_{α}$ , $I_{β}$ ) as well as confidence coefficients ( $B_{U}$ , $B_{I}$ ) in the process of Figure 3.

Figure 3.

The calculation process of motor mechanical speed.

First of all, the change rate of electrical angle during a sample time interval $Δ t$ is calculated by constant amplitude of volts and currents in equation (5) as below.

{\begin{matrix} Δ φ_{U} = {(\arctan U_{α} / U_{β})}^{'} - (\arctan U_{α} / U_{β}) \\ Δ φ_{I} = {(\arctan I_{α} / I_{β})}^{'} - (\arctan I_{α} / I_{β}) \end{matrix}

(5)

Where ${(\arctan U_{α} / U_{β})}^{'}$ and $(\arctan U_{α} / U_{β})$ are electrical angles of previous and present sample time within range of [0, 2π].

Then, confidence coefficient of parameters for volts and currents are calculated in equation (6). Here, the sum of $B_{U}$ and $B_{I}$ value (0 or 1) is obtained at each sample time and the confidence proportion $T I_{(U)}$ and $T I_{(I)}$ is evaluated as below.

{\begin{matrix} T I_{(U)} = \frac{\sum_{i = 1}^{m} B_{U}}{m} \\ T I_{(I)} = \frac{\sum_{i = 1}^{m} B_{I}}{m} \end{matrix}

(6)

Where $m$ is total sample points during a fixed sample time.

The calculation of motor mechanical speed depends $n_{mech}$ on confidence coefficients of volts and currents as well as the sum of change rate of electrical angle. Two paths of parameters feature extraction that calculates motor mechanical speed are finally merged together in equation (7), $Q F_{(U)}$ and $Q F_{(I)}$ are set to 2. When confidence coefficients of volts and currents ( $T I_{(U)}$ and $T I_{(I)}$ ) is not high enough within confidence range {0 < $[T I_{(U)}, T I_{(I)}]$ < $T I_{(\min)}$ }, rotary transformer angle is used to calculate motor speed instead of electrical angle which is related with parameters feature of volts and currents according to the process in Figure 3, $Q F_{(U)}$ and $Q F_{(I)}$ are set to 1 at this condition.

n_{mech} = \frac{\sum_{i = 1}^{m} Δ φ_{U} \cdot T I_{(U)} + \sum_{i = 1}^{m} Δ φ_{U} \cdot T I_{(I)}}{N_{p} \cdot m \cdot Δ t \cdot [T I_{(U)} + T I_{(I)}]}

(7)

Where $N_{p}$ is number of pole-pairs for motor, $Δ t$ is time interval per each sample point.

On the other hand, average power $P_{ave}$ during a sample time is calculated by deviation correction of volts and currents in equation (8) as below.

P_{ave} = \frac{\sum_{i = 1}^{m} {(U_{u} \cdot I_{u})}_{upd} + {(U_{v} \cdot I_{v})}_{upd} + {(U_{w} \cdot I_{w})}_{upd}}{m}

(8)

Torque estimation and determination

In order to ensure the validity of torque estimation, quality factor $QF$ is a key point to decide final torque estimation as equation (9). $Q F_{(U)}$ and $Q F_{(I)}$ from feature extraction of different parameters are usually different each other due to interference level, stability as well as failure probability for three-phase parameters. Therefore, the minimal value between $Q F_{(U)}$ and $Q F_{(I)}$ is proper quality factor to maintain reliability of motor torque estimation.

QF = MIN [Q F_{(U)}, Q F_{(I)}]

(9)

There are three states for $QF$ to estimate motor torque as below.

When $QF$ is equal to 0, motor torque estimation is set to 0. Because the feature extraction of parameters is invalid to estimate motor torque.

When $QF$ is equal to 1, the confidence coefficient of parameters is not too high to support torque estimation, therefore it is necessary to do bench test and find effective alternative solution to estimate motor torque by looking up table of motor currents square related with actual torque in Figure 4. Additionally, torque direction is decided by motor average power, copper loss as well as motor mechanical speed in equation (10).

{\begin{matrix} sign (T_{mot}) = sign (\frac{P_{ave} - I_{ave}^{2} \cdot R_{ave}}{n_{mech}}) \\ I_{ave}^{2} = \frac{\sum_{i = 1}^{m} I_{u}^{2} + I_{v}^{2} + I_{w}^{2}}{m} \\ R_{ave} = \frac{R_{u} + R_{v} + R_{w}}{3} \end{matrix}

(10)

Figure 4.

The relationship of motor currents and actual torque.

Where $sign (T_{mot})$ is the direction sign of motor torque estimation. $R_{ave}$ is average internal resistance of stator winding for three-phase. $R_{u}$ , $R_{v}$ , $R_{w}$ are internal resistance of stator winding for three-phase respectively.

When $QF$ is equal to 2, the confidence coefficient of parameters is high enough to estimate motor torque in equation (11). There are two operation states including driving and regenerating braking, motor torque direction is decided by results sign from equation (11).

{\begin{matrix} T_{mot} = \frac{P_{ave} η_{d}}{n_{mech}} \\ T_{mot} = \frac{P_{ave}}{n_{mech \cdot} η_{g}} \end{matrix}

(11)

Where $T_{mot}$ is motor torque estimation. $η_{d}$ and $η_{g}$ are the efficiency of driving and regenerating braking states respectively.

Failures diagnosis and security protection strategy

Driver requirement torque combined with power operation state from VCU analysis is send to MCU. The requirement of power and economy can be met by reasonable torque control, but abnormal motor driving or braking forces caused by incorrect torque estimation and invalid operation command generates unexpected acceleration or deceleration of EV. Therefore, reasonable fault diagnosis strategy and security protection mechanism are designed to ensure persons and motor system into security state before hazards and risks occur.^23,24

According to previous description, the failures diagnosis judgment is decided for overrange faults parameters (such as three-phase volts and currents), significant torque deviation, torque direction fault as well as security protection strategy is designed respectively for each failure.

The solution scheme to overrange fault

When overrange faults for three-phase volts or currents occur, Kirchhoff’s law can’t meet requirements. Invalid parameters feature extraction brings serious hazards for powertrain torque control. So it is necessary to ensure motor driving system comes into security state by controlling low-side or high-side active short circuit for three-phase full bridge circuit. Meanwhile $QF$ is set to 0 and motor output torque is inhibited.

The solution scheme to significant torque deviation

Significant torque deviation generates unexpected acceleration or deceleration behavior that brings drivers to serious hazards. Torque deviation range is decided carefully and set reasonably to void unnecessary power shut-off within normal range of torque deviation between motor output torque and VCU requirement torque. The torque deviation exceeding torque limit is considered as a judgment condition of serious torque deviation and active security state within Fault Tolerant Time Interval (FTTI, $Δ T_{FTTI}$ ≤ 150 ms). When equation (12) reaches to requirement, $QF$ is set to 0 and motor output torque is inhibited.

{\begin{matrix} Δ T_{dev} * k > T_{\lim} \\ Δ T_{dev} = T_{mot} - T_{req} \end{matrix}

(12)

Where $T_{req}$ is VCU requirement torques, $Δ T_{dev}$ is torque deviation, $k$ is sign factor of torque direction in Table 2, $T_{\lim}$ is torque deviation limit for active security state, $t_{0}$ is the beginning of sample time point.

Table 2.

The definition of factor $k$ .

$T_{req}$	$Δ T_{dev}$	Sign factor $k$
$T_{req} \geq 0$	$Δ T_{dev} \geq 0$	$k = 1$
$T_{req} \geq 0$	$Δ T_{dev} < 0$	$k = 0$
$T_{req} < 0$	$Δ T_{dev} > 0$	$k = 0$
$T_{req} < 0$	$Δ T_{dev} \leq 0$	$k = - 1$

The solution scheme to torque direction fault

In order to check torque direction fault, reasonable judgment condition is designed as equation (13). There are three steps as below:

Step (1): Confidence coefficient should be enough high ( $QF = 2$ ) to ensure the validity of estimation torque direction.

Step (2): Estimation torque direction is obtained by equation (10) and compared with that of VCU requirement torque.

Step (3): When both directions are reverse, security state is active or inactive by judging which is greater between motor torque estimation $T_{mot}$ and torque limit threshold $T_{dir_\lim}$ .

C = {\begin{matrix} sign (T_{req})! = sign (T_{mot}) AND \\ | T_{mot} | \geq T_{dir_\lim} AND QF = 2 \end{matrix}}

(13)

Where $T_{dir_\lim}$ is torque limit threshold for direction fault.

According to Figure 5, When motor runs at point A, the direction of torque estimation ( $a_{2} > 0$ ) is reverse to that of VCU requirement torque ( $a_{1} < 0$ ), but absolute value $a_{2}$ that brings a lower driving force to wheels is less than positive torque limit $+ T_{dir_\lim}$ . There is no risk for EV running, therefore protect strategy is inactive in point A. When it comes into point B, both directions of $b_{1}$ and $b_{2}$ are reverse and absolute value $b_{2}$ that brings a higher driving force to wheels is greater than positive torque limit $+ T_{dir_\lim}$ , therefore protect strategy is active in point B to ensure driving security. Meanwhile $QF$ is set to 0 and motor output torque is inhibited.

Figure 5.

Torque direction monitoring scheme.

Bench test

The model of torque estimation and security control is designed by the environment of MATLAB/Simulink, meanwhile source code is generated and complied by tools of Targetlink and CodeWarrior to hardware. Power and Hardware in Loop (HIL) test bench are built to verify torque estimation accuracy and security control strategy in Figure 6. VCU requirement torques and motor operation mode are sent to MCU by simulator dspace, feedback signals related with toque estimation and security control are observed by upper computer as a close-loop monitoring.

Figure 6.

Power and HIL test bench.

Accuracy verification of estimation torque

It is necessary to check the accuracy of estimation torque before the rationality of security control strategy is verified. Therefore, estimation torque is compared with actual test torque within whole motor operation range. Power level test results show that estimation torque error is within ±5 Nm according to Figure 7 and estimation torque proposed in this paper can be considered as actual torque to be applied in torque security control.

Figure 7.

The error between estimation and actual test torque.

Security verification of overrange fault

In order to verify security mechanism of overrange faults, V-phase volts and currents are brought to be overrange by calibration modification respectively. According to Figure 8, when V-phase volts exceeds upper threshold value ( $U_{pha_\max}$ = 800 V) at about 62 s, QF comes from normal state (QF = 2) to fault latch-state (QF = 0) and Kirchhoff Fault (KF) flag is also set to 1. According to Figure 9, when V-phase currents exceeds upper threshold value ( $I_{pha_\max} = 1000$ A) at about 152 s, QF comes from normal state (QF = 2) to fault latch-state (QF = 0) and Kirchhoff error flag is also set to 1. Motor actual torque is inhibited to be output at these overrange fault states.

Figure 8.

Overrange volts verification of V-phase.

Figure 9.

Overrange currents verification of V-phase.

Security verification of significant torque deviation fault

The security control strategy of positive and negative Torque Deviation Fault (TDF) is verified respectively at operation point (2500 rpm/+20 Nm, 1500 rpm/−20 Nm). Motor runs at operation state 2500 rpm/+10 Nm, when torque deviation between VCU requirement torque and estimation torque exceeds limit value ( $T_{\lim}$ = 50 Nm) at about 20.6 s, MCU goes into active security state with state flag change (QF = 0, TDE flag = 1) and motor torque is cut off within 90 ms (< $Δ T_{FTTI}$ ) in Figure 10. Motor runs at operation state 1500 rpm/−10 Nm, when torque deviation exceeds limit value $T_{\lim}$ at about 60.52 s, MCU also comes into active security state with state flag change (QF = 0, TDE flag = 1) and motor torque is cut off within 113 ms (< $Δ T_{FTTI}$ ) in Figure 11.

Figure 10.

Torque deviation verification at 2500 rpm/+10 Nm.

Figure 11.

Torque deviation verification at 1500 rpm/−10 Nm.

Security verification of torque reverse direction fault

The security control strategy of positive and negative Torque Reverse Deviation Fault (TRDF) is verified respectively at operation point (4000 rpm/+55 Nm, 3000 rpm/−10 Nm). When torque direction between VCU requirement torque and estimation torque is reverse at motor operation state 1500 rpm/−10 Nm, and estimation torque exceeds positive torque limit ( $+ T_{dir_\lim} = 50 Nm$ ) at about 90.16 s, MCU goes into active security state with state flag change (QF = 0, TDE flag = 1) and motor torque is cut off within 66 ms (< $Δ T_{FTTI}$ ) in Figure 12. Motor runs at operation state 1500 rpm/−10 Nm, when the absolute value of estimation torque exceeds that of negative torque limit $- T_{dir_\lim}$ at about 120.36 s, MCU also comes into active security state with state flag change (QF = 0, TDE flag = 1) and motor torque is cut off within 72 ms (< $Δ T_{FTTI}$ ) in Figure 13.

Figure 12.

Torque direction verification at 1500 rpm/−10 Nm.

Figure 13.

Torque direction verification at 1500 rpm/−10 Nm.

Conclusions

According to the importance introduction of motor functionality security design for business profits, brand affect, and ISO 26262 standard requirements, the development process of motor function security is designed and work item for each step is defined. Functionality security level and security goal are ensured after EV usage scenario and powertrain system HARA are analyzed sufficiently.

Three-tier architecture scheme of torque monitoring is designed. Assuming parameter confidence coefficient is considered, feature extraction for three-phase volts and currents is adopted to calculate motor mechanical speed and average power after signal plausibility check and deviation correction is finished. In addition, estimation scheme of motor torque is also decided by confidence coefficient and QF level.

Check condition and handling mechanism of each fault are defined. Power and HIL test bench are built to verify the accuracy of motor estimation torque and validity of security control strategy. Test results show that the accuracy of motor estimation torque is within ±5 Nm and it can support the control strategy development of motor functionality security. For overrange fault, significant torque deviation fault as well as torque direction fault, security responding mechanism can bring motor torque to cut off within FTTI and ensure the security of EV driving.

Footnotes

Handling Editor: Chenhui Liang

Authors’ note

PENG Zhiyuan, DU Changhong and ZHOU Anjian design the method of motor torque estimation and security control strategy. LIU Li and CHEN Yang integrate and test software after software building. CHEN Jian and PENG Qianlei verify software validity by building test bench. The information above is confirmed.

Declaration of conflicting interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: This work was supported by the Changan Multicomponent Integration of Electric Drive System (Grant No. 67612-53010210-030128), the Science and Technology Research Key Program of Chongqing Municipal Education Commission (Grant No. KJZD-K202000701), Key Projects of Technological Innovation and Application Development of Chongqing (Grant No. cstc2019jscx-fxydX0028), the Project of Green Aviation Technology Research Institute of Chongqing Jiaotong University (Grant No. GATRI2020 D02002).

ORCID iDs

Zhiyuan Peng

Li Liu

Data availability statement

Data and materials in this paper can be available by other authors

References

Sun

Lei

, et al. An improved model predictive current control for PMSM drives based on current track circle. IEEE Trans Ind Electron 2021; 68: 3782–3793.

Deng

, et al. Advanced Angle Field weakening control strategy of permanent magnet synchronous motor. IEEE Trans Vehicular Technol 2019; 68: 3424–3435.

Zheng

Wang

, et al. Review of fault diagnosis of PMSM drive system in electric vehicles. In: Proceedings of the 36th Chinese control conference, Dalian, 2017, pp.7426–7432.

Liu

Chen

, et al. Research on a multi-objective hierarchical prediction energy management strategy for range extended fuel cell vehicles. J Power Sources 2019; 429: 55–66.

Jin

Sun

Lei

, et al. Sliding mode direct torque control of SPMSMs based on a hybrid wolf optimization algorithm. IEEE Trans Ind Electron 2022; 69: 4534–4544.

Sun

Shi

Lei

, et al. Analysis and design optimization of a permanent magnet synchronous motor for a campus patrol electric vehicle. IEEE Trans Vehicular Technol 2019; 68: 10535–10544.

SM.

A review of high-efficiency motors: specification, policy, and technology. Renew Sustain Energ Rev 2016; 59: 1–12.

Sun

Cao

Lei

, et al. A robust deadbeat predictive controller with delay compensation based on composite sliding-mode observer for PMSMs. IEEE Trans Power Electron 2021; 36: 10742–10752.

Boazzo

Pellegrino

Model-based direct flux vector control of permanent-magnet synchronous motor drives. IEEE Trans Ind Appl 2015; 51: 3126–3136.

10.

ISO/WD 26262. Road vehicles-functional safety. Geneva: International Organization for Standardization, 2011.

11.

Zhao

Torque management safety concept and Torque monitoring model for pure electric vehicles. Chin J Automot Eng 2018; 8: 229–234.

12.

Zhu

Analysis of active-short-circuit of permanent magnet synchronous motor in electric vehicles. J TongJi Univ (Nat Sci) 2018; 46: 1288–1305.

13.

Song

Motor control system and HIL test development based on functional safety. Harbin: Harbin Institute of Technology, 2018.

14.

Sabbella

Arunachalam

. Functional safety development of motor control unit for electric vehicles. In: IEEE transportation electrification conference (ITEC-India), India, 2019.

15.

Zhuang

Zhang

Research on design of the motor drive system in electric vehicle based on ISO 26262. Automob Parts 2016; 12: 18–21.

16.

Bagalini

Sini

Reorda

, et al. An automatic approach to perform the verification of hardware designs according to the ISO 26262 functional safety standard. In: 2017 18th IEEE Latin American test symposium, Cundinamarca Bogota, 2017.

17.

Birch

Rivett

Habli

, et al. Safety cases and their role in ISO 26262 functional safety assessment. In: International conference on computer safety, reliability and security, New York, 2013, p.154165.

18.

Wang

Development and implementation of vehicle controller based on functional safety for electrical vehicle. Hunan: Hunan University, 2018.

19.

SAE J2980. Considerations for ISO 26262 ASIL hazard classification. United States: SAE international, 2015.

20.

Takahashi

Nakamura

Hasegawa

Examination of the validity of connections between MSILs and ASILs in the functional safety standard for motor vehicles. SAE Int J Engines 2015; 11: 466–472.

21.

Liu

Xiong

, et al. Analysis of impact of PMSM failure on the safety of EV under ISO 26262. Automot Technol 2013; 2: 13–18.

22.

Standardized E-GAS monitoring concept for gasoline and diesel engine control units. Version 6.0 . Egas Group (AUDI, BMW, DAIMLER, PORSCHE), Germany, 2015.

23.