mcu solutions for hybrid drive train · kinetic energy recovery systems (kers) are currently in...

TMFreescale, the Freescale logo, AltiVec, C-5, CodeTEST, CodeWarrior, ColdFire, C-Ware, mobileGT, PowerQUICC, StarCore, and Symphony are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off. BeeKit, BeeStack, CoreNet, the Energy Efficient Solutions logo, Flexis, MXC, Platform in a Package, Processor Expert, QorIQ, QUICC Engine, SMARTMOS, TurboLink and VortiQa are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners. © 2010 Freescale Semiconductor, Inc.

FTF-AUT-F0737

MCU Solutions for Hybrid Drive TrainJune, 2010

Leos Chalupa, Ph.D.Freescale System Solution Engineer – El. Powertrain

TMFreescale, the Freescale logo, AltiVec, C-5, CodeTEST, CodeWarrior, ColdFire, C-Ware, mobileGT, PowerQUICC, StarCore, and Symphony are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off. BeeKit, BeeStack, CoreNet, the Energy Efficient Solutions logo, Flexis, MXC, Platform in a Package, Processor Expert, QorIQ, QUICC Engine, SMARTMOS, TurboLinkand VortiQa are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners. © 2010 Freescale Semiconductor, Inc.

Session Objectives

►After completing this session you will be able to: • List the main areas of HEV application that are affected by

microcontroller selection• Understand the importance of functional safety for the application• Know the Freescale solution based on latest el. powertrain dedicated

microcontrollers

2

TMFreescale, the Freescale logo, AltiVec, C-5, CodeTEST, CodeWarrior, ColdFire, C-Ware, mobileGT, PowerQUICC, StarCore, and Symphony are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off. BeeKit, BeeStack, CoreNet, the Energy Efficient Solutions logo, Flexis, MXC, Platform in a Package, Processor Expert, QorIQ, QUICC Engine, SMARTMOS, TurboLinkand VortiQa are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners. © 2010 Freescale Semiconductor, Inc. 33

Agenda

►HEV System Overview

►MCU System Impacts• Main HEV component size,

weight, packaging

• Functional safety

►Freescale Advanced Solutions

• Device main functionality

• Functional safety

TM

HEV System Overview

4


Typical Hybrid System

• High efficiency gas engine• Planetary gear power split device

AC synchronous generator• High voltage AC-DC inverter• Battery• Permanent magnet AC motor

Battery

Inverter

Motor

Drive wheels

Generator

Engine

Power split device

Power circuit


Kinetic Energy Recovery Systems

►Kinetic Energy Recovery Systems (KERS) are currently in different motor sport applications and moving towards road vehicles.

6

MotorGenerator

KERS Control Unit

Boost Request(energy to be released)

Driver

Breaking System(energy to be recovered)

Energy Recovery

Energy Release

Energy Storage System

DC

/DC

Battery

Flywheel


Problem Statements

►Complex distributed system• Need for synchronization of multiple controllers including the transmission controller• High bandwidth communication needed

►System costs• Multiple controllers and sensors• Size of power units and el. machines dictate the system cost

►Power managements and motor control• Precise, fast and deterministic control timing• CPU high bandwidth is emphasized more than memory• Need optimized and flexible PWM output control for 3-phase motor control linked with fast

and effective analogue acquisition• DC/DC converter often needed for control of voltage conversion

►Functional safety• El. drive must guarantee torque production within specified limits• Fail silent architecture is required with “limp mode” for high system availability

7

TM

MCU System Impacts

8


MCU’s Control Energy Flow

►Main task is to control energy flow in the system:

• Inverter control• DC/DC control• Monitor eMotor/generator• Monitor ESS

►Communication between power conversion units is part of the control loop

►High-speed communication (such as FlexRay™) improves HEV system by:

• Better stability of the energy flow control

• Smaller temporary energy storages (capacitors/inductors) needed

9

ΔPeMotor ΔPCU ΔPESS

ΔPeMotor ΔPCU ΔPESS

Energy Recovery

Energy Release

Drive-train

Battery

Bat

tery

Driv

e-tra

in

ΔPeMotor ΔPESS

Drive-train

MotorGenerator

Control Unit

Energy Recovery

Energy Release

Energy Storage System

DC

/DC

ΔPCU

communication


MCU Based Digital Control System #1

►Main MCU peripherals are key drivers of the overall HEV system performance

►MCU is part of the control loop and provides in fact signal processing functionality. Data throughput defines control systemperformance such as response time, stability of the control loop, etc. Note: it is easy to change control technique/strategy/parameters since control is done on “soft”(ware) side.

10

MCU

Filte

r

Fast A/D

CPU

PWM Power Module Application

HIGH DATA THROUGHPUT REQUIRED

Control Loop

Communi-cation Port

TimerFilte

r



►Modified Harvard architecture increases architecture data throughput • CPU can read an instruction and perform a data memory access at the same time• HEV applications benefit from signal/control processing capabilities:

Simplification and cost reduction of existing sensors More sensors can be used within the same budgetMore information gained from sensorsMore intelligent application => increased safety, reduced fuel/energy consumption, emissions

11

MCU

Filte

r

Fast A/D

CPU

PWM

Communication Port

TimerFilte

r Data Memory

Instruction Memory

ALU

Control

Data Bus

Instruction Bus



►High performance CPU with advanced peripherals permits execution of advanced algorithms such as FOC, sensorless FOC and state observers

• Field Oriented Control (FOC) – independent torque and mag. flux controlThe current control performs equally well at low and high speeds. (PI controllers operating in the d-q reference frame of the rotor) is isolated from the sinusoidal variation of motor currents and voltages and therefore. Iq is made to equal the Torque Command, while Id is equal to zero which allows motors, when operating below base speed, to produce the rated torque at any speed. When Id is not equal to zero then the motor is in Field Weakening, operating above the base speed, where the maximum torque is reduced with increase speed.

• State variable observers (used in sensorless drives) addresses redundancy required by functional safety at SW cost

12

Inner Loop (faster) ~100Inner Loop (faster) ~100μμss

Outer Loop (slower) ~ 1Outer Loop (slower) ~ 1--5ms5ms

M

Motorola

Dave’sControlCenter

Supply

Position/speedsensor

Ib

IcMCU Power

Stage



Observer Based Control► Observers are simply real time

models of systems that are fed the same inputs as those provided to the real system (either commanded or measured)

► As a result, they estimate the real time response of the system to the inputs. A controller can be added to the real time model and used to force the observer model to track the measured states (Luenberger, Gopinath)

► Open loop Observer is formed on estimated model

► Closed Loop Observer K0 controller minimizes deviation of measured and estimated states

► Observers are key for plausibility check of the application behavior



List of needed matrix calculations

[ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ] ××

××⋅×××⋅×××⋅×××⋅×××⋅×××−×××−×××+×××+×××+×

− 122

)'125(25555)'25(11555)'50(15225)'10(21225)'20(12225

1555511212155diag552151512222

1K

K

K

K

K

K

K

K

K

K

K

sMACsMACsMACsMACsMAC

Addition:

Subtraction:

Multiplication:

Inversion:

Matrix calculation scheme

[ ] [ ] [ ] [ ][ ] [ ][ ] [ ][ ] [ ][ ][ ] [ ][ ] [ ][ ][ ][ ] [ ] [ ]

[ ] [ ] [ ][ ] [ ]

$

$

x

P

x

P

K

k k

k k

k k

k k

k

= × + × × − × = ×

= × − × × = ×

= × × + × × = ×

= × × × + × = ×

= × × + × = ×

+

+

−

5 1 5 2 2 1 2 1 5 1

5 5 5 2 2 5 5 5

5 5 5 1 5 2 2 1 5 1

5 5 5 5 5 5 5 5 5 5

5 2 2 2 2 2 5 2

1

1

1

diag

Matrix inversion contains 1x division

Extend Kalman Filter based Observer► Observers are simply real time

365 MAC’s

TM

Power Conversion Units

15


Benefits for DC/DC Converter and Inverter #1

► Advanced multi-channel high-resolution PWM peripheral permits: • Safe operation of the complementary power switches (including fault states)• To split the DC/DC converter and/or inverter into several phases

To reduce battery current ripples, DC-link ripples and el. motor torque ripples(e.g., 10-phase 100kHz DC/DC converter is equivalent to 1MHz single-phase converter)To prevent difficult paralleling of the power devices

• To use high-frequency high-efficiency switching devices• To achieve high density (10 kW/l) designs by

Reduced size of the energy storage components (inductors and capacitors)Improved packaging (it is easier to handle number of small components then one large one)

• To reduce material cost► Advanced ADC permits PWM-synchronous analogue acquisition of fast feedback

signals thus avoiding switching noise

16



► High-resolution PWM peripheral:• Resolution, count (word) length:

PWM resolution is limited by device clock to PWM period ratio In another words, given the PWM/control period the device clock determines the max. range valueExamples:

20kHz period => Max. range 6000 LSB’s @ 120 MHz clock => 12.6 bit range100kHz period => Max. range 1200 LSB’s @ 120 MHz clock => 10.2 bit rangeResolution in both examples is 1 LSB => 8.33 nsecNote the minimum/maximum PWM duty cycle is limited by du/dt capabilities of the device I/O drive-stage. However, such limitation odes not affect 0% or 100% operation.

PWM period

High-resolution clock

Ran

geM

in. -

Max

.

Device Counter/Timer

Min./Max. PWM Duty Cycle

Low-resolution clockOutput at real device pin

due to limited du/dt

PWM



► HEV application benefits from smooth low-speed operation• Torque control requires low-voltage at low-speed

<10% of nominal voltage needs to be generated• High-resolution PWM allows to generate low-voltage with required smooth torque control

el. motor speed

Base speed

Stator back-EMFMaximal voltage

0 3-Phase Power Stage

PMSM

Udc≈ k

High-resolution PWM

Low-resolution PWM



► HEV application benefits from high frequency operation• DC/DC conversion can be done using higher PWM frequency • Hi-frequency PWM is possible without compromising the resolution• This leads to smaller, higher power density designs with less material use => lower system cost

High-resolution PWM

Low-resolution PWM

TM

Motor / Generator

20


Asynchronous vs. Synchronous

►3-phase winding on the stator Distributed or concentrated

►Assumed sinusoidal flux distribution in air gap►Different rotor construction & consequences

• ACIMSquirrel cage (rugged, reliable, economical)No brushes, no PMLow maintenance cost

• Synchronous Rotor with permanent magnetHigh efficiency (no rotor loses)

►Synchronous motor rotates at the same frequency as the revolving magnetic field

►Asynchronous means that the mechanical speed of the rotor is generally different from the speed of the revolving magnetic field

21

ω


MCU Performance Impact to Motor/Generator

►High Resolution PWM (Pulse Width Modulator) Peripheral is key to design powerful electric motors at reduced cost:

• Motor/Generator to be small and powerful (not to carry unnecessary mass/space). shall be designed to work at high electric frequency (~1 kHz – high number of poles).

• Generation of high electric frequency 3-phase system requires high resolution PWM, both in time and amplitude

22

CuCue AABP σω δδπ ⋅⋅⋅⋅⋅≈Σ

1

Sine-wave generation

Low-resolution PWM High-resolution PWM

Air gap size × Sum of windings wire’s cross section

TM

Functional Safety

23


Safety Systems versus Functional Safety

Safety Systems

systems to protect against danger

outside the system

Functional Safety

the art to minimizedanger caused by a

(perhaps faulty) system


Errors in the Electronic System

►How could the electronics have failed? And why?• Hardware errors vs. software errors• Permanent vs. transient error

A permanent error continues to exist until the system is repairedA transient error only occurs for a (short) time

– Border case: Error only ‘repaired’ by reset or power cyclingAn intermittent error is a transient error which re-occurs with a relatively high rate

• Random vs. systematic errorA random error is an error that occurs unpredictably (following a probability distribution)A systematic error is an error that occurs deterministically in certain circumstances (in all/many instances of the component)

►Classification as cross-product of three criteria

25


The Fault-Error-Failure Chain

Failure

Error

Fault

error detectionlatency

fault duration

faultdormacy

faultoccurence

faultactivation

errordetection

erroractivation

error latency


Environment

Fault Propagation in Systems

System

SubSystem A SubSystem B

SubSystem C

SubSystem A1 SubSys A2

SubSys A2a

SubSys A2b

SubSystem A3

A1a A1b A1c

B1 B2 B3 B4

Undetectedfault

Undetectedfault

propagation

Undetected external fault

induced

Fault affectingenvironment

Undetected external fault

causingfaults in the

systemthat affect

the environment

Development of a common cause fault


Possible System Reactions on an Error

► fail-dangerous: Possibly causes a hazard in the case of a failure► fail-safe: Returns to or stays in a safe state in the case of a failure

• the number of simultaneous faults is normally restricted to 1

► fail-operational: Continues to work correctly in the case of a failure• Possibly in a degraded mode only

► fail-silent: Will not disturb anyone in the case of a failure• This includes not providing wrong results

► fail-stop: Completely stops itself in the case of a failure• Typically needs a reset to get out of this mode again

► fail-indicate: Indicates to its environment that it has failed• But might continue to provide wrong results, hog resources, ….

► fail-inconsistent: Provided results will be noticeably inconsistent in the case of a failure


Foreshadowing: Different Handling of Errors

►Knowing the error type is important as it influences how errors can be detected and handled

• Random errorsGoal: Reduce probability of occurrence (of effects) below a certain valueRisk can be estimated

• Systematic errorsGoal: Reduce probability of introduction into componentRisk caused by them is typically unknown

• Permanent errorsFunctionality stays destroyedCan be found by self tests

• Transient errorsFunctionality might recoverHappen more often; sometimes can be ignored

– e.g., if short and system safety time > 2*calculation cycle timeCan be found by time diversity

29


Functional Safety Measures

►Self test measures• Ensure that the device/unit is free from dormant faults• Core self-test• Device self-test

►Error detection measures• Stop errors from propagating beyond component boundary

Error correction (compensation)Shut down (fail-silence)

• Hardware plausibility based– Illegal address/op-code detection, supervisor and user modes, memory error detection, ECC,

clock monitors, voltage supervision, watchdogs,

• Hardware redundancy based– Redundant peripherals, dual-core

►Development process measures• Avoid systematic failures• Follow process requirements defined by industry standards

30

MCU


Safety Standards

►Two relevant safety standards• IEC 61508 (in revision)

Generic standard for functional safety of electronic systemsSpecialized versions for individual industries

• ISO 26262 (in preparation)‘Derivate’ of IEC 61508 for automotive applicationsAlready in used although not complete

►Goal• Prevent unacceptable risk due to failures of equipment

►Approach• Reduction of Systematic faults

Human-introduced ‘bugs’Constraints on development process

• Reduction of Random faultsFailures due to aging, interference, …Quantitative requirements via Safety metrics

31


IEC 61508 SIL versus ISO 26262 ASIL (approx. view)

SIL 1

SIL 2

SIL 3

SIL 4

ASIL A

ASIL B

ASIL C

ASIL D

Safety Integrity Level

IEC61508[today]

Ranking by assessing the probability of a dangerous

failure per hour

Automotive SIL

ISO26262[future]

Ranking by assessing severity of injuries, exposure to hazardous situations and the controllability of the driving situation

low

high

► Direct comparison not possible► Assessment of recommended and mandatory Hardware/software measures and

practices


Quantitative Requirements of IEC61508 versus ISO26262

►IEC 61508• 4 Safety Integrity Levels (SIL)• 2 key metrics

Probability of dangerous failure per hour (PFH)Safe Failure Fraction (SFF)

• Hardware redundancy in formulas (HFT)

SIL 1 SIL 2 SIL 3PFH [1/h] <10-5 <10-6 <10-7

SFF (HFT=0)

>=60% >=90% >=99%

SFF (HFT=1)

- >=60% >=90%

Note: Table adopted for typical automotive application

►ISO 26262• 4 Automotive SILs (ASIL)• 3 key metrics

Probability of violation of safety goals (PVSG)Single Point Fault MetricLatent Fault Metric

• Hardware redundancy in structural modeling

ASIL B ASIL C ASIL DPVSG [1/h]

<10-7

(recom.)<10-7 <10-8

SPFM >90% >97% >99%

LFM >60% >80% >90%


Intention of the Requirements

►3 intended effects• Reduce probability of a dangerous failure• Demonstrate effectiveness of measures against

immediately dangerous faults• Demonstrate effectiveness of measures against

latent faults which could accumulate

►Different measures against single point and latent faults• Single point faults

Detect within system safety timeExercised by system/application itself

• Latent FaultsDetect within hours/daysExercised by test routines

PFH

SPFM , SFF

LFM , SFF


MCU Architectural Breakdown

Core

MMU

Cache

BUS

RAM Flash

MPU

Peripheral Bridge DMA

Sensor & Actuator Ctrl CommunicationResets &Interrupts

Power

Config

Clock & Timing

Failurereporting

Debug

ComputationalSubsystem

Peripherals

Auxiliaries

1

2

3

4

All subsystems involved or influencing a typical application⇒ All require safety measures


Philosophies for Functional Safety – Examples

Core+

Periphery Memory

Aux

Safety related SW

SW self tests

Online Software Self Tests Single Core with Time Redundancy

Core+

Periphery Memory

Aux

Safety related SW

Two Asymmetric Cores

SR SW Compare

Memory

Core+

Periphery Memory

Aux

Safety related SW SW

SmallCore

Two non-locked Cores + SW Comparison

Core2+

Periphery Memory

Aux

Safety related SW SW 2

Core1+

Safety related SWSW 1

Compare

Two Cores in Lockstep

Core2+

Periphery Memory

Aux 3

SW

Core1+

Aux 1 Aux 2

Compare

Aux 3Supervisors


Comparison of Architectures

HW Architectures

Single Core

Asymmetric Cores

Dual Core

Dual Core Lockstep SW Effort Detection of

SW Errors

Single SW Instance - - - ASIL D - -

Replicated SW Instances

ASIL A(Time

redundancy)

Not common ASIL D Makes little

sense + -

SW

Approach

Diverse SW Instances

ASIL A-B(Time

redundancy)ASIL C-D ASIL D

ASIL D(Time

redundancy)++ +

Startup Self-Test

Makes little sense

Required for sufficient LFM



Self-Test Online

Self-Test ASIL A Not common

Not common

Not common

HW Effort - + + ++


Last but not Least … Software Safety

►Hardware Development Tools• Inject a systematic fault into the HW

e.g., Wrong synthesis, too small/close/slow/…. signals or gates, ….

►Software Development Tools• Inject a systematic fault into the SW

Compiler errors, Configuration mixups, ….

►Hardware Control and Driver Software• Accessing the hardware in a wrong way

Timing, Error handling, ….

►Application Software• Not realizing the application function in all cases

Various bugs possible


Software Development for Certification

► Both standards recommend process, information to exchange, and measures to apply• IEC 61508-3• ISO 26262-6 (draft)

► Process• V-Model

► Information to exchange• Plan/Specify – Execute – Report

► Measures to apply• ISO often more concrete than IEC; IEC more comprehensive

ISO has measures embedded in subsections (vs. tables at end in IEC)– leads to repetition

• IEC explains most measures in part 7• Mainly good software engineering practices required, e.g.,

Structured, hierarchical architecture & design– unambiguous

Defensive programmingLimited pointer usageVarious testing techniques

• Tables can be used as checklists (and expanded upon)


Functional Safety

►Hardware and Software techniques must be considered jointly whenassessing the (A)SIL of a safety system

►Good functional safety MCU architecture shall• Fully support required (A)SIL measures/techniques with no or minimum overhead• Minimize development effort (software + hardware) at competitive development cost• Minimize performance impact

►MCU software shall be based on the following techniques:• Fault detection and diagnosis• Error detecting and correcting codes• Diverse programming• Backward/Forward/ Re-try fault recovery• Graceful degradation• Intelligent fault correction• Dynamic reconfiguration• …

41

TM

Freescale Advanced Solutions

42


1MB – MPC5643LCore• Up to 120 MHz Dual e200 zen4 core built on Power

Architecture technology, 240 DMIPS• 4K 2-way / 4-way I-cache• FPU• Safety enhanced Cores + FPU + VLE + MMU• Dual Parallel or Lock Step configuration + HW/SW monitoring

Memory• Up to 1 MByte RWW Flash with ECC• Up to 128 KByte SRAM with ECC• EE emulation• Dual crossbar with MPUs

I/O• 2 x FlexCAN (32 message buffers each)• 1 x FlexRay™ (64 msg. buffers)• 2 x LINFlex• 3 x DSPI • 1 x External clock output • 2 x FlexPWM (2 x 12 channels)• 3 x eTimer modules (3 x 6 channels)• Dual ADC (16 channels each, 12bit, 650ns), 1 S/H per ADC• 1 x Cross-triggering unit for motor control

System• 16 Channels eDMA• Autonomous Fault Collection and Control Unit• CRC computing unit• Software watchdog timer (inc. window mode, flow monitoring)• 2 x Junction temperature sensor • Nexus debug interface (up to N3)• FM-PLL + FlexRay PLL • 3.3 V Single supply with external and internal ballast transistor• 3.3 V I/Os (ADC 5 V capable)• 144 LQFP / 257 MAPBGA• Tj = 150°C

Cross Bar Switch

I/OBridge

Memory Protection UnitCross Bar Switch

Memory Protection Unit

FlexRay

RC

RC RC

1MFLASH(ECC)

128KSRAM(ECC)

RC

I/OBridge

PMU

SWT

MCM

STM

INTC

eDMA CACHE

e200Core

MMU

VLE

CACHE

FPU Nexus

JTAG

Debug PMU

SWT

MCM

STM

INTC

eDMACACHE

e200Core

MMU

VLE

CACHE

FPU

Com

mun

icat

ions

I/O S

yste

m

2 x LIN

Flex

3 x DSPI

2 xA

DC

2 FlexC

AN

3 x eTim

er

FCC

U

2 xFlexP

WM

CTU

TSENS


3x Timer Module:• 8.3 ns edge resolution• Six Ch IC/OC• Double buffered registers for

detecting two edges in a row• eDMA supported• Integrated quad decoder support

MCU

CTU

eTimer(Pos Counter)

PWM Reload

Timer/ Pos. decoder compare

External Signal

External Trigger

Trig

ger G

ener

ator

eTimer

flexPWM

Sch

edul

er

ADC Cmd

ADC Trig & Ackw

RealPWM’s

PWM’s

PWM Triggers

Real PWM’sADC Inputs

AD

C 1

SHAR

ED

AD

C 2

MPC5643L – Electric Motor Control Peripherals

2x FlexPWM• 8.3 ns edge resolution• Optimized for 3-ph motor control• One „extra“ pair of PWM integrated• Includes dead time insertion, fault channels,

center/edge alignment, Distortion correction, …

• Register (configuration) protections• Double buffered registers• Safe reload mechanism• eDMA supported

2x ADC• Up to 22 channels, with 4 shared. • 12-bit• 650 nsec conversion time• Limit checking & zero crossing detect

1x Cross Triggering Unit• Allows mcTIM, PWM, ATD

to be synchronized• Automatic ADC & eTimer acquisitions • No CPU intervention during the

control cycle• Over-run faults detection• Safe reload mechanism

PWM0 Ch0PWM0 Ch1

PWM1 Ch0PWM1 Ch1

PWM2 Ch0PWM2 Ch1

PWM3 Ch0PWM3 Ch1

Con

trol

M

M

DC/DC

8

2

6

9 4 9

12bit

S&HMUX

I/F12bit

S&HMUX

I/F


► Main Features► 4 Submodules, each with complementary PWM generation, Isense

IC/OC and fault input

► 16 bits of resolution for center, edge aligned, and asymmetricalPWMs

► PWM outputs can operate as complimentary pairs or independent channels

► Independent control of both edges of each PWM output

► Independently programmable PWM output polarity

► Separate dead time for rising and falling edges

► Each complementary pair can operate with its own PWM frequency and deadtime values

► All outputs can be programmed to change simultaneously via a "Force Out" event

► Double buffered PWM registers• Integral reload rates from 1 to 16• Half cycle reload capability

► Safety► Write protection for critical registers

► Fault inputs can be assigned to control multiple PWM outputs

► Programmable filters for fault inputs

PWM0 Ch0

Con

trol

PWM0 Ch1

PWM1 Ch0

PWM1 Ch1

PWM2 Ch0

PWM2 Ch1

PWM3 Ch0

PWM3 Ch1

Faults

Internal triggers

Complementary Pairs PWM Modes

Independent ChannelPWM Modes

auX

auX

auX

auX

• Permanent magnet synchronous motor (PMSM, PMAC) • Brushless DC motor (BLDC)• Brush DC motor (BDC)• AC induction motor (ACIM) • Switched reluctance motor (SRM) • Variable reluctance motor (VRM) • Stepper motors• DC/DC converters

CMP1CMP2Independent

Edge Control

Motor Control PWM Peripheral Module


Independent Edge Control – Edge Aligned PWM

PWM output

ValONValOFF

INIT

Val00

-4

34

-3

Case A Case B Case C Case B Case A0% 100% 75% 100% 0%

• Case A• Duty cycle – 0%

General– x% = 0%– ValON <= INIT– ValOFF <= INIT

Example– MOD = 8– x% = 0– INIT = -4– Val0 = INIT + MOD – 1 = 3– ValON = -4– ValOFF = INIT + MOD * x% = -4

• Case B• Duty cycle – 100%

General– x% = 100%– ValON <= INIT– ValOFF >= INIT + MOD > Val0

Example– MOD = 8– x% = 100% – INIT = -4– Val0 = INIT + MOD – 1 = 3– ValON = -4– ValOFF = INIT + MOD * x%

= -4 + 8 * 100% = 4

• Case C• Duty cycle – 75%

General– x% = 75%– ValON <= INIT– ValOFF = INIT + MOD * x%

Example– MOD = 8– x% = 75% – INIT = -4– Val0 = INIT + MOD – 1 = 3– ValON = -4– ValOFF = INIT + MOD * x%

= -4 + 8 * 75% = 2


Independent Edge Control – Centre Aligned PWM

PWM output

ValONValOFF

INIT

Val00

-4

34

-3

Case A Case B Case C Case B Case A0% 100% 75% 100% 0%


General– x% = 0%– ValON = 0– ValOFF = 0

Example– MOD = 8– x% = 0– INIT = -4– Val0 = INIT + MOD – 1 = -(INIT) -1 = 3– ValON = -(MOD/2 * x%) = 0– ValOFF = -(ValON) = 0


General– x% = 100%– ValON <= INIT– ValOFF >= -(ValON) = -(INIT) > Val0

Example– MOD = 8– x% = 100% – INIT = -4– Val0 = INIT + MOD – 1 = -(INIT) -1 = 3– ValON = -(MOD/2 * x%) = -4– ValOFF = -(ValON) = -(-4) = 4

• Case C• Duty cycle – 75%

General– x% = 75%– ValON = -(MOD/2 * x%) – ValOFF = -(ValON)

Example– MOD = 8– x% = 75% – INIT = -4– Val0 = INIT + MOD – 1 = -(INIT) -1 = 3– ValON = -(MOD/2 * x%) = -3– ValOFF = -(ValON) = -(-3) = 3


Independent Edge Control – Quasi-Centre Aligned PWM (Full Resolution)

PWM output

0

-4

34

-3

Case A0%

Case B100%

Case A0%

Case B100%

Case C62.5%

ValONValOFF

INIT

Val0


General– x% = 0%– ValON = 0– ValOFF = 0

Example– MOD = 8– x% = 0– INIT = -4– Val0 = INIT + MOD – 1 = -(INIT) -1 = 3– TMP = MOD/2 * x% = 0– ValON = -round(TMP) = 0– ValOFF = truncate(TMP) = 0


General– x% =100%– ValON <= INIT– ValOFF >= -(ValON) = -(INIT) > Val0

Example– MOD = 8– x% = 100% – INIT = -4– Val0 = INIT + MOD – 1 = -(INIT) -1 = 3– TMP = MOD/2 * x% = 4– ValON = -round(TMP) = -4– ValOFF = truncate(TMP) = 4

• Case C• Duty cycle – <0%,100%>

General– x% = <0%,100%>– TMP = MOD/2 * x% – ValON = -round(TMP– ValOFF = truncate(TMP)

Example– MOD = 8– x% = 62.5% – INIT = -4– Val0 = INIT + MOD – 1 = -(INIT) -1 = 3– TMP = MOD/2 * x% = 2.5– ValON = -round(TMP) = -3– ValOFF = truncate(TMP) = 2

In comparison with standard Centre-aligned PWM, this method improves resolution by 2x. It can increase ON time just by single count (min. two for C-A PWM) and keeps the ON pulse at the centre within ±½ count (±4.15 ns @ 120 MHz).


Independent Edge Control – Other PWM Paterns Example

►3-ph PWMs can be divided into:

• Standard – center aligned

• Two active vectors – left aligned

• Three active vectors – sequential

• Two active vectors – centered

• Three active vectors – center aligned (double switching)

60° - 120° 240° - 300°

120° - 180°60° - 120°

0° - 60° 60° - 120°


Sinusoidal Modulation – Limited in Amplitude

►In sinusoidal modulation the amplitude is limited to half of the DC-bus voltage

►The phase to phase voltage is then lower then the DC-bus voltage (although such voltage can be generated between the terminals)

50

UD

C-B

US

Uph

ase-

phas

e BC

A

PWM3PWM1

PWM4PWM2

PWM5

PWM6

Can such a modulation technique be found that wouldgenerate full phase-to-phase voltage?


Full Phase-to-Phase Voltage Generation

►Full phase-to-phase voltage can be generated by continuously shifting the 3-phase voltage system

►The amplitude of the first harmonic can be then increased by 15.5%

51

Uph

ase-

phas

e

BC

A

PWM1

PWM4PWM2

PWM3 PWM5

PWM6 Uph

ase-

phas

e BC

A

15%


How to Increase Modulation Index

►Modulation index is increased by adding the “shifting” voltage u0 to first harmonic

►“Shifting” voltage u0 must be the same for all three phases, thus it can only contain 3r harmonics!

52

B C

A

15%


► Main Features

► 2 Independent units• 4 channels shared on ADC1 and ADC2

► 4 shared signals for motor control acquisitions• 3 for phase currents• 1 for other acquisitions

► 650 ns conversion time128 ns sampling time

► 12-bit resolution

► Single sample and hold per ADC• Dual sample through ADC cross triggering

► Separate sampling and conversionclock pre-scalers

► Analog watchdogs allow continuous hardware monitoring

Motor Control ADC Peripheral ModuleADC Unit

►ADC_INTERRUPTS

ADC data registers

►D15►D14►.►.►.

►D1►D0

SUCCESSIVE APPROXIMATION A/D CONVERTER

SAMPLESAMPLE

& &

HOLDHOLD

12 bit12 bit

ConvertorConvertor

AIN0

AIN1

AIN15

..

..

..

ANALOG MUX

►ADC_CONTROLTrigger Event for

conversion

Trigger event for injected conversion

END OF CONVERSION

END OF INJECTION

THRESHOLD VIOLATION

INTERRUPTS

Results FIFOs

►Analogwatchdog

SUCCESSIVE APPROXIMATION A/D CONVERTER

SAMPLESAMPLE

& &

HOLDHOLD

12 bit12 bit

ConvertorConvertor

AIN0

AIN1

AIN15

..

..

..

ANALOG MUX

9 4 9

12bit

S&HMUX

I/F12bit

S&HMUX

I/F


Motor Control Cross Triggering Unit

► Main Features

► Two modes of operation:• Sequential mode• Triggered mode

► Schedule acquisition of the state variables (ADC, position counter, PWM duty cycle decoder) with respect to PWM cycle

► ADC commands stored in ADC lists

► Support for over-sampling

► Triggers activate an ADC list• ADC commands can be static• Triggers are changed according to space

vector location

► Trigger generation, ADC commands and ADC lists are double-buffered

► Manages both ADCs

► No real time involvement of CPU

► Compliant with ISO26262 for reduction of CPU interrupts

► DMA support

CTU

Trigger GeneratorSubunit

eTimer1

External signal

SchedulerSubunit

PWM triggersodd

Real PWM’s/IsenseX

Trigger0..7

eTimer2/ Pos. decoder

compare

PWM reload

2 x CLK

ADC Command Bus

External trigger

Presc.

Master Reload

eTimer1

eTimer2/ Pos. decoder compare

PWM triggerseven

Trigger


ADC Commands► ADCs must be in CTU control mode► Commands List of 24 commands► Commands List registers are double-buffered► Single conversion mode or dual conversion mode► The result of each conversion, in both modes, can be

stored in one of the 4 FIFOs► The interrupt request bit is used as an interrupt request

to the CPU when ADC will complete the command► The commands in the list will allow to have control on:

• Channel A number: number of ADC channel to sample from ADC unit A (4 bits)

• Channel B number: number of ADC channel to sample from ADC unit B (4 bits)

• FIFO selection bits for the ADC unit A/B (2 bits)• Conversion Mode selection bit• First command bit (only for CTU internal use)• Interrupt request bit

► 1 trigger from CTU initiate execution of the ADC command list; such command list can contain conversion stream (multiple ADC acquisitions)

Conversions only triggered by CTU

ADCch0...chN...ch23

CTUChannel ConversionCommand

Result FIFOs

CPU/eDMA

Memory

eTimer,FlexPWM


Cross Triggering Unit Benefits

PWM Period

PWM topPWM Bottom

Phase Current

Sampled and Average Currents

A/D

Control action calculation

New PWM Parameters Calculation with Half-cycle Reload

►ADC sampling helps to filter the measured current – anti-aliasing►Noise free ADC sampling when the power switch is not acting


microcontroller

microcontroller

Delays Involved in ADC-PWM Synchronization

► Delays are chained and are caused by:• Dead time insertion• Opto-coupler propagation delay• IGBT Driver propagation delay• IGBT turn ON/OFF times• Sensor slew rate

Low-pass filter delay• ADC delays

i+

PWM1

50 A

+-

GND

+5V

LPF ADC

Driv

erOverall delay: ~0.4 ÷ 6 us


Internal counter

Desired PWM

Cross Triggering Unit – Synchronized (Over)Sampling

Overall delay: ~0.4 ÷ 6 us

ADC trigger output event

ADC clock sync. ADC MUX selection S&H

ADC sample

Trigger advancement to compensate ADC delays

ADC delays

Low pass filter delay + Topto: ~1usReal feedback signal

at ADC pin


Control Signals Scheme – PWM_AD_MCU

abc

Desired PWM’s

Phase Currents

DC-Link Currenta -c a -c a -c

Sin/Cos

DC-link Voltage

ADC AcquisitionIC of Real PWM

Control Loop Calculation

PWM Commands ADC Triggers Setting

Real PWM’s

6x IC’s

on-the-fly reference calibration

- ADC sample- PWM switching noise


Microcontroller

ADC

TIMER

PWM

Cross Triggering Unit

Resolver Physical LayerResolver Physical LayerUcos

Usin

Resolver θ

GNDUref

Vdc

3-Phase Low Voltage Power Stage

PWM Isa Isc

U_Dc bus

Isb

U_D

c bu

s

Motor

Differential Amplifier + FilterDifferential Amplifier + Filter

3.3V

0V

3.3V

0V

Resolver Ref. DriverResolver Ref. Driver

Advanced Peripherals Enable On-chip Resolver-to-Digital Conversion

IRef 20-100 mA

LP

Filte

r

Tracking Observer Algorithm - SW

Tracking Observercomputation

co-sine samplesine sample

position speed # revolutions

Synchronization


Resolvers

► Rotor is put directly on the drive’s shaft► Stator is fixed on drive’s shield► Simple assembly and maintenance► No bearings — “unlimited” durability► Resist well against distortion, vibration,

deviation of operating temperature and dust► Worldwide consumption millions of pieces at

present time► Widely used in precious positioning

applications► The number of generated sine and cosine

cycles per one mechanical revolution depends on the number of resolver pole-pairs (usually 1-3 cycles)

Sensor Principle

Auxiliary transformer Rotor StatorAuxiliary

transformer Rotor StatorAuxiliary

transformer Rotor StatorAuxiliary

transformer Rotor Stator

Uref

Usin

Rotor shaft

θ

Ucos

ω

Uref

Usin

Rotor shaft

θ

Ucos

ω

0 0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009 0.01

Sinusoidal Voltage

0 0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009 0.01

Co-sinusoidal Voltage

0 0.001 0.002 0.003 0.004 0.005 0.006 0.007 0.008 0.009 0.01

0.5

-1-0.5

0

1

-1-0.5

00.5

1

-1-0.5

00.5

1 Reference Voltage

Sensor Components

Resolver Parameters:Electrical Error – +/-10’, Transformation Ratio – 0.5, Phase Shift – +/-10°Input Voltage – 4-30V, Input Current – 20-100mA, Input Frequency – 400Hz-10kHz


Angle Tracking Observer

►Method Basics:

►Features:• Robust method in term of noise • High accuracy of the angle extraction, speed estimation for free as side effect• Can deal with non-sinusoidal signals/envelops• Can be implemented fully digitally

62

Pos. Error ComparatorPos. Error

Comparator RegulatorRegulator

Angle TrackingAngle Trackingω

θω

e(θ)Envelope ExtractorEnvelope Extractor

LPFilterLP

Filter

ωest

θest

SineCosine

Generator

SineCosine

Generator


Accuracy

N = 13-bitError = ± 1LSB

±π = ± N-1 bit

N = 10-bitError = ± 1LSB

Experimental Results


Motor Control eTimer Peripheral Module

► Main Features► Six 16-bit general purpose up/down

timer/counter per module► Powerful multiplexer between external pins

and internal signals for external triggers► Individual channel capability:

• Input capture trigger• Output compare• Many counting modes (gating; triggered; one-shot)• Separate prescaler for each counter• Selectable clock source• Rotation direction flag (Quad decoder mode)

64

► Dual action capability per channel• PWM measurement 0% to 100%

► Quadrature decoder• rotor position• rotor zero speed detection (position watchdog)

► ADC trigger can also trigger input capture for rotor position measurement (ex: sin/cos sensor)

► Cascade able for higher precision (32 bits)

Sec.Input

PRIMARY

SECONDARY

PRESCALER

MUX

STATUS & CONTROL

DMA IF

COUNTER

TMRLOAD TMRHOLD

Edge Detect.

CAPTURE CAPTURE

CAP Buf.1 CAP Buf.1

TMRCMP1 TMRCMP2

CMPLD1 CMPLD2

COMP. COMP.

MUX OFLAG

OutputPrim.Input

CONTROL

OUTPUT

DATA BUS

Peripheral Clock

WD Count

UP/DNOutput Disable

OTHER CTNTRS

eTimer Channel


IC 1

IC1IC2

Counter

forward forwardjitter jitterbackward

PRESCALER 16-BIT

Trigger/ClockController

Input Capture

ARR16 bit Counter

Encoder Interface

IC 2

Output Trigger

Output Compare

Encoder Index

eTimer – Encoder Interface Mode

► The counter is clocked by each valid transition on IC 1 or IC 2 by incremental encoder

► Depending on the sequence the counter counts, automatically, up or down

► The output of encoder interface can be connected to encoder index to reset the counter on zero position detection

► The timer can provide information on encoded position► To obtain dynamic information (speed, acceleration,

deceleration) by measuring the periods between two encoder events using a second timer


Encoder Interface Mode — Safety

► Position WATCHDOG Timer/Counter

► Two successive counts indicate proper operation and will reset the timer.

► The timeout value is programmable. When a timeout occurs, an interrupt to the processor can be generated.

► This timer is separate from the watchdog timer in the COP module.

PHASE A

PHASE B

+/-1

PositionCounter

Incr. Encoder

What happens when PHASE A is cut off ?

Normal Operation

Operation at phase cut off

Pos. WatchdogInt. Request

Watchdog timeout

ISR

+/-1 counts of the Position Counter do not reset the Watchdog timer!

The Watchdog can detect the encoder signal line cut off!


Software - Motor Control Library – Key Features

►All functions ANSI-C MISRA compatible for easy porting to other target platforms

►Independent of target platform peripherals►Theory and performance results summarized in extensive

documentation►Delivery as object file enabling easy way of integration►Bit accurate Matlab/Simulink models included►Reference models for Matlab/Simulink, and test vectors available on

demand


Software - Motor Control Library Structure


Software - Motor Control Library – Application Example

MPC56xx

FreeMaster

-

Forward ClarkTransformation

a,b,c >alpha,beta

Current Sensing

Processing

-

Forward ParkTransformationalpha,beta>d,q

SpeedController

Current qPI

Controller

PWMModulation

-

Inverse ParkTransformationd,q >alpha,beta

Current dPI

Controller

-DC busripple

compensation

Is_a

_com

p

Us_alpha

Us_beta

Is_b

_com

pIs

_c_c

omp

Is_beta

Is_alpha

Is_q

Is_d

Us_q

Us_d

Is_q_Req

Us_alpha_comp

Us_beta_comp

Spe

ed_R

eq

Is_aIs_bIs_c

U_d

cb

Duty cycle aDuty cycle bDuty cycle c


theta_actual_elsin cos

Application ControlSector

Resolver HW

Sin

e

Cos

ine

Ref

Sin

eC

osin

e

START/STOP

12 V

dc

3-Phase Low Voltage Power Stage

PWM Isa Isc

U_Dc bus

Isb

U_D

c bu

s

6PMSM6PMSM

Load

Encoder

SoftwareSwitch

Resolver

Field Weakening Controller

SCI

Driver Driver

GPIOADCPWM eTimerGPIO

Driver Driver Driver Driver

Om

ega_

atua

l_m

ech

Fault Protection

Faults


Pos

ition

cou

nt

CTU

Driver

MCLIB functions

TM

Freescale Functional Safety Solutions

70


Challenge - Systems Become Components

In the past strong separation of systems and components.

More recently, however, complete systems are being condensed to single components.


Functional Safety Aspects for System-on-Chip

►It must be possible to test correct function of every safety feature• At least after reset — ideally during operation• Common technique: intentionally trigger specific error scenarios and check if the device

behaves as expected• Read-back of settings (registers) is important but not sufficient

►Configurable safety features• Make sure the default configuration is the most stringent one (highest level safety)• Make sure the configuration cannot be changed by a wild going unit• Consider a challenge-response protocol or other mechanisms that require “intelligent”

behavior of the unit before changing configurations that have a critical impact

►Graceful degradation• In case of a fault of the unit it should behave “gracefully” (manageable, detectable)• When designing safety features take into account that faults may affect their correct

operation as well – document measures to manage these cases (frequently on application level)

• Some circuitry can be designed in a self checking way, which requires some redundancy –however full duplication usually not necessary to detect faults

72


I/OBridge

Memory Protection UnitCross Bar Switch

Memory Protection Unit

RC RC

1MFLASH(ECC)

128KSRAM(ECC)

I/OBridge

PMU

SWT

MCM

STM

INTC

eDMA CACHE

PowerPC™e200

MMU

VLE

CACHE

FPU Nexus

JTAG

Debug PMU

SWT

MCM

STM

INTC

eDMACACHE

PowerPC™e200

MMU

VLE

CACHE

FPU

Com

mun

icat

ions

I/O S

yste

mM

CM

MC

M

2 x LIN

Flex

3 x DSPI

2 FlexC

AN

3 x eTim

er

FCC

U

2 xA

DC

2 xFlexP

WM

CTU

CR

C

TSENS

TSENS RC

Sphere of Replication

FlexRay

RC

MPC5643L - Ready for Functional Safety

Flash + Data Block•Provides ECC for both program Flash and Data Flash

Cross Bar Switch

Core built on Power Architecture Technology

• Replicated e200 core• Replicated eDMA• Redundant INTC,

crossbar and I/O bridge

Clock Monitor•Detect and mitigate clock disturbances Temp monitor

• Redundant temp monitor

FlexRay™2 ch @ 10 Mbps

ADC•Shared inputs•On Line Assisted Hardware BIST

eTimer Modules• Redundant operation• loop-back mode Fault Collection Unit

• detects when errors have occurred

• indicates error to external• brings device into safe state • independent of software

operation

Watchdog TimerRedundant operation

RAM• Provides ECC in HW• Higher safety than SW

signature at no speed constraint

CRC Module•Calculate Application signatures

Interrupt Controller• Redundant operation

Memory Management Unit• Memory HW access

control for Core, eDMA, FlexRay

Redundancy Checkers•Cycle-by-cycle comparison of the SoR

Power Management Unit• Separate Vreg and

redundant Vreg monitor

FlexPWM Module• Loop-back mode

KAL1 KAL2

KAL1 Need to remove PowerPC from the e200 block and put "e200 core"rm027c, 5/4/2010

KAL2 Need to remove PowerPC from the e200 block and put "e200 core"rm027c, 5/4/2010


MPC5643L Safety Concept – Turn-key Solution for SIL3 Certification

► MPC5643L safety concept has been defined with the target to meet IEC 61508 2nd ED WD safety standard to simplify system design, reduce development cost and minimize certification costs:

► Main Elements• Processing subsystem (Sphere of Replication):

No software requirements on start-up diagnostics (Logic BIST) No software requirement during application time

• SRAM Memory:No software requirement at start up (Memory BIST)

• Flash Memory:On-line test needed only to check ECC logicHardware assisted array integrity startup test

• Peripherals:Safety concept generic to application without specificities on the usage and control methodOn Line hardware assisted BIST for the ADCCRC Unit for Fault tolerant communication layer and Application data protection

• Centralized Fault Collection and Control UnitIndependent from the CPUConfigurable graded reaction to faults

• Minimum requirements on external circuitry (external watchdog, voltage monitoring) and software► Safety Application Guide detailing requirements on external circuitry and on software


Comparison of Different Dual-core Modes for Selected Fault Examples

Mode

Dual-core w/o safety

Dual-core w/o safety + SW Rep

Dual-core w/o safety + SW Div

DPM DPM + SW Rep

DPM + SW Div

LSM LSM + SW Div

Adapted LSM

Adapted LSM + SW Div

FPU-Fault (Single channel fault)

INTC fault (stop fault)

Voltage too low (CCF)

CAN clock (safe fault)

Annoyance failure not caught Reaction highly SW dependent Shutdown Graceful degradation

SW fault

Modes possible with MPC5643L

Demo at: http://www.freescale.com/webapp/sps/site/training_information.jsp?code=WBNR_MPC564XL_SAFETY


Example of Cost Effective Functional Safety Architecture

MPC5643L

IntelligentWatchdog

CPU Replicated CPU

Actuator’sEnergyControl

(DC-link Main Switch)

Actuator(s)

(Power Stage)

Sensor(s)

ActuatorControl

(IGBT Drivers)

disable

disable

control values

energy

controlsignals

token_Atoken_B

input value

input value

Fail Silent System

Redundant Peripherals


Safety Function and Fail Safe State

►Safety Function: • Perform in specification or move to the Fail Safe State within the

following assumptions:Dedicated periodic and/or diagnostic tests are executed at boot-time

– E.g., Build in Self Test at bootPeriphery is used in an application specific manner

– E.g., Motor control, communication peripheralsExternal watchdog (via FCCU error pins)

►Fail Safe State: • The device fail safe state is either the micro-controller reset or the “Error

Out” signaling with the appropriate protocol.

77


Freescale Functional Safety Application Guide

►Safety Application Guide• For safety certifications customers (not only)• Describes safety functions provided, how they work, what they can address/not

address

TM

Motor Control on Freescale Website

79


Freescale Motor Control Web Sitewww.freescale.com/motorcontrol

80


Freescale Reference DesignsFreescale > Reference Designs (under “support” tab)> Motor Control

81


Freescale Reference DesignsFreescale > Reference Designs > Motor Control > DC Motors - Brushless DC Motor (BLDC)

82


Summary

►Not surprisingly microcontroller is key element of the system and defining system overall performance

►High-performance CPU architecture• Improve control loop time• Provides hardware support for functional safety measures• Allows to implement complex (but effective) software safety measures

►Advanced peripherals help to reduce system cost• Reduced complexity of external circuitry• Lowered system size and mass• Easier packaging

►Today microcontrollers support and are integral part of functional safety solution

• High diagnostic coverage• Minimum impact to overall performance, cost and development effort

mcu solutions for hybrid drive train · kinetic energy recovery systems (kers) are currently in...

Documents