Tesla Small Drive Unit - Safe shutdown?

[cloudy]

Obviously to start up the small drive, you just need to give 12+V, ign start pulse and a direction...

I think the SDU is sensitive to blowing up the IGBTs if the unit is powered down while rotor is moving. What's the best way to safely shutdown the unit? Resending ignition start pulse I don't think shuts down into pre-run - so you end up just pulling the main 12V supply and hoping the drive isn't rotating at the time... Is there a better way?

Also is there any risk if reverse is selected at high forward speed (and vice versa?)

Lastly, does anyone know the function of the brake light digital switch input? It seems superfluous given the analog brake pressure input...

Many Thanks!

[johu]

Obviously to start up the small drive, you just need to give 12+V, ign start pulse and a direction...

I think the SDU is sensitive to blowing up the IGBTs if the unit is powered down while rotor is moving. What's the best way to safely shutdown the unit? Resending ignition start pulse I don't think shuts down into pre-run - so you end up just pulling the main 12V supply and hoping the drive isn't rotating at the time... Is there a better way?

The issue is rather dropping the main relay while the IGBTs are still clocked. I used to restart Polo all the time when something went wrong, but then that wasn't a SDU, still an async motor though.

Also is there any risk if reverse is selected at high forward speed (and vice versa?)

No, that is locked out until you reach a configurable minimum speed. If you drop it out of forward you can not put it back in forward though.

Lastly, does anyone know the function of the brake light digital switch input? It seems superfluous given the analog brake pressure input...

Yes, I know It locks out the throttle pedal. Safety feature. If you don't have a brake pressure sensor it can also be used to give some additional "digital" regen.

[cloudy]

Thanks Johannes - that clears it up!

I've had the HV contactors drop several times in 'motion' without issue (only at 60V for testing though) I presume once the HV drops out the IGBTs stop being driven as udcmin is reached and inverter stops - The main DC cap will still be in circuit I guess. I assumed the damage was being done by the back EMF into the IGBTs - not sure if that's because of their driven/undriven state - or just the fact there is no battery load (I guess that's the same situation as a freewheeling motor when regen is switched off though....)

James

[coleasterling]

I don't think it is as much of an issue with the contactors opening since PWM will have been shut down. In my case, the breaker I was testing with blew and PWM was still active.

[Peter]

If the shutdown is due to an event such as overcurrent will it be preferable and less likely to damage the IGBT's if the precharge is still energised? Also would it not be the case the bus caps will absorb a bemf spike and limit it ?

[EV_Builder]

If the shutdown is due to an event such as over current will it be preferable and less likely to damage the IGBT's if the precharge is still energized? Also would it not be the case the bus caps will absorb a bemf spike and limit it ?

Yes but the point is that when there is noway the power can go it will build up.
So that means that the voltage will rise and it will rise very quick.
Adding a resistor in the path is better then nothing but in front of the resistor the charge will build up and voltage will rise to.
So basically you would need an extra cont actor with a high enough resistance to limit amps but low enough to not have big spikes.

[Peter]

What about using a Transient Voltage Suppressor with high enough Joule rating?

[catphish]

I'd like to resurrect this thread because I'm worrying about the same thing. Would it be sufficient (and sensible) to add a time delay to the precharge contactor so that if +12v is cut, the precharge contactor remains closed long enough to dissipate power until the IGBTs power down? It's not clear to me whether this would dissipate enough power or not.

[catphish]

I've just spoken with Peter about this. An option he's suggested is to place reverse diodes across the main contactor so that regen energy can still be returned to the battery if the contactor opens. Would this help, or is the problem bidirectional?

[Doig5710]

I like the idea of that as well because I'll need some sort of safe back up incase of an emergency shut down in motorsport use, a size and rating would be useful if you had any ideas?

[catphish]

I like the idea of that as well because I'll need some sort of safe back up incase of an emergency shut down in motorsport use, a size and rating would be useful if you had any ideas?

This depends somewhat on how much peak regen you'll be doing. One of these per every 100A should do the job. I believe they can be used in parallel.
https://uk.farnell.com/genesic-semicond ... dp/3598663

I think we should get some input from Johannes though, because I actually don't understand the mechanism by which the inverter is damaged when the main contactor opens. It could be that regen causes an excessive charge to accumulate on the DC bus, unable to return to the battery, in which case these diodes seem like the correct solution.

However, this may not be the case at all. The damage could be caused by an inductive spike somewhere, in which case I'd really expect the DC bus capacitors to prevent this problem, but again it would be good to get advice is at all possible from someone who actually has experience with the action that causes this failure.

[johu]

I have never seen any manufacturer placing diodes across the DC link. Other than the ones inside the inverter bridge itself, that is.
Not sure what the silicon carbide diode is supposed to do because it is not a transient voltage suppressor and you can't just free-wheel an inverter as you would free-wheel a relay coil.

I too can only speculate about the failure mode, over voltage seems the most probable one.

[catphish]

Not sure what the silicon carbide diode is supposed to do because it is not a transient voltage suppressor and you can't just free-wheel an inverter as you would free-wheel a relay coil.

Thank you for your reply, but I don't think I explained correctly. The proposal was not to connect the diode in parallel with the DC bus, but to connect it in parallel with the main contactor. This would suppress excess voltage in cases where the main contactor opens unexpectedly. Falstad demo: https://tinyurl.com/yenut6gk vs https://tinyurl.com/yglhgjg

[johu]

Oh I see. But wouldn't that defeat the purpose of having a contactor, i.e. making absolutely sure voltage is mechanically disconnected when the contactor is off? A diode that fails shorted would bridge the contactor.

[catphish]

Oh I see. But wouldn't that defeat the purpose of having a contactor, i.e. making absolutely sure voltage is mechanically disconnected when the contactor is off? A diode that fails shorted would bridge the contactor.

Yes, you're quite right. While this might work, it's probably not a good idea.

I'd really like to better understand why this problem occurs at all. Assuming the STM32 samples the DC bus voltage every switching cycle, I'd expect it to be able to shut the IGBTs down (with a high bus voltage error) before the voltage reached a dangerous value. I'd really want that process to work every time regardless of the state of the inverter, but obviously I don't have a big pile of Tesla inverters to test failures on

It may be that the best solution is just to add a larger DC bus capacitor.

Thanks again!

[johu]

Assuming the STM32 samples the DC bus voltage every switching cycle, I'd expect it to be able to shut the IGBTs down (with a high bus voltage error) before the voltage reached a dangerous value.

It doesn't, it is only sampled in the 10ms task because on traditional hardware the analog bandwidth is much too low for doing cycle by cycle processing. The Tesla isolator might deliver a higher bandwidth though...

[muehlpower]

The issue is rather dropping the main relay while the IGBTs are still clocked. I used to restart Polo all the time when something went wrong, but then that wasn't a SDU, still an async motor though.

I think I have read that if no forward or backward signal is set, the IGBTs are not clocked either. I will install a relay for the ignition that will hold the 12V for the drive unit and the main contactors approx. 1 second after switching off the ignition key. The 12V to supply the direction switch are immediately interrupted.
Would that make switching off a rotating motor safer?

[catphish]

I think I have read that if no forward or backward signal is set, the IGBTs are not clocked either. I will install a relay for the ignition that will hold the 12V for the drive unit and the main contactors approx. 1 second after switching off the ignition key. The 12V to supply the direction switch are immediately interrupted.
Would that make switching off a rotating motor safer?

This seems like a sensible approach to me. I was trying to think of the right way to do this, and I suspect this is it.

The other question is whether it would be better to have the precharge contactor closed at all times when the main contactor is closed, this might provide a small amount of protection in case the main contactor failed.

[catphish]

After damaging a LDU inverter this week that was connected to a motor that was absolutely not spinning, I just wanted to resurrect this thread, and think about failsafe shutdown procedures.

It seems to me that damage could occur any time current is flowing through the windings, and switched 12V is removed, essentially opening the contactors before openinverter has a chance to stop driving the IGBTs.

Are people doing anything to eliminate this possibility, or it is just extremely unlikely to cause damage when the motor isn't spinning?

[johu]

You might be chasing a phantom there. When the motor is stationary and there is no throttle request the PWM is in fact halted, i.e. all IGBTs are off. In my Polo conversion I could even shut down the inverter while driving without causing damage.

[catphish]

You might be chasing a phantom there. When the motor is stationary and there is no throttle request the PWM is in fact halted, i.e. all IGBTs are off. In my Polo conversion I could even shut down the inverter while driving without causing damage.

I'm absolutely being paranoid at this point, you're right, Just wanting to make sure I'm not missing anything. As long as zero throttle demand and zero rpm doesn't call for any applied voltage at all, there should be no problem. Thanks!

[Peter]

Does Ampnom allow power to motor when throttle is not pressed with fwd or rev selected? But not when in neutral ?

[catphish]

Does Ampnom allow power to motor when throttle is not pressed with fwd or rev selected? But not when in neutral ?

There are some obvious things that could cause power to the motor when not in neutral:
* Throttle applied, accidentally, deliberately, or by a misconfigured threshold
* Regen, if the shaft is turning
* Hill old, if enabled and active

I think ampnom is only for testing, not normal operation modes. It will apply power regardless, but will only matter if you intentionally put the inverter into test mode, which I've always been too scared to do, since it has no throttle and no RPM limit

[EV_Builder]

Wouldn't a hardware protection be an possibility here?

If a input isn't high clock signals to the igbt's are not sended or don't end up at said igbts?
I think thats how it should be done. On HW level.
That "SAFE" input is then wired into the system and 100mS before coil opening is brought low.

In the SMALL Tesla SDU i would almost expect that the HVIL could/would do something like this...

[arber333]

You want to have DC contactor latching to 12V start pulse. Obviously OI or Lebowski can provide DC contactor signal, however i still use twin relay in latching circuit in my Pug.
EV200 contactors have economizer which operated down to 9V level. I really like that for obvious reasons .
If any Aux voltage LV event inverter should close PWM generation and issue an emergency signal without recovery possible.
I consider brownout the only scenario where you dont have full control over your DC contactor.
Humans in the loop should then use their heads and drive to the side and slow down below FW speed and eventually stop safely. I guess from 12V down to 9V there should be enough time to stop safely?
Otherwise i am strongly for keeping DC contactor engaged when driving the car! None of the notaus trip your DC contactor nonsense. About the only thing to trip the DC contactor from energized state should be removal of the key from the steering wheel lock. And you want to do that only when you are stationary since the steering can lock up on you .
Ok, granted you can have an emergency DC disconnect which could trip the DC contactor GND line for failsafe action. But that should be safetied by a cover or dual action trigger and not in normal use!

Any ideas how to communicate that in OI HMI (human machine interface)? Would amber engine light be enough EMGC to obey?