W H I T E PA P E R

Gerhard Wenderlein,
automotive system application engineer
Texas Instruments

Microcontrollers for the drive train

in hybrid and electric vehicles

Introduction The various development stages of electric vehicles range from simple start/stop systems, to
The electric drive train is superior in many mild hybrids, in which an electric motor provides the combustion engine with torque support,
respects to the conventional drive train to full electric vehicles. In full electric vehicles, a distinction is made between parallel and
with combustion engines. The electric mo- serial architectures. In parallel architectures, either combustion engines or electric motors
tor has higher efficiency, as well as better directly power the vehicle. Serial architectures, also known as “range extenders,” can drive
torque and performance. An electric drive solely on electric power. A small combustion engine is switched on when the batteries need
train provides a much simpler mechanical recharging.
design while eliminating undesirable noise Switched reluctance machines and three-phase asynchronous machines are sometimes
and pollution emissions. Although today’s used for electric motors, but permanent magnet synchronous motors (PMSM) are most widely
electrical energy storage systems limit the used because of their high efficiency, high-power density and high torque, even at low speeds.
vehicle range employing intelligent battery The synchronous machine runs with a synchronous rotor and stator frequency speed.
management and the hybrid concept (i.e.,
the combination of electric motor and com-
Battery Battery
bustion engine), helps to compensate for monitoring management

this. In addition, certain system faults can

be dangerous to passengers and damage

Infrastructure/Charging spot
Electrical DC/DC High- AC/DC
DC/AC voltage
motor/ converter converter
the electrical components of the vehicle, so generator
inverter
(reversible) Li-ion
battery
(PFC + PLC)
Motor control Energy conversion Charger
automotive safety requirements, under the
ISO 26262 standard, must be taken into DC/DC
converter
account. This article describes the types of (full bridge)

e-machines used, the electronic controller

Low-
for e-motor control, and the resulting spe- 12-V board voltage
12-V
net
battery
cific demands on the microcontroller. With
the Hercules™ TMS570LS safety microcon- Figure 1: System architecture of an electric vehicle

troller series, Texas Instruments offers con-

trollers that have the characteristics need- Depending on the type of vehicle, it can be powered by a single electric motor, one electric
ed for use in the electric motor controller. motor per axle or one per wheel, as in wheel-hub motors. All of these systems have been real-
ized in electric vehicles or prototypes today. When braking in recuperation mode, the kinetic
energy is converted into electrical energy and stored in the battery (regenerative braking).
During this mode the electric motors of the drive are used as generators.
2 Texas Instruments

Power inverter and The high-voltage battery in mild hybrids has a range of about 40–150V; in full hybrids the voltage range is
electric control unit several hundred volts. The pulse inverters used (DC/AC inverters) typically have a B6 bridge configuration
with MOSFETs as electronic circuit breakers for voltage ranges up to approximately 120V. At higher voltages,
insulated gate bipolar transistors (IGBTs) with the lowest possible on-state resistance and low-switching
losses are used. The motor controller consists mainly of the digital microcontroller, components for regulating
and monitoring the motor and power electronics and modules for processing sensor signals, communication
and power supply.

Battery

MibADC(s) Phase currents

Temperature
CPU
Gate
System High-end driver Motor
units PWM and
timer
(N2HET) isolation
Other DC/AC inverter Absolute angle
Capture sensor
peripherals
(sine/cosine)

Quadrature Hall elements

decoder
Incremental
encoder

Position/speed
measurement
Figure 2. Microcontrollers and power electronics for controlling the electric motor

Measuring the To regulate the torque of the motor, the microcontroller requires instantaneous information on the phase cur-
phase currents rents of the motor in every control cycle. Phase currents of several hundred amps can occur at high torques.
For this reason, current transformers with galvanic isolation are used between the primary (heavy current
circuit) and secondary circuit (electronic circuit). These converters are based on the Hall Effect and typically
deliver an output voltage on the secondary side that is proportionate to the current to be measured. The ad-
vantage of Hall Effect current converters is that they can be placed outside the signal cable therefore they do
not interfere with the signal (contact-free). Using an alternative of serial measuring shunt resistors, resistive
losses and overheating would occur which is problematic for measuring high currents, but these Hall Effect
current converters do not exhibit these effects and even resist very high currents in the primary cable.

Isolation Since currents and voltages in the inverter are much higher than in the control unit of the microcontroller,
isolation is required at all interfaces between these components in order to protect the control unit from
failure and malfunction. Texas Instruments offers automotive-qualified digital isolators with the ISO72xx
family featuring low-power consumption and clock speeds of up to 250 Mbps. These modules use capacitive

Microcontrollers for the drive train in hybrid and electric vehicles April 2012
 Texas Instruments 3

galvanic isolation, which compared to optical or magnetic isolation, exhibits very good characteristics with
regard to clock speed, reliability, ESD protection and EMC behavior.

The microcontroller With the Hercules™ TMS570LS safety microcontroller series, Texas Instruments offers microcontrollers that
are used today in the automotive sector in complex and safety-critical systems. These microcontrollers aid in
the development of safety-critical applications since they were specifically designed to meet and have been
deemed suitable for use in safety integrity level 3 (SIL3) under the IEC 61508 standard. Hercules TMS570LS
safety microcontrollers will be highlighted in greater detail below with respect to function and safety charac-
teristics for use in drive controls for electric vehicles.
The field-oriented principle for controlling rotating field e-machines is state-of-the-art. Communication
networks, online safety and diagnostic functions, standardized software architectures (i.e., AUTOSAR), and
the field-oriented control routines can lead to high demands on the microcontroller’s processing power and
memory requirements. Faster microcontrollers generally permit a higher function density and especially for
e-motor drives, better dynamics and control efficiency because shorter control loop times can be achieved.
To tackle the increased processing load, the Hercules TMS570LS safety microcontroller series offers
the 32-bit ARM® Cortex™-R4F CPU which can be clocked at up to 180 MHz (>280 DMIPS) and includes
a double-precision floating-point unit (FPU) for fast 32-bit and 64-bit floating-point operations (IEEE 754).
The floating-point and integer operations can run in parallel to achieve higher processing power. The FPU
facilitates software development since control and regulating algorithms are increasingly being developed
with model-based code generators, whose results are then integrated into the entire project as floating-point
subprograms.
The ARM Cortex-R4F core can process 16- or 32-bit commands, depending on the requirements of
the program code because of the Thumb®-2 instruction set, resulting in an optimal compromise between
processing speed and code size. The Hercules TMS570LS safety microcontroller series is currently available
with large amounts of integrated Flash memory from 1 to 3 MB and data memory from 128 kB to 256 kB.

High-end timer The high-end timer (N2HET) module of the Hercules TMS570LS safety microcontroller series is a flexible,
­coprocessor user programmable, timing generator and capture engine. A single program can control up to 32 pins that
can be freely configured as input or output. The N2HET program is copied into its local RAM during system
initialization. During operation, the core can update key values in the N2HET RAM in order to create pulse
width modulations (PWM) or read out values captured by input pins. In order to further reduce the CPU’s load,
transactions between the N2HET RAM and the CPU memory can also be carried out by system direct memory
access (DMA) or the high-end transfer unit (HTU), a DMA controller specific to N2HET. Due to its high degree
of flexibility, the N2HET is capable of generating simple, as well as very specialized timer requirements, such
as the PWM control of an electric motor or the reading in sensor signals. The N2HET also has the ability to
implement state machines without CPU load because it can process input signals and create appropriate
output responses or status information on its own.

Microcontrollers for the drive train in hybrid and electric vehicles April 2012
4 Texas Instruments

Figure 3: Safety features on TI’s Hercules™ microcontroller family

In order to control a three-phase electric motor, timer modules must typically generate six pulse-width
modulated (PWM) signals. Therefore, with the appropriate pulse pattern on the power switches of the inverter,
a three-phase voltage system of a specific amplitude, phase angle and specified frequency is generated.
It is generally possible to control two three-phase motors with a single N2HET module. Because the
TMS570LS21x/31x microcontrollers provide two NHET modules, additional functionality can be realized. The
second N2HET can be used for a number of different purposes, such as to control different motors with vari-
ous inverter circuits or even other sensor communication protocols such as single-edge nibble transmission
(SENT).

Analog-to-digital TI’s Hercules TMS570LS safety microcontroller has two multi-input-buffered analog-to-digital converters
converter (MibADC) with 12-bit resolution and 24 input channels to convert analog sensor signals. In order to reduce
the CPU load, each MibADC module has its own multi-buffered RAM capable of storing up to 64 conversion
results per module. This RAM is memory mapped and can be read out by CPU or DMA at defined time points.
The N2HET module has extensive configuration options for triggering A/D conversions. For electric motor
control applications, the N2HET can start multiple A/D conversion sequences within the PWM period at freely
programmable time points.

Communication Although the trend indicates an integration of vehicle functions in a smaller number of electronic controllers,
the communication interfaces play an important role. The integrated Ethernet, FlexRay™ and CAN modules
of the Hercules™ TMS570LS safety microcontroller can be used for local communication or connection to

Microcontrollers for the drive train in hybrid and electric vehicles April 2012
 Texas Instruments 5

the main vehicle network. Similar to the HTU, the FlexRay module includes a transfer unit (FTU) to read out
the data without CPU interaction. In addition, sensors and application-specific integration circuits (ASICs) can
be connected to the controller via the SPI or LIN/SCI module. Many modules have their own RAM in which the
data to be sent or received can be buffered.

Safety requirements The rotor magnet field of a PMSM motor energizes the stator coils as long as the motor is turning. This is true
even in case of an error that may short circuit the inverter, or the stator windings of the motor. In such a case,
the error must be detected quickly and countermeasures must be taken in order to prevent damage due to
the high currents, but most important is to prevent a dangerous, undesirable braking moment of the PMSM
motor.
The architecture of the electric vehicle, which comes out very differently in wheel-hub motors and mild,
parallel or serial hybrids, is a deciding factor in the vehicle’s safety considerations. For a mild hybrid, for
example, lower safety demands are placed on the electric drive than for pure electric driving. It is obvious that
braking processes are critical to safety and thus the safety consideration must include the use of the electric
motor in the generator operation as regenerative or recuperation braking.
The international standard IEC 61508, mandatory since 2004 in Europe, controls the development of
safety-critical electronic systems, including their associated development processes and quality assurance
practices. The standard ISO 26262 is derived from IEC 61508 and has been adapted to the specific circum-
stances of the automotive sector for safety-relevant electrical/electronic systems in motor vehicles. The safety
features of the Hercules™ TMS570LS safety microcontroller, as a central component in a control electronics
system, are explored below.
The Hercules TMS570LS safety microcontroller series was specifically designed for use in safety integrity
level 3 (SIL3) systems as defined under IEC 61508 and also benefits from Texas Instruments’ 20+ years of
experience with safety-critical microcontroller applications in the automotive sector. The development process
and safety concept of Hercules TMS570LS safety microcontrollers were certified as suitable for use in SIL3
systems by exida, an independent company that specializes in certifications in the field of functional safety.
The Hercules TMS570LS safety microcontroller series uses two identical ARM® Cortex™-R4F cores on the
chip, which run the same program and receive the same input in a lockstep fashion. Operations and results
of both calculations are logically compared to one another on every CPU cycle to detect and respond to pos-
sible errors. Both CPUs are implemented in silicon with geometric, as well as time diversity, in order to reduce
the chance of physical common-cause failures. The second ARM Cortex-R4F core is physically mirrored and
rotated in silicon and its processing is delayed by a few cycles.
The advantages of a lockstep architecture are high diagnostic coverage and reduced diagnostic software
development effort. The hardware comparison of the two cores happens on each CPU cycle. Therefore, when
an error is detected, a fail-safe state, such as safely shutting down the system’s actuators, can be achieved
within a few CPU cycles. Since the error detection on the core is executed purely by the hardware, it requires
no CPU load and little software as compared to software-based detection schemes. Other types of errors

Microcontrollers for the drive train in hybrid and electric vehicles April 2012
6 Texas Instruments

detected in the microcontroller by the hardware mechanisms are presented below. This reduces the cost
and complexity of the software development and safety validation on the system side. Users can integrate
third-party software packages into the overall project with little effort and the step from a dual- to a single-
processor system can help reduce costs.
In order to detect and respond to errors both in the program memory and the data memory of the
­Hercules™ TMS570LS safety microcontroller, every ARM® Cortex™-R4F core has integrated error correc-
tion code (ECC) logic. This module makes it possible to correct individual bit errors and detect double errors.
In addition, address buses and decoders are monitored internally.
Two types of built-in self-test modules monitor the cores – logic built-in self-test (LBIST) and the data
memory programmable build-in self test (PBIST) – respectively. The LBIST module can check the Cortex-R4
core for defects during controller initialization or while the application is running. The PBIST module can test
any or all integrated data memory (RAM) with various selectable algorithms. The built-in self-test modules
simplify the software development and code space since no test routines must be implemented for the core
and data memory. All peripheral modules that have their own data memory (N2HET, MibADC, FlexRay™, DCAN
and MibSPI) are protected by parity logic in the hardware. These RAM areas can also be tested with PBIST.
The integrated memory protection unit (MPU) can be used to monitor access to specific memory areas and
assign specific access rights to these areas. A 64-bit cyclic redundancy checker (CRC) unit is included for
testing stored static data and can be operated in the background by DMA. In addition, the peripheral modules
have their own error detection abilities, such as the self-test of the analog-digital converter (ADC). All mod-
ules used for error detection are connected with the error-signaling module. This module enables centralized
prioritization and configurable external signaling of all detected errors.

Figure 4: Hercules™ Safety Microcontroller Roadmap

Microcontrollers for the drive train in hybrid and electric vehicles April 2012
 Texas Instruments 7

Summary and The ARM cores implemented on the Hercules safety family of microcontrollers are used as processor cores
outlook by many semiconductor manufacturers. There are many advantages of ARM-based cores due to the stan-
dardization that has made it possible for a number of third-party vendors to support these cores with devel-
opment tools and software components. FlexRay drivers and AUTOSAR packages are available for Hercules
TMS570LS safety microcontrollers.
The Hercules TMS570LS safety microcontroller offers the performance, the peripherals and the safety
functions to be used for drive control in electric vehicles.
The Hercules TMS570LS safety microcontroller roadmap supports up to 4 MB Flash memory and variant
architectures that include the current lockstep approach as well as a dual independent Cortex-R configuration
capable of executing two different programs simultaneously. The use of cache with these derivatives will al-
low even higher processing power. For more information on the Hercules family of microcontrollers, including
Hercules TMS570LS safety microcontrollers and development tools, visit www.ti.com/hercules. For more
specific information on the Hercules Safety features please see the “Safety Manual for TMS570LS31x/21x
and RM48x Hercules ARM Safety Critical MCUs.”
In addition, the “Hybrid and Electric Vehicle Solutions Guide (Rev. A)”, offers a wide range of TI semi-
conductor modules for use in hybrid and electric vehicles.

Important Notice: The products and services of Texas Instruments Incorporated and its subsidiaries described herein are sold subject to TI’s standard terms and
conditions of sale. Customers are advised to obtain the most current and complete information about TI products and services before placing orders. TI assumes no
­liability for applications assistance, customer’s applications or product designs, software performance, or infringement of patents. The publication of information
regarding any other company’s products or services does not constitute TI’s approval, warranty or endorsement thereof.

Hercules is a trademark of Texas Instruments Incorporated. All other trademarks are the property of their respective owners.

© 2012 Texas Instruments Incorporated SPRY200

 IMPORTANT NOTICE
Texas Instruments Incorporated and its subsidiaries (TI) reserve the right to make corrections, modifications, enhancements, improvements,
and other changes to its products and services at any time and to discontinue any product or service without notice. Customers should
obtain the latest relevant information before placing orders and should verify that such information is current and complete. All products are
sold subject to TI’s terms and conditions of sale supplied at the time of order acknowledgment.
TI warrants performance of its hardware products to the specifications applicable at the time of sale in accordance with TI’s standard
warranty. Testing and other quality control techniques are used to the extent TI deems necessary to support this warranty. Except where
mandated by government requirements, testing of all parameters of each product is not necessarily performed.
TI assumes no liability for applications assistance or customer product design. Customers are responsible for their products and
applications using TI components. To minimize the risks associated with customer products and applications, customers should provide
adequate design and operating safeguards.
TI does not warrant or represent that any license, either express or implied, is granted under any TI patent right, copyright, mask work right,
or other TI intellectual property right relating to any combination, machine, or process in which TI products or services are used. Information
published by TI regarding third-party products or services does not constitute a license from TI to use such products or services or a
warranty or endorsement thereof. Use of such information may require a license from a third party under the patents or other intellectual
property of the third party, or a license from TI under the patents or other intellectual property of TI.
Reproduction of TI information in TI data books or data sheets is permissible only if reproduction is without alteration and is accompanied
by all associated warranties, conditions, limitations, and notices. Reproduction of this information with alteration is an unfair and deceptive
business practice. TI is not responsible or liable for such altered documentation. Information of third parties may be subject to additional
restrictions.
Resale of TI products or services with statements different from or beyond the parameters stated by TI for that product or service voids all
express and any implied warranties for the associated TI product or service and is an unfair and deceptive business practice. TI is not
responsible or liable for any such statements.
TI products are not authorized for use in safety-critical applications (such as life support) where a failure of the TI product would reasonably
be expected to cause severe personal injury or death, unless officers of the parties have executed an agreement specifically governing
such use. Buyers represent that they have all necessary expertise in the safety and regulatory ramifications of their applications, and
acknowledge and agree that they are solely responsible for all legal, regulatory and safety-related requirements concerning their products
and any use of TI products in such safety-critical applications, notwithstanding any applications-related information or support that may be
provided by TI. Further, Buyers must fully indemnify TI and its representatives against any damages arising out of the use of TI products in
such safety-critical applications.
TI products are neither designed nor intended for use in military/aerospace applications or environments unless the TI products are
specifically designated by TI as military-grade or "enhanced plastic." Only products designated by TI as military-grade meet military
specifications. Buyers acknowledge and agree that any such use of TI products which TI has not designated as military-grade is solely at
the Buyer's risk, and that they are solely responsible for compliance with all legal and regulatory requirements in connection with such use.
TI products are neither designed nor intended for use in automotive applications or environments unless the specific TI products are
designated by TI as compliant with ISO/TS 16949 requirements. Buyers acknowledge and agree that, if they use any non-designated
products in automotive applications, TI will not be responsible for any failure to meet such requirements.
Following are URLs where you can obtain information on other Texas Instruments products and application solutions:
Products Applications
Audio www.ti.com/audio Automotive and Transportation www.ti.com/automotive
Amplifiers amplifier.ti.com Communications and Telecom www.ti.com/communications
Data Converters dataconverter.ti.com Computers and Peripherals www.ti.com/computers
DLP® Products www.dlp.com Consumer Electronics www.ti.com/consumer-apps
DSP dsp.ti.com Energy and Lighting www.ti.com/energy
Clocks and Timers www.ti.com/clocks Industrial www.ti.com/industrial
Interface interface.ti.com Medical www.ti.com/medical
Logic logic.ti.com Security www.ti.com/security
Power Mgmt power.ti.com Space, Avionics and Defense www.ti.com/space-avionics-defense
Microcontrollers microcontroller.ti.com Video and Imaging www.ti.com/video
RFID www.ti-rfid.com
OMAP Mobile Processors www.ti.com/omap
Wireless Connectivity www.ti.com/wirelessconnectivity
TI E2E Community Home Page e2e.ti.com

Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265
Copyright © 2012, Texas Instruments Incorporated