WO2025111687A1

WO2025111687A1 - Overvoltage protection circuit and method of overvoltage protection

Info

Publication number: WO2025111687A1
Application number: PCT/CA2023/051597
Authority: WO
Inventors: Aliasgar GHADYALI; Ian STOTHART
Original assignee: Epiroc Fvt Inc
Current assignee: Epiroc Fvt Inc
Priority date: 2023-11-29
Filing date: 2023-11-29
Publication date: 2025-06-05
Anticipated expiration: 2026-05-29

Abstract

In an electronic system such as an electric vehicle, damaging overvoltage may be generated very quickly without warning, requiring a rapid response to protect the system. In some embodiments herein, an electronic system may be protected from overvoltage using a hardware-based protection circuit. The protection circuit may include a dissipation resistor, a switch for connecting the resistor to a bus of the electronic system, and a hardware control circuit configured to monitor a bus voltage magnitude of the bus. If the control circuit detects that the bus voltage magnitude is greater than an overvoltage threshold, it may cause the switch to connect the resistor to the bus to dissipate power in the bus. Then, after a minimum time has elapsed, if the bus voltage magnitude has dropped below the overvoltage threshold, the hardware control circuit may cause the switch to disconnect the resistor from the bus.

Description

OVERVOLTAGE PROTECTION CIRCUIT AND METHOD OF OVERVOLTAGE

PROTECTION

FIELD

This disclosure relates generally to protection of an electronic system, such as an electric vehicle, from overvoltage.

BACKGROUND

Overvoltage occurs where voltage in an electronic system exceeds a design value. Such conditions may damage elements of the electronic system. For example, in an electric vehicle, back electromotive force (back EMF) generated by the vehicle’s motor may cause damaging overvoltage in some situations.

SUMMARY

An electric vehicle may include a traction battery and an electric motor, connected by a high-voltage bus. In operation, power may flow through the bus between the battery and the motor. For example, during propulsion, the battery may provide power to the motor, while during regenerative braking, the motor may act as a generator and provide power to recharge the battery. However, in certain situations, the motor may generate back EMF sufficient to cause considerable overvoltage in the bus. For example, back EMF may produce overvoltage if the vehicle is moving at a high speed and the battery fails or is otherwise disconnected. As another example, back EMF may produce overvoltage if the vehicle is being towed at too high a speed. In such situations, bus voltage may quickly rise to levels which may damage power electronics connected to the bus. Known overvoltage protection systems may not respond rapidly enough to mitigate damage under these circumstances. Known overvoltage protection systems may also not account for sustained back EMF repeatedly causing overvoltage, leading to the bus voltage oscillating between overvoltage and normal operating levels.

In some embodiments herein, an electronic system such as an electric vehicle may be protected from overvoltage using a hardware-based protection circuit. The hardware-based protection circuit may provide a more rapid response time (e.g., compared to software control), and in some embodiments the hardware-based protection circuit may implement a time delay (e.g., via a timing circuit) to prevent voltage oscillation. One example is as follows. The protection circuit includes a dissipation resistor, a switch, and a hardware control circuit. The switch may be engaged to connect the dissipation resistor to a bus of the electronic system to dissipate power in the bus - for example, to reduce overvoltage in the bus. The hardware control circuit monitors a magnitude of a bus voltage in the bus. If the magnitude of the bus voltage exceeds an overvoltage threshold, then the hardware control circuit outputs a signal to cause the switch to connect the resistor to the bus. The hardware control circuit then holds this signal up for at least a minimum time to ensure that the switch maintains the connection between the resistor and the bus for at least the minimum time regardless of whether the magnitude of the bus voltage drops below the overvoltage threshold before the minimum time has elapsed. Once the minimum time has elapsed, if the magnitude of the bus voltage has dropped below the overvoltage threshold, then the hardware control circuit may cause the switch to disconnect the resistor from the bus. This time delay before disconnecting the resistor provides a technical benefit in that it can help prevent oscillation of the bus voltage if the source of overvoltage is sustained. For example, in an electric vehicle where overvoltage may be caused by back EMF arising from overly high motor speeds during battery failure or towing, connecting the resistor to the bus loads the motor and thus causes it to slow down. Keeping the resistor connected to the bus may allow the motor to slow down enough to be safely below overvoltage speeds, providing a margin to avoid bus voltage oscillation. This time delay approach may also provide time for engaging potential secondary overvoltage protections such as engaging a parking brake of the vehicle.

In one aspect, there is provided a protection circuit for protecting an electronic system from overvoltage. The protection circuit may include a dissipation resistor, a switch, and a hardware control circuit. The switch may be operable to selectively electrically connect the dissipation resistor to a bus of the electronic system. The hardware control circuit may be configured to monitor a magnitude of a bus voltage of the bus. In response to detecting that the magnitude of the bus voltage is greater than an overvoltage threshold, the hardware control circuit may further be configured to output a first signal at a first level to cause the switch to electrically connect the dissipation resistor to the bus to dissipate power in the bus, and to hold the first signal at the first level for at least a minimum time to cause the switch to continue to electrically connect the dissipation resistor to the bus for at least the minimum time, regardless of whether the magnitude of the bus voltage drops below the overvoltage threshold before the minimum time has elapsed. In response to the minimum time having elapsed and the magnitude of the bus voltage being below the overvoltage threshold, the hardware control circuit may further be configured to output the first signal at a second level to cause the switch to electrically disconnect the dissipation resistor from the bus.

In some embodiments, the hardware control circuit may include a comparator and a timing circuit. The comparator may be configured to receive a converted voltage corresponding to the bus voltage and a reference voltage corresponding to the overvoltage threshold. In response to detecting that a magnitude of the converted voltage is greater than a magnitude of the reference voltage, the comparator may further be configured to transmit an overvoltage signal to the timing circuit. In response to detecting that the magnitude of the converted voltage is less than the magnitude of the reference voltage, the comparator may further be configured to terminate transmission of the overvoltage signal to the timing circuit. In response to receiving the overvoltage signal, the timing circuit may be configured to output the first signal at the first level to cause the switch to electrically connect the dissipation resistor to the bus to dissipate power in the bus, and to hold the first signal at the first level for at least the minimum time to cause the switch to continue to electrically connect the dissipation resistor to the bus for at least the minimum time. In response to the minimum time having elapsed and receiving no overvoltage signal, the timing circuit may further be configured to output the first signal at the second level to cause the switch to electrically disconnect the bus from the dissipation resistor.

In some embodiments, the comparator may include an operational amplifier.

In some embodiments, the hardware control circuit may further include a voltage divider configured to provide the reference voltage to the comparator.

In some embodiments, the hardware control circuit may further include a voltage transducer. The voltage transducer may be configured to measure the bus voltage. The voltage transducer may further be configured to determine the converted voltage from the bus voltage and provide the converted voltage to the comparator.

In some embodiments, the voltage transducer may include a Hall effect sensor. In some embodiments, the hardware control circuit may further include a logic gate and a resistor connection sensor. The logic gate may include a plurality of inputs, each input configured to receive a respective signal. In response to every one of the plurality of inputs receiving a signal at the first level, the logic gate may be configured to cause the switch to electrically connect the dissipation resistor to the bus. In response to at least one of the plurality of inputs not receiving a signal at the first level, the logic gate may further be configured to cause the switch to electrically disconnect the bus from the dissipation resistor. In response to receiving the overvoltage signal from the comparator, the timing circuit may be configured output the first signal at the first level to a first one of the plurality of inputs of the logic gate, and hold the first signal at the first level for at least the minimum time. In response to the minimum time having elapsed and receiving no overvoltage signal, the timing circuit may be configured to output the first signal at the second level to the first one of the plurality of inputs. The resistor connection sensor may be configured to monitor an electrical connection between the dissipation resistor and the switch. In response to detecting that the dissipation resistor is electrically connected to the switch, the resistor connection sensor may further be configured to output a second signal at the first level to a second one of the plurality of inputs of the logic gate. In response to detecting that the dissipation resistor is not electrically connected to the switch, the resistor connection sensor may further be configured to output the second signal at the second level to the second one of the plurality of inputs.

In some embodiments, the protection circuit may further include a control unit. The control unit may be programmed to selectively output a third signal at the first level to a third one of the plurality of inputs of the logic gate. In response to detecting a default condition, the control unit may further be programmed to output the third signal at the second level to the third one of the plurality of inputs of the logic gate.

In some embodiments, the protection circuit may further include a resistor temperature sensor. The resistor temperature sensor may be configured to measure a temperature of the dissipation resistor. The resistor temperature sensor may be in operative communication with the control unit. In response to the resistor temperature sensor detecting that the temperature of the dissipation resistor is greater than a resistor temperature threshold, the control unit may be programmed to output the third signal at the second level to the third one of the plurality of inputs of the logic gate.

In some embodiments, the protection circuit may further include a switch temperature sensor. The switch temperature sensor may be configured to measure a temperature of the switch. The switch temperature sensor may be in operative communication with the control unit. In response to the switch temperature sensor detecting that the temperature of the switch is greater than a switch temperature threshold, the control unit may be programmed to output the third signal at the second level to the third one of the plurality of inputs of the logic gate.

In some embodiments, the protection circuit may further include a switch error sensor. The switch error sensor may be configured to detect whether the switch has an error. The switch error sensor may be in operative communication with the control unit. In response to the switch error sensor detecting that the switch has an error, the control unit may be programmed to output the third signal at the second level to the third one of the plurality of inputs of the logic gate.

In some embodiments, the protection circuit may be configured to be part of a vehicle. In such embodiments, the control unit may be configured to output a brake control signal to engage a brake of the vehicle in response to the hardware control circuit causing the switch to electrically connect the dissipation resistor to the bus.

In some embodiments, the control unit may be in operative communication with the switch. In such embodiments, the control unit may be programmed to control the switch to electrically connect the dissipation resistor to the bus and to electrically disconnect the dissipation resistor from the bus.

In some embodiments, the protection circuit may further include a control unit in operative communication with the switch. In such embodiments, the control unit may be programmed to control the switch to electrically connect the dissipation resistor to the bus and to electrically disconnect the dissipation resistor from the bus.

In some embodiments, the control unit may further be programmed to control the switch to selectively connect and disconnect the dissipation resistor and the bus to control dissipation of power in the bus by pulse-width modulation. In some embodiments, the electronic system may include a battery, and the protection circuit may be configured to receive power from the battery to operate the protection circuit.

In some embodiments, the protection circuit may further include a holdup circuit. The holdup circuit may be configured to store electrical power from the battery. In response to the protection circuit being disconnected from the battery, the holdup circuit may further be configured to provide power to operate the protection circuit.

In some embodiments, the electronic system may include an electric motor. The electric motor may generate a back electromotive force, and the protection circuit may be configured to receive power from the back electromotive force to operate the protection circuit.

In some embodiments, the protection circuit may further include a voltage converter. The voltage converter may be configured to convert voltage from the back electromotive force to a supply voltage for the protection circuit.

In some embodiments, the voltage converter may include a direct current-to-direct current (DC-to-DC) converter.

In some embodiments, the DC-to-DC converter may include a step-down converter.

In some embodiments, the step-down converter may be configured to convert the voltage from the back electromotive force to the supply voltage only if the voltage from the back electromotive force exceeds a converter threshold.

In some embodiments, the electronic system may include an electric vehicle including a parking brake. In such embodiments, in response to detecting that the magnitude of the bus voltage is greater than the overvoltage threshold, the protection circuit may be configured to engage the parking brake.

In another aspect, there is provided an electric vehicle. The electric vehicle may include an electric motor, a traction battery, a bus for carrying power between the electric motor and the traction battery; and a protection circuit as described herein operatively connected to the bus.

In another aspect, there is provided a method of protecting an electronic system from overvoltage. The method may involve monitoring a magnitude of a bus voltage of a bus of the electronic system. In response to detecting that the magnitude of the bus voltage is greater than an overvoltage threshold, the method may further involve causing a switch to electrically connect a dissipation resistor to the bus to dissipate power in the bus, and causing the switch to continue to electrically connect the dissipation resistor to the bus for at least a minimum time regardless of whether the magnitude of the bus voltage drops below the overvoltage threshold before the minimum time has elapsed. In response to the minimum time having elapsed and the magnitude of the bus voltage being below the overvoltage threshold, the method may further involve causing the switch to electrically disconnect the dissipation resistor from the bus.

Other aspects and features will become apparent to those ordinarily skilled in the art upon review of the following description of illustrative embodiments in conjunction with the accompanying figures.

BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary embodiments are illustrated in referenced figures of the drawings. It is intended that the embodiments and figures disclosed herein are to be considered illustrative rather than restrictive.

FIG. l is a circuit diagram illustrating a protection circuit for protecting an electronic system from overvoltage according to one embodiment.

FIG. 2 is a circuit diagram illustrating a 555 timer integrated circuit of the hardware control circuit of FIG. 1.

FIG. 3 is a flow chart of a method for protecting an electronic system from overvoltage according to one embodiment.

FIG. 4 is a schematic diagram illustrating an electronic system which includes a protection circuit for protecting the electronic system from overvoltage according to another embodiment.

FIG. 5 is a simplified schematic diagram of an example battery electric vehicle incorporating the electronic system of FIG. 4.

FIG. 6 is a circuit diagram illustrating a holdup circuit of the protection circuit of FIG. 4. FIG. 7 is a schematic diagram illustrating an electronic system which includes a protection circuit for protecting the electronic system from overvoltage according to another embodiment.

FIG. 8 is a graph demonstrating an overvoltage response time of the protection circuit of FIG. 1.

DETAILED DESCRIPTION

Referring to FIG. 1, a protection circuit according to one embodiment is shown generally at 100. The protection circuit 100 may engage with a bus 102 of an electronic system, such as an electric vehicle, to protect electronics connected to or part of the bus 102 and thus the electronic system from overvoltage. The protection circuit 100 includes a dissipation resistor 104, a switch 106, and a hardware control circuit 108. The switch 106 is operable, by the hardware control circuit 108, to selectively electrically connect the dissipation resistor 104 to the bus 102 in order to dissipate power in the bus 102 and thus reduce voltage or overvoltage in the bus 102. In the embodiment shown, the switch 106 is an insulated-gate bipolar transistor (IGBT). However, in other embodiments, other types of switches or transistors may be used in place of or in addition to the switch 106. Further, in some alternative embodiments, the protection circuit may include more than one switch and/or more than one dissipation resistor.

Generally, the hardware control circuit 108 monitors a bus voltage of the bus 102 and, based at least on the bus voltage, controls the switch 106 to electrically connect or disconnect the dissipation resistor 104 and the bus 102. For example, the hardware control circuit 108 may cause the switch 106 to electrically connect the dissipation resistor 104 to the bus 102 if overvoltage is detected in the bus 102 - that is, if a magnitude of the bus voltage is above an overvoltage threshold. In the embodiment shown, the hardware control circuit 108 includes a voltage divider 110, a voltage transducer 112, a comparator 114, a timing circuit 116, and a logic gate 118.

The voltage divider 110, the voltage transducer 112, and the comparator 114 function together to detect overvoltage in the bus 102 and signal to the timing circuit 116 if overvoltage is detected. In some embodiments, the voltage divider 110, the voltage transducer 112, and the comparator 114 may collectively be referred to as a “monitoring circuit”.

The voltage transducer 112 measures the bus voltage of the bus 102, determines a converted voltage based on the measured bus voltage, and provides the converted voltage to the comparator 114. In some embodiments, the voltage transducer 112 may include a Hall effect sensor (i.e., a current clamp) configured to provide contactless measurements of a bus current in the bus 102. In such embodiments, the voltage transducer 112 may determine the bus voltage from the bus current provided by the Hall effect sensor, and may then calculate a converted voltage that corresponds to the measured bus voltage. For example, the converted voltage may have a value that is scaled by a scaling factor relative to the bus voltage. The voltage transducer 112 then outputs this converted voltage to the comparator 114. By using contactless measurement, this configuration of the voltage transducer 112 advantageously allows measurement of the bus voltage without applying a load to the bus 102 - that is, without consuming power. Additionally, using this configuration, the comparator 114 may be isolated from high voltages on the bus 102.

The voltage divider 110 defines and provides a reference voltage to the comparator 114, for comparison to the converted voltage provided by the voltage transducer 112. The reference voltage generally corresponds to an overvoltage threshold defining a maximum allowable value for a magnitude of the bus voltage, above which overvoltage protection is required. For example, the reference voltage may have a value that is scaled relative to the overvoltage threshold by the same scaling factor as that relating the converted voltage to the bus voltage, such that if the magnitude of the bus voltage is greater than the overvoltage threshold, a magnitude of the converted voltage will be greater than a magnitude of the reference voltage. In the embodiment shown, the voltage divider 110 includes a power supply terminal 120, a first voltage divider resistor 122, a second voltage divider resistor 124, and a divider output 126. The voltage divider 110 receives a supply voltage at the power supply terminal 120 and produces the reference voltage at the divider output 126, which is connected to the comparator 114. By selectively varying the resistances of the first and second voltage divider resistors 122 and 124, the reference voltage at the divider output 126 may be adjusted. For example, in the embodiment shown in Figure 1, the reference voltage V_ref may be obtained as:

where Ri is the resistance of the first voltage divider resistor 122, R2 is the resistance of the second voltage divider resistor 124, and V_s is the supply voltage at the power supply terminal 120. Thus, as an example, if Ri is 27000 , R2 is 2200 , and V_s is 15 V, the reference voltage Vref at the divider output 126 will be 1.13 V.

The comparator 114 includes a positive input terminal 128 which receives the converted voltage (corresponding to the measured bus voltage) from the transducer 112, and a negative input terminal 130 which receives the reference voltage (corresponding to the overvoltage threshold) from the divider output 126 of the voltage divider 110. The comparator 114 compares the converted voltage to the reference voltage to determine if there is overvoltage in the bus 102, and transmits an overvoltage signal to the timing circuit 116 if overvoltage is detected. More specifically, the comparator 114 transmits the overvoltage signal to the timing circuit 116 in response to detecting that a magnitude of the converted voltage is greater than a magnitude of the reference voltage. Conversely, the comparator 114 will terminate transmission of the overvoltage signal to the timing circuit 116 in response to detecting that the magnitude of the converted voltage is less than the magnitude of the reference voltage. In the embodiment shown, the comparator 114 is an operational amplifier and receives a power supply voltage at a power supply terminal 132.

Generally, upon receiving the overvoltage signal from the comparator 114, the timing circuit 116 outputs a first signal at a first level to cause the switch 106 to electrically connect the dissipation resistor 104 to the bus 102, and holds the first signal at the first level for at least a minimum time to cause the switch 106 to continue to electrically connect the dissipation resistor 104 to the bus 102 for at least the minimum time. Once the minimum time has elapsed, and if the timing circuit 116 is no longer receiving the overvoltage signal from the comparator 114, then the timing circuit 116 outputs the first signal at a second level to cause the switch 106 to electrically disconnect the dissipation resistor 104 from the bus 102. By causing the switch 106 to maintain the connection between the dissipation resistor 104 and the bus 102 for at least the minimum time, the timing circuit 116 helps prevent oscillation of the bus voltage between overvoltage and normal operating levels in situations where the source of the overvoltage is sustained. The minimum time delay before disconnecting the dissipation resistor 104 from the bus 102, and thus potentially allowing the overvoltage to return, also functions as a buffer or margin, providing time to address the source of the overvoltage. In some embodiments, the minimum time may be, for example, about 500 milliseconds. In some embodiments, the timing circuit 116 may be referred to as a “timer” or “hysteresis timer”.

In the embodiment shown in FIG. 1, the timing circuit 116 includes a 555 timer integrated circuit 200, a trigger switch 134, a timing resistor 136, a timing capacitor 138, a decoupling capacitor 140, and a power supply terminal 142. The 555 timer 200 may be, for example, Texas Instruments® TLC555 LinCMOS™ timer. An internal schematic of the 555 timer 200 is shown FIG. 2, which corresponds to the TLC555 LinCMOS™ timer. Referring to FIGS. 1 and 2, the 555 timer 200 includes a ground pin 202, a trigger pin 204, an output pin 206, a reset pin 208, a control pin 210, a threshold pin 212, a discharge pin 214, a power supply pin 216, a flip-flop 220, a first comparator 222, and a second comparator 224. The flip- flop 220 is an S-R flip-flop, with its R input connected to the output of the first comparator 222 and its S input connected to the output of the second comparator 224. Very generally, the ground pin 202 is a ground reference voltage, while power to the 555 timer 200 is supplied at the power supply pin 216. The discharge pin 214 is an open-collector output to discharge a timing capacitor, such as the timing capacitor 138. The output pin 206 transmits an output signal of the 555 timer 200. The output signal may be transmitted at a high level or at a low level. In the embodiment shown, the output signal of the 555 timer 200 is the first signal, the high level is the first level, and the low level is the second level. The trigger pin 204 is used to start a high output timing interval during which the output signal is transmitted at the high level. The threshold pin 212 is used to define the end of the high output timing interval. In the embodiment shown, the high output timing interval corresponds to the minimum time for which the timing circuit 116 holds the first signal at the first level in response to receiving the overvoltage signal from the comparator 114. The reset pin 208 may be used to reset the high output timing interval and/or cause the output signal to be transmitted at the low level. The reset pin 208 overrides the trigger pin 204, which overrides the threshold pin 212. Finally, the control pin 210 may be used to control comparator thresholds in the 555 timer 200 to adjust timing characteristics of the 555 timer 200.

In the embodiment shown in FIG. 1, the 555 timer 200 is configured for monostable operation. The reset pin 208 is electrically connected to the power supply pin 216 to prevent any accidental or false triggering of a reset, and the control pin 210 is connected to the decoupling capacitor 140 to ensure that electrical noise does not affect internal circuitry of the 555 timer 200. In operation of this embodiment, when the timing circuit 116 is in a latent state before the comparator 114 has transmitted the overvoltage signal to the timing circuit 116, the output pin 206 transmits the first signal at the second level (low). When the comparator 114 transmits the overvoltage signal to the timing circuit 116, the overvoltage signal is received by the trigger switch 134 and causes the trigger switch 134 to close. As a result, the trigger pin 204 is connected to ground, dropping to a low voltage level and initiating the high output timing interval of the 555 timer 200. During the high output timing interval, the output pin 206 transmits the first signal at the first level (high), and the timing capacitor 138 is charged through the timing resistor 136. The high output timing interval ends when a voltage across the timing capacitor 138 reaches a threshold voltage of the threshold pin 212. In the embodiment shown, this threshold voltage is 2/3 of the supply voltage at the power supply pin 216. If, by the end of the high output timing interval, the comparator 114 has terminated transmission of the overvoltage signal to the timing circuit 116 such that the trigger switch 134 is open and thus the trigger pin 204 is disconnected from ground and has returned to a high voltage level, then the output pin 206 transmits the first signal at the second level (low), and the timing capacitor 138 is discharged through the discharge pin 214 to allow for subsequent triggering of the 555 timer 200. Thus, in response to receiving the overvoltage signal from the comparator 114, the timing circuit 116 transmits the first signal at the first level from the output pin 206 for at least the minimum time of the high output timing interval. The high output timing interval, and therefore the minimum time, can be set by adjusting a resistance of the timing resistor 136 and a capacitance of the timing capacitor 138. More specifically, the high output time interval t may be obtained as: t = ln(3) R_tC_t , where Rt is the resistance of the timing resistor 136 and Ct is the capacitance of the timing capacitor 138. Thus, as an example, if Rt is 50000 and Ct is 10 pF, the high output time interval t will be approximately 549 milliseconds.

In the embodiment shown in FIG. 1, the timing circuit 116 outputs the first signal from the output pin 206 of the 555 timer 200 to an input of the logic gate 118, and it is the logic gate 118 that ultimately directly controls the switch 106 to connect or disconnect the dissipation resistor 104 and the bus 102. Generally, the logic gate 118 may include a plurality of inputs, each configured to receive a respective signal, with at least one of those inputs configured to receive the first signal from the timing circuit 116. The logic gate 118 causes the switch 106 to electrically connect the dissipation resistor 104 to the bus 102 if every one of the plurality of inputs receives its respective signal at the first level. However, if at least one of the plurality of inputs of the logic gate 118 does not receive its respective signal at the first level, then the logic gate 118 causes the switch 106 to electrically disconnect the dissipation resistor 104 from the bus 102. In the embodiment shown, the logic gate 118 is an AND gate and includes a first gate switch 144 configured to receive the first signal from the timing circuit 116, a second gate switch 146 configured to receive a second signal from a second external source 148, a third gate switch 150 configured to receive a third signal from a third external source 152, and a power supply terminal 154 receiving a power supply voltage. The second and third external sources 148 and 152 may be, for example, controllers and/or sensors monitoring other elements of the protection circuit 100 or the electronic system. Each of the gate switches 144, 146, and 150 will close if it receives its respective signal at the first level. More specifically, in the embodiment shown, the first level is a high level and each of the gate switches 144, 146, and 150 is an N-channel enhancement-mode metal-oxide-semiconductor field-effect transistor (MOSFET) that will close if it receives a high level input signal. Therefore, if the first, second, and third signals are all received at the first level (high), the gate switches 144, 146, and 150 will all close and thus connect the power supply voltage to the switch 106, causing the switch 106 to close and connect the dissipation resistor 104 to the bus 102. If one or more of the first, second, and/or third signals is instead received at the second level (low), then the corresponding gate switch(es) will open and disconnect the power supply voltage from the switch 106, causing the switch 106 to open and disconnect the dissipation resistor 104 from the bus 102.

The hardware control circuit 108 of the embodiment shown in FIG. 1 is an example only, and alternative embodiments may differ. For example, some alternative embodiments may use a different type of logic gate than an AND gate. Other alternative embodiments may omit the logic gate 118 altogether and have the timing circuit 116 connect directly to the switch 106. In yet other alternative embodiments, the logic gate 118 may include more than three inputs, or fewer that three inputs (e.g., the logic gate 118 might omit external source 152 and gate switch 150, e.g., if there is no software control supplementing the hardware circuit). In still other alternative embodiments, the monitoring circuit (illustrated as the voltage divider 110, transducer 112, and comparator 114) may have a different hardware configuration that achieves the same overvoltage monitoring described herein.

Referring to FIG. 3, an overall method for operating the protection circuit 100 to protect an electronic system including the bus 102 from overvoltage is shown generally at 300. At 302, the magnitude of the bus voltage of the bus 102 is monitored using the voltage divider 110, the voltage transducer 112, and the comparator 114. At 304, the comparator 114 is used to compare the magnitude of the bus voltage measured by the voltage transducer 112 to the overvoltage threshold defined by the voltage divider 110. At 306, in response to detecting that the magnitude of the bus voltage is greater than the overvoltage threshold (i.e., that there is overvoltage in the bus 102), the first signal is output at the first level by the timing circuit 116 to cause the switch 106, via the logic gate 118, to electrically connect the dissipation resistor 104 to the bus 102 to dissipate power in the bus 102. At 308, the timing circuit 116 is used to hold the first signal at the first level for at least the minimum time to cause the switch 106 to continue to electrically connect the dissipation resistor 104 to the bus 102 for at least the minimum time regardless of whether the magnitude of the bus voltage drops below the overvoltage threshold before the minimum time has elapsed. At 310, once the minimum time has elapsed, the comparator 114 indicates whether the magnitude of the measured bus voltage is below the overvoltage threshold. At 312, in response to the minimum time having elapsed and to detecting that the magnitude of the bus voltage is below the overvoltage threshold, the first signal is output at the second level by the timing circuit 116 to cause the switch 106 to electrically disconnect the dissipation resistor 104 from the bus 102.

Because the protection circuit 100 is implemented entirely in hardware, it may provide a more rapid response time to overvoltage events than a software-based overvoltage protection system. For example, the protection circuit 100 may trigger within 100 microseconds of an overvoltage event occurring. Without this rapid response time, electronics may be damaged from the overvoltage.

Referring now to FIGS. 4 and 5, an electronic system according to another embodiment is shown generally at 400 and includes a bus 402 and a protection circuit 404. The bus may be bus 102 described in relation to FIGS. 1 to 3, and the protection circuit 404 may include hardware protection circuit 100 described in relation to FIG. 1. In the embodiment shown in FIGS. 4 and 5, the electronic system 400 is an electric vehicle and (as shown in FIG. 5) further includes an electric motor 406, a motor controller 408, a traction battery 410, a vehicle master control unit 412, a parking brake 414, and an auxiliary battery 416. Very generally, the motor controller 408 controls operation of the electric motor 406. The bus 402 electrically connects the traction battery 410 to the motor controller 408 and the electric motor 406, to allow power to flow between the traction battery 410 and the electric motor 406. As explained above, in some situations, back EMF generated by the electric motor 406 may produce potentially damaging overvoltage on the bus 402. The protection circuit 404 is operatively connected to the bus 402 between the traction battery 410 and the motor controller 408 to protect the bus 402 and the electronic system 400 (i.e., the vehicle) from this and other sources of overvoltage.

As shown in FIG. 4, the protection circuit 404 includes a dissipation resistor 418 (illustrated as “R” in FIG. 4), a switch 420 (illustrated as “S” in FIG. 4), a hardware control circuit 422, a resistor connection sensor 424, a control unit 426 (illustrated as a microcontroller unit (MCU) in FIG. 4), and a holdup circuit 428. The dissipation resistor 418 may be, or may be similar to, the dissipation resistor 104, the switch 420 may be, or may be similar to, the switch 106, and the hardware control circuit 422 may be, or may be similar to, the hardware control circuit 108. Generally, the dissipation resistor 418, the switch 420, and the hardware control circuit 422 function together in the same way as the dissipation resistor 104, the switch 106, and the hardware control circuit 108. That is, the hardware control circuit 422 monitors a bus voltage of the bus 402 and, based at least on the bus voltage, controls the switch 420 to electrically connect or disconnect the dissipation resistor 418 and the bus 402.

The resistor connection sensor 424 monitors an electrical connection between the dissipation resistor 418 and the switch 420, and signals to the hardware control circuit 422 whether the dissipation resistor 418 is electrically connected to the switch 420. For example, the dissipation resistor 418 may not be electrically connected to the switch 420 if the dissipation resistor 418 has failed. More specifically, in some embodiments where the hardware control circuit 422 is the hardware control circuit 108, the resistor connection sensor 424 is configured to output a second signal at the first level to the second gate switch 146 of the logic gate 118 in response to detecting that the dissipation resistor 418 is electrically connected to the switch 420, and is further configured to output the second signal at the second level to the second gate switch 146 in response to detecting that the dissipation resistor 418 is not electrically connected to the switch 420. That is, in such embodiments, the resistor connection sensor 424 may be the second external source 148. By outputting the second signal at the second level to the logic gate 118 when the dissipation resistor 418 is disconnected from the switch 420, the resistor connection sensor 424 prevents the logic gate 118 from causing the switch 420 to electrically connect the dissipation resistor 418 to the bus 402 under such circumstances. This mechanism is an important safety feature, because if the dissipation resistor 418 has failed and is thus not electrically connected to the switch 420, causing the switch 420 to attempt to connect the (failed) dissipation resistor 418 to the bus 402 may cause a short circuit between the bus 402 and other parts of the electronic system 400, potentially leading to fires.

The control unit 426 generally provides additional software-based control and reporting features to the protection circuit 404 to supplement the hardware control circuit 422. For example, in some embodiments where the hardware control circuit 422 is the hardware control circuit 108, the control unit 426 is programmed to selectively output a third signal at the first level to the third gate switch 150 of the logic gate 118, and is further programmed to output the third signal at the second level to the third gate switch 150 in response to detecting a default condition. That is, in such embodiments, the control unit 426 may be the third external source 152. In some embodiments, the control unit 426 may be, for example, a microcontroller unit (MCU), e.g., as illustrated, however the control unit 426 need not necessarily be an MCU. If the control unit 426 is an MCU it may be implemented by a processor that execute instructions stored in a memory of the MCU to provide software control that supplements the hardware overvoltage protection, thereby resulting in the benefit of both rapid response time of hardware protection, supplemented by software control for enhanced complementary features, examples of which are described herein.

In some embodiments, the control unit 426 may be in operative communication with one or more sensors monitoring other elements of the protection circuit 404. For example, in the embodiment shown, the protection circuit 404 includes a resistor temperature sensor 430, a switch temperature sensor 432, and a switch error sensor 434. Each of the resistor temperature sensor 430, the switch temperature sensor 432, and the switch error sensor 434 is in operative communication with the control unit 426. The resistor temperature sensor 430 is configured to measure a temperature of the dissipation resistor 418, and the control unit 426 is programmed to output the third signal at the second level to the third gate switch 150 of the logic gate 118 in response to the resistor temperature sensor 430 detecting that the temperature of the dissipation resistor 418 is greater than a resistor temperature threshold. The switch temperature sensor 432 is configured to measure a temperature of the switch 420, and the control unit 426 is programmed to output the third signal at the second level to the third gate switch 150 in response to the switch temperature sensor 432 detecting that the temperature of the switch 420 is greater than a switch temperature threshold. Finally, the switch error sensor 434 is configured to detect whether the switch 420 has an error, and the control unit 426 is programmed to output the third signal at the second level to the third gate switch 150 in response to the switch error sensor 434 detecting that the switch 420 has an error.

In some embodiments, the control unit 426 may also be in operative communication with the hardware control circuit 422 and the parking brake 414. In some such embodiments, the control unit 426 may be configured to output a brake control signal to engage the parking brake 414 in response to the hardware control circuit 422 causing the switch 420 to electrically connect the dissipation resistor 418 to the bus 402. That is, in an overvoltage situation, in addition to the hardware control circuit 422 causing the switch 420 to electrically connect the dissipation resistor 418 to the bus 402, the control unit 426 may cause the parking brake 414 to engage. This additional engagement of the parking brake 414 may be advantageous in situations where the source of overvoltage in the bus 402 is sustained long-term (e.g., highspeed towing of the vehicle), as extended use of the dissipation resistor 418 for power dissipation may overwhelm the dissipation resistor 418 and cause it to fail. In alternative embodiments, engagement of the parking brake 414 may be triggered by elements of the protection circuit 404 other than the control unit 426. For example, the signal originating from the output of the timing circuit that triggers the switch (e.g.. the signal from output pin 206 of FIG. 1) may also engage the parking brake 414. As another example, the parking brake 414 may be triggered independently of causing the switch 420 to electrically connect the dissipation resistor 418 to the bus 402. That is, the protection circuit 404 may generally be configured to, in response to detecting that the magnitude of the bus voltage is greater than the overvoltage threshold, engage the parking brake 414.

In some embodiments, the control unit 426 may also be in direct operative communication with the switch 420, and may be programmed to control the switch 420 to electrically connect the dissipation resistor 418 to the bus 402 and to electrically disconnect the dissipation resistor 418 from the bus 402. In some such embodiments, the control unit 426 may be further programmed to control the switch 420 to selectively connect and disconnect the dissipation resistor 418 and the bus 402 to control dissipation of power in the bus 402 by pulse-width modulation (PWM). PWM of the switch 420 may allow power dissipation in the bus 402 during normal operation, when there is no overvoltage in the electronic system 400 due to towing or a fault, e.g., during regenerative braking when the battery is already at a full state of charge such that voltage generated by the regenerative braking needs to be dissipated. The PWM may mitigate or avoid the need for spinning auxiliary motors to dissipate the power.

In some embodiments, the control unit 426 may also be in operative communication with the vehicle master control unit 412. For example, the control unit 426 may provide feedback to the master control unit 412 regarding a status of the protection circuit 404 or other elements of the electronic system 400. In the embodiment shown, the protection circuit 404 is configured to receive operating power from the auxiliary battery 416, from the bus 402, or from both of these sources. Power received by the protection circuit 404 from the bus 402 may be or include power from back EMF generated on the bus 402 by the electric motor 406. Regardless of source, power provided to the protection circuit 404 first passes through the holdup circuit 428.

Referring now to FIGS. 4 and 6, in the embodiment shown, the holdup circuit 428 includes a bus input terminal 430, a battery input terminal 432, a voltage converter 434, a holdup capacitor 436, and a power output terminal 438. The bus input terminal 430 is configured to receive power from the bus 402, such as from back EMF on the bus 402. The battery input terminal 432 is configured to receive power from the auxiliary battery 416. The power output terminal 438 is configured to provide power to other components of the protection circuit 404.

The voltage converter 434 is configured to convert a voltage received at the bus input terminal 430, which can be a very high voltage if caused by back EMF (e.g., an overvoltage), to a supply voltage for powering the protection circuit 404. In the embodiment shown, the bus 402 carries direct current (DC), and so the voltage converter 434 is a direct current-to-direct current (DC-to-DC) converter. More specifically, the voltage converter 434 is a step-down converter, and is configured to convert the voltage received at the bus input terminal 430 (e.g., from back EMF) to the supply voltage for the protection circuit 404 only if the voltage received at the bus input terminal 430 (e.g., from back EMF) exceeds a converter threshold. The voltage converter 434 may be, for example, a MORNSUN® PV40-29BxxR3 Series DC/DC converter, and the converter threshold may be, for example, 200 V.

The holdup capacitor 436 is configured to store electrical power received by the holdup circuit 428 from the auxiliary battery 416 and/or from the bus 402. In the event of a loss of power input to the holdup circuit 428, the holdup capacitor 436 may temporarily provide power to operate the protection circuit 404. Thus, for example, if the holdup circuit 428 is receiving electrical power from the auxiliary battery 416, some of that power will be stored in the holdup capacitor 436. Subsequently, if the holdup circuit 428 becomes disconnected from the auxiliary battery 416, the holdup circuit 428 will respond by providing the stored power from the holdup capacitor 436 to operate the protection circuit 404. In some embodiments, the holdup circuit 428 may be able to power the protection circuit for up to 4 milliseconds after power source disconnection. This feature is particularly advantageous in a high-speed fault scenario, such as where the electric vehicle (i.e., the electronic system 400) is moving at a high speed and the vehicle batteries (i.e., the auxiliary battery 416 and the traction battery 410) suddenly become disconnected. In this situation, the electric motor 406 will generate considerable back EMF and overvoltage that needs to be immediately dissipated. The auxiliary battery cannot power the protection circuit 404 to dissipate the overvoltage because it has become disconnected. The electronics connected to the bus may be damaged from the overvoltage before the back EMF on input terminal 430 provides the necessary power to power the protection circuit 404. However, the holdup circuit 428 advantageously holds up the power to power the protection circuit 404. As such, the stored power from the holdup circuit 428 powers the protection circuit 404 to dissipate the energy from the back EMF.

With reference to FIG. 4, the protection circuit 404 also includes voltage converters 440 and 442. The voltage converter 440 receives power from the power output terminal 438 of the holdup circuit, and converts the voltage to values appropriate for components of the hardware control circuit 422 (e.g., 5 V or 15 V). Similarly, the voltage converter 442 receives power from the power output terminal 438 of the holdup circuit, and converts the voltage to values appropriate for the control unit 426 (e.g., 3.3 V).

Note that the holdup circuit 428 with its two power inputs (from bus 402 via bus input terminal 430 and from auxiliary battery 416 via battery input terminal 432) and with voltage convertor 440 may be provided in combination with the hardware control circuit 108 of FIG. 1 without the other components (e.g., MCU, etc.) illustrated in the FIG. 4 embodiment. The components of the hardware control circuit 108 of FIG. 1 require power to operate, and this power may be provided by the bus 402 (via back EMF during towing) or the auxiliary battery 416 (when overvoltage protection is needed during vehicle operation), with the holdup circuit 428 holding up the power and the voltage convertor 440 down-converting the voltage to the level needed to power the components of the hardware control circuit 108.

Also note that in the illustrated embodiment the power source for the hardware protection circuit may be from the back EMF (via bus input terminal 430) or from the auxiliary battery 416 (via battery input terminal 432). It is not necessary in all embodiments to have both power sources, but the advantage of having both power sources is that the overvoltage protection can be implemented both when the vehicle is operating and when it is not operating. When the vehicle is operating, the auxiliary battery 416 provides the power for the overvoltage protection circuit in a fault scenario (the power is held up in the manner explained above). When the vehicle is not operating, there is no power from the auxiliary battery 416, but there may still be overvoltage scenarios, e.g., when the vehicle is being towed. In this situation the back EMF generated by the towing can itself provide the power to the hardware protection circuit. Therefore, overvoltage protection is implemented both when the vehicle is operating and when it is not operating.

Referring now to FIG. 7, an electronic system according to another embodiment is shown generally at 700 and includes a bus 702, an auxiliary battery 704, a Controller Area Network (CAN) bus 706, and a protection circuit 708. The protection circuit 708 includes all components described in relation to FIG. 7 that participate directly or indirectly in providing the overvoltage protection, which is most of the illustrated components. Very generally, the protection circuit 708 is similar to the protection circuit 404 in FIG. 4. The protection circuit 708 is operatively connected to the bus 702 to protect the bus 702 and the electronic system 700 from overvoltage. The protection circuit 708 includes a dissipation resistor 710 (labelled “R” in FIG. 7), a switch 712 (labelled “S” in FIG. 7), a voltage transducer 714, a response circuit 716, a timing circuit 718, an AND gate 720, a resistor connection sensor 722, a control unit 724 (illustrated as an MCU in FIG. 7), a holdup circuit 726, a resistor temperature sensor 728, a switch temperature sensor 730, and a switch error sensor 732.

The dissipation resistor 710 may be similar to the dissipation resistor 418 of the protection circuit 404 or to the dissipation resistor 104 of the protection circuit 100. Similarly, the switch 712 may be similar to the switch 420 or to the switch 106. The voltage transducer 714 may be similar to the voltage transducer 112. The response circuit 716 may correspond to the voltage divider 110 and the comparator 114. The timing circuit 718 may be similar to the timing circuit 116. The AND gate 720 may be similar to the logic gate 118. Generally, the dissipation resistor 710, the switch 712, the voltage transducer 714, the response circuit 716, the timing circuit 718, and the AND gate 720 of the protection circuit 708 may function together in the same way as the dissipation resistor 104, the switch 106, the voltage transducer 112, the voltage divider 110, the comparator 114, the timing circuit 116, and the logic gate 118 of the protection circuit 100. That is, the voltage transducer 714, the response circuit 716, the timing circuit 718, and the AND gate 720 monitor a bus voltage of the bus 702 and, based at least on the bus voltage, control the switch 712 to electrically connect or disconnect the dissipation resistor 710 and the bus 702.

The resistor connection sensor 722 may be similar to the resistor connection sensor 424, the control unit 724 may be similar to the control unit 426, the holdup circuit 726 may be similar to the holdup circuit 428, the resistor temperature sensor 728 may be similar to the resistor temperature sensor 430, the switch temperature sensor 730 may be similar to the switch temperature sensor 432, and the switch error sensor 732 may be similar to the switch error sensor 434. Generally, the resistor connection sensor 722, the control unit 724, the holdup circuit 726, the resistor temperature sensor 728, the switch temperature sensor 730, and the switch error sensor 732 of the protection circuit 708 may function together with the dissipation resistor 710, the switch 712, the voltage transducer 714, the response circuit 716, the timing circuit 718, and the AND gate 720 of the protection circuit 708 in the same way as the resistor connection sensor 424, the control unit 426, the holdup circuit 428, the resistor temperature sensor 430, the switch temperature sensor 432, and the switch error sensor 434 of the protection circuit 404 function with the dissipation resistor 418, the switch 420, and the hardware control circuit 422 of the protection circuit 404.

The protection circuit 708 also includes voltage converters 734, 736, and 738, an isolation circuit 740, and isolation circuits 742, 744, and 746. The voltage converters 734, 736, and 738 may generally be similar to the voltage converters 440 and 442 of the protection circuit 404. In the embodiment shown, the voltage converters 734, 736, and 738 are DC-to-DC step-down converters (i.e., buck converters) that reduce voltage received from the holdup circuit 726 to levels appropriate for other components of the protection circuit 708. For example, in the embodiment shown, the holdup circuit 726 outputs a voltage of 24 V to the voltage convertors 734 and 736. The voltage convertor 734 steps this input voltage down to an output voltage 15 V, which is used to power, for example, elements of the response circuit 716, the AND gate 720, and the switch 712. The voltage converter 736 steps the input voltage down to a 5 V output voltage, which is in turn stepped down to a 3.3 V output voltage by the voltage converter 738. The 3.3 V output voltage is used to power, for example, the control unit 724. The isolation circuit 740 receives the 5 V output voltage of the voltage converter 736 and provides an isolated 5 V output voltage for use by the resistor temperature sensor 728 and the switch temperature sensor 730. The isolation circuits 742, 744, and 746 isolate high voltage input signals from circuits that may be damaged by such high voltages.

The protection circuit 708 also includes an input level shifter circuit 748 and an output level shifter circuit 750, a resistor current clamp 752, and a control unit address bus 754. The input level shifter circuit 748 and the output level shifter circuit 750 are isolated signal conditioning integrated circuits that provide level shifting appropriate for the control unit 724. More specifically, the input level shifter circuit 748 scales input voltages to a range of 0-3.3 V, while the output level shifter circuit 750 boosts 3.3 V signals to 15 V and 24 V signals. The resistor current clamp 752 is a contactless ammeter which monitors a current in the dissipation resistor 710. The control unit address bus 754 provides an address for the control unit 724 in embodiments which include more than one control unit.

In operation, hardware overvoltage protection is provided by the response circuit 716, timing circuit 718, AND gate 720, switch 712, and dissipation resistor 710 in the same manner described earlier, e.g., in relation to FIG. 1. The control unit 724 includes a processor executing instructions stored in memory, to provide supplementary software control, including preventing the switch 712 from connecting the dissipation resistor 710 to the bus 702 (e.g., by driving the third gate switch 150 of the AND gate 720 low) based on a default condition. An example of a default condition may be a fault with the dissipation resistor 710 or switch 712, such as the dissipation resistor 710 temperature being too high (from resistor temperature sensor 728) or the switch 712 temperature being too high (from switch temperature sensor 730) or the switch 712 having an error (from switch error sensor 732), as an example. The software control of the control unit 724 may also perform the PWM described earlier and/or control engagement of a vehicle parking brake (not shown in FIG. 7; see FIGS. 4 and 5) in an overvoltage situation. The holdup circuit 726 provides power (from the auxiliary battery 704 or back EMF of the bus 702) to the protection circuit in the manner described earlier, with the DC-to-DC down convertors (i.e., voltage converters 734, 736, and 738) providing the appropriate DC power to the components of the protection circuit. Example: Response to Simulated Overvoltage Scenario

An experimental test was performed to evaluate the overvoltage protection of the protection circuit 100 (see FIGS. 1 and 2). The test protection circuit (i.e., protection circuit 100 in FIG. 1) was connected to a DC bus joining an electric motor and a high voltage battery. The motor had a maximum speed rated at 5200 rotations per minute (RPM). The battery provided power at 715 V. A power resistor with a resistance of 1.960 Q was used as a dissipation resistor (i.e., the dissipation resistor 104 in FIG. 1), and was connected to an IGBT switch of the test protection circuit (i.e., the switch 106 in FIG. 1). An overvoltage threshold of 870 V was set in the test protection circuit. To simulate an overvoltage scenario, the motor was run at maximum RPM, and then the battery was disconnected.

To monitor a response of the test protection circuit to the simulated overvoltage scenario, an oscilloscope was connected to the DC bus and a current clamp was connected at the IGBT of the test protection circuit. The oscilloscope measured the voltage of the DC bus, while the current clamp measured the current through the dissipation resistor connected to the IGBT.

Measurements of the DC bus voltage and the dissipation resistor current as a function of time during the simulated overvoltage scenario are shown in FIG. 8.

As can be seen in FIG. 8, the DC bus voltage increased to 893 V when the battery was disconnected while the motor was spinning at 5200 RPM. The rate of voltage change was 400 kV/s.

The test protection circuit triggered at a DC bus voltage of 872 V and controlled the DC bus voltage. The test protection circuit triggered within 100 microseconds of the simulated overvoltage event.

The measured dissipation resistor current can be used to evaluate the end-to-end response time of the test protection circuit once the overvoltage threshold was exceeded. With a dissipation resistor resistance of 1.960 Q, a peak power of 406 kW was reached after the IGBT was triggered. Conclusion

Protection circuits such as those described herein, for example, may be used to protect electronic systems such as electric vehicles from overvoltage, and may be preferable to other overvoltage protection systems. For example, the protection circuits herein may provide rapid response times to overvoltage, and may implement a time delay to prevent voltage oscillation.

Although specific embodiments have been described and illustrated, such embodiments should be considered illustrative only and not as limiting the invention as construed according to the accompanying claims.

Claims

1. A protection circuit for protecting an electronic system from overvoltage, the protection circuit comprising: a dissipation resistor; a switch operable to selectively electrically connect the dissipation resistor to a bus of the electronic system; and a hardware control circuit configured to: monitor a magnitude of a bus voltage of the bus; in response to detecting that the magnitude of the bus voltage is greater than an overvoltage threshold, output a first signal at a first level to cause the switch to electrically connect the dissipation resistor to the bus to dissipate power in the bus, and hold the first signal at the first level for at least a minimum time to cause the switch to continue to electrically connect the dissipation resistor to the bus for at least the minimum time regardless of whether the magnitude of the bus voltage drops below the overvoltage threshold before the minimum time has elapsed; and in response to the minimum time having elapsed and the magnitude of the bus voltage being below the overvoltage threshold, output the first signal at a second level to cause the switch to electrically disconnect the dissipation resistor from the bus.

2. The protection circuit of claim 1 wherein: the hardware control circuit comprises a comparator and a timing circuit; the comparator is configured to: receive a converted voltage corresponding to the bus voltage; receive a reference voltage corresponding to the overvoltage threshold; in response to detecting that a magnitude of the converted voltage is greater than a magnitude of the reference voltage, transmit an overvoltage signal to the timing circuit; and in response to detecting that the magnitude of the converted voltage is less than the magnitude of the reference voltage, terminate transmission of the overvoltage signal to the timing circuit; and the timing circuit is configured to: in response to receiving the overvoltage signal, output the first signal at the first level to cause the switch to electrically connect the dissipation resistor to the bus to dissipate power in the bus, and hold the first signal at the first level for at least the minimum time to cause the switch to continue to electrically connect the dissipation resistor to the bus for at least the minimum time; and in response to the minimum time having elapsed and receiving no overvoltage signal, output the first signal at the second level to cause the switch to electrically disconnect the bus from the dissipation resistor.

3. The protection circuit of claim 2 wherein the comparator comprises an operational amplifier.

4. The protection circuit of claim 2 or 3 wherein the hardware control circuit further comprises a voltage divider configured to provide the reference voltage to the comparator.

5. The protection circuit of claim 2, 3, or 4 wherein the hardware control circuit further comprises a voltage transducer configured to: measure the bus voltage; determine the converted voltage from the bus voltage; provide the converted voltage to the comparator.

6. The protection circuit of claim 5 wherein the voltage transducer comprises a Hall effect sensor.

7. The protection circuit of any one of claims 2 to 6 wherein: the hardware control circuit comprises a logic gate and a resistor connection sensor; the logic gate comprises a plurality of inputs, each input configured to receive a respective signal; the logic gate is configured to: in response to every one of the plurality of inputs receiving a signal at the first level, cause the switch to electrically connect the dissipation resistor to the bus; and in response to at least one of the plurality of inputs not receiving a signal at the first level, cause the switch to electrically disconnect the bus from the dissipation resistor; the timing circuit is configured to: in response to receiving the overvoltage signal from the comparator, output the first signal at the first level to a first one of the plurality of inputs of the logic gate, and hold the first signal at the first level for at least the minimum time; and in response to the minimum time having elapsed and receiving no overvoltage signal, output the first signal at the second level to the first one of the plurality of inputs; and the resistor connection sensor is configured to: monitor an electrical connection between the dissipation resistor and the switch; in response to detecting that the dissipation resistor is electrically connected to the switch, output a second signal at the first level to a second one of the plurality of inputs of the logic gate; and in response to detecting that the dissipation resistor is not electrically connected to the switch, output the second signal at the second level to the second one of the plurality of inputs.

8. The protection circuit of claim 7 further comprising a control unit programmed to, at least: selectively output a third signal at the first level to a third one of the plurality of inputs of the logic gate; and in response to detecting a default condition, output the third signal at the second level to the third one of the plurality of inputs of the logic gate.

9. The protection circuit of claim 8 further comprising a resistor temperature sensor configured to measure a temperature of the dissipation resistor, wherein the resistor temperature sensor is in operative communication with the control unit, and wherein the control unit is programmed to output the third signal at the second level to the third one of the plurality of inputs of the logic gate in response to the resistor temperature sensor detecting that the temperature of the dissipation resistor is greater than a resistor temperature threshold.

10. The protection circuit of claim 8 or 9 further comprising a switch temperature sensor configured to measure a temperature of the switch, wherein the switch temperature sensor is in operative communication with the control unit, and wherein the control unit is programmed to output the third signal at the second level to the third one of the plurality of inputs of the logic gate in response to the switch temperature sensor detecting that the temperature of the switch is greater than a switch temperature threshold.

11. The protection circuit of claim 8, 9, or 10 further comprising a switch error sensor configured to detect whether the switch has an error, wherein the switch error sensor is in operative communication with the control unit, and wherein the control unit is programmed to output the third signal at the second level to the third one of the plurality of inputs of the logic gate in response to the switch error sensor detecting that the switch has an error.

12. The protection circuit of any one of claims 8 to 11, wherein: the protection circuit is configured to be part of a vehicle; and the control unit is configured to output a brake control signal to engage a brake of the vehicle in response to the hardware control circuit causing the switch to electrically connect the dissipation resistor to the bus.

13. The protection circuit of any one of claims 8 to 12 wherein the control unit is in operative communication with the switch and is programmed to, at least: control the switch to electrically connect the dissipation resistor to the bus; and control the switch to electrically disconnect the dissipation resistor from the bus.

14. The protection circuit of any one of claims 1 to 7 further comprising a control unit in operative communication with the switch and programmed to, at least: control the switch to electrically connect the dissipation resistor to the bus; and control the switch to electrically disconnect the dissipation resistor from the bus.

15. The protection circuit of claim 13 or 14 wherein the control unit is further programmed to, at least, control the switch to selectively connect and disconnect the dissipation resistor and the bus to control dissipation of power in the bus by pulse-width modulation.

16. The protection circuit of any one of claims 1 to 15 wherein: the electronic system comprises a battery; and the protection circuit is configured to receive power from the battery to operate the protection circuit.

17. The protection circuit of claim 16 further comprising a holdup circuit configured to: store electrical power from the battery; and in response to the protection circuit being disconnected from the battery, provide power to operate the protection circuit.

18. The protection circuit of any one of claims 1 to 17 wherein: the electronic system comprises an electric motor; the electric motor generates a back electromotive force; and the protection circuit is configured to receive power from the back electromotive force to operate the protection circuit.

19. The protection circuit of claim 18 further comprising a voltage converter configured to convert voltage from the back electromotive force to a supply voltage for the protection circuit.

20. The protection circuit of claim 19 wherein the voltage converter comprises a direct current-to-direct current (DC-to-DC) converter.

21. The protection circuit of claim 20 wherein the DC-to-DC converter comprises a stepdown converter.

22. The protection circuit of claim 21 wherein the step-down converter is configured to convert the voltage from the back electromotive force to the supply voltage only if the voltage from the back electromotive force exceeds a converter threshold.

23. The protection circuit of any one of claims 1 to 22 wherein: the electronic system comprises an electric vehicle comprising a parking brake; and the protection circuit is configured to, in response to detecting that the magnitude of the bus voltage is greater than the overvoltage threshold, engage the parking brake.

24. An electric vehicle comprising: an electric motor; a traction battery; a bus for carrying power between the electric motor and the traction battery; and the protection circuit of any one of claims 1 to 23 operatively connected to the bus.

25. A method of protecting an electronic system from overvoltage, the method comprising: monitoring a magnitude of a bus voltage of a bus of the electronic system; in response to detecting that the magnitude of the bus voltage is greater than an overvoltage threshold, causing a switch to electrically connect a dissipation resistor to the bus to dissipate power in the bus, and causing the switch to continue to electrically connect the dissipation resistor to the bus for at least a minimum time regardless of whether the magnitude of the bus voltage drops below the overvoltage threshold before the minimum time has elapsed; and in response to the minimum time having elapsed and the magnitude of the bus voltage being below the overvoltage threshold, causing the switch to electrically disconnect the dissipation resistor from the bus.