Watchdog system, watchdog method, and battery management system including the watchdog system

Abstract

Provided is a watchdog system, comprising: a software area and a shared memory area, the software area including a boot loader area and an application area, the shared memory area storing a last watchdog refresh timing; and an external watchdog module, the external watchdog module responding to a refresh request sent from the boot loader area or the application area and based on the sent refresh request timing and the last watchdog refresh timing sent from the shared memory area, refreshing the watchdog when the sent refresh request timing corresponds to a window open time.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Korean Patent Application No. 10-2019-0113110 filed on September 11, 2019, in the Korean Intellectual Property Office, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The invention relates to a watchdog system, a watchdog method and a battery management system comprising the watchdog system. Background Art

[0004] For high-level system management, the watchdog can be executed in window mode. For higher-level system safety, not only the watchdog module inside the main control unit (MCU) of the battery management system, but also the watchdog module of the application-specific integrated circuit (ASIC) outside the MCU of the battery management system can be executed interlocked with the watchdog module of the MCU.

[0005] In window mode, the watchdog module may provide watchdog service only during the window open time, and watchdog service attempted during the window close time may therefore be identified as a failure. If the watchdog is not refreshed within a predetermined time, the system should be reset. The purpose of the watchdog is to allow a safe disabling operation (e.g., reset) to be performed when the watchdog is not refreshed normally due to system problems, etc.

[0006] When executing a specific sequence that takes a long time, a watchdog service can be performed in the middle of its encoding to prevent a reset due to the watchdog. Conventionally, it has been difficult to determine the exact window opening time.

[0007] For example, when performing a reprogramming / software flash, a transaction may be made between a bootloader and an application, which are different software components from each other. Here, if the watchdog service is provided by an ASIC external to the MCU of the battery management system, it may be difficult to determine the exact window opening time. Therefore, a safety disable operation such as a reset may be performed.

[0008] That is, even if there are no problems in the system, it may be difficult to determine when the window is open, so an unexpected security disabling situation may occur. Summary of the invention

[0009]

Technical issues

[0010] The present invention aims to provide a watchdog system, a watchdog method and a battery management system including the watchdog system, which have the advantage of solving the following problem: even if there is no problem in the system, an unexpected safety disabling situation occurs because it is difficult to determine the window opening time.

[0011]

Technical solution

[0012] According to an exemplary embodiment of the present invention, a watchdog system includes: a software area and a shared memory area, the software area includes a boot loader area and an application area, the shared memory area stores a last watchdog refresh timing; and an external watchdog module, the external watchdog module responds to a refresh request sent from the boot loader area or the application area and based on the sent refresh request timing and the last watchdog refresh timing sent from the shared memory area, refreshes the watchdog when the sent refresh request timing corresponds to a window open time.

[0013] The boot loader area or the application area can generate a refresh request, determine whether its refresh request timing corresponds to the window opening time of the window time of the external watchdog module based on the timing of generating the refresh request and the last watchdog refresh timing obtained from the shared memory area, and send the refresh request to the external watchdog module if the generated refresh request timing corresponds to the window opening time.

[0014] The external watchdog module may update the timing at which the watchdog is refreshed to the last watchdog refresh timing in the shared memory area.

[0015] Which of the boot loader area and the application area performs a refresh request may be determined based on the program flow in the software area and obtain the last watchdog refresh timing from the shared memory area.

[0016] According to another exemplary embodiment of the present invention, a watchdog method of a watchdog system including a boot loader area, an application area, a shared memory area and an external watchdog module includes: sending a refresh request by the boot loader area or the application area to the external watchdog module; obtaining the last watchdog refresh timing from the shared memory area by the external watchdog module, and determining whether the received refresh request timing corresponds to a window opening time in which the watchdog refresh can be performed; if, as a result of the determination of the external watchdog module, the received refresh request timing corresponds to the window opening time, refreshing the watchdog based on the watchdog refresh request; and storing the refresh timing of the watchdog as the last watchdog refresh timing in the shared memory area.

[0017] The watchdog method may further include not performing the watchdog refresh if, as a result of the determination of the external watchdog module, the received refresh request timing corresponds to a window closing time in which the watchdog refresh cannot be performed.

[0018] Sending a refresh request to an external watchdog module by the boot loader area or the application area may include: generating a watchdog refresh request by the boot loader area or the application area and obtaining a last watchdog refresh timing from the shared memory area; determining, by the boot loader area or the application area, whether the generated refresh request timing corresponds to a window open time based on a difference between the generated refresh request timing and the obtained last watchdog refresh timing; and sending the refresh request to the external watchdog module if the generated refresh request timing corresponds to the window open time as a result of the determination by the boot loader area or the application area.

[0019] Sending the refresh request to the external watchdog module by the bootloader area or the application area may also include: if the refresh request timing generated does not correspond to the window open time as a result of the determination by the bootloader area or the application area, ignoring the refresh request.

[0020] The watchdog method may further include determining which one of the boot loader area and the application area performs a refresh request based on a program flow in the software area and obtaining a last watchdog refresh timing from the shared memory area.

[0021] According to another exemplary embodiment of the present invention, a battery management system for managing a battery pack including a plurality of battery cells includes: at least one application specific integrated circuit (ASIC) that measures the voltage of the plurality of battery cells and performs cell balancing for the plurality of battery cells; and a main control unit (MCU) that controls the at least one ASIC. The MCU includes a software area and a shared memory area, the software area including a bootloader area and an application area, the shared memory area storing the last watchdog refresh timing. At least one ASIC includes an external watchdog module that responds to a refresh request sent from the bootloader area or the application area and based on the refresh request timing sent and the last watchdog refresh timing sent from the shared memory area, refreshes the watchdog when the refresh request timing sent corresponds to the window opening time.

[0022] The boot loader area or the application area can generate a refresh request, determine whether its refresh request timing corresponds to the window opening time of the window time of the external watchdog module based on the timing of generating the refresh request and the last watchdog refresh timing obtained from the shared memory area, and send the refresh request to the external watchdog module if the generated refresh request timing corresponds to the window opening time.

[0023] The external watchdog module may update the timing at which the watchdog is refreshed to the last watchdog refresh timing in the shared memory area.

[0024] The bootloader area or the application area may be determined based on the program flow in the software area.

[0025]

Beneficial Effects

[0026] According to the present invention, a watchdog system, a watchdog method and a battery management system including the watchdog system can be provided, which have the advantage of solving the problem that an unexpected safety disabling situation occurs because it is difficult to determine a window opening time even if there is no problem in the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 is a block diagram illustrating a watchdog system according to an exemplary embodiment.

[0028] Figure 2 is a flowchart illustrating operations of a main control unit (MCU) and an external watchdog module according to an exemplary embodiment.

[0029] Figure 3 is a schematic diagram illustrating performing a watchdog refresh according to an exemplary embodiment.

[0030] Figure 4 is a diagram illustrating a battery system including a main control unit and an external watchdog module to which an exemplary embodiment is applied.

[0031] Figure 5 is a diagram illustrating a configuration of a battery management system according to an exemplary embodiment. DETAILED DESCRIPTION

[0032] The present invention can also include a routine for calculating the window opening time of the watchdog module, wherein the watchdog service is only performed during the window opening time based on the routine. Even if the watchdog service is attempted at any timing, there is no situation in which a failure occurs due to the window time.

[0033] The present invention can set a specific memory area in the shared memory, such as a timing calculation area, to avoid failure due to an incorrect window time when attempting a watchdog service in the case of a transaction between a boot loader and an application, which are different software components. Through the shared memory and the interface with the shared memory, different modules can synchronize their timing with each other, and all modules can therefore perform the watchdog service at an exact timing. That is, it is possible to prevent an unexpected safety disabling situation due to an error in calculating the window time.

[0034] Hereinafter, the exemplary embodiments disclosed in this specification are described in detail with reference to the accompanying drawings, and components identical or similar to each other are represented by identical or similar reference numerals, and their repeated description is omitted. The terms "module" and / or "unit" of the components used in the following description are only used to easily make the present invention. Therefore, these terms themselves do not have meanings or functions that are distinguished from each other. In addition, when describing the exemplary embodiments of the present invention, in the case where it is determined that the detailed description of the known technology related to the present invention may confuse the gist of the exemplary embodiments of the present invention, the detailed description is omitted. In addition, it should be understood that the accompanying drawings are provided only to allow embodiments of the present invention to be more easily understood, and the spirit of the present invention is not limited by the accompanying drawings, but includes all modifications, equivalents and substitutions contained in the spirit and scope of the present invention.

[0035] Terms including ordinal numbers such as "first", "second", etc. may be used to describe various components. However, these components are not limited by these terms. The terms are used only to distinguish one component from another.

[0036] It should be understood that when an element is referred to as being “connected to” or “coupled to” another element, it may be directly connected to or directly coupled to the other element, or connected to or coupled to the other element with other elements interposed therebetween. On the other hand, it should be understood that when an element is referred to as being “directly connected to” or “directly coupled to” another element, it may be connected to or coupled to the other element without any other elements interposed therebetween.

[0037] It should be understood that the terms "include" or "have" used in this specification specify the existence of the features, numbers, steps, operations, elements, parts or a combination thereof mentioned in this specification, but do not exclude the existence or addition of one or more other features, numbers, steps, operations, elements, parts or a combination thereof.

[0038] Figure 1 is a block diagram illustrating a watchdog system according to an exemplary embodiment.

[0039] Figure 2 is a flowchart illustrating operations of a main control unit (MCU) and an external watchdog module according to an exemplary embodiment.

[0040] like Figure 1 As shown, the watchdog system may include a main control unit (MCU) 1 and an external watchdog module 4. The main control unit 1 may include a software area 2 and a shared memory area 3. The software area 2 may include a boot loader area 21 and an application area 22.

[0041] The shared memory area 3 may store the last watchdog refresh timing sent from the external watchdog module 4 .

[0042] The bootloader area 21 may store code for updating the application area. When an application stored in the application area 22 needs to be updated or reprogrammed, or the code of the application area 22 is damaged or defective, the application area 22 may be updated based on the code stored in the bootloader area 21.

[0043] The application area 22 may store a plurality of applications including codes for performing various functions such as measurement, control, and communication.

[0044] The boot loader area 21 and the application area 22 may each include a timer for requesting a watchdog refresh service. Figure 1 As shown, the boot loader area 21 may include a timer 211, and the application area 22 may include a timer 221. The timers 211 and 221 may each count the passage of time.

[0045] The boot loader area 21 and the application area 22 may each receive the last watchdog refresh timing from the shared memory area 3. The boot loader area 21 may determine whether its refresh request timing corresponds to the window opening time of the window time based on the time of the timer 211 and the last watchdog refresh timing. The application area 22 may also determine whether its refresh request timing corresponds to the window opening time of the window time based on the time of the timer 221 and the last watchdog refresh timing.

[0046] The bootloader area 21 and the application area 22 may each generate a refresh request for refreshing its watchdog timer at a predetermined time interval. Neither the bootloader area 21 nor the application area 22 sends all refresh requests to the external watchdog module 4. The bootloader area 21 and the application area 22 may each determine whether its refresh request corresponds to a window opening time of a window time of the external watchdog module 4, and then each may send a refresh request to the external watchdog module 4 if the refresh request timing corresponds to the window opening time, otherwise no request is sent.

[0047] A program running in the software area 2 may be changed from the boot loader area 21 to the application area 22, and vice versa. The corresponding area may request a watchdog refresh depending on which area the currently running program corresponds to.

[0048] The external watchdog module 4 can set the window time to be synchronized with the timing at which the watchdog is refreshed; can obtain the last watchdog refresh timing from the shared memory area 3 when a watchdog refresh request is received from the software area 2; can determine whether the received refresh request timing corresponds to the time at which the watchdog refresh can be performed; and if the watchdog refresh can be performed as a result of the determination, the watchdog is refreshed based on the watchdog refresh request, or if the watchdog refresh cannot be performed as a result of the determination, the watchdog refresh may not be performed.

[0049] When the watchdog is refreshed, it can be determined that there is no defect in the main control unit 1 or the external watchdog module 4, and the watchdog can reset the result of the count until that time and restart the count using the oscillator clock. Conventionally, when a program jump from the boot loader area to the application area and a program jump from the application area to the boot loader area are made, it is impossible to determine the last watchdog refresh timing, the watchdog refresh request timing does not correspond to the window open time, and thus the occurrence of a defect is recognized. An exemplary embodiment of the present invention can store the last watchdog refresh timing in the shared memory area to prevent this problem.

[0050] like Figure 2 As shown, the boot loader area 21 or the application area 22 of the main control unit 1 may first obtain the last watchdog refresh timing from the shared memory area 3 (S1).

[0051] The boot loader area 21 or the application area 22 may periodically generate a watchdog refresh request and determine whether the currently generated refresh request timing corresponds to the window opening time of the window time based on the difference between the generated refresh request timing and the last obtained watchdog refresh timing (S2).

[0052] As a result of the determination in S2, if the generated refresh request timing corresponds to the window open time, the boot loader area 21 or the application area 22 may send a corresponding refresh request to the external watchdog module 4 (S3).

[0053] Whether the boot loader area 21 or the application area 22 obtains the last watchdog refresh timing from the shared memory area 3 and performs a refresh request may be determined by the program flow in the software area 2. That is, if a program is currently executed in the boot loader area 21, a refresh request can be performed in the boot loader area 21, and if a program is currently executed in the application area 22, a refresh request can be performed in the application area 22.

[0054] As a result of the determination in S2, if the generated refresh request timing does not correspond to the window open time, the refresh request may be ignored (S4), and the next refresh request may be determined in S2.

[0055] The external watchdog module 4 may receive the transmitted refresh request and obtain the last watchdog refresh timing from the shared memory area 3 (S5). The external watchdog module 4 may determine whether the received refresh request timing corresponds to the time when the watchdog refresh can be performed, that is, the window open time (S6).

[0056] As a result of the determination in S6, if the received refresh request timing corresponds to the window open time in which the watchdog refresh can be performed, the external watchdog module 4 may refresh the watchdog based on the watchdog refresh request (S7).

[0057] As a result of the determination in S6, if the received refresh request timing corresponds to the window closing time in which the watchdog refresh cannot be performed, the external watchdog module 4 does not perform the watchdog refresh (S8). As time passes, the external watchdog module 4 may return to S6 after S8 and determine whether the received refresh request timing corresponds to the time when the watchdog refresh can be performed.

[0058] The timing of executing S7 may become the last watchdog refresh timing, and the external watchdog module 4 may send this timing to the shared memory area 3, and may store this last watchdog refresh timing in the shared memory area 3. That is, the last watchdog refresh timing may be updated (S9).

[0059] According to an exemplary embodiment, steps S1 to S9 may be continuously repeated.

[0060] Figure 3 is a schematic diagram illustrating performing a watchdog refresh according to an exemplary embodiment.

[0061] like Figure 3 As shown, the program flow can be described as changing from the boot loader area 21 to the application area 22 at timing t8.

[0062] The boot loader area 21 may generate a refresh request at timing t1, obtain the last refresh timing from the shared memory area 3, and determine that the refresh request timing at timing t1 corresponds to the window open time. The refresh request at timing t1 may then be sent to the external watchdog module 4, and the external watchdog module 4 may refresh the watchdog based on the refresh request at timing t1, and start a new window time W1 synchronized with timing t1.

[0063] The refresh requests generated at the timings t2 and t3 may correspond to the refresh off time before the refresh on time of the window time W1 , and therefore, the boot loader area 21 does not send the corresponding refresh request to the external watchdog module 4 .

[0064] The boot loader area 21 may generate a refresh request at timing t4, obtain the last refresh timing t1 from the shared memory area 3, and determine that the refresh request timing at timing t4 corresponds to the window open time. The refresh request at timing t4 may then be sent to the external watchdog module 4, and the external watchdog module 4 may refresh the watchdog based on the refresh request at timing t4, and start a new window time W2 synchronized with timing t4.

[0065] The refresh requests generated at timing t5 and t6 may be ignored in the same manner, the refresh request generated at timing t7 may be sent to the external watchdog module 4, and the external watchdog module 4 may refresh the watchdog based on the refresh request at timing t7 and start a new window time W3 synchronized with timing t7.

[0066] At timing t8 , the program flow may be changed from the boot loader area 21 to the application area 22 .

[0067] The application area 22 may generate a refresh request at timing t9, obtain the last refresh timing t7 from the shared memory area 3, determine that the refresh request timing at timing t9 corresponds to the window closing time before the window opening time of the window time W3, and ignore the refresh request at timing t9. The refresh request generated at timing t10 ​​may also be ignored in the same manner.

[0068] The application area 22 may generate a refresh request at timing t11, obtain the last refresh timing t7 from the shared memory area 3, and determine that the refresh request timing at timing t11 corresponds to the window open time. The refresh request at timing t11 may then be sent to the external watchdog module 4, and the external watchdog module 4 may refresh the watchdog based on the refresh request at timing t11, and start a new window time W4 synchronized with timing t11.

[0069] The refresh requests generated at timing t12 and t13 may be ignored in the same manner, the refresh request generated at timing t14 may be sent to the external watchdog module 4, and the external watchdog module 4 may refresh the watchdog based on the refresh request at timing t14 and start a new window time W5 synchronized with timing t14.

[0070] Figure 4 is a diagram illustrating a battery system including a main control unit and an external watchdog module to which an exemplary embodiment is applied.

[0071] Figure 5 is a diagram illustrating a configuration of a battery management system according to an exemplary embodiment.

[0072] The battery system 100 may include a battery management system (BMS) 110 , a battery pack 120 , and a connection unit 130 .

[0073] The BMS 110 may collect and analyze various information about the battery system, including information about the plurality of battery cells C1 to Cn, thereby controlling charging and discharging, battery cell balancing, battery protection operations, and the like of the battery system.

[0074] The battery pack 120 may include a plurality of battery cells C1 to Cn electrically connected to each other. The plurality of battery cells C1 to Cn included in the battery pack 120 may be electrically connected to the BMS 110 through a plurality of wires. Figure 4 In the illustrated battery pack 120 , a predetermined number of battery cells may be connected to one another in series to form a battery module, and a predetermined number of battery modules may be connected to one another in series or in parallel to form a battery pack.

[0075] The connection unit 130 may be implemented as a relay or an n-channel type transistor and may be connected in series between the battery pack 120 and the external device. The connection unit 130 may be operated by a signal supplied from the BMS 110.

[0076] The BMS 110 may include a main control unit (MCU) 111 and a plurality of application specific integrated circuits (ASICs) 112 to 114. The plurality of ASICs 112 to 114 may each be connected to a corresponding battery cell among the plurality of battery cells C1 to Cn to measure the voltage of the battery cell under the control of the MCU 111, to perform battery cell balancing for a cell that needs balancing among the battery cells, and to measure the temperature of the battery cell. Figure 4 Three ASICs 112 to 114 are shown, which is an example, and the number of ASICs may depend on the number of cells included in the battery pack 120 .

[0077] MCU 111 may include a software area 101 and a shared memory area 102, and may be used in conjunction with a reference Figures 1 to 3 Software area 101 is implemented in the same manner as described for software area 2.

[0078] The application stored in the application area 1012 of the software area 101 may be executed, and the MCU 111 may be operated by the application. A plurality of applications required for battery monitoring and management may be stored in the application area 1012, and the MCU 111 may be driven by the executed applications. For example, the application area 1012 may include an application for estimating the state of charge and life of the battery pack, an application for detecting information about the state of the battery pack, such as the current of the battery pack and the voltage and temperature of the battery cell. In addition, the application area 1012 may include applications for controlling battery cell balancing, charging and discharging of the battery, battery protection operations, and the like. That is, the application area 1012 may store various applications for controlling a plurality of ASICs 112 to 114 to collect information about the state of the battery pack and for controlling the MCU 111 to process the collected information and perform operations necessary for managing the battery pack (battery cell balancing, charging / discharging of the battery, etc.).

[0079] like Figure 5 As shown, the external watchdog module 121 may be implemented in at least one ASIC 112 among the plurality of ASICs 112 to 114 .

[0080] like Figure 5 As shown, it can be compared with the above reference Figures 1 to 3 The external watchdog module 121 of the ASIC 112 and the boot loader area 1011 , the application area 1012 , and the shared memory area 102 of the MCU 111 are implemented in the same manner as described.

[0081] Conventionally, a watchdog refresh can be performed only during the exact window opening time, and therefore the routine for watchdog refresh can be inserted into a specific task in view of the window size. When the window size is 32ms and the window is opened from 16ms to 32ms, a refresh request can be inserted into a 25ms task to operate normally. However, if a program jump is made between different software components, it is impossible to determine the task timing, the last watchdog refresh timing, etc., thereby causing an unexpected watchdog failure.

[0082] The above problems can be solved by exemplary embodiments described in the present invention.

[0083] As set forth above, the present invention can provide a watchdog system, a watchdog method, and a battery management system including the watchdog system, which can solve the problem that an unexpected safety disabling situation occurs even if there is no problem in the system because it is difficult to determine the window open time.

[0084] Although the exemplary embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto. Various modifications and improvements made by those skilled in the art to which the present invention belongs also belong to the scope of the present invention.

Claims

1. A watchdog system, comprising: A software area and a shared memory area, the software area including a boot loader area and an application area, the shared memory area storing a last watchdog refresh timing; as well as External watchdog module, wherein the bootloader area or the application area generates a refresh request, determines whether its refresh request timing corresponds to a window opening time of a window time of the external watchdog module based on a timing of generating the refresh request and the last watchdog refresh timing obtained from the shared memory area, and sends the refresh request to the external watchdog module if the generated refresh request timing corresponds to the window opening time, and ignores the refresh request if the generated refresh request timing does not correspond to the window opening time, The external watchdog module responds to the refresh request sent from the boot loader area or the application area and based on the refresh request timing sent and the last watchdog refresh timing sent from the shared memory area, refreshes the watchdog of the external watchdog module when the refresh request timing sent corresponds to the window opening time.

2. The watchdog system according to claim 1, wherein The external watchdog module The timing at which the watchdog is refreshed is updated to the last watchdog refresh timing in the shared memory area.

3. The watchdog system according to claim 1, wherein Which of the boot loader area and the application area executes the refresh request is determined based on a program flow in the software area and the last watchdog refresh timing is obtained from the shared memory area.

4. A watchdog method of a watchdog system, the watchdog system comprising a software area, a shared memory area and an external watchdog module, the software area comprising a boot loader area and an application area, the watchdog method comprising: generating a watchdog refresh request by the boot loader area or the application area, and obtaining a last watchdog refresh timing from the shared memory area; determining, by the bootloader area or the application area, whether the generated refresh request timing corresponds to a window opening time during which a watchdog refresh can be performed based on a difference between the generated refresh request timing and the obtained last watchdog refresh timing; If the generated refresh request timing corresponds to the window opening time as a result of the determination by the bootloader area or the application area, the watchdog refresh request is sent by the bootloader area or the application area to the external watchdog module, and if the generated refresh request timing does not correspond to the window opening time, the refresh request is ignored; obtaining, by the external watchdog module, the last watchdog refresh timing from the shared memory area, and determining whether the received refresh request timing corresponds to the window open time; If, as a result of the determination of the external watchdog module, the received refresh request timing corresponds to the window open time, refreshing the watchdog of the external watchdog module based on the watchdog refresh request; as well as The refresh timing of the watchdog is stored in the shared memory area as the final watchdog refresh timing.

5. The watchdog method according to claim 4, further comprising: If, as a result of the determination of the external watchdog module, the received refresh request timing corresponds to a window closing time in which the watchdog refresh cannot be performed, the watchdog refresh is not performed.

6. The watchdog method according to claim 4, further comprising: Which of the boot loader area and the application area executes the refresh request is determined based on a program flow in the software area and the last watchdog refresh timing is obtained from the shared memory area.

7. A battery management system for managing a battery pack including a plurality of battery cells, the battery management system comprising: at least one application specific integrated circuit ASIC, the at least one ASIC measuring voltages of the plurality of battery cells and performing cell balancing for the plurality of battery cells; as well as A main control unit MCU, the MCU controls the at least one ASIC, Wherein, the MCU includes A software area and a shared memory area, the software area including a boot loader area and an application area, the shared memory area storing the last watchdog refresh timing, and The at least one ASIC comprises External watchdog module, wherein the bootloader area or the application area generates a refresh request, determines whether its refresh request timing corresponds to a window opening time of a window time of the external watchdog module based on a timing of generating the refresh request and the last watchdog refresh timing obtained from the shared memory area, and sends the refresh request to the external watchdog module if the generated refresh request timing corresponds to the window opening time, and ignores the refresh request if the generated refresh request timing does not correspond to the window opening time; and The external watchdog module responds to the refresh request sent from the boot loader area or the application area and based on the refresh request timing sent and the last watchdog refresh timing sent from the shared memory area, refreshes the watchdog of the external watchdog module when the refresh request timing sent corresponds to the window opening time.

8. The battery management system according to claim 7, wherein The external watchdog module The timing at which the watchdog is refreshed is updated to the last watchdog refresh timing in the shared memory area.

9. The battery management system according to claim 7, wherein The boot loader area or the application area is determined based on a program flow in the software area.

Images