Current measuring device, battery system including the same and method thereof, and electric vehicle

Abstract

A current measuring device for a battery system and a corresponding method, the current measuring device having a first control unit including a first microcontroller, a second control unit, and a communication line communicatively connecting the first and second control units. The second control unit includes: a second microcontroller; an amplifier electrically interconnected between the second microcontroller and the terminals of a shunt resistor for current measurement; and a node interconnected between the terminals of the shunt resistor and the amplifier. The first microcontroller generates a test mode signal and sends the test mode signal to the second control unit through the communication line. The second control unit sends the test mode signal to the node. The second microcontroller receives a measurement signal through the amplifier in response to the sent test mode signal. The first microcontroller receives the measurement signal from the second microcontroller through the communication line, compares the measurement signal with the generated test mode signal, and verifies the function of the current measurement based on the comparison.

Description

Technical Field

[0001] The invention relates to a current measuring device for a battery system and a method for measuring the current of a battery system. In addition, a corresponding battery system and an electric vehicle are disclosed. Background Art

[0002] In recent years, vehicles for transporting goods and people have been developed using electricity as a source of motion. Such an electric vehicle is a car driven by an electric motor using energy stored in a rechargeable battery. An electric vehicle may be powered solely by a battery, or may be in the form of a hybrid vehicle powered by, for example, a gasoline generator. In addition, a vehicle may include a combination of an electric motor and a conventional internal combustion engine. Typically, an electric vehicle battery (EVB) or traction battery is a battery used to power the propulsion of a battery electric vehicle. Electric vehicle batteries differ from starting, lighting, and ignition batteries in that they are designed to provide power for a sustained period of time. A rechargeable battery or secondary battery differs from a primary battery in that it can be charged and discharged repeatedly, whereas a primary battery can only irreversibly convert chemical energy into electrical energy. Low-capacity rechargeable batteries are used as power sources for small electronic devices, such as cellular phones, laptops, and video cameras, while high-capacity rechargeable batteries are used as power sources for hybrid vehicles and the like.

[0003] Typically, a rechargeable battery includes an electrode assembly including a positive electrode, a negative electrode, and a separator between the positive electrode and the negative electrode, a housing that houses the electrode assembly, and electrode terminals that are electrically connected to the electrode assembly. An electrolyte solution is injected into the housing so that the battery can be charged and discharged by an electrochemical reaction of the positive electrode, the negative electrode, and the electrolyte solution. The shape of the housing, such as cylindrical or rectangular, depends on the intended use of the battery. Lithium-ion (and similar lithium polymer) batteries are widely known for their use in laptop computers and consumer electronics, and dominate the latest developed electric vehicles.

[0004] Rechargeable batteries can be used as battery modules formed by connecting a plurality of unit battery cells in series and / or in parallel to provide high energy density, particularly for motor driving of hybrid vehicles. That is, a battery module is formed by interconnecting electrode terminals of a plurality of unit battery cells according to the required amount of electricity to realize a high-power rechargeable battery.

[0005] A battery pack is a group of any number of (preferably identical) battery modules. They can be connected in series, parallel, or in a mixed configuration to provide the required voltage, capacity, or power density. The components of a battery pack include multiple individual battery modules and interconnects that provide conductivity between them.

[0006] In order to meet the dynamic power requirements of various power-consuming devices connected to the battery system, static control of battery power output and charging is not enough. Therefore, a stable information exchange is required between the controllers of the battery system and the power-consuming devices. This information includes the actual state of charge (SoC), potential electrical performance, charging capacity and internal resistance of the battery system, as well as the actual or predicted power demand or surplus of the power-consuming devices.

[0007] The battery system typically includes a battery management system (BMS) and / or a battery management unit (BMU) for processing the above information. The BMS / BMU can communicate with the controllers of various power-consuming devices via a suitable communication bus such as an SPI or CAN interface. The BMS / BMU can further communicate with each battery submodule, in particular, with the cell monitoring circuit (CSC) of each battery submodule. The CSC can be further connected to the cell connection and sensing unit (CCU) of the battery submodule, which interconnects the battery cells of the battery submodule.

[0008] Thus, a BMS / BMU is provided for managing the battery pack, for example by protecting the battery from operating outside its safe operating area, monitoring its status, calculating auxiliary data, reporting that data, controlling its environment, authenticating and / or balancing it.

[0009] In a battery system according to the prior art, an electronic battery disconnect unit (generally referred to as a control unit) uses two measurement channels for current measurement, including a Hall sensor and a shunt resistor. Due to the two measurement paths, a certain degree of safety can be provided.

[0010] However, Hall sensors are expensive and magnetic fields from other buses can affect the measurement results. Therefore, an expensive shield for the magnetic field is required.

[0011] In a typical battery system, this high voltage system uses three different control components: The battery system manager, which includes the main control unit in the battery system and controls the relays. The above-mentioned electronic battery disconnect unit BDUe has the function of providing current measurement. The battery module manager BMM has cell voltage measurement and cell temperature measurement functions.

[0012] Typically, for current measurement, the current is measured by the shunt sensor and the Hall sensor. For these two sensors, two physical interfaces for sending measurement signals are used, including a CAN interface for the shunt sensor and an analog interface for the Hall sensor.

[0013] The problem with such a system is that due to the breakdown of ASIL levels, shunt resistors (ASIL A(C)) and Hall sensors (ASIL B(C)), ASIL A software needs to be installed on the BDUe’s microcontroller, which is a challenging task for the operating system. ASIL stands for Automotive Safety Integrity Level as defined in ISO 26262.

[0014] The microcontroller of the battery system manager usually has the required ASIL rating to process the required signals of ASIL C or D quality required by the consumer. The bottleneck is the microcontroller of the BDUe. Due to the fact that this is identified as an ASIL A path, ASIL A is required on the microcontroller.

[0015] So the problem to be solved is to reduce the cost, provide ASIL A on the microcontroller of the BDUe, reduce the sensitivity to magnetic fields, reduce the work in the wiring harness, and provide a smarter, simpler, and less complex approach.

[0016] A further implementation of the prior art is to use a test mode or a test mode signal. The measurement path is verified by an additional mode on the shunt resistor. Due to the fact that both measurement channels pass through the microcontroller, the microcontroller must meet the required ASIL level, typically ASIL C. This prior art variant therefore increases serial costs and development effort.

[0017] It is therefore an object of the present invention to overcome or reduce at least some of the disadvantages of the prior art and to provide a measuring device that verifies current measurements across a shunt resistor with reduced implementation costs and development effort while achieving certain required safety levels. Summary of the invention

[0018] Embodiments of the present disclosure seek to solve at least one problem existing in the prior art to some extent. In particular, a current measuring device for a battery system is provided, comprising: a first control unit including a first microcontroller. In addition, the device includes a second control unit. The second control unit includes a second microcontroller, an amplifier electrically interconnected between the second microcontroller and the terminals of a shunt resistor for current measurement, and a node interconnected between one of the terminals of the shunt resistor and the amplifier. In addition, the device includes a communication line that communicatively connects the first control unit and the second control unit. The first microcontroller is configured to generate a test mode signal and send the test mode signal to the second control unit via the communication line. The second control unit is configured to send the test mode signal to the node. The second microcontroller is configured to receive a measurement signal through an amplifier in response to the test mode signal sent. The first microcontroller is configured to receive a measurement signal from the second microcontroller via the communication line, compare the measurement signal with the generated test mode signal, and verify the current measurement based on the comparison.

[0019] The first control unit may be, for example, a battery system manager. The second control unit may be a battery disconnect unit. The communication line may form a communication path via a physical interface between the first control unit and the second control unit. The interface may preferably be a CAN interface, where CAN stands for controller area network, but the present invention is not limited thereto and other interfaces may be used. Verifying the current measurement may in other words be detecting the integrity or functionality of the current measurement. This comparison may be successful when the test pattern is consistent with the measurement signal. This may be the case when the measurement signal and the test mode signal have the same pattern. The test mode signal may also be referred to as a test signal. The test mode signal may include a sequence of low and high levels. This test pattern may be characteristic so that a comparison with the measurement signal may verify the current measurement. The comparison may detect and verify several fault modes. For example, when a shunt resistor is missing or incorrectly connected, when an amplifier is not working properly, for example, not or not providing enough gain, or not or not connected correctly. In other words, the measurement path is checked by the test mode signal.

[0020] The advantage of the present invention is that the second microcontroller does not have to generate a test mode signal, nor does it have to compare / verify the measurement signal with the test mode. For these operations, a sufficient safety level should be met that the second microcontroller associated with the current measurement usually does not have. Therefore, the first microcontroller of the first control unit is used for these operations. Therefore, in the present invention, the second microcontroller can have a low safety level or no safety level. This implementation is cost-effective because it takes advantage of the fact that the second microcontroller used for current measurement has a low or no safety level, such as in a battery disconnect unit, while the system-related microcontroller of the battery system manager can have a high or higher safety level. Due to the use of the first microcontroller, even if the second microcontroller has no safety level, but the first microcontroller has a high safety level, i.e., ASIL C or ASIL D, the safety level of ASIL C can be achieved. Therefore, the safety-related tasks are outsourced from the second microcontroller, and therefore, the bottleneck problem of the second microcontroller is solved by using the first microcontroller. Further advantages are that no additional Hall sensors are required, no magnetic interference is generated, no shielding is required, and one less communication line is required.

[0021] In a preferred embodiment, the safety level of the first microcontroller may be higher than the safety level of the second microcontroller. The safety level may be determined according to ASIL or ISO 26262, but the present invention is not limited thereto. Therefore, safety-critical tasks, such as the generation of test patterns and the comparison of test patterns with measurement signals, are performed by the first microcontroller with a higher safety level. The safety level is an inherent technical attribute of each microcontroller. The safety level can also be defined in terms of failure rate. In other words, a higher safety level may be a lower failure rate per operation, and vice versa. The first microcontroller may, for example, have a safety level of ASIL D or ASIL C. The second microcontroller may, for example, not have a safety level according to ASIL.

[0022] Preferably, the second control unit may include a hardware encryption unit provided separately from the second microcontroller, the hardware encryption unit being configured to generate an encrypted test mode signal based on the received test mode signal and being configured to send the encrypted test mode signal to the node. The second microcontroller may be configured to receive the measurement signal through the amplifier in response to the sent encrypted test mode signal. Thus, due to the encryption, a secure end-to-end connection may be achieved. It is also advantageous that the second microcontroller does not have to provide encryption, since a separate hardware encryption unit independent of the second microcontroller is generating the encrypted test mode signal.

[0023] In a preferred embodiment, the hardware encryption unit may include a shift register configured to generate an encrypted test mode signal. This implementation is simple and fast, where standard gates may be used. The hardware encryption unit may also be referred to as a hardware security element.

[0024] Preferably, the second microcontroller can be configured to generate an encrypted test mode signal based on the received test mode signal, and is configured to send the encrypted test mode signal to the node, and the second microcontroller is configured to receive the measurement signal through the amplifier in response to the sent encrypted test mode signal. This embodiment is possible because, as described below, the first microcontroller is used to check the generated test mode signal with a higher security level than the second microcontroller. The encryption in the second microcontroller can be accomplished by using an encryption program including instructions that, when executed on the first microcontroller, cause the microcontroller to generate an encryption of the encrypted test pattern based on the generated test pattern.

[0025] In a preferred embodiment, the first microcontroller can be configured to generate an encrypted test pattern signal based on the generated test pattern signal, receive the measurement signal through the communication line, and compare the measurement signal with the generated encrypted test pattern signal. Thus, a secure end-to-end connection, also known as a gray channel, is achieved. The encrypted signals are then compared. The second microcontroller is completely excluded from the comparison. The encryption in the first microcontroller can be accomplished by using an encryption program, which includes encrypted instructions that, when executed on the first microcontroller, cause the microcontroller to generate an encrypted test pattern based on the generated test pattern. The encryption program can be referred to as an encryption function.

[0026] Preferably, the first microcontroller and the second microcontroller or the hardware encryption unit are configured to start generating an encrypted test mode signal according to a synchronized clock. Thereby, the same encrypted test mode signal is generated. As a result, when the comparison is performed by the first microcontroller, the verification of the current measurement can be reliably performed. The encryption can be performed using conventional methods. For example, the encryption can be performed by using a pseudo-random generator applied to the test mode signal. A reset function can be implemented. This depends on the architecture and failure rate of the system.

[0027] In a preferred embodiment, the second microcontroller can be configured to receive a test mode signal and send the test mode signal to the node. Preferably, the second microcontroller can be configured to receive a test mode signal and send the test mode signal to the hardware encryption unit. In these embodiments, the second microcontroller acts as a receiver and transmitter of the test mode signal, thereby acting as a communicator. However, the second microcontroller does not generate a test mode signal and does not compare, because these operations are only performed by the first microcontroller.

[0028] In a preferred embodiment, the first microcontroller can be configured to send the test mode signal to the node of the second control unit via the communication line by bypassing the second microcontroller. An advantage of this embodiment is that the test mode signal does not even pass through the second microcontroller. Thus, when no or only a low security level is associated with the second microcontroller, bypassing the microcontroller further increases security, as the microcontroller may not have to provide these communication steps.

[0029] In a preferred embodiment, the second control unit may include two amplifiers, each amplifier interconnected between the shunt resistor and the second microcontroller, the second microcontroller may be configured to receive two measurement signals through the amplifier in response to the transmitted test mode signal; the first microcontroller may be configured to receive the measurement signals through the communication line and compare the first measurement signal and the second measurement signal with the generated test mode signal. The two amplifiers may provide redundancy. A malfunction or defect of one of the amplifiers may be detected.

[0030] In another aspect of the present invention, a battery system includes a plurality of interconnected battery cells and a current measuring device according to one of the above embodiments, wherein a shunt resistor is electrically connected to output terminals of the plurality of battery cells.

[0031] In another aspect of the present invention, an electric vehicle including the battery system according to the above-mentioned embodiment is disclosed.

[0032] In another aspect of the present invention, a method for measuring the current of a battery system according to one of the above embodiments includes: generating a test mode signal by a first microcontroller; sending the test mode signal by the first microcontroller to a second control unit (20) via a communication line (50); sending the test mode signal by the second microcontroller to the node; receiving a measurement signal by the second microcontroller through an amplifier in response to the sent test mode signal; receiving the measurement signal by the first microcontroller from the second microcontroller via the communication line; and comparing the measurement signal with the generated test mode signal by the first microcontroller to verify the current measurement.

[0033] The advantages of this method correspond to the advantages described above.

[0034] In a preferred embodiment, the security level of the first microcontroller may be higher than the security level of the second microcontroller.

[0035] Further preferred embodiments of the method can be extracted from the features of the preferred arrangements disclosed above and below.

[0036] Other aspects of the present disclosure can be learned from the specification or the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Features will become apparent to those skilled in the art by describing in detail exemplary embodiments with reference to the accompanying drawings, in which:

[0038] Figure 1 A current measuring device for a battery system according to a first embodiment is shown;

[0039] Figure 2 A current measuring device for a battery system according to a second embodiment is shown;

[0040] Figure 3 A current measuring device for a battery system according to a third embodiment is shown;

[0041] Figure 4 shows a current measuring device for a battery system according to a fourth embodiment; and

[0042] Figure 5 A battery system according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0043] Reference will now be made in detail to the embodiments, examples of which are shown in the accompanying drawings. The effects and features of the exemplary embodiments and methods of implementing the same will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals denote the same elements, and redundant descriptions are omitted. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items. In addition, when describing embodiments of the present invention, the use of "may" refers to "one or more embodiments of the present invention."

[0044] It should be understood that although the terms "first" and "second" are used to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the present invention, a first element can be named as a second element, and similarly, a second element can be named as a first element.

[0045] In the following description of the embodiments of the present invention, terms in the singular form may include plural forms unless the context clearly indicates otherwise.

[0046] It will be further understood that the terms “comprises,” “includes,” “including,” or “comprising” specify attributes, regions, fixed numbers, steps, processes, elements, components, and combinations thereof, but do not exclude other attributes, regions, fixed numbers, steps, processes, elements, components, and combinations thereof.

[0047] By referring to the detailed description of the following embodiments and the accompanying drawings, the features of the inventive concept and the methods for implementing the inventive concept can be more easily understood. Hereinafter, exemplary embodiments will be described in more detail with reference to the accompanying drawings, and in all the accompanying drawings, the same reference numerals refer to the same elements. However, the present invention can be implemented in various different forms and should not be interpreted as being limited to the embodiments shown here. On the contrary, these embodiments are provided as examples, so that this disclosure will be thorough and complete, and will fully convey the aspects and features of the present invention to those skilled in the art. Therefore, processes, elements and techniques that are not necessary for a person of ordinary skill in the art to fully understand the aspects and features of the present invention may not be described. In the accompanying drawings, for clarity, the relative sizes of elements, layers and regions may be exaggerated.

[0048] The electronic or electrical devices and / or any other related devices or components according to the embodiments of the present invention described herein can be implemented using any suitable hardware, firmware (e.g., application specific integrated circuits), software, or a combination of software, firmware, and hardware. For example, the various components of these devices can be formed on an integrated circuit (IC) chip or on a separate IC chip. In addition, the various components of these devices can be implemented on a flexible printed circuit film, a carrier package (TCP), a printed circuit board (PCB), or formed on a substrate. In addition, the various components of these devices can be processes or threads running on one or more processors in one or more computing devices, executing computer program instructions and interacting with other system components to perform the various functions described herein. Computer program instructions are stored in a memory, which can be implemented in a computing device using a standard storage device (e.g., a random access memory (RAM)). Computer program instructions can also be stored in other non-temporary computer-readable media, such as CD-ROMs, flash drives, etc. In addition, those skilled in the art should recognize that the functions of various computing devices can be combined or integrated into a single computing device, or the functions of a specific computing device can be distributed on one or more other computing devices without departing from the scope of the exemplary embodiments of the present invention.

[0049] Figure 1 A current measuring device 1 for a battery system according to an embodiment of the invention is shown. The device 1 comprises a first control unit 10 comprising a first microcontroller 12. The first control unit 10 is preferably a battery system manager, but the invention is not limited thereto.

[0050] The second control unit 20 may include a second microcontroller 22. Preferably, the second control unit 20 may be a battery disconnect unit.

[0051] The first microcontroller 12 may have a safety level higher than the safety level of the second microcontroller 22. For example, the first microcontroller 12 may have a safety level according to ASIL. A higher safety level may refer to a lower timely failure rate, and a lower safety level may refer to a higher timely failure rate per operation. Therefore, the safety level is an inherent technical attribute of the microcontrollers 12, 22. The safety level of the first microcontroller 12 may have an ASIL C or ASIL D level. The second microcontroller 22 may not meet the ASIL safety level or may only meet a low safety level.

[0052] The second control unit 20 includes a shunt resistor 26. The shunt resistor 26 is used to measure the current of the battery system. The shunt resistor 26 can be connected in series with the power line 35, and the current as the output or input of the plurality of battery cells flows through the power line 35. For further description, see Figure 5 The voltage signal across the terminals T1 , T2 of the shunt resistor 26 is indicative of the current flow of the known ohmic resistance.

[0053] Due to the low voltage signal on the shunt resistor 26, the amplifiers 24, 32 are electrically interconnected between the second microcontroller 22 and the respective terminals T1, T2 of the shunt resistor 26. Optionally, an input resistor may be provided at each input of the amplifiers 24, 32, which is not shown here. The amplifiers 24, 32 amplify the voltage signal across the terminals T1, T2 of the shunt resistor 26, which voltage signal represents the current. The output signal of the amplifiers 24, 32 is received by the second microcontroller 22. The amplifiers 24, 32 may have additional voltage sources, which are not shown here for simplicity, for providing a gain in the voltage signal.

[0054] Furthermore, nodes N1, N2 are interconnected between one of the terminals T1, T2 of the shunt resistor 26 and the amplifiers 24, 32. The nodes N1, N2 will be described in more detail below.

[0055] In this exemplary embodiment, two amplifiers 24, 32 are provided, both of which are interconnected between the second microcontroller 22 and the respective terminals T1, T2 of the shunt resistor 26. Thus, redundancy can be provided, which can increase safety. In other embodiments, only one amplifier, such as amplifier 32, is used.

[0056] The device 1 also includes a communication line 50 that communicatively connects the first control unit 10 and the second control unit 20. The communication line 50 may be a communication path for sending signals through a physical interface between the first control unit 10 and the second control unit 20. The physical interface between the control units 10, 20 may be, for example, a CAN interface. In the following, the functions of the disclosed entities will be described in more detail.

[0057] The first microcontroller 12 is configured to generate a test mode signal 60. The test mode signal may be, for example, a characteristic sequence of low and high signal levels in a specific order. The generated test mode signal 60 is sent by the first microcontroller 12 to the second control unit 20 via the communication line 50. Since the first microcontroller 12 may have a safety rating, such as ASIL C or D, generating the test mode signal by the first microcontroller 12 may be a safe process. A memory may be provided to store the generated test mode signal 60.

[0058] In response to receiving the test mode signal 60, the second control unit 20 is configured to send the test mode signal 60 to the nodes N1, N2. This sending can be achieved in several ways, a preferred example of which will be described in more detail below.

[0059] In this example, the second microcontroller 22 is configured to receive the test mode signal 60. In response, the second microcontroller 22 then sends the test mode signal 60 to the nodes N1, N2. Thus, the second microcontroller 22 acts as a communicator of the test mode signal 60.

[0060] Here, transmission to nodes N1, N2 is performed in an exemplary manner using the test mode circuit 28. This exemplary embodiment is also used as Figures 2 to 4 The present invention is not limited to the analog test mode circuit 28 sending the test mode signal 60 to the nodes N1, N2, but constitutes a simple and preferred solution that can be easily implemented.

[0061] In this example, the test mode signal 60 can be used as a control signal to output a switching voltage signal from the voltage source VREF according to the test mode signal 60. The switching signal is consistent with the test mode signal 60, and since only the amplitude changes, it can be referred to as the test mode signal 60 itself. The voltage VREF can be predetermined to impose a measurable offset on the nodes N1, N2.

[0062] The test mode signal 60, or also referred to as a switching voltage signal, is then applied to the nodes N1, N2 through the resistors R1 and R2. The second resistor R2 may also be omitted. Therefore, the test mode signal 60 causes a voltage change on the nodes N1, N2, thereby generating a measurable offset at the input of the amplifiers 24, 32 according to the test mode signal 60. Therefore, the sequence of the test mode signal 60 is measurable.

[0063] In response, the amplifier 24,32 may output a measurement signal 64,66 in response to the transmitted test mode signal 60. The measurement signal 64,66 is an amplified signal according to the particular gain of the amplifier 24,32.

[0064] The second microcontroller 22 is configured to receive the measurement signals 64 , 66 through the amplifiers 24 , 32 in response to the transmitted test mode signal 60 .

[0065] The second microcontroller 22 is configured to send the measurement signals 64 , 66 to the first microcontroller 12 via the communication line 50 , and the first microcontroller 12 is configured to receive the measurement signals 64 , 66 from the second microcontroller 22 via the communication line 50 .

[0066] The first microcontroller 12 is also configured to compare the measurement signals 64, 66 with the generated test mode signal 60. Since the first microcontroller 12 may have a safety level, such as C or D, according to ASIL, the comparison of the test mode signal by the first microcontroller 12 may be a safe process. As shown, the comparison may be performed by a comparison function 15 of the first microcontroller. The comparison function 15 may be implemented by a computer program including instructions that cause the first microcontroller 12 to perform the comparison and verification.

[0067] Based on this comparison, the current measurement can be verified. In other words, the integrity or functionality of the current measurement can be tested or checked. For example, the current measurement is performed by a continuous test. When the comparison is successful, the previous current measurement is verified. In other words, the functionality of the current measurement is checked.

[0068] This comparison can succeed when the generated test pattern is consistent or equal to the measurement signal. This may be the case when the measurement signal and the test pattern signal have the same pattern. The test pattern signal may also be referred to as the test signal. This comparison can detect and verify several failure modes. For example, when the shunt resistor 26 is missing or incorrectly connected, there is a short to ground, if the amplifier 24, 32 is not working properly, such as not having or not providing enough gain, or the amplifier is not or is not connected correctly. In other words, the integrity of the measurement path is checked by comparing the signals.

[0069] Compared to the prior art, the second microcontroller 22 does not perform the generation of the test mode signal 60, nor does it perform the comparison of the measurement signals 64, 66 with the test mode signal 60. For these functions, the first microcontroller 12 of the first control unit 10 is used. Therefore, in the present invention, the second microcontroller 22 can have a lower or lower safety level, and a cost-effective second microcontroller 22 can be used, while a higher or higher safety level can be used, and the safety level of the external first microcontroller 12 is used in the present invention. This implementation is cost-effective because usually the second microcontroller 22 has a low, or lower, or even no safety level, and an available microcontroller with a higher safety level, such as a battery system manager, can be used to complete the safety-related tasks of generating the test mode signal and providing the signal comparison. The safety-related tasks of generating the test mode signal and providing the comparison are outsourced by the second microcontroller 22, so that the bottleneck problem of the second microcontroller 22 is solved by using the safety level of the first microcontroller 12 to achieve a current measurement of a high safety level (e.g., ASIL C).

[0070] In this example embodiment, the second control unit 20 may include two amplifiers 24, 32 interconnected between the shunt resistor 26 and the second microcontroller 22. The second microcontroller 22 may be configured to receive two measurement signals 64, 66 through the amplifiers 24, 32 in response to the transmitted test mode signal 60. The first microcontroller 12 may be configured to receive the measurement signals 64, 66 through the communication line 50 and compare the first measurement signal 64 and the second measurement signal 66 with the generated test mode signal 60. Thus, multiple measurement paths may also be verified. Due to redundancy, the two amplifiers 24, 32 may provide further safety in the test. The advantage of the resistor R2 is that the first microcontroller 12 may distinguish between the measurement signals 64, 66 due to the different amplitudes.

[0071] Figure 2 FIG. 1 shows a current measuring device 1 for a battery system according to another embodiment of the present invention. Figure 1 The differences in embodiments.

[0072] According to the present embodiment, the second control unit 20 may include a hardware encryption unit 40. In this embodiment, the hardware encryption unit 40 is provided separately from the second microcontroller 22. The hardware encryption unit 40 may also be configured to generate an encrypted test mode signal 62 based on a received test mode signal 60 received from the first microcontroller 12 via the communication line 50 and generated by the first microcontroller 12. In this example, but the embodiment is not limited thereto, the second microcontroller 22 is configured to receive the test mode signal 60 and send the test mode signal 60 from the second microcontroller 22 to the hardware encryption unit 40. In another embodiment, similar to Figure 4 In the embodiment of the present invention, the test mode signal 60 may be sent directly from the communication line 50 to the hardware encryption unit 40 bypassing the second microcontroller 22 .

[0073] The hardware encryption unit 40 may include a shift register configured to generate the encrypted test pattern signal 62. Such a shift register is fast in, for example, generating pseudo-random numbers and provides fast encryption.

[0074] The hardware encryption unit 40 may be configured to send the encrypted test mode signal 62 to the nodes N1, N2. Figure 1 The transmission is performed by the test mode circuit 28 disclosed in the context of the present invention, but the present invention is not limited thereto. Then, according to the encrypted test mode signal 62, the switching voltage source VREF is switched. The second microcontroller 22 can be configured to receive the measurement signals 64, 66 through the amplifiers 24, 32 in response to the transmitted encrypted test mode signal 62.

[0075] Furthermore, the first microcontroller 12 may receive the measurement signals 64, 66 via the communication line 50. The first microcontroller 12 may also be configured to generate an encrypted test mode signal based on the generated test mode signal 60. Thus, the first microcontroller 12 may include, for example, Figure 2 The encryption function 13 is shown. The encryption in the first microcontroller 12 may be accomplished by using an encrypted computer program comprising instructions which, when executed on the first microcontroller 12, cause the microcontroller to generate an encrypted test pattern based on the generated test pattern.

[0076] The first microcontroller 12 may be configured to compare the measurement signals 64, 66 with the generated encrypted test mode signal 62. This comparison and verification may be performed in the same manner as Figure 1 is performed in the same manner as described in the context of .

[0077] The first microcontroller 12 and the hardware encryption unit 40 can be configured to start generating an encrypted test mode signal 62 according to the synchronization clock. Thus, the same encrypted test mode is created. To this end, a pseudo-random number generator can be used for encryption. In addition, a reset function can be implemented.

[0078] The advantage of this embodiment is that Figure 1 Compared to the embodiment of FIG. 1 , a secure end-to-end connection is created due to the encryption process. Thus, due to the implementation of the gray channel, the use of the first microcontroller 12 is securely provided. A secure end-to-end connection is established without using the second microcontroller 22. Therefore, in this embodiment, a low or lower security level does not result in a loss of security, even when encryption is additionally performed.

[0079] Figure 3 FIG. 1 shows a current measuring device 1 for a battery system according to another embodiment of the present invention. Figure 2 For the remaining features, refer to Figure 1 and Figure 2 and its description.

[0080] and Figure 2 In contrast, the second microcontroller 22 itself is configured to generate an encrypted test mode signal 62 based on the received test mode signal 60. The second microcontroller 22 may thus include Figure 3 The encryption function 23 is shown. The encryption of the second microcontroller 22 may be accomplished by using an encryption program that includes instructions that, when executed on the second microcontroller 22, cause the microcontroller to generate an encrypted test pattern based on the received test pattern 60.

[0081] This encryption can be done by the second microcontroller 22. The reason for this is that the comparison / checking or verification of the signal is still done at the high or higher security level of the first microcontroller 12. Therefore, this embodiment takes advantage of the fact that the first microcontroller 12 can have a high security level to perform the test pattern generation and comparison operations.

[0082] The second microcontroller 22 may be configured to send the encrypted test mode signal 62 to the nodes N1, N2. Therefore, according to this embodiment, no additional hardware encryption unit is required. Figure 2 In an embodiment of the present invention, the second microcontroller 22 may be configured to receive the measurement signals 64, 66 through the amplifiers 24, 32 in response to the transmitted encrypted test mode signal 62. Figure 2 As described in the context of FIG. 1 , the first microcontroller 12 may be configured to generate an encrypted test mode signal based on the generated test mode signal 60. Thus, the first microcontroller 12 may include: Figure 2 The encryption function 13 is shown. The measurement signals 64, 66 may be received via the communication line 50. The first microcontroller 12 may be configured to compare the measurement signals 64, 66 with the generated encryption test mode signal 62.

[0083] Also in this case, the first microcontroller 12 and the second microcontroller 22 can be configured to start generating the encrypted test pattern signal 62 according to the synchronized clock. Thus, the pseudo-random number generator can be used for encryption and then the same encrypted signal is obtained.

[0084] This embodiment may use only the second microcontroller as the encryption unit, because the tasks of generating the test pattern signal and the comparison and verification performed by the first microcontroller 12 may have a higher or higher security level.

[0085] Figure 4 FIG. 1 shows a current measuring device 1 for a battery system according to another embodiment of the present invention. Figure 1 and for further features, refer to Figure 1 In this embodiment, the first microcontroller 12 is configured to send the test mode signal 60 to the nodes N1, N2 of the second control unit 20 via the communication line 50 and bypassing the second microcontroller 22. Therefore, the second microcontroller 22 is not used as a communicator, i.e., receiving the test mode signal 60 and sending the test mode signal to the nodes N1, N2. Therefore, further safety-related operating tasks of the weak second microcontroller 22 can be outsourced from the second microcontroller 22, because the test mode signal 60 does not pass through the second microcontroller 22 using only the communication line.

[0086] Figure 5 1 shows a battery system 100 according to an embodiment of the present invention. The battery system includes a current measuring device 1 according to one of the above-mentioned embodiments. The battery system 100 also includes a plurality of interconnected battery cells 110. The shunt resistor 26 is configured to Figures 1 to 4 , and is electrically connected to output terminals of a plurality of battery cells 110 .

Claims

1. A current measuring device (1) for a battery system, comprising: A first control unit (10) comprising a first microcontroller (12); The second control unit (20) comprises: A second microcontroller (22); an amplifier (24, 32) electrically interconnected between the second microcontroller (22) and the terminals (T1, T2) of the shunt resistor (26) for current measurement; a node (N1, N2) interconnected between one terminal (T1, T2) of the shunt resistor (26) and the amplifier (24, 32); a switch controllable to electrically connect a voltage (VREF) to nodes (N1, N2); A communication line (50) communicatively connecting the first control unit (10) and the second control unit (20); wherein the first microcontroller (12) is configured to generate a test mode signal (60) including a sequence of low and high levels and to send the test mode signal (60) to the second control unit (20) via a communication line (50); wherein the second control unit (20) is configured to send the test mode signal (60) to the switch to control the switch according to the test mode signal; wherein the second microcontroller (22) is configured to receive a measurement signal (64, 66) in response to a test mode signal (60) sent through the amplifier (24, 32); The first microcontroller (12) is configured to receive a measurement signal (64, 66) from a second microcontroller (22) via a communication line (50), compare the measurement signal (64, 66) to a generated test mode signal (60), and verify the current measurement based on the comparison.

2. The device (1) according to claim 1, wherein the security level of the first microcontroller (12) is higher than the security level of the second microcontroller (22).

3. The device (1) according to any one of claims 1 to 2, wherein the second control unit (20) comprises a hardware encryption unit (40) provided separately from the second microcontroller (22) and electrically connected to the switch, wherein: The hardware encryption unit (40) is configured to generate an encrypted test mode signal (62) based on the received test mode signal (60) and is configured to send the encrypted test mode signal (62) to the switch to control the switch according to the encrypted test mode signal, and the second microcontroller (22) is configured to receive the measurement signal (64, 66) in response to the encrypted test mode signal (62) sent through the amplifier (24, 32), The first microcontroller (12) is configured to generate an encrypted test mode signal (62) based on the generated test mode signal (60), receive a measurement signal (64, 66) via a communication line (50), and compare the measurement signal (64, 66) with the generated encrypted test mode signal (62).

4. The device (1) according to claim 3, wherein: The hardware encryption unit (40) includes a shift register configured to generate an encrypted test mode signal (62).

5. The apparatus (1) of any one of claims 1 to 2, wherein the second microcontroller (22) is configured to generate an encrypted test mode signal (62) based on the received test mode signal (60), and is configured to send the encrypted test mode signal (62) to the switch to control the switch according to the encrypted test mode signal, and the second microcontroller (22) is configured to receive the measurement signal (64, 66) in response to the encrypted test mode signal (62) sent through the amplifier (24, 32), in, The first microcontroller (12) is configured to generate an encrypted test mode signal (62) based on the generated test mode signal (60), receive a measurement signal (64, 66) via a communication line (50), and compare the measurement signal (64, 66) with the generated encrypted test mode signal (62).

6. The apparatus according to claim 3, wherein the first microcontroller (12) and the second microcontroller (22), or the first microcontroller (12) and the hardware encryption unit (40), are configured to start generating an encrypted test mode signal (62) according to a synchronous clock.

7. The device according to any one of claims 1 to 2, wherein: The second microcontroller (22) is configured to receive the test mode signal (60) and send the test mode signal to the switch.

8. The device according to claim 3, wherein: The second microcontroller (22) is configured to receive the test mode signal (60) and send the test mode signal (60) to the hardware encryption unit (40).

9. The device according to any one of claims 1 to 2, wherein the first microcontroller (12) is configured to send the test mode signal (60) to the switch of the second control unit (20) through a communication line (50) bypassing the second microcontroller (22).

10. The device according to any one of claims 1 to 2, wherein: The second control unit (20) includes two amplifiers (24, 32) interconnected between the shunt resistor (26) and the second microcontroller (22), the second microcontroller (22) being configured to receive two measurement signals (64, 66) in response to a test mode signal (60) sent through the amplifier; the first microcontroller (12) being configured to receive the measurement signals (64, 66) through the communication line (50) and compare the first measurement signal (64) and the second measurement signal (66) with the generated test mode signal (60).

11. A battery system (100), comprising: a plurality of interconnected battery cells (110); and The current measuring device (1) according to one of claims 1 to 10, The shunt resistor (26) is electrically connected to the output terminals (B) of the plurality of battery cells (110).

12. An electric vehicle comprising the battery system (100) according to claim 11.

13. A method for measuring the current of the battery system according to claim 11, comprising: Generating a test mode signal (60) by the first microcontroller (12); The first microcontroller (12) sends a test mode signal (60) to the second control unit (20) via a communication line (50); sending a test mode signal (60) to a switch to control the switch according to the test mode signal; Receiving a measurement signal (64, 66) through an amplifier (24, 32) by the second microcontroller (22) in response to the transmitted test mode signal (60); Receiving a measurement signal (64, 66) from a second microcontroller (22) via a communication line (50) by the first microcontroller (12); and The measurement signal (64, 66) is compared to a generated test mode signal (60) by the first microcontroller (12) to verify the current measurement.

14. The method according to claim 13, wherein the security level of the first microcontroller (12) is higher than the security level of the second microcontroller (22).

Images